Trojan.Inject.5089, или Dialer.NGB.Trojan

This topic has 2 ответа, 2 участника, and was last updated 16 years, 3 months назад by Admin.

Просмотр 3 сообщений - с 1 по 3 (из 3 всего)

Автор

Сообщения
27 января, 2009 в 9:38 дп #16200
4st
Participant
- Темы:1
- Сообщений:2
NOD32 обнаружил вирус Dialer.NGB.Trojan. Dr.Web определяет тот же вирус как Trojan.Inject.5089. При попытках сканировать директорию System Volume Information антивирус зависает. Компьютер тормозит при подключении к интернету. Во время работы в сети антивирус постоянно блокирует URL со зверским названием и сообщает об обнаружении вредоносной программы.

info.txt logfile of random’s system information tool 1.05 2009-01-27 12:22:37

======Uninstall list======

—>C:Program FilesDivXConverterUninstall.exe /CONVERTER
—>C:WINDOWSsystem32\MSIEXEC.EXE /x {1206EF92-2E83-4859-ACCB-2048C3CB7DA6}
—>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:WINDOWSINFPCHealth.inf
«Большой энциклопедии Кирилла и Мефодия 2003»—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{A8335EB4-490B-42FF-B5E5-9B5832D8F715}setup.exe» -l0x19
ABBYY FineReader 6.0 Corporate Edition—>MsiExec.exe /I{AF600F7B-67A7-48D9-BA3B-0FF97F35F970}
ABBYY Lingvo 10 English-Russian Dictionary—>MsiExec.exe /I{AA10000A-C75E-487C-88FC-37AA1AACFB61}
ACDSee 6.0 PowerPack—>MsiExec.exe /I{38A0BB97-772D-422E-BCCA-4BA2A5D81F42}
Ad-Aware—>MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe Acrobat 5.0—>C:WINDOWSISUNINST.EXE -f»C:Program FilesCommon FilesAdobeAcrobat 5.0NTUninst.isu» -c»C:Program FilesCommon FilesAdobeAcrobat 5.0NTUninst.dll»
Adobe Flash Player ActiveX—>C:WINDOWSsystem32MacromedFlashuninstall_activeX.exe
Adobe Reader 6.0.1—>MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A00000000001}
ALPS Touch Pad Driver—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}setup.exe» UNINSTALL
Alt WAV MP3 WMA OGG Converter v3.2—>C:PROGRA~1ALTWAV~1UNWISE.EXE C:PROGRA~1ALTWAV~1INSTALL.LOG
America Online (Choose which version to remove)—>C:Program FilesCommon FilesaolshareAolunins_us.exe
Applian FLV Player—>»C:WINDOWSApplian FLV Playeruninstall.exe» «/U:C:Program FilesFLV PlayerUninstalluninstall.xml»
Ashampoo Burning Studio 2009—>»C:Program FilesAshampooAshampoo Burning Studio 2009unins000.exe»
Avant Browser (remove only)—>»C:Program FilesAvant Browseruninst.exe»
AVIcodec (remove only)—>»C:Program FilesAVIcodecuninst.exe»
CD/DVD Drive Acoustic Silencer—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}Setup.exe» -l0x9
Chameleon—>MsiExec.exe /I{564811FD-1E9B-4CB8-8F28-B686C5AB8189}
Cool Edit Pro 2.1—>C:Program Filescoolpro2cep2unin.exe
Creative DVD Audio Plugin for Audigy Series—>»C:Program FilesCreativeCTDPluginCTUIDVD.exe » -u
DivX Codec—>C:Program FilesDivXDivXCodecUninstall.exe /CODEC
DivX Content Uploader—>C:Program FilesDivXDivXContentUploaderUninstall.exe /CUPLOADER
DivX Converter—>C:Program FilesDivXConverterUninstall.exe /CONVERTER
DivX Player—>C:Program FilesDivXDivXPlayerUninstall.exe /PLAYER
DivX Web Player—>C:Program FilesDivXDivXWebPlayerUninstall.exe /PLUGIN
Download Master version 5.5.6.1139—>»C:Program FilesDownload Masterunins000.exe»
Dr.Web Security Space 5.0—>MsiExec.exe /I{E96B3169-86F4-415E-8E87-F0B6251167FB}
DVD Region+CSS Free 5.90—>»C:Program FilesDVD Region+CSS Freeunins000.exe»
DVD-RAM Driver—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime90Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{9D765FA6-F2BC-40AF-8145-50808F9BDF4E}setup.exe» -l0x9 DVD-RAM Driver
EA SPORTS online 2006—>C:Program FilesEA SPORTSEA SPORTS onlineEASOUNInstaller.exe
eMule—>»C:Program FileseMuleUninstall.exe»
FIFA 2005—>»C:Program FilesFIFA2005unins000.exe»
FlashGet(JetCar)—>C:PROGRA~1FlashGetUNWISE.EXE C:PROGRA~1FlashGetINSTALL.LOG
Guitar Pro 4—>MsiExec.exe /X{491CED7A-0F13-4BE6-957A-59DCA69E8271}
HijackThis 2.0.2—>»C:Program Filestrend microHijackThis.exe» /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399)—>»C:WINDOWS$NtUninstallKB929399$spuninstspuninst.exe»
Hotfix for Windows Media Player 11 (KB939683)—>»C:WINDOWS$NtUninstallKB939683$spuninstspuninst.exe»
Hotfix for Windows XP (KB926239)—>»C:WINDOWS$NtUninstallKB926239$spuninstspuninst.exe»
hp LaserJet 1000—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{975C8028-51D8-44A9-9585-82E9810FE96A}setup.exe»
ICQ Toolbar—>regsvr32 /u /s «C:PROGRA~1ICQTOO~1toolbaru.dll»
ICQ6—>»C:Program FilesInstallShield Installation Information{60DE4033-9503-48D1-A483-7846BD217CA9}setup.exe» -runfromtemp -l0x0009 -removeonly
Intel(R) Graphics Media Accelerator Driver for Mobile—>RUNDLL32.EXE C:WINDOWSsystem32ialmrem.dll,UninstallW2KIGfx2ID PCIVEN_8086&DEV_2792 PCIVEN_8086&DEV_2592
Intel(R) PROSet/Wireless Software—>C:WINDOWSInstalleriProInst.exe
InterVideo WinDVD 6—>»C:Program FilesInstallShield Installation Information{6ACA2FD2-4C4A-42F3-AFB5-7B433BBDF6DB}setup.exe» REMOVEALL
InterVideo WinDVD Creator 2—>»C:Program FilesInstallShield Installation Information{2FCE4FC5-6930-40E7-A4F1-F862207424EF}setup.exe» REMOVEALL
iolo technologies’ System Mechanic Professional 6—>»C:Program FilesioloSystem Mechanic Professional 6UninstallSMPro.exe»
J2SE Runtime Environment 5.0 Update 1—>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150010}
jv16 PowerTools—>»C:Program Filesjv16 PowerToolsunins000.exe»
Learn2 Player (Uninstall Only)—>C:Program FilesLearn2.comStRunnerstuninst.exe
Lizardtech DjVu Control—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{105CFC7C-6992-11D5-BD9D-000102C10FD8}Setup.exe» -l0x9
LJ Comment Stats Wizard 1.6—>»C:Program FilesLJ Comment Stats Wizardunins000.exe»
Mail.Ru Agent—>C:WINDOWSSYSTEMMRA.EXE -uninstall
mCore—>MsiExec.exe /I{6DE14BE4-6F04-4935-8ABD-A0A19FE2E55A}
mDrWiFi—>MsiExec.exe /I{F6090A17-0967-4A8A-B3C3-422A1B514D49}
Megaupload Toolbar—>C:Program FilesMegauploadToolbaruninstall.exe
mHelp—>MsiExec.exe /I{8C6BB412-D3A8-4AAE-A01B-35B681789D68}
Microsoft .NET Framework 1.1 Hotfix (KB886903)—>»C:WINDOWSMicrosoft.NETFrameworkv1.1.4322Updateshotfix.exe» «C:WINDOWSMicrosoft.NETFrameworkv1.1.4322UpdatesM886903M886903Uninstall.msp»
Microsoft .NET Framework 1.1—>msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1—>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0—>C:WINDOWSMicrosoft.NETFrameworkv2.0.50727Microsoft .NET Framework 2.0install.exe
Microsoft Compression Client Pack 1.0 for Windows XP—>»C:WINDOWS$NtUninstallMSCompPackV1$spuninstspuninst.exe»
Microsoft Office — профессиональный выпуск версии 2003—>MsiExec.exe /I{90110419-6000-11D3-8CFE-0150048383C9}
Microsoft Office OneNote 2003—>MsiExec.exe /I{91A10409-6000-11D3-8CFE-0150048383C9}
Microsoft User-Mode Driver Framework Feature Pack 1.0—>»C:WINDOWS$NtUninstallWudf01000$spuninstspuninst.exe»
Microsoft Visual C++ 2005 Redistributable—>MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Works—>MsiExec.exe /I{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}
mIWA—>MsiExec.exe /I{3E9D596A-61D4-4239-BD19-2DB984D2A16F}
mIWCA—>MsiExec.exe /I{6FFFE74E-3FBD-4E2E-97F9-5E9A2A077626}
mLogView—>MsiExec.exe /I{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7}
mMHouse—>MsiExec.exe /I{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}
mPfMgr—>MsiExec.exe /I{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}
mPfWiz—>MsiExec.exe /I{90B0D222-8C21-4B35-9262-53B042F18AF9}
mProSafe—>MsiExec.exe /I{23FB368F-1399-4EAC-817C-4B83ECBE3D83}
MSXML 4.0 SP2 (KB927978)—>MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)—>MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
Multi Media Toolbar—>C:PROGRA~1MULTI_~1UNWISE.EXE C:PROGRA~1MULTI_~1INSTALL.LOG
mWlsSafe—>MsiExec.exe /I{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}
mXML—>MsiExec.exe /I{9CC89556-3578-48DD-8408-04E66EBEF401}
mZConfig—>MsiExec.exe /I{94658027-9F16-4509-BBD7-A59FE57C3023}
O&O Defrag Professional Edition—>MsiExec.exe /I{53480370-6CA2-47EC-BC05-02B4B9271C31}
Personal License Update Wizard for Windows Media Player—>RunDll32 advpack.dll,LaunchINFSection C:WINDOWSINFdrmtool.inf,Uninstall
Pure Networks Port Magic—>C:PROGRA~1PURENE~1PORTMA~1PortAOL.exe -Uninstall -ShowUI
QuickTime—>C:WINDOWSunvise32qt.exe C:WINDOWSsystem32QuickTimeUninstall.log
Realtek AC’97 Audio—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{FB08F381-6533-4108-B7DD-039E11FBC27E}setup.exe» REMOVE
Roxio Burn Engine—>MsiExec.exe /X{9860A9CF-7E71-43AC-888F-0B4D3EA212D1}
sat_screensaver_30mb—>C:WINDOWSsat_screensaver_30mb.scr /U
SD Secure Module—>MsiExec.exe /X{C45F4811-31D5-4786-801D-F79CD06EDD85}
Security Update for Microsoft .NET Framework 2.0 (KB928365)—>C:WINDOWSsystem32msiexec.exe /promptrestart /uninstall {8056AC9E-49C5-4375-9ADE-B2F862C9DF51} /package {7131646D-CD3C-40F4-97B9-CD9E4E6262EF}
Security Update for Windows Media Player (KB911564)—>»C:WINDOWS$NtUninstallKB911564$spuninstspuninst.exe»
Security Update for Windows Media Player 10 (KB911565)—>»C:WINDOWS$NtUninstallKB911565$spuninstspuninst.exe»
Security Update for Windows Media Player 10 (KB917734)—>»C:WINDOWS$NtUninstallKB917734_WMP10$spuninstspuninst.exe»
Security Update for Windows Media Player 11 (KB936782)—>»C:WINDOWS$NtUninstallKB936782_WMP11$spuninstspuninst.exe»
Security Update for Windows Media Player 6.4 (KB925398)—>»C:WINDOWS$NtUninstallKB925398_WMP64$spuninstspuninst.exe»
Security Update for Windows XP (KB890046)—>»C:WINDOWS$NtUninstallKB890046$spuninstspuninst.exe»
Security Update for Windows XP (KB893756)—>»C:WINDOWS$NtUninstallKB893756$spuninstspuninst.exe»
Security Update for Windows XP (KB896358)—>»C:WINDOWS$NtUninstallKB896358$spuninstspuninst.exe»
Security Update for Windows XP (KB896422)—>»C:WINDOWS$NtUninstallKB896422$spuninstspuninst.exe»
Security Update for Windows XP (KB896423)—>»C:WINDOWS$NtUninstallKB896423$spuninstspuninst.exe»
Security Update for Windows XP (KB896424)—>»C:WINDOWS$NtUninstallKB896424$spuninstspuninst.exe»
Security Update for Windows XP (KB896428)—>»C:WINDOWS$NtUninstallKB896428$spuninstspuninst.exe»
Security Update for Windows XP (KB899587)—>»C:WINDOWS$NtUninstallKB899587$spuninstspuninst.exe»
Security Update for Windows XP (KB899591)—>»C:WINDOWS$NtUninstallKB899591$spuninstspuninst.exe»
Security Update for Windows XP (KB900725)—>»C:WINDOWS$NtUninstallKB900725$spuninstspuninst.exe»
Security Update for Windows XP (KB901017)—>»C:WINDOWS$NtUninstallKB901017$spuninstspuninst.exe»
Security Update for Windows XP (KB901214)—>»C:WINDOWS$NtUninstallKB901214$spuninstspuninst.exe»
Security Update for Windows XP (KB902400)—>»C:WINDOWS$NtUninstallKB902400$spuninstspuninst.exe»
Security Update for Windows XP (KB904706)—>»C:WINDOWS$NtUninstallKB904706$spuninstspuninst.exe»
Security Update for Windows XP (KB905414)—>»C:WINDOWS$NtUninstallKB905414$spuninstspuninst.exe»
Security Update for Windows XP (KB905749)—>»C:WINDOWS$NtUninstallKB905749$spuninstspuninst.exe»
Security Update for Windows XP (KB908519)—>»C:WINDOWS$NtUninstallKB908519$spuninstspuninst.exe»
Security Update for Windows XP (KB908531)—>»C:WINDOWS$NtUninstallKB908531$spuninstspuninst.exe»
Security Update for Windows XP (KB911562)—>»C:WINDOWS$NtUninstallKB911562$spuninstspuninst.exe»
Security Update for Windows XP (KB911567)—>»C:WINDOWS$NtUninstallKB911567$spuninstspuninst.exe»
Security Update for Windows XP (KB911927)—>»C:WINDOWS$NtUninstallKB911927$spuninstspuninst.exe»
Security Update for Windows XP (KB912812)—>»C:WINDOWS$NtUninstallKB912812$spuninstspuninst.exe»
Security Update for Windows XP (KB912919)—>»C:WINDOWS$NtUninstallKB912919$spuninstspuninst.exe»
Security Update for Windows XP (KB913446)—>»C:WINDOWS$NtUninstallKB913446$spuninstspuninst.exe»
Security Update for Windows XP (KB913580)—>»C:WINDOWS$NtUninstallKB913580$spuninstspuninst.exe»
Security Update for Windows XP (KB914388)—>»C:WINDOWS$NtUninstallKB914388$spuninstspuninst.exe»
Security Update for Windows XP (KB914389)—>»C:WINDOWS$NtUninstallKB914389$spuninstspuninst.exe»
Security Update for Windows XP (KB916281)—>»C:WINDOWS$NtUninstallKB916281$spuninstspuninst.exe»
Security Update for Windows XP (KB917159)—>»C:WINDOWS$NtUninstallKB917159$spuninstspuninst.exe»
Security Update for Windows XP (KB917344)—>»C:WINDOWS$NtUninstallKB917344$spuninstspuninst.exe»
Security Update for Windows XP (KB917422)—>»C:WINDOWS$NtUninstallKB917422$spuninstspuninst.exe»
Security Update for Windows XP (KB917953)—>»C:WINDOWS$NtUninstallKB917953$spuninstspuninst.exe»
Security Update for Windows XP (KB918118)—>»C:WINDOWS$NtUninstallKB918118$spuninstspuninst.exe»
Security Update for Windows XP (KB918439)—>»C:WINDOWS$NtUninstallKB918439$spuninstspuninst.exe»
Security Update for Windows XP (KB918899)—>»C:WINDOWS$NtUninstallKB918899$spuninstspuninst.exe»
Security Update for Windows XP (KB919007)—>»C:WINDOWS$NtUninstallKB919007$spuninstspuninst.exe»
Security Update for Windows XP (KB920213)—>»C:WINDOWS$NtUninstallKB920213$spuninstspuninst.exe»
Security Update for Windows XP (KB920214)—>»C:WINDOWS$NtUninstallKB920214$spuninstspuninst.exe»
Security Update for Windows XP (KB920670)—>»C:WINDOWS$NtUninstallKB920670$spuninstspuninst.exe»
Security Update for Windows XP (KB920683)—>»C:WINDOWS$NtUninstallKB920683$spuninstspuninst.exe»
Security Update for Windows XP (KB920685)—>»C:WINDOWS$NtUninstallKB920685$spuninstspuninst.exe»
Security Update for Windows XP (KB921398)—>»C:WINDOWS$NtUninstallKB921398$spuninstspuninst.exe»
Security Update for Windows XP (KB921503)—>»C:WINDOWS$NtUninstallKB921503$spuninstspuninst.exe»
Security Update for Windows XP (KB921883)—>»C:WINDOWS$NtUninstallKB921883$spuninstspuninst.exe»
Security Update for Windows XP (KB922616)—>»C:WINDOWS$NtUninstallKB922616$spuninstspuninst.exe»
Security Update for Windows XP (KB922760)—>»C:WINDOWS$NtUninstallKB922760$spuninstspuninst.exe»
Security Update for Windows XP (KB922819)—>»C:WINDOWS$NtUninstallKB922819$spuninstspuninst.exe»
Security Update for Windows XP (KB923191)—>»C:WINDOWS$NtUninstallKB923191$spuninstspuninst.exe»
Security Update for Windows XP (KB923414)—>»C:WINDOWS$NtUninstallKB923414$spuninstspuninst.exe»
Security Update for Windows XP (KB923694)—>»C:WINDOWS$NtUninstallKB923694$spuninstspuninst.exe»
Security Update for Windows XP (KB923980)—>»C:WINDOWS$NtUninstallKB923980$spuninstspuninst.exe»
Security Update for Windows XP (KB924191)—>»C:WINDOWS$NtUninstallKB924191$spuninstspuninst.exe»
Security Update for Windows XP (KB924270)—>»C:WINDOWS$NtUninstallKB924270$spuninstspuninst.exe»
Security Update for Windows XP (KB924496)—>»C:WINDOWS$NtUninstallKB924496$spuninstspuninst.exe»
Security Update for Windows XP (KB924667)—>»C:WINDOWS$NtUninstallKB924667$spuninstspuninst.exe»
Security Update for Windows XP (KB925454)—>»C:WINDOWS$NtUninstallKB925454$spuninstspuninst.exe»
Security Update for Windows XP (KB925486)—>»C:WINDOWS$NtUninstallKB925486$spuninstspuninst.exe»
Security Update for Windows XP (KB925902)—>»C:WINDOWS$NtUninstallKB925902$spuninstspuninst.exe»
Security Update for Windows XP (KB926255)—>»C:WINDOWS$NtUninstallKB926255$spuninstspuninst.exe»
Security Update for Windows XP (KB926436)—>»C:WINDOWS$NtUninstallKB926436$spuninstspuninst.exe»
Security Update for Windows XP (KB927779)—>»C:WINDOWS$NtUninstallKB927779$spuninstspuninst.exe»
Security Update for Windows XP (KB927802)—>»C:WINDOWS$NtUninstallKB927802$spuninstspuninst.exe»
Security Update for Windows XP (KB928090)—>»C:WINDOWS$NtUninstallKB928090$spuninstspuninst.exe»
Security Update for Windows XP (KB928255)—>»C:WINDOWS$NtUninstallKB928255$spuninstspuninst.exe»
Security Update for Windows XP (KB928843)—>»C:WINDOWS$NtUninstallKB928843$spuninstspuninst.exe»
Security Update for Windows XP (KB929123)—>»C:WINDOWS$NtUninstallKB929123$spuninstspuninst.exe»
Security Update for Windows XP (KB929969)—>»C:WINDOWS$NtUninstallKB929969$spuninstspuninst.exe»
Security Update for Windows XP (KB930178)—>»C:WINDOWS$NtUninstallKB930178$spuninstspuninst.exe»
Security Update for Windows XP (KB931261)—>»C:WINDOWS$NtUninstallKB931261$spuninstspuninst.exe»
Security Update for Windows XP (KB931768)—>»C:WINDOWS$NtUninstallKB931768$spuninstspuninst.exe»
Security Update for Windows XP (KB931784)—>»C:WINDOWS$NtUninstallKB931784$spuninstspuninst.exe»
Security Update for Windows XP (KB932168)—>»C:WINDOWS$NtUninstallKB932168$spuninstspuninst.exe»
Security Update for Windows XP (KB933566)—>»C:WINDOWS$NtUninstallKB933566$spuninstspuninst.exe»
Security Update for Windows XP (KB935839)—>»C:WINDOWS$NtUninstallKB935839$spuninstspuninst.exe»
Security Update for Windows XP (KB935840)—>»C:WINDOWS$NtUninstallKB935840$spuninstspuninst.exe»
Security Update for Windows XP (KB936021)—>»C:WINDOWS$NtUninstallKB936021$spuninstspuninst.exe»
Security Update for Windows XP (KB937143)—>»C:WINDOWS$NtUninstallKB937143$spuninstspuninst.exe»
Security Update for Windows XP (KB938127)—>»C:WINDOWS$NtUninstallKB938127$spuninstspuninst.exe»
Security Update for Windows XP (KB938829)—>»C:WINDOWS$NtUninstallKB938829$spuninstspuninst.exe»
Sonic DLA—>MsiExec.exe /I{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}
Sonic Foundry Sound Forge 6.0—>MsiExec.exe /I{62FC357F-022B-4F90-9376-7A0DF9FBE7A1}
Sony Noise Reduction Plug-In 2.0e—>MsiExec.exe /X{D533C9D4-ED96-4191-B9C3-279C0DD6BABA}
Sony Sound Forge 7.0—>MsiExec.exe /I{0712667C-A171-49AE-A098-4ACDA28625F8}
Sony Sound Forge 8.0—>MsiExec.exe /X{767572FD-4D01-4FA3-B0A6-4B09FB2CFC37}
Sony Sound Forge 9.0—>MsiExec.exe /X{6842DCCB-2840-4E46-8AF3-BEA9CFF3455B}
SopCast 1.1.2—>C:Program FilesSopCastuninst.exe
Sound Forge 6.0 Руссификатор—>C:PROGRA~1SONICF~2UNWISE.EXE C:PROGRA~1SONICF~2INSTALL.LOG
SUPER © Version 2008.bld.30 (Mar 22, 2008)—>C:PROGRA~1ERIGHT~1SUPERSetup.exe /remove /q0
Texas Instruments PCIxx21/x515 drivers.—>C:PROGRA~1COMMON~1INSTAL~1Driver7INTEL3~1IDriver.exe /M{F47B2DF8-35EC-4B51-B5F2-0E03EF5F51DA} /l1033
Titanic—>C:Program FilesCyberFlixTitanicTITANIC.EXE -U
TOSHIBA Accessibility—>C:PROGRA~1COMMON~1INSTAL~1Driver7INTEL3~1IDriver.exe /M{3A57482F-BEBC-47E4-ADA1-6302403C7E50} /l1033
TOSHIBA Assist—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{12B3A009-A080-4619-9A2A-C6DB151D8D67}Setup.exe» -l0x9
TOSHIBA ConfigFree—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime701Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{BDD83DC9-BEE9-4654-A5DA-CC46C250088D}setup.exe» -l0x9 UNINSTALL
TOSHIBA Controls—>C:PROGRA~1COMMON~1INSTAL~1Driver7INTEL3~1IDriver.exe /M{5BCA8D15-BCB6-421E-9654-238B43456A4F} /l1033
TOSHIBA Fn-esse—>C:WINDOWSUnInst32.exe Fn-esse.UNI
TOSHIBA Hardware Setup—>C:PROGRA~1COMMON~1INSTAL~1Driver7INTEL3~1IDriver.exe /M{5279374D-87FE-4879-9385-F17278EBB9D3} /l1033
TOSHIBA Hotkey Utility—>C:PROGRA~1COMMON~1INSTAL~1Driver7INTEL3~1IDriver.exe /M{7900D3A6-A9E8-4954-ACCB-AB15867978BF} /l1033
TOSHIBA PC Diagnostic Tool—>C:WINDOWSIsUninst.exe -f»C:Program FilesTOSHIBAPCDiagUninst.isu»
TOSHIBA Power Saver—>C:PROGRA~1COMMON~1INSTAL~1Driver7INTEL3~1IDriver.exe /M{A38D57D1-5F29-4691-B3DD-FE4B3A7B3AFE} /l1033
Toshiba Registration and Metamail Trust Architecture—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{BE3F89C0-42D5-11D5-A40A-00105AC8331A}Setup.exe» -l0x9
TOSHIBA SD Memory Card Format—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{48CF9A66-5F03-4025-ABD0-B3A3FA095A59}Setup.exe»
TOSHIBA Software Modem—>Tosmreg -U
TOSHIBA Software Upgrades—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{425A2BC2-AA64-4107-9C29-484245BBEA05}setup.exe»
TOSHIBA Speech System Applications—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{EE033C1F-443E-41EC-A0E2-559B539A4E4D}Setup.exe» -l0x9
TOSHIBA Speech System SR Engine(U.S.) Version1.0—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{008D69EB-70FF-46AB-9C75-924620DF191A}Setup.exe» -l0x9 UNINSTALL
TOSHIBA Speech System TTS Engine(U.S.) Version1.0—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{3FBF6F99-8EC6-41B4-8527-0A32241B5496}Setup.exe» -l0x9
TOSHIBA Supervisor Password—>C:PROGRA~1COMMON~1INSTAL~1Driver7INTEL3~1IDriver.exe /M{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE} /l1033
Toshiba Tbiosdrv Driver—>C:WINDOWSIsUninst.exe -f»C:Program FilesToshibaToshiba Tbiosdrv DriverTbiosdrv.isu»
TOSHIBA Virtual Sound—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{8B12BA86-ADAC-4BA6-B441-FFC591087252}Setup.exe» /uninstall
TOSHIBA Zooming Utility—>C:PROGRA~1COMMON~1INSTAL~1Driver7INTEL3~1IDriver.exe /M{02EED746-8C5A-43C8-BB3D-D29C8B363A4D} /l1033
Total Commander 6.0—>»C:Program FilesTotal Commandertcuninst.exe»
Touch and Launch—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{5D96E2B1-D9AC-46E0-9073-425C5F63E338}Setup.exe»
TouchPad On/Off Utility—>C:PROGRA~1COMMON~1INSTAL~1Driver7INTEL3~1IDriver.exe /M{80977342-27E8-4FF7-8B6A-D8D89461DA7F} /l1033
TrafficCompressor—>C:Program FilesTrafficCompressoruninstall.exe
TubeTilla—>MsiExec.exe /X{5701A652-0DCF-40FE-8040-5C09368EEFD6}
Update for Windows XP (KB894391)—>»C:WINDOWS$NtUninstallKB894391$spuninstspuninst.exe»
Update for Windows XP (KB898461)—>»C:WINDOWS$NtUninstallKB898461$spuninstspuninst.exe»
Update for Windows XP (KB900485)—>»C:WINDOWS$NtUninstallKB900485$spuninstspuninst.exe»
Update for Windows XP (KB910437)—>»C:WINDOWS$NtUninstallKB910437$spuninstspuninst.exe»
Update for Windows XP (KB911280)—>»C:WINDOWS$NtUninstallKB911280$spuninstspuninst.exe»
Update for Windows XP (KB916595)—>»C:WINDOWS$NtUninstallKB916595$spuninstspuninst.exe»
Update for Windows XP (KB920872)—>»C:WINDOWS$NtUninstallKB920872$spuninstspuninst.exe»
Update for Windows XP (KB922582)—>»C:WINDOWS$NtUninstallKB922582$spuninstspuninst.exe»
Update for Windows XP (KB927891)—>»C:WINDOWS$NtUninstallKB927891$spuninstspuninst.exe»
Update for Windows XP (KB929338)—>»C:WINDOWS$NtUninstallKB929338$spuninstspuninst.exe»
Update for Windows XP (KB930916)—>»C:WINDOWS$NtUninstallKB930916$spuninstspuninst.exe»
Update for Windows XP (KB931836)—>»C:WINDOWS$NtUninstallKB931836$spuninstspuninst.exe»
Update for Windows XP (KB933360)—>»C:WINDOWS$NtUninstallKB933360$spuninstspuninst.exe»
Update for Windows XP (KB936357)—>»C:WINDOWS$NtUninstallKB936357$spuninstspuninst.exe»
Valex AC3-DTS codec (remove only)—>C:Program FilesVAC3ACMuninstall.exe
VideoLAN VLC media player 0.8.4—>C:Program FilesVideoLANVLCuninstall.exe
Viewpoint Media Player—>C:Program FilesViewpointViewpoint Experience TechnologymtsAxInstaller.exe /u
VobSub v2.23 (Remove Only)—>»C:Program FilesGabestVobSubuninstall.exe»
WebMoney Agent—>C:Program FilesWebMoney Agentuninst_wmagent.exe
WebMoney Keeper Classic 3.6.0.6—>»C:Program FilesWebMoneyUninstall.exe» «C:Program FilesWebMoneyinstall.log» -u
Winamp (remove only)—>»C:Program FilesWinampUninstWA.exe»
Windows Installer 3.1 (KB893803)—>»C:WINDOWS$MSI31Uninstall_KB893803v2$spuninstspuninst.exe»
Windows Media Format 11 runtime—>»C:Program FilesWindows Media Playerwmsetsdk.exe» /UninstallAll
Windows Media Format 11 runtime—>»C:WINDOWS$NtUninstallWMFDist11$spuninstspuninst.exe»
Windows Media Player 11—>»C:WINDOWS$NtUninstallwmp11$spuninstspuninst.exe»
Windows XP Hotfix — KB867282—>C:WINDOWS$NtUninstallKB867282$spuninstspuninst.exe
Windows XP Hotfix — KB873333—>C:WINDOWS$NtUninstallKB873333$spuninstspuninst.exe
Windows XP Hotfix — KB873339—>C:WINDOWS$NtUninstallKB873339$spuninstspuninst.exe
Windows XP Hotfix — KB884018—>C:WINDOWS$NtUninstallKB884018$spuninstspuninst.exe
Windows XP Hotfix — KB885250—>C:WINDOWS$NtUninstallKB885250$spuninstspuninst.exe
Windows XP Hotfix — KB885835—>C:WINDOWS$NtUninstallKB885835$spuninstspuninst.exe
Windows XP Hotfix — KB885836—>C:WINDOWS$NtUninstallKB885836$spuninstspuninst.exe
Windows XP Hotfix — KB885855—>C:WINDOWS$NtUninstallKB885855$spuninstspuninst.exe
Windows XP Hotfix — KB886185—>C:WINDOWS$NtUninstallKB886185$spuninstspuninst.exe
Windows XP Hotfix — KB887472—>C:WINDOWS$NtUninstallKB887472$spuninstspuninst.exe
Windows XP Hotfix — KB887742—>C:WINDOWS$NtUninstallKB887742$spuninstspuninst.exe
Windows XP Hotfix — KB888113—>C:WINDOWS$NtUninstallKB888113$spuninstspuninst.exe
Windows XP Hotfix — KB888302—>C:WINDOWS$NtUninstallKB888302$spuninstspuninst.exe
Windows XP Hotfix — KB889673—>C:WINDOWS$NtUninstallKB889673$spuninstspuninst.exe
Windows XP Hotfix — KB890047—>C:WINDOWS$NtUninstallKB890047$spuninstspuninst.exe
Windows XP Hotfix — KB890175—>C:WINDOWS$NtUninstallKB890175$spuninstspuninst.exe
Windows XP Hotfix — KB890859—>»C:WINDOWS$NtUninstallKB890859$spuninstspuninst.exe»
Windows XP Hotfix — KB891781—>C:WINDOWS$NtUninstallKB891781$spuninstspuninst.exe
WinRAR archiver—>C:Program FilesWinRARuninstall.exe
XP Tweaker 1.30—>C:Program FilesXP TweakerUninstall.exe
XviD MPEG4 Video Codec (remove only)—>»C:WINDOWSsystem32xvid-uninstall.exe»
Подсчет дней 1.0—>»C:Program FilesПодсчет днейunins000.exe»
Проигрыватель Windows Media 11—>»C:Program FilesWindows Media PlayerSetup_wm.exe» /Uninstall
Цитата из Библии (BibleQuote) 5.01—>c:BibleQuoteunins000.exe
ЮристГоспошлина 3.1—>»C:Program FilesЮристГоспошлинаunins000.exe»

======Security center information======

AV: Doctor Web Anti-Virus

System event log

Computer Name: DNK
Event Code: 4201
Message: Система обнаружила, что сетевой адаптер DEVICETCPIP_{58FAF2E4-CF4B-40F3-85AC-32C6C7C8D6D8} был подключен к сети,
и инициировала нормальную работу через этот сетевой адаптер.

Record Number: 94177
Source Name: Tcpip
Time Written: 20090123033644.000000+180
Event Type: информация
User:

Computer Name: DNK
Event Code: 4201
Message: Система обнаружила, что сетевой адаптер DEVICETCPIP_{58FAF2E4-CF4B-40F3-85AC-32C6C7C8D6D8} был подключен к сети,
и инициировала нормальную работу через этот сетевой адаптер.

Record Number: 94176
Source Name: Tcpip
Time Written: 20090123033639.000000+180
Event Type: информация
User:

Computer Name: DNK
Event Code: 4201
Message: Система обнаружила, что сетевой адаптер DEVICETCPIP_{58FAF2E4-CF4B-40F3-85AC-32C6C7C8D6D8} был подключен к сети,
и инициировала нормальную работу через этот сетевой адаптер.

Record Number: 94175
Source Name: Tcpip
Time Written: 20090123033609.000000+180
Event Type: информация
User:

Computer Name: DNK
Event Code: 1003
Message: Компьютеру не удалось обновить адрес, полученный от DHCP-cервера, для
сетевого адаптера с сетевым адресом 0013CE4BE119.
Произошла следующая ошибка:
Операция была отменена пользователем.
.
Компьютер продолжит попытки получить свой
собственный адрес от DHCP-cервера.

Record Number: 94174
Source Name: Dhcp
Time Written: 20090123033504.000000+180
Event Type: предупреждение
User:

Computer Name: DNK
Event Code: 4201
Message: Система обнаружила, что сетевой адаптер DEVICETCPIP_{58FAF2E4-CF4B-40F3-85AC-32C6C7C8D6D8} был подключен к сети,
и инициировала нормальную работу через этот сетевой адаптер.

Record Number: 94173
Source Name: Tcpip
Time Written: 20090123033504.000000+180
Event Type: информация
User:

Application event log

Computer Name: DNK
Event Code: 1090
Message: Windows не удалось записать в журнал состояние сеанса RSoP. Попытка подключения к WMI не удалась. Дальнейшее протоколирование RSoP не будет выполняться для этого применения политики.

Record Number: 17113
Source Name: Userenv
Time Written: 20080711191100.000000+240
Event Type: ошибка
User: NT AUTHORITYSYSTEM

Computer Name: DNK
Event Code: 1090
Message: Windows не удалось записать в журнал состояние сеанса RSoP. Попытка подключения к WMI не удалась. Дальнейшее протоколирование RSoP не будет выполняться для этого применения политики.

Record Number: 17112
Source Name: Userenv
Time Written: 20080711173323.000000+240
Event Type: ошибка
User: NT AUTHORITYSYSTEM

Computer Name: DNK
Event Code: 1090
Message: Windows не удалось записать в журнал состояние сеанса RSoP. Попытка подключения к WMI не удалась. Дальнейшее протоколирование RSoP не будет выполняться для этого применения политики.

Record Number: 17111
Source Name: Userenv
Time Written: 20080711173300.000000+240
Event Type: ошибка
User: NT AUTHORITYSYSTEM

Computer Name: DNK
Event Code: 1800
Message: The Windows Security Center Service has started.

Record Number: 17110
Source Name: SecurityCenter
Time Written: 20080711173259.000000+240
Event Type: информация
User:

Computer Name: DNK
Event Code: 0
Message:
Record Number: 17109
Source Name: EvtEng
Time Written: 20080711173247.000000+240
Event Type: информация
User:

======Environment variables======

«ComSpec»=%SystemRoot%system32cmd.exe
«Path»=%SystemRoot%system32;%SystemRoot%;%SystemRoot%System32Wbem
«windir»=%SystemRoot%
«FP_NO_HOST_CHECK»=NO
«OS»=Windows_NT
«PROCESSOR_ARCHITECTURE»=x86
«PROCESSOR_LEVEL»=6
«PROCESSOR_IDENTIFIER»=x86 Family 6 Model 13 Stepping 8, GenuineIntel
«PROCESSOR_REVISION»=0d08
«NUMBER_OF_PROCESSORS»=1
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP

EOF
27 января, 2009 в 9:40 дп #21546
4st
Participant
- Темы:1
- Сообщений:2
Logfile of random’s system information tool 1.05 (written by random/random)
Run by Toshiba at 2009-01-27 12:22:17
Microsoft Windows XP Professional Service Pack 2
System drive C: has 12 GB (12%) free of 95 GB
Total RAM: 502 MB (36% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:22, on 2009-01-27
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesIntelWirelessBinEvtEng.exe
C:Program FilesIntelWirelessBinS24EvMon.exe
C:Program FilesLavasoftAd-Awareaawservice.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesIntelWirelessBinZcfgSvc.exe
C:WINDOWSExplorer.EXE
C:PROGRA~1IntelWirelessBin1XConfig.exe
C:WINDOWSsystem32dlatfswctrl.exe
C:Program FilesApoint2KApoint.exe
C:WINDOWSAGRSMMSG.exe
C:Program FilesTOSHIBAE-KEYCeEKey.exe
C:Program FilesTOSHIBATouchPadTPTray.exe
C:WINDOWSsystem32hkcmd.exe
C:Program FilesDrWebSpIDerAgent.exe
C:Program FilesDrWebspiderml.exe
C:PROGRA~1DrWebspiderui.exe
C:Program FilesApoint2KApntex.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesYourWare SolutionsFreeRAM XP ProFreeRAM XP Pro.exe
C:WINDOWSsystem32zstatus.exe
C:Program FilesCommon FilesDoctor WebScanning Enginedwengine.exe
C:WINDOWSsystem32DVDRAMSV.exe
C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
C:WINDOWSsystem32oodag.exe
C:PROGRA~1DrWebspidernt.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesDrWebspidergate.exe
C:Program FilesInternet ExplorerIEXPLORE.EXE
C:WINDOWSsystem32wuauclt.exe
C:DownloadsRSIT.exe
C:Program Filestrend microToshiba.exe

R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://www.toshiba.com/search
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://forum.local/
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://www.toshibadirect.com/dpdstart
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page =
R3 — URLSearchHook: (no name) — {83821C2B-32A8-4DD7-B6D4-44309A78E668} — C:Program FilesMail.RuAgentMradllnewmrasearch.dll (file missing)
R3 — URLSearchHook: MraSearch Class — {30DA811B-BCBF-4aa7-B5E3-CEE0E03EF2B2} — C:WINDOWSSYSTEMMraSearch.dll (file missing)
R3 — URLSearchHook: Multi Media Toolbar — {b5146c40-189a-4311-bda9-fbae3e023187} — C:Program FilesMulti_MediatbMult.dll
R3 — URLSearchHook: ICQ Toolbar — {855F3B16-6D32-4fe6-8A56-BBB695989046} — C:PROGRA~1ICQTOO~1toolbaru.dll
O2 — BHO: XTTBPos00 Class — {055FD26D-3A88-4e15-963D-DC8493744B1D} — C:PROGRA~1ICQTOO~1toolbaru.dll
O2 — BHO: AcroIEHlprObj Class — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dll
O2 — BHO: Megaupload Toolbar — {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} — C:PROGRA~1MEGAUP~1MEGAUP~1.DLL
O2 — BHO: DriveLetterAccess — {5CA3D70E-1895-11CF-8E15-001234567890} — C:WINDOWSsystem32dlatfswshx.dll
O2 — BHO: IE 4.x-6.x BHO for Download Master — {9961627E-4059-41B4-8E0E-A7D6B3854ADF} — C:PROGRA~1DOWNLO~1dmiehlp.dll
O2 — BHO: IeCatch2 Class — {A5366673-E8CA-11D3-9CD9-0090271D075B} — C:PROGRA~1FlashGetjccatch.dll
O2 — BHO: Multi Media Toolbar — {b5146c40-189a-4311-bda9-fbae3e023187} — C:Program FilesMulti_MediatbMult.dll
O2 — BHO: MegaIEMn — {bf00e119-21a3-4fd1-b178-3b8537e75c92} — C:Program FilesMegauploadMega ManagerMegaIEMn.dll
O2 — BHO: Metamail IEPlugin — {C09C9904-FD44-11D6-A711-00105AC8F168} — C:PROGRA~1METAMA~1METAMA~1IEPlugIn.dll
O3 — Toolbar: (no name) — {BA52B914-B692-46c4-B683-905236F6F655} — (no file)
O3 — Toolbar: FlashGet Bar — {E0E899AB-F487-11D5-8D29-0050BA6940E3} — C:PROGRA~1FlashGetfgiebar.dll
O3 — Toolbar: Multi Media Toolbar — {b5146c40-189a-4311-bda9-fbae3e023187} — C:Program FilesMulti_MediatbMult.dll
O3 — Toolbar: Megaupload Toolbar — {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} — C:PROGRA~1MEGAUP~1MEGAUP~1.DLL
O3 — Toolbar: ICQ Toolbar — {855F3B16-6D32-4fe6-8A56-BBB695989046} — C:PROGRA~1ICQTOO~1toolbaru.dll
O3 — Toolbar: DM Bar — {0E1230F8-EA50-42A9-983C-D22ABC2EED3C} — C:Program FilesDownload Masterdmbar.dll
O4 — HKLM..Run: [dla] C:WINDOWSsystem32dlatfswctrl.exe
O4 — HKLM..Run: [Apoint] C:Program FilesApoint2KApoint.exe
O4 — HKLM..Run: [AGRSMMSG] AGRSMMSG.exe
O4 — HKLM..Run: [CeEKEY] C:Program FilesTOSHIBAE-KEYCeEKey.exe
O4 — HKLM..Run: [TPNF] C:Program FilesTOSHIBATouchPadTPTray.exe
O4 — HKLM..Run: [hp 1000 firmware] C:Program Fileshp LaserJet 1000fwdl.exe
O4 — HKLM..Run: [igfxhkcmd] C:WINDOWSsystem32hkcmd.exe
O4 — HKLM..Run: [ioloDelayModule] C:Program FilesioloSystem Mechanic Professional 6delay.exe
O4 — HKLM..Run: [QuickTime Task] «C:Program FilesQuickTimeqttask.exe» -atboottime
O4 — HKLM..Run: [Mra] C:WINDOWSSYSTEMMra.EXE
O4 — HKLM..Run: [SpIDerAgent] «C:Program FilesDrWebSpIDerAgent.exe»
O4 — HKLM..Run: [SpIDerMail] «C:Program FilesDrWebspiderml.exe»
O4 — HKLM..Run: [SpIDerGate] «C:Program FilesDrWebspidergate.exe» -autorun
O4 — HKLM..Run: [SpIDerNT] C:PROGRA~1DrWebspiderui.exe /agent
O4 — HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [FreeRAM XP] «C:Program FilesYourWare SolutionsFreeRAM XP ProFreeRAM XP Pro.exe» -win
O4 — HKCU..Run: [BitTorrent] «C:Program FilesBitTorrentbittorrent.exe» —force_start_minimized
O4 — HKCU..Run: [Mra] C:Documents and SettingsToshibaApplication DataMraMra.EXE
O4 — HKCU..Run: [Windows Explorer] C:RECYCLED-0-060-0000000000-1111111-2222222FiX.exe
O4 — HKCU..Run: [Kasbersky Antivirus] C:SYSTEMS-1-5-21-1482476501-1644491937-682003330-1013Perfume.exe
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O8 — Extra context menu item: E&xport to Microsoft Excel — res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 — Extra context menu item: Scan link by Dr.Web — http://www.drweb.com/online/drweb-online-en.html
O8 — Extra context menu item: Translate with Lingvo — res://C:Program FilesABBYY Lingvo 10 English-Russian DictionaryLingvo.exe/3000
O8 — Extra context menu item: Закачать ВСЕ при помощи Download Master — C:Program FilesDownload Masterdmieall.htm
O8 — Extra context menu item: Закачать все при помощи FlashGet — C:Program FilesFlashGetjc_all.htm
O8 — Extra context menu item: Закачать при помощи Download Master — C:Program FilesDownload Masterdmie.htm
O8 — Extra context menu item: Закачать при помощи FlashGet — C:Program FilesFlashGetjc_link.htm
O9 — Extra button: (no name) — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.5.0_01binnpjpi150_01.dll
O9 — Extra ‘Tools’ menuitem: Sun Java Console — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.5.0_01binnpjpi150_01.dll
O9 — Extra button: Mail.Ru Agent — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:WINDOWSSYSTEMMra.EXE
O9 — Extra button: Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
O9 — Extra ‘Tools’ menuitem: &Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
O9 — Extra button: Справочные материалы — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 — Extra button: (no name) — {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} — (no file)
O9 — Extra button: FlashGet — {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} — C:PROGRA~1FlashGetflashget.exe
O9 — Extra ‘Tools’ menuitem: &FlashGet — {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} — C:PROGRA~1FlashGetflashget.exe
O9 — Extra button: ICQ6 — {E59EB121-F339-4851-A3BA-FE49C35617C2} — C:Program FilesICQ6ICQ.exe
O9 — Extra ‘Tools’ menuitem: ICQ6 — {E59EB121-F339-4851-A3BA-FE49C35617C2} — C:Program FilesICQ6ICQ.exe
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O10 — Unknown file in Winsock LSP: c:program filestrafficcompressortcomplsp.dll
O10 — Unknown file in Winsock LSP: c:program filestrafficcompressortcomplsp.dll
O10 — Unknown file in Winsock LSP: c:program filestrafficcompressortcomplsp.dll
O10 — Unknown file in Winsock LSP: c:program filestrafficcompressortcomplsp.dll
O12 — Plugin for .spop: C:Program FilesInternet ExplorerPluginsNPDocBox.dll
O14 — IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
O16 — DPF: {103F3DA0-690B-4687-85DC-DB824FA72BB4} (DemoForge Player Control 2.0) — http://www.demoforge.com/download/dfctrl.cab
O16 — DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) — http://go.microsoft.com/fwlink/?linkid=39204
O16 — DPF: {463ED66E-431B-11D2-ADB0-0080C83DA4EB} (AcceptWM Class) — https://w3s.webmoney.ru/WMAcceptor.dll
O17 — HKLMSystemCCSServicesTcpip..{C51CA2CA-7DEE-462B-B49A-8B75E297F5B7}: NameServer = 192.168.130.1 172.16.0.1
O23 — Service: Lavasoft Ad-Aware Service (aawservice) — Lavasoft — C:Program FilesLavasoftAd-Awareaawservice.exe
O23 — Service: Dr.Web ® Scanning Engine (DrWebEngine) (DrWebEngine) — Doctor Web, Ltd. — C:Program FilesCommon FilesDoctor WebScanning Enginedwengine.exe
O23 — Service: DVD-RAM_Service — Matsushita Electric Industrial Co., Ltd. — C:WINDOWSsystem32DVDRAMSV.exe
O23 — Service: EvtEng — Intel Corporation — C:Program FilesIntelWirelessBinEvtEng.exe
O23 — Service: O&O Defrag — O&O Software GmbH — C:WINDOWSsystem32oodag.exe
O23 — Service: Spectrum24 Event Monitor (S24EventMonitor) — Intel Corporation — C:Program FilesIntelWirelessBinS24EvMon.exe
O23 — Service: SpIDer Guard for Windows (SPIDERNT) — Doctor Web, Ltd. — C:PROGRA~1DrWebspidernt.exe

—
End of file — 10091 bytes

======Scheduled tasks folder======

C:WINDOWStasksDr.Web Update.job
C:WINDOWStasksRegistration reminder 1.job
C:WINDOWStasksRegistration reminder 2.job
C:WINDOWStasksRegistration reminder 3.job

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{055FD26D-3A88-4e15-963D-DC8493744B1D}]
XTTBPos00 Class — C:PROGRA~1ICQTOO~1toolbaru.dll [2008-03-09 824656]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class — C:Program FilesAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dll [2003-11-03 54248]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}]
Megaupload Toolbar — C:PROGRA~1MEGAUP~1MEGAUP~1.DLL [2007-06-20 1936840]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{5CA3D70E-1895-11CF-8E15-001234567890}]
DriveLetterAccess — C:WINDOWSsystem32dlatfswshx.dll [2005-01-14 118842]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9961627E-4059-41B4-8E0E-A7D6B3854ADF}]
IE 4.x-6.x BHO for Download Master — C:PROGRA~1DOWNLO~1dmiehlp.dll [2007-07-20 152064]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{A5366673-E8CA-11D3-9CD9-0090271D075B}]
IeCatch2 Class — C:PROGRA~1FlashGetjccatch.dll [2002-01-16 65536]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{b5146c40-189a-4311-bda9-fbae3e023187}]
Multi Media Toolbar — C:Program FilesMulti_MediatbMult.dll [2007-02-01 1285144]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{bf00e119-21a3-4fd1-b178-3b8537e75c92}]
IeMonitorBho Class — C:Program FilesMegauploadMega ManagerMegaIEMn.dll [2006-10-31 98304]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{C09C9904-FD44-11D6-A711-00105AC8F168}]
MCIEPlugIn Class — C:PROGRA~1METAMA~1METAMA~1IEPlugIn.dll [2005-04-27 86016]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{BA52B914-B692-46c4-B683-905236F6F655}
{E0E899AB-F487-11D5-8D29-0050BA6940E3} — FlashGet Bar — C:PROGRA~1FlashGetfgiebar.dll [2005-06-07 86016]
{b5146c40-189a-4311-bda9-fbae3e023187} — Multi Media Toolbar — C:Program FilesMulti_MediatbMult.dll [2007-02-01 1285144]
{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} — Megaupload Toolbar — C:PROGRA~1MEGAUP~1MEGAUP~1.DLL [2007-06-20 1936840]
{855F3B16-6D32-4fe6-8A56-BBB695989046} — ICQ Toolbar — C:PROGRA~1ICQTOO~1toolbaru.dll [2008-03-09 824656]
{0E1230F8-EA50-42A9-983C-D22ABC2EED3C} — DM Bar — C:Program FilesDownload Masterdmbar.dll [2007-11-26 180224]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«dla»=C:WINDOWSsystem32dlatfswctrl.exe [2005-01-14 122939]
«Apoint»=C:Program FilesApoint2KApoint.exe [2004-03-24 196608]
«AGRSMMSG»=C:WINDOWSAGRSMMSG.exe [2005-04-13 88358]
«CeEKEY»=C:Program FilesTOSHIBAE-KEYCeEKey.exe [2005-04-29 675840]
«TPNF»=C:Program FilesTOSHIBATouchPadTPTray.exe [2004-11-30 53248]
«hp 1000 firmware»=C:Program Fileshp LaserJet 1000fwdl.exe [2001-12-15 36864]
«igfxhkcmd»=C:WINDOWSsystem32hkcmd.exe [2006-02-07 77824]
«ioloDelayModule»=C:Program FilesioloSystem Mechanic Professional 6delay.exe [2005-06-08 96256]
«QuickTime Task»=C:Program FilesQuickTimeqttask.exe [2005-05-24 98304]
«Mra»=C:WINDOWSSYSTEMMra.EXE [2004-07-28 489984]
«SpIDerAgent»=C:Program FilesDrWebSpIDerAgent.exe [2008-12-17 697584]
«SpIDerMail»=C:Program FilesDrWebspiderml.exe [2008-12-12 627952]
«SpIDerGate»=C:Program FilesDrWebspidergate.exe [2008-12-15 1402096]
«SpIDerNT»=C:PROGRA~1DrWebspiderui.exe [2008-12-09 197896]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«ctfmon.exe»=C:WINDOWSsystem32ctfmon.exe [2004-08-04 15360]
«FreeRAM XP»=C:Program FilesYourWare SolutionsFreeRAM XP ProFreeRAM XP Pro.exe [2005-09-19 1585664]
«BitTorrent»=C:Program FilesBitTorrentbittorrent.exe —force_start_minimized []
«Mra»=C:Documents and SettingsToshibaApplication DataMraMra.EXE [2004-07-28 489984]
«Windows Explorer»=C:RECYCLED-0-060-0000000000-1111111-2222222FiX.exe [2009-01-23 81920]
«Kasbersky Antivirus»=C:SYSTEMS-1-5-21-1482476501-1644491937-682003330-1013Perfume.exe []

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyigfxcui]
C:WINDOWSsystem32igfxdev.dll [2006-02-07 139264]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyIntelWireless]
C:Program FilesIntelWirelessBinLgNotify.dll [2004-10-15 110592]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyWgaLogon]
C:WINDOWSsystem32WgaLogon.dll [2007-03-15 236928]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks]
«{93994DE8-8239-4655-B1D1-5F4E91300429}»=C:Program FilesDVD Region+CSS FreeDVDShell.dll [2004-10-09 49152]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalaawservice]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalprocexp90.Sys]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalPSEXESVC]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkaawservice]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworknm]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworknm.sys]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkprocexp90.Sys]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkPSEXESVC]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=0

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:TOSHIBAivpNetIntNetint.exe»=»C:TOSHIBAivpNetIntNetint.exe:*:Enabled:NIE — Toshiba Software Upgrade Engine»
«C:TOSHIBAIvpISMpinger.exe»=»C:TOSHIBAIVPISMpinger.exe:*:Enabled:Toshiba Software Upgrades Pinger»
«C:Program FilesCommon FilesAOLACSAOLacsd.exe»=»C:Program FilesCommon FilesAOLACSAOLacsd.exe:*:Enabled:AOL»
«C:Program FilesCommon FilesAOLACSAOLDial.exe»=»C:Program FilesCommon FilesAOLACSAOLDial.exe:*:Enabled:AOL»
«C:Program FilesAmerica Online 9.0waol.exe»=»C:Program FilesAmerica Online 9.0waol.exe:*:Enabled:America Online 9.0»
«C:Program FilesTrafficCompressorTCompres.exe»=»C:Program FilesTrafficCompressorTCompres.exe:*:Enabled:TrafficCompressor beta»
«C:Program FileseMuleemule.exe»=»C:Program FileseMuleemule.exe:*:Enabled:eMule»
«C:Program FilesRealRealPlayerrealplay.exe»=»C:Program FilesRealRealPlayerrealplay.exe:*:Enabled:RealPlayer»
«C:Program FilesInterVideoDVD6WinDVD.exe»=»C:Program FilesInterVideoDVD6WinDVD.exe:*:Enabled:WinDVD»
«C:Program FilesBitTorrentbittorrent.exe»=»C:Program FilesBitTorrentbittorrent.exe:*:Enabled:BitTorrent»
«C:Program FilesInternet ExplorerIEXPLORE.EXE»=»C:Program FilesInternet ExplorerIEXPLORE.EXE:*:Enabled:Internet Explorer»
«D:garantappsf1shell.run»=»D:garantappsf1shell.run:*:Enabled:Система ГАРАНТ»
«C:Program FilesSopCastSopCast.exe»=»C:Program FilesSopCastSopCast.exe:*:Enabled:SopCast Main Application»
«C:Documents and SettingsToshibaApplication DataSopCastadvSopAdver.exe»=»C:Documents and SettingsToshibaApplication DataSopCastadvSopAdver.exe:*:Enabled:SopCast Adver»
«C:Program FilesVideoLANVLCvlc.exe»=»C:Program FilesVideoLANVLCvlc.exe:*:Enabled:VLC media player»
«C:Program FilesICQ6ICQ.exe»=»C:Program FilesICQ6ICQ.exe:*:Enabled:ICQ6»
«C:Program FilesuTorrentuTorrent.exe»=»C:Program FilesuTorrentuTorrent.exe:*:Enabled:µTorrent»
«C:Program FilesWebMoneyWebMoney.exe»=»C:Program FilesWebMoneyWebMoney.exe:*:Enabled:WebMoney Keeper Classic Runner Module»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesCommon FilesAOLACSAOLacsd.exe»=»C:Program FilesCommon FilesAOLACSAOLacsd.exe:*:Enabled:AOL»
«C:Program FilesCommon FilesAOLACSAOLDial.exe»=»C:Program FilesCommon FilesAOLACSAOLDial.exe:*:Enabled:AOL»
«C:Program FilesAmerica Online 9.0waol.exe»=»C:Program FilesAmerica Online 9.0waol.exe:*:Enabled:America Online 9.0»

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{1e2135ee-219a-11dc-86fe-0013ce4be119}]
shellAutoRuncommand — C:WINDOWSsystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL .Recycleddeskinf.pif

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{d1fd7230-a60b-11da-83fb-00038a000015}]
shellAutoRuncommand — F:RECYCLED-0-060-0000000000-1111111-2222222FiX.exe
shellopencommand — F:RECYCLED-0-060-0000000000-1111111-2222222FiX.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{e6b2f0ee-f0e4-11dc-88e6-0013ce4be119}]
shellAutoRuncommand — E:PStart.exe

======File associations======

.js — open — NOTEPAD.EXE %1
.vbs — open — NOTEPAD.EXE %1

======List of files/folders created in the last 1 months======

2009-01-27 12:22:17 —-D—- C:rsit
2009-01-27 12:22:17 —-D—- C:Program Filestrend micro
2009-01-27 04:19:43 —-D—- C:Program FilesCommon FilesDoctor Web
2009-01-27 04:19:37 —-D—- C:Documents and SettingsAll UsersApplication DataDoctor Web
2009-01-27 04:03:15 —-SHD—- C:RECYCLER
2009-01-27 04:03:15 —-SHD—- C:Documents and SettingsToshibaApplication Data.#
2009-01-27 04:03:15 —-D—- C:ComboFix
2009-01-27 03:13:21 —-A—- C:WINDOWSIE4 Error Log.txt
2009-01-27 02:45:43 —-D—- C:WINDOWStemp
2009-01-27 02:45:40 —-A—- C:ComboFix.txt
2009-01-26 23:28:06 —-D—- C:Program FilesDrWeb
2009-01-26 22:45:59 —-A—- C:Boot.bak
2009-01-26 22:45:49 —-D—- C:cmdcons
2009-01-26 22:42:43 —-A—- C:WINDOWSsystem32CF22285.exe
2009-01-26 22:35:35 —-A—- C:WINDOWSzip.exe
2009-01-26 22:35:35 —-A—- C:WINDOWSSWREG.exe
2009-01-26 22:35:35 —-A—- C:WINDOWSNIRCMD.exe
2009-01-26 22:35:34 —-A—- C:WINDOWSVFIND.exe
2009-01-26 22:35:34 —-A—- C:WINDOWSSWXCACLS.exe
2009-01-26 22:35:34 —-A—- C:WINDOWSSWSC.exe
2009-01-26 22:35:34 —-A—- C:WINDOWSsed.exe
2009-01-26 22:35:34 —-A—- C:WINDOWSgrep.exe
2009-01-26 22:35:34 —-A—- C:WINDOWSfdsv.exe
2009-01-26 22:35:27 —-D—- C:WINDOWSERDNT
2009-01-26 22:35:27 —-D—- C:Qoobox
2009-01-26 22:35:16 —-A—- C:WINDOWSsystem32CF20806.exe
2009-01-22 00:13:27 —-RSHD—- C:SYSTEM
2009-01-19 23:02:46 —-RSHD—- C:RECYCLE
2009-01-12 21:10:48 —-D—- C:WINDOWSEpa
2009-01-12 20:49:24 —-D—- C:sgcfinder5r
2009-01-07 20:56:16 —-A—- C:Documents and SettingsToshibaApplication Datamractl.dll
2008-12-28 23:14:15 —-D—- C:Documents and SettingsToshibaApplication DataAshampoo
2008-12-28 23:12:04 —-D—- C:Documents and SettingsAll UsersApplication Dataashampoo
2008-12-28 23:11:35 —-D—- C:Program FilesAshampoo

======List of files/folders modified in the last 1 months======

2009-01-27 12:22:17 —-AD—- C:Program Files
2009-01-27 12:21:57 —-D—- C:Documents and SettingsToshibaApplication DataMegauploadToolbar
2009-01-27 12:15:55 —-D—- C:WINDOWSsystem32CatRoot2
2009-01-27 12:15:47 —-A—- C:WINDOWSModemLog_TOSHIBA Software Modem.txt
2009-01-27 12:13:27 —-D—- C:WINDOWSsystem32
2009-01-27 12:13:27 —-D—- C:WINDOWSsystem
2009-01-27 12:10:42 —-A—- C:WINDOWSSchedLgU.Txt
2009-01-27 11:57:02 —-D—- C:Downloads
2009-01-27 11:56:41 —-D—- C:Program FilesFlashGet
2009-01-27 11:53:34 —-RSHDC—- C:WINDOWSsystem32dllcache
2009-01-27 11:53:30 —-D—- C:WINDOWS
2009-01-27 11:23:52 —-D—- C:Documents and SettingsToshibaApplication DatauTorrent
2009-01-27 09:27:58 —-HD—- C:WINDOWSinf
2009-01-27 04:20:30 —-SHD—- C:WINDOWSInstaller
2009-01-27 04:20:30 —-D—- C:Config.Msi
2009-01-27 04:20:23 —-D—- C:WINDOWSsystem32drivers
2009-01-27 04:19:55 —-SD—- C:WINDOWSTasks
2009-01-27 04:19:00 —-D—- C:Program FilesESET
2009-01-27 03:57:40 —-D—- C:WINDOWSsystem32wbem
2009-01-27 03:54:13 —-D—- C:WINDOWSsystem32config
2009-01-27 03:53:52 —-D—- C:WINDOWSRegistration
2009-01-27 03:52:15 —-D—- C:Documents and SettingsToshibaApplication DataMra
2009-01-27 02:43:56 —-A—- C:WINDOWSsystem.ini
2009-01-27 02:43:28 —-D—- C:WINDOWSAppPatch
2009-01-27 02:43:28 —-D—- C:Program FilesCommon Files
2009-01-27 02:04:52 —-D—- C:WINDOWSHelp
2009-01-26 22:36:32 —-A—- C:WINDOWSSysMech6.INI
2009-01-26 22:35:31 —-D—- C:WINDOWSPrefetch
2009-01-26 09:46:46 —-D—- C:WINDOWSMinidump
2009-01-24 22:37:04 —-A—- C:WINDOWScm.ini
2009-01-18 21:41:43 —-D—- C:Documents and SettingsToshibaApplication DataGarant-DVD
2009-01-02 00:42:35 —-D—- C:Program FilesBitSpirit
2009-01-01 22:49:19 —-D—- C:Program FilesAhead
2008-12-28 22:39:07 —-D—- C:Program FilesMail.Ru
2008-12-28 20:45:25 —-D—- C:Documents and SettingsToshibaApplication DataSendSpace Wizard
2008-12-28 18:48:57 —-D—- C:WINDOWSsystem32oodag
2008-12-28 15:47:11 —-AD—- C:Documents and SettingsAll UsersApplication DataTEMP

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Cdralw2k;Cdralw2k; C:WINDOWSsystem32driversCdralw2k.sys [2007-01-26 2560]
R1 FileDisk;FileDisk; C:WINDOWSsystem32driversFileDisk.sys [2006-01-18 9341]
R1 intelppm;Intel Processor Driver; C:WINDOWSsystem32DRIVERSintelppm.sys [2004-08-04 36096]
R1 meiudf;meiudf; C:WINDOWSSystem32Driversmeiudf.sys [2005-02-25 102320]
R1 SerTVOutCtlr;TOSHIBA Controls Driver -EPIOMngr; C:WINDOWSsystem32driversEPIOMngr.sys [2004-07-31 6400]
R1 SrvcEKIOMngr;SrvcEKIOMngr; C:WINDOWSSystem32DriversEKIoMngr.sys [2005-04-21 6400]
R1 SrvcSSIOMngr;SrvcSSIOMngr; C:WINDOWSSystem32DriversSSIoMngr.sys [2005-04-21 6400]
R1 sscdbhk5;sscdbhk5; C:WINDOWSsystem32driverssscdbhk5.sys [2004-12-02 5627]
R1 ssrtln;ssrtln; C:WINDOWSsystem32driversssrtln.sys [2004-12-02 23545]
R1 TPwSav;Common Driver; C:WINDOWSSystem32DriversTPwSav.sys [2005-02-26 8704]
R1 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:WINDOWSSystem32driversws2ifsl.sys [2004-08-04 12032]
R2 ACEDRV07;ACEDRV07; ??C:WINDOWSsystem32driversACEDRV07.sys []
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.1.6.0; C:WINDOWSsystem32DRIVERSAegisP.sys [2006-01-13 17119]
R2 drvnddm;drvnddm; C:WINDOWSsystem32driversdrvnddm.sys [2004-12-23 40544]
R2 Netdevio;TOSHIBA Network Device Usermode I/O Protocol; C:WINDOWSsystem32DRIVERSnetdevio.sys [2003-01-30 12032]
R2 s24trans;WLAN Transport; C:WINDOWSsystem32DRIVERSs24trans.sys [2004-10-15 11354]
R2 SPIDER;SpIDer Guard File System Monitor; ??C:PROGRA~1DrWebspider.sys []
R2 TBiosDrv;TBiosDrv; ??C:WINDOWSsystem32driversTBiosDrv.sys []
R2 tfsnboio;tfsnboio; C:WINDOWSsystem32dlatfsnboio.sys [2005-01-14 25883]
R2 tfsncofs;tfsncofs; C:WINDOWSsystem32dlatfsncofs.sys [2005-01-14 34843]
R2 tfsndrct;tfsndrct; C:WINDOWSsystem32dlatfsndrct.sys [2005-01-14 4123]
R2 tfsndres;tfsndres; C:WINDOWSsystem32dlatfsndres.sys [2005-01-14 2239]
R2 tfsnifs;tfsnifs; C:WINDOWSsystem32dlatfsnifs.sys [2005-01-14 87706]
R2 tfsnopio;tfsnopio; C:WINDOWSsystem32dlatfsnopio.sys [2005-01-14 15227]
R2 tfsnpool;tfsnpool; C:WINDOWSsystem32dlatfsnpool.sys [2005-01-14 6363]
R2 tfsnudf;tfsnudf; C:WINDOWSsystem32dlatfsnudf.sys [2005-01-14 99098]
R2 tfsnudfa;tfsnudfa; C:WINDOWSsystem32dlatfsnudfa.sys [2005-01-14 100603]
R3 AgereSoftModem;TOSHIBA V92 Software Modem; C:WINDOWSsystem32DRIVERSAGRSM.sys [2005-04-13 1066278]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:WINDOWSsystem32driversALCXWDM.SYS [2005-04-19 2317504]
R3 ApfiltrService;Alps Pointing-device Filter Driver; C:WINDOWSsystem32DRIVERSApfiltr.sys [2004-11-16 101874]
R3 Arp1394;1394 ARP Client Protocol; C:WINDOWSsystem32DRIVERSarp1394.sys [2004-08-04 60800]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:WINDOWSsystem32DRIVERSCmBatt.sys [2004-08-04 14080]
R3 ialm;ialm; C:WINDOWSsystem32DRIVERSialmnt5.sys [2006-02-07 1399615]
R3 Iviaspi;IVI ASPI Shell; C:WINDOWSsystem32driversiviaspi.sys [2003-09-11 21060]
R3 IWCA;Intel Wireless Connection Agent Miniport for Win XP; C:WINDOWSsystem32DRIVERSiwca.sys [2004-08-12 234496]
R3 NIC1394;1394 Net Driver; C:WINDOWSsystem32DRIVERSnic1394.sys [2004-08-04 61824]
R3 Pfc;Padus ASPI Shell; C:WINDOWSsystem32driverspfc.sys [2003-09-20 21248]
R3 sdbus;sdbus; C:WINDOWSsystem32DRIVERSsdbus.sys [2004-08-04 67584]
R3 tifm21;tifm21; C:WINDOWSsystem32driverstifm21.sys [2005-04-05 160768]
R3 Tvs;Toshiba Virtual Sound with SRS technologies; C:WINDOWSsystem32DRIVERSTvs.sys [2005-04-15 29056]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:WINDOWSsystem32DRIVERSusbehci.sys [2004-08-04 26624]
R3 usbhub;USB2 Enabled Hub; C:WINDOWSsystem32DRIVERSusbhub.sys [2004-08-04 57600]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:WINDOWSsystem32DRIVERSusbuhci.sys [2004-08-04 20480]
R3 w29n51;Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows XP; C:WINDOWSsystem32DRIVERSw29n51.sys [2004-10-29 3222784]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:WINDOWSsystem32DRIVERSyk51x86.sys [2005-03-31 230400]
S1 Cdr4_xp;Cdr4_xp; C:WINDOWSsystem32driversCdr4_xp.sys [2007-01-26 2432]
S1 StickyMesger;StickyMesger; ??C:Program FilesTOSHIBAAccessibilityStickyMesger.sys []
S3 HidUsb;Microsoft HID Class Driver; C:WINDOWSsystem32DRIVERShidusb.sys [2001-08-18 9600]
S3 mouhid;Mouse HID Driver; C:WINDOWSsystem32DRIVERSmouhid.sys [2001-08-18 12160]
S3 nm;Network Monitor Driver; C:WINDOWSsystem32DRIVERSNMnt.sys [2004-08-04 40320]
S3 sffdisk;SFF Storage Class Driver; C:WINDOWSsystem32DRIVERSsffdisk.sys [2004-08-04 11136]
S3 sffp_sd;SFF Storage Protocol Driver for SDBus; C:WINDOWSsystem32DRIVERSsffp_sd.sys [2004-08-04 10240]
S3 SPT2Sp50;SPT2Sp50 NDIS Protocol Driver; C:WINDOWSSystem32DriversSPT2Sp50.sys []
S3 usbccgp;Microsoft USB Generic Parent Driver; C:WINDOWSsystem32DRIVERSusbccgp.sys [2004-08-03 31616]
S3 usbprint;Microsoft USB PRINTER Class; C:WINDOWSsystem32DRIVERSusbprint.sys [2004-08-03 25856]
S3 usbscan;USB Scanner Driver; C:WINDOWSsystem32DRIVERSusbscan.sys [2004-08-03 15104]
S3 USBSTOR;USB Mass Storage Driver; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2004-08-04 26496]
S3 wanatw;WAN Miniport (ATW); C:WINDOWSsystem32DRIVERSwanatw4.sys []
S3 WudfPf;Windows Driver Foundation — User-mode Driver Framework Platform Driver; C:WINDOWSsystem32DRIVERSWudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2006-09-28 82944]
S4 dwshd;dwshd; C:WINDOWSSystem32driversdwshd.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Lavasoft Ad-Aware Service; C:Program FilesLavasoftAd-Awareaawservice.exe [2008-09-10 611664]
R2 DrWebEngine;Dr.Web ® Scanning Engine (DrWebEngine); C:Program FilesCommon FilesDoctor WebScanning Enginedwengine.exe [2008-10-17 869688]
R2 DVD-RAM_Service;DVD-RAM_Service; C:WINDOWSsystem32DVDRAMSV.exe [2004-08-28 110592]
R2 EvtEng;EvtEng; C:Program FilesIntelWirelessBinEvtEng.exe [2004-10-15 86016]
R2 MDM;Machine Debug Manager; C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE [2003-06-19 322120]
R2 O&O Defrag;O&O Defrag; C:WINDOWSsystem32oodag.exe [2005-05-11 225280]
R2 S24EventMonitor;Spectrum24 Event Monitor; C:Program FilesIntelWirelessBinS24EvMon.exe [2004-10-15 360521]
R2 SPIDERNT;SpIDer Guard for Windows; C:PROGRA~1DrWebspidernt.exe [2008-12-09 197896]
S2 Fax;Fax; C:WINDOWSsystem32fxssvc.exe [2004-08-04 267776]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2007-04-13 33632]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2007-04-13 68952]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2003-07-28 89136]
S3 WMPNetworkSvc;Служба общих сетевых ресурсов проигрывателя Windows Media; C:Program FilesWindows Media PlayerWMPNetwk.exe [2006-11-02 914944]
S3 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2004-08-04 14336]
S4 CFSvcs;ConfigFree Service; C:Program FilesTOSHIBAConfigFreeCFSvcs.exe [2005-01-18 40960]
S4 RegSrvc;RegSrvc; C:Program FilesIntelWirelessBinRegSrvc.exe [2004-10-15 139264]
S4 Swupdtmr;Swupdtmr; c:TOSHIBAIVPswupdateswupdtmr.exe [2004-05-13 53248]

EOF
28 января, 2009 в 1:04 пп #21547
Admin
Keymaster
- Темы:40
- Сообщений:5676
Здравствуйте, добро пожаловать на Spyware-ru форум.

Кроме описанного вами, ваш компьютер заражён autorun.inf трояном.

Прочитайте эту инструкцию Flash_Disinfector ещё одно оружие против autorun.inf троянов. Скачайте и запустите Flash_Disinfector, не забудьте при этом по требованию программы вставить ваш флэш диск или подключить другие внешние устройства хранения информации.

Судя по логам у вас уже есть Combofix.
Откройте блокнот (Кликните Пуск, Выполнить, в строке ввода введите notepad и нажмите Enter) и вставьте в него следующий текст:
```
Registry::

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]

"Mra"=-



[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]

"Mra"=-

"Windows Explorer"=-

"Kasbersky Antivirus"=-



[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{1e2135ee-219a-11dc-86fe-0013ce4be119}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{d1fd7230-a60b-11da-83fb-00038a000015}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{e6b2f0ee-f0e4-11dc-88e6-0013ce4be119}]



File::

C:WINDOWSSYSTEMMra.EXE

C:Documents and SettingsToshibaApplication DataMraMra.EXE



Folder::

C:RECYCLE

C:SYSTEM
```
Запишите получившийся файл на ваш рабочий стол под именем CFScript
Далее перетащите получившийся файл на иконку Combofix, как показано на картинке ниже.

Сombofix запуститься и выполнит процедуры описанные в созданном нами файле.
По результатам работы Combofix будет создан новый лог, его и вставьте в свой следующий ответ.
Автор

Сообщения