- This topic has 5 ответов, 2 участника, and was last updated 15 years, 8 months назад by
.
-
Сообщения
-
Добрый день всем, хотя сложно его назвать добрым.
Сегодня по глупости был запущен файл, который в последствии оказался Трояном.
Теперь ноутбук при включении показывает лишь иконку фальшивого антивирусника, Виндоус не загружается ( я уже пробывала безопасный режим).
Скачать какую либо программу с инета нет возможности из-за вируса.
Что делать ? Волнует вопрос — потеряна ли теперь вся инфа на комп-ре или все же есть надежда , что ее можно будет восстаносвить?Thank you!
Здравствуйте, добро пожаловать на Spyware-ru форум.
Теперь ноутбук при включении показывает лишь иконку фальшивого антивирусника
Что это значит ? Загружается Windows и на рабочем столе только одна иконка ?
потеряна ли теперь вся инфа на комп-ре или все же есть надежда , что ее можно будет восстаносвить
Думаю вся ваша информация на месте и никуда не делась
рабочий стол вообще не загружается, на черном фоне сразу же высвечивается фальшивая анти-вирусная программа, кот. просит зарег-ся.
в Безопасном режиме происходит тоже самое. ❗
Нам сказали, что можно использовать какой-то Boot-CD , кот. поможет сохранить все данные перед форматированием компьютера. 😕
Про такой вариант сохранения памяти слышу впервые, он надежный? И стоит ли заниматься этим самостоятельно без соот-щих навыков? 😐удалось таки зайти в комп-р, подключится к инету. Правда клав-ра пищит (.
аваст нашел Троян Win 32. Как его удалить подчистую?Logfile of random’s system information tool 1.06 (written by random/random)
Run by Gulshat at 2010-02-23 10:16:25
Microsoft® Windows Vista™ Home Basic Service Pack 1
System drive C: has 29 GB (21%) free of 143 GB
Total RAM: 2038 MB (39% free)Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:17:34 AM, on 2/23/2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: NormalRunning processes:
C:Windowssystem32Dwm.exe
C:WindowsExplorer.EXE
C:Windowssystem32taskeng.exe
C:Program FilesWindows DefenderMSASCui.exe
C:WindowsRtHDVCpl.exe
C:WindowsOEM13Mon.exe
C:Program FilesDellDell Webcam ManagerDellWMgr.exe
C:WindowsSystem32WLTRAY.EXE
C:Program FilesDell Support Centerbinsprtcmd.exe
C:WindowsSystem32hkcmd.exe
C:WindowsSystem32igfxpers.exe
C:Program FilesSynapticsSynTPSynTPEnh.exe
C:Program FilesAlwil SoftwareAvast4ashDisp.exe
C:Program FilesWinampwinampa.exe
C:Program FilesCommon FilesRealUpdate_OBrealsched.exe
C:Program FilesiTunesiTunesHelper.exe
C:Program FilesCommon FilesInstallShieldUpdateServiceISUSPM.exe
C:Program FilesAd MuncherAdMunch.exe
C:Program FilesDellQuickSetquickset.exe
C:Program FilesSynapticsSynTPSynToshiba.exe
C:Windowssystem32igfxsrvc.exe
C:Windowssystem32wbemunsecapp.exe
C:Program FilesSynapticsSynTPSynTPHelper.exe
C:Windowssystem32wuauclt.exe
C:Program FilesAlwil SoftwareAvast4ashSimpl.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:UsersGulshatDesktopDesktopRSIT.exe
C:Program Filestrend microGulshat.exeR1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=6080912
R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT1750559
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://mail.ru
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =
R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Window Title = Internet Explorer provided by Dell
R1 — HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyServer = http=127.0.0.1:6711
R1 — HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *.local
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =
R3 — URLSearchHook: (no name) — {83821C2B-32A8-4DD7-B6D4-44309A78E668} — C:Program FilesMail.RuAgentMradllnewmrasearch.dll
R3 — URLSearchHook: (no name) — — (no file)
R3 — URLSearchHook: ICQToolBar — {855F3B16-6D32-4fe6-8A56-BBB695989046} — C:Program FilesICQ6ToolbarICQToolBar.dll
R3 — URLSearchHook: Ñïóòíèê@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — C:Program FilesMail.RuSputnikMRSptnk2_0_1_54.dll
O1 — Hosts: ::1 localhost
O2 — BHO: Adobe PDF Reader Link Helper — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 — BHO: Skype add-on (mastermind) — {22BF413B-C6D2-4d91-82A9-A0F997BA588C} — C:Program FilesSkypeToolbarsInternet ExplorerSkypeIEPlugin.dll
O2 — BHO: RealPlayer Download and Record Plugin for Internet Explorer — {3049C3E9-B461-4BC5-8870-4C09146192CA} — C:Program FilesRealRealPlayerrpbrowserrecordplugin.dll
O2 — BHO: SSVHelper Class — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — C:Program FilesJavajre1.6.0_05binssv.dll
O2 — BHO: (no name) — {7E853D72-626A-48EC-A868-BA8D5E23E045} — (no file)
O2 — BHO: ???????@Mail.Ru — {8984B388-A5BB-4DF7-B274-77B879E179DB} — C:Program FilesMail.RuSputnikMRSptnk2_0_1_54.dll
O2 — BHO: Google Toolbar Notifier BHO — {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} — C:Program FilesGoogleGoogleToolbarNotifier5.1.1309.3572swg.dll
O3 — Toolbar: Ñïóòíèê@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — C:Program FilesMail.RuSputnikMRSptnk2_0_1_54.dll
O3 — Toolbar: ICQToolBar — {855F3B16-6D32-4fe6-8A56-BBB695989046} — C:Program FilesICQ6ToolbarICQToolBar.dll
O4 — HKLM..Run: [Windows Defender] %ProgramFiles%Windows DefenderMSASCui.exe -hide
O4 — HKLM..Run: [ECenter] C:DellE-CenterEULALauncher.exe
O4 — HKLM..Run: [Apoint] C:Program FilesDellTPadApoint.exe
O4 — HKLM..Run: [RtHDVCpl] RtHDVCpl.exe
O4 — HKLM..Run: [OEM13Mon.exe] C:WindowsOEM13Mon.exe
O4 — HKLM..Run: [DELL Webcam Manager] «C:Program FilesDellDell Webcam ManagerDellWMgr.exe» /s
O4 — HKLM..Run: [Broadcom Wireless Manager UI] C:Windowssystem32WLTRAY.exe
O4 — HKLM..Run: [dscactivate] «C:Program FilesDell Support Centergs_agentcustomdsca.exe»
O4 — HKLM..Run: [DellSupportCenter] «C:Program FilesDell Support Centerbinsprtcmd.exe» /P DellSupportCenter
O4 — HKLM..Run: [IgfxTray] C:Windowssystem32igfxtray.exe
O4 — HKLM..Run: [HotKeysCmds] C:Windowssystem32hkcmd.exe
O4 — HKLM..Run: [Persistence] C:Windowssystem32igfxpers.exe
O4 — HKLM..Run: [SynTPEnh] C:Program FilesSynapticsSynTPSynTPEnh.exe
O4 — HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 — HKLM..Run: [WinampAgent] «C:Program FilesWinampwinampa.exe»
O4 — HKLM..Run: [Adobe Reader Speed Launcher] «C:Program FilesAdobeReader 8.0ReaderReader_sl.exe»
O4 — HKLM..Run: [Ad Muncher] C:Program FilesAd MuncherAdMunch.exe /bt
O4 — HKLM..Run: [MAgent] C:Program FilesMail.RuAgentmagent.exe -LM
O4 — HKLM..Run: [TkBellExe] «C:Program FilesCommon FilesRealUpdate_OBrealsched.exe» -osboot
O4 — HKLM..Run: [trioService] «C:PROGRA~1Freeze.comLiving 3D DolphinstrioService.exe «
O4 — HKLM..Run: [QuickTime Task] «C:Program FilesQuickTimeQTTask.exe» -atboottime
O4 — HKLM..Run: [iTunesHelper] «C:Program FilesiTunesiTunesHelper.exe»
O4 — HKCU..Run: [DellSupportCenter] «C:Program FilesDell Support Centerbinsprtcmd.exe» /P DellSupportCenter
O4 — HKCU..Run: [ISUSPM] «C:Program FilesCommon FilesInstallShieldUpdateServiceISUSPM.exe» -scheduler
O4 — HKCU..Run: [Ad Muncher] C:Program FilesAd MuncherAdMunch.exe /bt
O4 — HKUSS-1-5-19..Run: [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User ‘NETWORK SERVICE’)
O4 — Startup: 2WireSetup.lnk = ?
O4 — Global Startup: QuickSet.lnk = C:Program FilesDellQuickSetquickset.exe
O8 — Extra context menu item: E&xport to Microsoft Excel — res://C:PROGRA~1MICROS~2Office12EXCEL.EXE/3000
O8 — Extra context menu item: Íàéòè â èíòåðíåòå — res://C:Program FilesMail.RuSputnikMailRuSputnik.dll/282
O8 — Extra context menu item: Íàéòè â ñëîâàðÿõ — res://C:Program FilesMail.RuSputnikMailRuSputnik.dll/283
O8 — Extra context menu item: Ïîèñê@Mail.Ru — res://C:Program FilesMail.RuSputnikMRSptnk2_0_1_54.dll/282
O8 — Extra context menu item: Ñëîâàðè@Mail.Ru — res://C:Program FilesMail.RuSputnikMRSptnk2_0_1_54.dll/283
O9 — Extra button: (no name) — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_05binssv.dll
O9 — Extra ‘Tools’ menuitem: Sun Java Console — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_05binssv.dll
O9 — Extra button: Mail.Ru ????? — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra ‘Tools’ menuitem: Mail.Ru ????? — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra button: Skype — {77BF5300-1474-4EC7-9980-D32B190E9B07} — C:Program FilesSkypeToolbarsInternet ExplorerSkypeIEPlugin.dll
O9 — Extra button: Research — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2Office12REFIEBAR.DLL
O13 — Gopher Prefix:
O16 — DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) — file:///C:/Program%20Files/Monopoly%20Here%20and%20Now/Images/armhelper.ocx
O17 — HKLMSystemCCSServicesTcpip..{2C36E207-26EC-4FC4-9676-10DABF128FB0}: NameServer = 85.255.112.151,85.255.112.207
O17 — HKLMSystemCCSServicesTcpip..{E90AE144-0625-4DAA-AC77-9BFE4F5516C6}: NameServer = 85.255.112.151,85.255.112.207
O17 — HKLMSystemCS1ServicesTcpipParameters: NameServer = 85.255.112.151,85.255.112.207
O17 — HKLMSystemCS1ServicesTcpip..{2C36E207-26EC-4FC4-9676-10DABF128FB0}: NameServer = 85.255.112.151,85.255.112.207
O17 — HKLMSystemCS2ServicesTcpipParameters: NameServer = 85.255.112.151,85.255.112.207
O17 — HKLMSystemCS2ServicesTcpip..{2C36E207-26EC-4FC4-9676-10DABF128FB0}: NameServer = 85.255.112.151,85.255.112.207
O17 — HKLMSystemCCSServicesTcpipParameters: NameServer = 85.255.112.151,85.255.112.207
O18 — Protocol: skype4com — {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} — C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O23 — Service: Andrea RT Filters Service (AERTFilters) — Andrea Electronics Corporation — C:Windowssystem32AERTSrv.exe
O23 — Service: Apple Mobile Device — Apple Inc. — C:Program FilesCommon FilesAppleMobile Device SupportbinAppleMobileDeviceService.exe
O23 — Service: avast! iAVS4 Control Service (aswUpdSv) — ALWIL Software — C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 — Service: avast! Antivirus — ALWIL Software — C:Program FilesAlwil SoftwareAvast4ashServ.exe
O23 — Service: avast! Mail Scanner — ALWIL Software — C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
O23 — Service: avast! Web Scanner — ALWIL Software — C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
O23 — Service: Bonjour Service — Apple Inc. — C:Program FilesBonjourmDNSResponder.exe
O23 — Service: dlbc_device — — C:Windowssystem32dlbccoms.exe
O23 — Service: Firebird Guardian — DefaultInstance (FirebirdGuardianDefaultInstance) — FirebirdSQL Project — C:Program FilesFirebirdFirebird_2_0binfbguard.exe
O23 — Service: Firebird Server — DefaultInstance (FirebirdServerDefaultInstance) — FirebirdSQL Project — C:Program FilesFirebirdFirebird_2_0binfbserver.exe
O23 — Service: FreezeScreenSaver — Unknown owner — C:Windowssystem32FreezeScreenSaver.exe
O23 — Service: Google Software Updater (gusvc) — Google — C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
O23 — Service: iPod Service — Apple Inc. — C:Program FilesiPodbiniPodService.exe
O23 — Service: SBSD Security Center Service (SBSDWSCService) — Safer Networking Ltd. — C:Program FilesSpybot — Search & DestroySDWinSec.exe
O23 — Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) — SupportSoft, Inc. — C:Program FilesDell Support Centerbinsprtsvc.exe
O23 — Service: stllssvr — MicroVision Development, Inc. — C:Program FilesCommon FilesSureThing Sharedstllssvr.exe
O23 — Service: TeamViewer 4 (TeamViewer4) — TeamViewer GmbH — C:Program FilesTeamViewerVersion4TeamViewer_Service.exe
O23 — Service: Dell Wireless WLAN Tray Service (wltrysvc) — Unknown owner — C:WindowsSystem32WLTRYSVC.EXE—
End of file — 11458 bytes======Scheduled tasks folder======
C:WindowstasksGoogle Software Updater.job
======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll [2006-10-22 62080][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) — C:Program FilesSkypeToolbarsInternet ExplorerSkypeIEPlugin.dll [2008-08-12 1437696][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer — C:Program FilesRealRealPlayerrpbrowserrecordplugin.dll [2009-02-22 312928][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class — C:Program FilesJavajre1.6.0_05binssv.dll [2008-02-22 509328][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{7E853D72-626A-48EC-A868-BA8D5E23E045}]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{8984B388-A5BB-4DF7-B274-77B879E179DB}]
MailRuBHO Class — C:Program FilesMail.RuSputnikMRSptnk2_0_1_54.dll [2009-02-04 676704][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO — C:Program FilesGoogleGoogleToolbarNotifier5.1.1309.3572swg.dll [2009-03-24 668656][HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{09900DE8-1DCA-443F-9243-26FF581438AF} — Ñïóòíèê@Mail.Ru — C:Program FilesMail.RuSputnikMRSptnk2_0_1_54.dll [2009-02-04 676704]
{855F3B16-6D32-4fe6-8A56-BBB695989046} — ICQToolBar — C:Program FilesICQ6ToolbarICQToolBar.dll [2008-06-12 958712][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«Windows Defender»=C:Program FilesWindows DefenderMSASCui.exe [2008-01-20 1008184]
«ECenter»=C:DellE-CenterEULALauncher.exe [2008-02-28 17920]
«Apoint»=C:Program FilesDellTPadApoint.exe [2008-02-21 159744]
«RtHDVCpl»=C:WindowsRtHDVCpl.exe [2008-02-21 4907008]
«OEM13Mon.exe»=C:WindowsOEM13Mon.exe [2008-07-16 36864]
«DELL Webcam Manager»=C:Program FilesDellDell Webcam ManagerDellWMgr.exe [2007-07-27 118784]
«Broadcom Wireless Manager UI»=C:Windowssystem32WLTRAY.exe [2008-05-16 3444736]
«dscactivate»=C:Program FilesDell Support Centergs_agentcustomdsca.exe [2008-03-11 16384]
«DellSupportCenter»=C:Program FilesDell Support Centerbinsprtcmd.exe [2009-05-21 206064]
«IgfxTray»=C:Windowssystem32igfxtray.exe [2008-02-11 141848]
«HotKeysCmds»=C:Windowssystem32hkcmd.exe [2008-02-11 166424]
«Persistence»=C:Windowssystem32igfxpers.exe [2008-02-11 133656]
«SynTPEnh»=C:Program FilesSynapticsSynTPSynTPEnh.exe [2008-06-20 1316136]
«avast!»=C:PROGRA~1ALWILS~1Avast4ashDisp.exe [2009-11-24 81000]
«WinampAgent»=C:Program FilesWinampwinampa.exe [2008-08-03 36352]
«Adobe Reader Speed Launcher»=C:Program FilesAdobeReader 8.0ReaderReader_sl.exe [2008-10-15 39792]
«Ad Muncher»=C:Program FilesAd MuncherAdMunch.exe [2008-11-24 7168]
«MAgent»=C:Program FilesMail.RuAgentmagent.exe [2009-02-04 5600952]
«TkBellExe»=C:Program FilesCommon FilesRealUpdate_OBrealsched.exe [2009-02-22 198160]
«trioService»=C:PROGRA~1Freeze.comLiving 3D DolphinstrioService.exe []
«Amazing3DAquariumWallpaper»= []
«QuickTime Task»=C:Program FilesQuickTimeQTTask.exe [2009-11-10 417792]
«iTunesHelper»=C:Program FilesiTunesiTunesHelper.exe [2009-11-12 141600][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«DellSupportCenter»=C:Program FilesDell Support Centerbinsprtcmd.exe [2009-05-21 206064]
«ISUSPM»=C:Program FilesCommon FilesInstallShieldUpdateServiceISUSPM.exe [2006-09-11 218032]
«Ad Muncher»=C:Program FilesAd MuncherAdMunch.exe [2008-11-24 7168]
«EleFunAnimatedWallpaper»= []C:ProgramDataMicrosoftWindowsStart MenuProgramsStartup
QuickSet.lnk — C:Program FilesDellQuickSetquickset.exeC:UsersGulshatAppDataRoamingMicrosoftWindowsStart MenuProgramsStartup
2WireSetup.lnk — C:Program Files2WireLaunchSetupWiz.exe[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyigfxcui]
C:Windowssystem32igfxdev.dll [2008-02-11 204800][HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalWdf01000.sys]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkWdf01000.sys]
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1
«EnableUIADesktopToggle»=0[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{30aa1b4a-f11f-11de-a9b1-002170b6ca71}]
shellAutoRuncommand — F:LaunchU3.exe -a======File associations======
.js — edit — C:WindowsSystem32Notepad.exe %1
.js — open — C:WindowsSystem32WScript.exe «%1» %*======List of files/folders created in the last 1 months======
2010-02-23 10:16:27 —-D—- C:Program Filestrend micro
2010-02-23 10:16:25 —-D—- C:rsit
2010-01-28 19:32:54 —-D—- C:Program FilesiMacsoft
2010-01-28 17:31:48 —-A—- C:Windowssystem32GEARAspi.dll
2010-01-28 17:31:05 —-D—- C:Program FilesiPod
2010-01-28 17:31:03 —-D—- C:ProgramData{755AC846-7372-4AC8-8550-C52491DAA8BD}
2010-01-28 17:31:03 —-D—- C:Program FilesiTunes
2010-01-28 17:24:01 —-D—- C:Program FilesBonjour
2010-01-28 17:23:00 —-D—- C:Program FilesQuickTime======List of files/folders modified in the last 1 months======
2010-02-23 10:16:45 —-D—- C:WindowsPrefetch
2010-02-23 10:16:40 —-D—- C:WindowsTemp
2010-02-23 10:16:27 —-D—- C:Program Files
2010-02-23 10:02:20 —-D—- C:Windowstracing
2010-02-22 23:13:00 —-SHD—- C:System Volume Information
2010-02-22 23:05:21 —-D—- C:WindowsTasks
2010-02-22 23:05:14 —-D—- C:ProgramDataGoogle Updater
2010-02-21 19:17:14 —-D—- C:Windowssystem32config
2010-02-21 19:17:05 —-D—- C:Windowssystem32Tasks
2010-02-21 19:17:05 —-D—- C:Windowssystem32spool
2010-02-21 19:17:05 —-D—- C:Windowssystem32Msdtc
2010-02-21 19:17:05 —-D—- C:WindowsSystem32
2010-02-21 19:17:04 —-D—- C:Windowssystem32catroot2
2010-02-21 19:17:04 —-D—- C:Windowsinf
2010-02-21 19:17:04 —-D—- C:Windows
2010-02-21 19:17:04 —-D—- C:UsersGulshatAppDataRoamingWinamp
2010-02-21 19:17:04 —-D—- C:UsersGulshatAppDataRoaminguTorrent
2010-02-21 19:17:04 —-D—- C:Program FilesMozilla Firefox
2010-02-21 19:17:03 —-D—- C:Windowssystem32wbem
2010-02-21 19:17:03 —-D—- C:Windowsregistration
2010-02-20 11:47:19 —-D—- C:Windowssystem32drivers
2010-02-20 11:20:17 —-D—- C:UsersGulshatAppDataRoamingSkype
2010-02-20 11:19:10 —-D—- C:UsersGulshatAppDataRoamingskypePM
2010-02-14 16:51:44 —-D—- C:Program FilesFullMovies
2010-02-12 19:45:16 —-D—- C:UsersGulshatAppDataRoamingU3
2010-02-07 23:12:51 —-SD—- C:WindowsDownloaded Program Files
2010-02-07 17:51:22 —-A—- C:Windowssystem32PerfStringBackup.INI
2010-01-28 19:20:15 —-D—- C:UsersGulshatAppDataRoamingApple Computer
2010-01-28 17:47:13 —-SHD—- C:WindowsInstaller
2010-01-28 17:31:49 —-D—- C:Windowssystem32catroot
2010-01-28 17:31:48 —-DC—- C:Windowssystem32DRVSTORE
2010-01-28 17:31:04 —-D—- C:Program FilesCommon FilesApple
2010-01-28 17:31:03 —-HD—- C:ProgramData
2010-01-28 17:19:37 —-D—- C:ProgramDataApple======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 aswRdr;aswRdr; C:Windowssystem32driversaswRdr.sys [2009-11-24 23120]
R1 aswSP;avast! Self Protection; C:Windowssystem32driversaswSP.sys [2009-11-24 114768]
R1 aswTdi;avast! Network Shield Support; C:Windowssystem32driversaswTdi.sys [2009-11-24 48560]
R2 aswFsBlk;aswFsBlk; C:Windowssystem32DRIVERSaswFsBlk.sys [2009-11-24 20560]
R2 aswMonFlt;aswMonFlt; C:Windowssystem32DRIVERSaswMonFlt.sys [2009-11-24 53328]
R3 BCM43XX;Dell Wireless WLAN Card Driver; C:Windowssystem32DRIVERSbcmwl6.sys [2008-05-16 1044984]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:Windowssystem32DRIVERSCmBatt.sys [2008-01-20 14208]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:Windowssystem32DRIVERSGEARAspiWDM.sys [2009-05-18 26600]
R3 igfx;igfx; C:Windowssystem32DRIVERSigdkmd32.sys [2008-02-11 2302976]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:Windowssystem32driversRTKVHDA.sys [2008-02-21 2054872]
R3 O2MDRDR;O2MDRDR; C:Windowssystem32DRIVERSo2media.sys [2008-02-21 48472]
R3 O2SDRDR;O2SDRDR; C:Windowssystem32DRIVERSo2sd.sys [2008-02-21 43480]
R3 OEM13Vfx;Creative Camera OEM013 Video VFX Driver; C:Windowssystem32DRIVERSOEM13Vfx.sys [2008-07-16 7424]
R3 OEM13Vid;Creative Camera OEM013 Driver; C:Windowssystem32DRIVERSOEM13Vid.sys [2008-07-16 235840]
R3 RTL8169;Realtek 8169 NT Driver; C:Windowssystem32DRIVERSRtlh86.sys [2008-12-23 138240]
R3 SynTP;Synaptics TouchPad Driver; C:Windowssystem32DRIVERSSynTP.sys [2008-06-20 200112]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:Windowssystem32DRIVERSwmiacpi.sys [2008-01-20 11264]
S3 ApfiltrService;Alps Touch Pad Filter Driver for Windows 2000/XP/Vista; C:Windowssystem32DRIVERSApfiltr.sys [2008-02-21 155136]
S3 BCM42RLY;BCM42RLY; C:Windowssystem32driversBCM42RLY.sys []
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:Windowssystem32driversdrmkaud.sys [2008-01-20 5632]
S3 e1express;Intel(R) PRO/1000 PCI Express Network Connection Driver; C:Windowssystem32DRIVERSe1e6032.sys [2008-01-20 220672]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:Windowssystem32driversMSKSSRV.sys [2008-01-20 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:Windowssystem32driversMSPCLOCK.sys [2008-01-20 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:Windowssystem32driversMSPQM.sys [2008-01-20 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:Windowssystem32driversMSTEE.sys [2008-01-20 6016]
S3 R300;R300; C:Windowssystem32DRIVERSatikmdag.sys [2006-11-01 2028032]
S3 USBAAPL;Apple Mobile USB Driver; C:WindowsSystem32Driversusbaapl.sys [2009-08-28 40448]
S3 usbaudio;USB Audio Driver (WDM); C:Windowssystem32driversusbaudio.sys [2008-01-20 73088]
S3 WpdUsb;WpdUsb; C:Windowssystem32DRIVERSwpdusb.sys [2008-01-20 39936]
S3 WUDFRd;WUDFRd; C:Windowssystem32DRIVERSWUDFRd.sys [2008-01-20 83328]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:Windowssystem32driverserrdev.sys [2008-01-20 6656]
S4 MegaSR;MegaSR; C:Windowssystem32driversmegasr.sys [2008-01-20 386616]======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 AERTFilters;Andrea RT Filters Service; C:Windowssystem32AERTSrv.exe [2008-02-21 77824]
R2 Apple Mobile Device;Apple Mobile Device; C:Program FilesCommon FilesAppleMobile Device SupportbinAppleMobileDeviceService.exe [2009-08-28 144672]
R2 aswUpdSv;avast! iAVS4 Control Service; C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe [2009-11-24 18752]
R2 avast! Antivirus;avast! Antivirus; C:Program FilesAlwil SoftwareAvast4ashServ.exe [2009-11-24 138680]
R2 Bonjour Service;Bonjour Service; C:Program FilesBonjourmDNSResponder.exe [2008-12-12 238888]
R2 dlbc_device;dlbc_device; C:Windowssystem32dlbccoms.exe [2007-03-01 538096]
R2 FirebirdGuardianDefaultInstance;Firebird Guardian — DefaultInstance; C:Program FilesFirebirdFirebird_2_0binfbguard.exe [2007-09-03 81920]
R2 FreezeScreenSaver;FreezeScreenSaver; C:Windowssystem32FreezeScreenSaver.exe [2005-09-29 69632]
R2 SBSDWSCService;SBSD Security Center Service; C:Program FilesSpybot — Search & DestroySDWinSec.exe [2008-07-07 809296]
R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter); C:Program FilesDell Support Centerbinsprtsvc.exe [2008-08-13 201968]
R2 TeamViewer4;TeamViewer 4; C:Program FilesTeamViewerVersion4TeamViewer_Service.exe [2009-01-27 185640]
R2 wltrysvc;Dell Wireless WLAN Tray Service; C:WindowsSystem32WLTRYSVC.EXE [2008-05-16 24064]
R3 avast! Mail Scanner;avast! Mail Scanner; C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe [2009-11-24 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:Program FilesAlwil SoftwareAvast4ashWebSv.exe [2009-11-24 352920]
R3 FirebirdServerDefaultInstance;Firebird Server — DefaultInstance; C:Program FilesFirebirdFirebird_2_0binfbserver.exe [2007-09-03 2002944]
R3 iPod Service;iPod Service; C:Program FilesiPodbiniPodService.exe [2009-11-12 545568]
S2 gusvc;Google Software Updater; C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe [2009-03-24 183280]
S3 odserv;Microsoft Office Diagnostics Service; C:Program FilesCommon FilesMicrosoft SharedOFFICE12ODSERV.EXE [2007-08-23 443776]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2006-10-26 145184]
S3 stllssvr;stllssvr; C:Program FilesCommon FilesSureThing Sharedstllssvr.exe [2007-07-11 69632]
S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:Program FilesWindows LiveMessengerusnsvc.exe [2007-10-18 98328]
S3 WLSetupSvc;Windows Live Setup Service; C:Program FilesWindows LiveinstallerWLSetupSvc.exe [2007-10-25 266240]
EOF
info.txt logfile of random’s system information tool 1.06 2010-02-23 10:17:40
======Uninstall list======
????????? WinRAR—>C:Program FilesWinRARuninstall.exe
—>C:Program FilesCommon FilesRealUpdate_OBr1puninst.exe RealNetworks|RealPlayer|6.0
—>C:Program FilesDivXDivXConverterUninstall.exe /CONVERTER
—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime91Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{88564CEF-20A5-4EF2-A05F-309F2EBA9B06}setup.exe» -l0x9
—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime91Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{A1A5BA3E-9ABF-4037-820B-6151022B8ACB}setup.exe» -l0x9
—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime91Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{A82F10CB-18B5-4EAC-AEF2-FA49CD565626}setup.exe» -l0x9
—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime91Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{D5BA7C09-E523-478C-9C37-A1D86C76383E}setup.exe» -l0x9
—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime91Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{F6366726-BA44-4D6A-8ECE-476E2E616AD1}setup.exe» -l0x9
«Îáëàêà íàä Îêåàíîì»—>»C:Program FilesEleFun DesktopsÀíèìèðîâàííûå ÎáîèÎáëàêà íàä Îêåàíîìunins000.exe»
1tv news Screen Saver—>C:Windows1tv news.scr /u
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-0044-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-0117-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
3D Spring Blossoms Screen Saver—>»C:PROGRA~1Freeze.com3D Spring BlossomsUNINSTAL.EXE»
7-Zip 4.57—>»C:Program Files7-ZipUninstall.exe»
Ad Muncher—>C:Windowssystem32AM-Install.exe /die
Adobe Flash Player 10 ActiveX—>C:Windowssystem32MacromedFlashuninstall_activeX.exe
Adobe Flash Player Plugin—>C:Windowssystem32MacromedFlashuninstall_plugin.exe
Adobe Reader 8.1.3—>MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81300000003}
Advanced Audio FX Engine—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime91Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{88564CEF-20A5-4EF2-A05F-309F2EBA9B06}setup.exe» -l0x9 /remove
Advanced Video FX Engine—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime91Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{D5BA7C09-E523-478C-9C37-A1D86C76383E}setup.exe» -l0x9 /remove
Âîçâðàùåíèå Àòëàíòèäû—>C:Program FilesGames.Mail.RuÂîçâðàùåíèå ÀòëàíòèäûUninstall.exe
Amazing Universe Screen Saver—>»C:PROGRA~1Freeze.comAmazing UniverseUNINSTAL.EXE»
Apple Application Support—>MsiExec.exe /I{3FA365DF-2D68-45ED-8F83-8C8A33E65143}
Apple Mobile Device Support—>MsiExec.exe /I{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}
Apple Software Update—>MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
AT&T Yahoo! High Speed Internet Home Networking Installer—>C:Program Files2WireUninstaller.exe
avast! Antivirus—>C:Program FilesAlwil SoftwareAvast4aswRunDll.exe «C:Program FilesAlwil SoftwareAvast4Setupsetiface.dll»,RunSetup
Bonjour—>MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
Business Tools Launcher—>MsiExec.exe /I{75685CA8-0B74-45BB-9C64-744A0FB79EDC}
Calm Before the Storm Screen Saver—>»C:PROGRA~1Freeze.comCalm Before the StormUNINSTAL.EXE»
Cisco EAP-FAST Module—>MsiExec.exe /I{BF53252E-4AB2-4C7F-A0FD-6100755745E3}
Cisco LEAP Module—>MsiExec.exe /I{76F9CF97-FC4B-4E20-B363-D127C888448F}
Cisco PEAP Module—>MsiExec.exe /I{4E5386F5-C0F6-4532-A54A-374865AEAB71}
Coupon Printer for Windows—>»C:Program FilesCouponsuninstall.exe» «/U:C:Program FilesCouponsUninstalluninstall.xml»
Dell Getting Started Guide—>MsiExec.exe /I{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}
Dell Support Center (Support Software)—>MsiExec.exe /X{E3BFEE55-39E2-4BE0-B966-89FE583822C1}
Dell Touchpad—>C:Program FilesDellTPadUninstap.exe ADDREMOVE
Dell Webcam Center—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime91Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{A1A5BA3E-9ABF-4037-820B-6151022B8ACB}setup.exe» -l0x9 /remove
Dell Webcam Manager—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime91Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{F6366726-BA44-4D6A-8ECE-476E2E616AD1}setup.exe» -l0x9 /remove
Dell Wireless WLAN Card—>»C:Program FilesDellDell Wireless WLAN Cardbcmwlu00.exe» verbose /rootkey=»SoftwareBroadcom802.11UninstallInfo» /rootdir=»C:Program FilesDellDell Wireless WLAN Card»
DivX Codec—>C:Program FilesDivXDivXCodecUninstall.exe /CODEC
DivX Converter—>C:Program FilesDivXDivXConverterUninstall.exe /CONVERTER
DivX Player—>C:Program FilesDivXDivXPlayerUninstall.exe /PLAYER
DivX Plus DirectShow Filters—>C:Program FilesDivXDivXDSFiltersUninstall.exe /DSFILTERS
DivX Plus Web Player—>C:Program FilesDivXDivXWebPlayerUninstall.exe /PLUGIN
EDocs—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{6B7B6D4D-8F9B-4CB3-8CA4-BCA9CC4C1A22}setup.exe»
Firebird 2.0.3—>»C:Program FilesFirebirdFirebird_2_0unins000.exe»
Fishdom H2O — Hidden Odyssey(TM)—>»C:Program FilesRealArcadeInstallerbingameinstaller.exe» «C:Program FilesRealArcadeInstallerinstallerMain.clf» «C:Program FilesRealArcadeInstalleruninstallam-fishdomh2ohiddenodysseytm.rguninst» «AddRemove»
FLV Player—>»C:WindowsFLV Playeruninstall.exe» «/U:C:Program FilesFLV PlayerUninstalluninstall.xml»
FullMovies—>»C:Program FilesFullMoviesUninstall.exe»
GameHouse—>»C:Program FilesRealArcadeInstallerbingameinstaller.exe» «C:Program FilesRealArcadeInstallerinstallerMain.clf» «C:Program FilesRealArcadeInstalleruninstallGameHouse.rguninst» «AddRemove»
GOM Player—>»C:Program FilesGRETECHGomPlayerUninstall.exe»
Google Updater—>»C:Program FilesGoogleGoogle UpdaterGoogleUpdater.exe» -uninstall
HijackThis 2.0.2—>»C:Program Filestrend microHijackThis.exe» /uninstall
ICQ Toolbar—>C:Program FilesICQ6ToolbarICQUnToolbar.exe
iMacsoft iPod to PC Transfer—>C:Program FilesiMacsoftiPod to PC TransferUninstall.exe
Intel(R) Graphics Media Accelerator Driver—>C:Windowssystem32igxpun.exe -uninstall
iTunes—>MsiExec.exe /I{A6FDF86A-F541-4E7B-AEA0-8849A2A700D5}
Java(TM) 6 Update 5—>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
K-Lite Codec Pack 4.2.5 (Standard)—>»C:Program FilesK-Lite Codec Packunins000.exe»
Laptop Integrated Webcam Driver (1.01.01.0529) —>C:WindowsCtDrvIns.exe -uninstall -script OEM013.uns -plugin OEM13Pin.dll -pluginres OEM13Pin.crl -nodisconprompt -langid 0x0409
Live! Cam Avatar Creator—>C:Program FilesInstallShield Installation Information{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}setup.exe -runfromtemp -l0x0009 -removeonly /remove
Live! Cam Avatar v1.0—>C:Program FilesInstallShield Installation Information{1D5E29AD-39A9-4D0A-A8B6-46A6FCD8C995}setup.exe -runfromtemp -l0x0009 -removeonly /remove
Living Marine Aquarium 2 Screen Saver—>»C:PROGRA~1Freeze.comLiving Marine Aquarium 2UNINSTAL.EXE»
Mail.Ru ????? 5.3 (?????? 2564, ??? ???? ?????????????)—>C:Program FilesMail.RuAgentmagentsetup.exe -uninstalllm
Mail.Ru ??????? 2.0.1.54—>C:Program FilesMail.RuSputnikSputnikInstaller.exe -uninstall
Malwarebytes’ Anti-Malware—>»C:Program FilesMalwarebytes’ Anti-Malwareunins000.exe»
Microsoft Office Access MUI (English) 2007—>MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2007—>MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2007—>MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (English) 2007—>MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2007—>MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007—>MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007—>»C:Program FilesCommon FilesMicrosoft SharedOFFICE12Office Setup Controllersetup.exe» /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007—>MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007—>MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007—>MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007—>MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007—>MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Publisher MUI (English) 2007—>MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007—>MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007—>MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007—>MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Silverlight—>MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Visual C++ 2005 ATL Update kb973923 — x86 8.0.50727.4053—>MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable—>MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Monopoly Here and Now—>C:Program FilesMonopoly Here and Nowuninstall.exe
Mozilla Firefox (3.5.7)—>C:Program FilesMozilla Firefoxuninstallhelper.exe
Personal Entertainment Launcher—>MsiExec.exe /I{37F964E4-9C3F-4066-B933-1747D3AC6737}
Product Support Launcher—>MsiExec.exe /I{B8ABB25D-1E30-4ED7-A3CE-0F8BED439647}
QuickSet—>MsiExec.exe /I{4B6AD248-D3BF-426A-8D64-847288154F13}
QuickTime—>MsiExec.exe /I{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}
RealPlayer—>C:Program FilesCommon FilesRealUpdate_OBr1puninst.exe RealNetworks|RealPlayer|6.0
Realtek High Definition Audio Driver—>RtlUpd.exe -r -m
Roxio Activation Module—>MsiExec.exe /I{07159635-9DFE-4105-BFC0-2817DB540C68}
Roxio Creator BDAV Plugin—>MsiExec.exe /I{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}
Roxio Creator Copy—>MsiExec.exe /I{619CDD8A-14B6-43A1-AB6C-0F4EE48CE048}
Roxio Creator Data—>MsiExec.exe /I{0D397393-9B50-4C52-84D5-77E344289F87}
Roxio Express Labeler 3—>MsiExec.exe /I{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
Russian Dhuha — Yasin R. I.—>Rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstallFast 132 C:YasinRDhuhaRDhuha.Inf
Russian Phonetic Student — RusWin.net — Custom—>MsiExec.exe /I{AAEA8C1E-6335-467A-9115-A111F368C695}
Saunders NCLEX-RN4e—>C:Program FilesSaunders NCLEX-RN4euninst.exe
Security Update for 2007 Microsoft Office System (KB951550)—>msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
Security Update for 2007 Microsoft Office System (KB951944)—>msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
Security Update for 2007 Microsoft Office System (KB969559)—>msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
Security Update for 2007 Microsoft Office System (KB969679)—>msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {C66E4A6C-6E07-4C63-8CCD-2493B5087C73}
Security Update for Microsoft Office Excel 2007 (KB969682)—>msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {C03803BD-745A-46F8-8557-817DED578780}
Security Update for Microsoft Office PowerPoint 2007 (KB957789)—>msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
Security Update for Microsoft Office Publisher 2007 (KB969693)—>msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {7BE67088-1EB3-4569-8E75-DDAFBF61BC4E}
Security Update for Microsoft Office system 2007 (KB954326)—>msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
Security Update for Microsoft Office system 2007 (KB969613)—>msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
Security Update for Microsoft Office Word 2007 (KB969604)—>msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {CF3D6499-709C-43D0-8908-BC5652656050}
Skype™ 3.8—>MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
Sonic CinePlayer Decoder Pack—>MsiExec.exe /I{8D337F77-BE7F-41A2-A7CB-D5A63FD7049B}
Spybot — Search & Destroy—>»C:Program FilesSpybot — Search & Destroyunins000.exe»
Synaptics Pointing Device Driver—>rundll32.exe «C:Program FilesSynapticsSynTPSynISDLL.dll»,standAloneUninstall
TeamViewer 4—>C:Program FilesTeamViewerVersion4uninstall.exe
TOEFL Sample Questions—>C:Windowsuninst.exe -f»C:Program FilesETSTOEFL Sample QuestionsDeIsL1.isu» -c»C:Program FilesETSTOEFL Sample Questions_ISREG32.DLL»
Update for 2007 Microsoft Office System (KB967642)—>msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for Microsoft Office 2007 Help for Common Features (KB963673)—>msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {AB365889-0395-4FAD-B702-CA5985D53D42}
Update for Microsoft Office Access 2007 Help (KB963663)—>msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {6B76A18A-AA1E-42AB-A7AD-6C84BBB43987}
Update for Microsoft Office Excel 2007 Help (KB963678)—>msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {199DF7B6-169C-448C-B511-1054101BE9C9}
Update for Microsoft Office Infopath 2007 Help (KB963662)—>msiexec /package {90120000-0044-0409-0000-0000000FF1CE} /uninstall {716B81B8-B13C-41DF-8EAC-7A2F656CAB63}
Update for Microsoft Office Outlook 2007 (KB969907)—>msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {74F98B24-AFBD-4800-9BD6-87D349B5C462}
Update for Microsoft Office Outlook 2007 Help (KB963677)—>msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {0451F231-E3E3-4943-AB9F-58EB96171784}
Update for Microsoft Office Powerpoint 2007 Help (KB963669)—>msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {397B1D4F-ED7B-4ACA-A637-43B670843876}
Update for Microsoft Office Publisher 2007 Help (KB963667)—>msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {2E40DE55-B289-4C8B-8901-5D369B16814F}
Update for Microsoft Office Script Editor Help (KB963671)—>msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {CD11C6A2-FFC6-4271-8EAB-79C3582F505C}
Update for Microsoft Office Word 2007 Help (KB963665)—>msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {80E762AA-C921-4839-9D7D-DB62A72C0726}
Update for Outlook 2007 Junk Email Filter (kb973514)—>msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {03B11C77-336F-43B4-9B43-79890BA84504}
VC80CRTRedist — 8.0.50727.4053—>MsiExec.exe /I{5EE7D259-D137-4438-9A5F-42F432EC0421}
WebTV—>C:Program FilesInstallShield Installation Information{B9135AC5-0FA4-4565-9768-61BF6C79CD29}setup.exe -runfromtemp -l0x0009 -removeonly
Winamp—>»C:Program FilesWinampUninstWA.exe»
Windows Live installer—>MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}
Windows Live Messenger—>MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0}======Hosts File======
127.0.0.1 http://www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 http://www.008k.com
127.0.0.1 008k.com
127.0.0.1 http://www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 http://www.032439.com
127.0.0.1 032439.com======Security center information======
AV: avast! antivirus 4.8.1229 [VPS 090624-0]
AS: Spybot — Search and Destroy (disabled) (outdated)
AS: Windows Defender
AS: avast! antivirus 4.8.1229 [VPS 090624-0]======System event log======
Computer Name: Vostro1510
Event Code: 134
Message: NtpClient was unable to set a manual peer to use as a time source because of DNS resolution error on ‘time.windows.com,0x9’. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: No such host is known. (0x80072AF9)
Record Number: 227594
Source Name: Microsoft-Windows-Time-Service
Time Written: 20100223180011.000000-000
Event Type: Warning
User:Computer Name: Vostro1510
Event Code: 134
Message: NtpClient was unable to set a manual peer to use as a time source because of DNS resolution error on ‘time.windows.com,0x9’. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: No such host is known. (0x80072AF9)
Record Number: 227596
Source Name: Microsoft-Windows-Time-Service
Time Written: 20100223180015.000000-000
Event Type: Warning
User:Computer Name: Vostro1510
Event Code: 1003
Message: Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 001FE29648C1. The following error occurred:
The semaphore timeout period has expired.. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
Record Number: 227608
Source Name: Microsoft-Windows-Dhcp-Client
Time Written: 20100223180538.000000-000
Event Type: Warning
User:Computer Name: Vostro1510
Event Code: 1003
Message:
Record Number: 227611
Source Name: Microsoft-Windows-Dhcp-Client
Time Written: 20100223180610.000000-000
Event Type: Warning
User:Computer Name: Vostro1510
Event Code: 1002
Message: The IP address lease 75.16.63.178 for the Network Card with network address 001FE29648C1 has been denied by the DHCP server 192.168.1.254 (The DHCP Server sent a DHCPNACK message).
Record Number: 227612
Source Name: Microsoft-Windows-Dhcp-Client
Time Written: 20100223180610.000000-000
Event Type: Error
User:=====Application event log=====
Computer Name: Vostro1510
Event Code: 4354
Message: The COM+ Event System failed to fire the StartShell method on subscription {AA44355E-6911-4447-BA5D-6720480579AF}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}. The subscriber returned HRESULT 80070005.
Record Number: 30036
Source Name: Microsoft-Windows-EventSystem
Time Written: 20100221211808.000000-000
Event Type: Warning
User:Computer Name: Vostro1510
Event Code: 6000
Message: The winlogon notification subscriber was unavailable to handle a notification event.
Record Number: 30042
Source Name: Microsoft-Windows-Winlogon
Time Written: 20100221211949.000000-000
Event Type: Warning
User:Computer Name: Vostro1510
Event Code: 10
Message: Event filter with query «SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA «Win32_Processor» AND TargetInstance.LoadPercentage > 99″ could not be reactivated in namespace «//./root/CIMV2» because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Record Number: 30046
Source Name: Microsoft-Windows-WMI
Time Written: 20100221212109.000000-000
Event Type: Error
User:Computer Name: Vostro1510
Event Code: 10
Message: Event filter with query «SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA «Win32_Processor» AND TargetInstance.LoadPercentage > 99″ could not be reactivated in namespace «//./root/CIMV2» because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Record Number: 30061
Source Name: Microsoft-Windows-WMI
Time Written: 20100222032205.000000-000
Event Type: Error
User:Computer Name: Vostro1510
Event Code: 507
Message: wuaueng.dll (1132) SUS20ClientDataStore: A request to read from the file «C:WindowsSoftwareDistributionDataStoreDataStore.edb» at offset 303104 (0x000000000004a000) for 4096 (0x00001000) bytes succeeded, but took an abnormally long time (65 seconds) to be serviced by the OS. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.
Record Number: 30076
Source Name: ESENT
Time Written: 20100223075530.000000-000
Event Type: Warning
User:=====Security event log=====
Computer Name: Vostro1510
Event Code: 5038
Message: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.File Name: DeviceHarddiskVolume3WindowsSystem32driverstcpip.sys
Record Number: 55492
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100223181730.821388-000
Event Type: Audit Failure
User:Computer Name: Vostro1510
Event Code: 5038
Message: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.File Name: DeviceHarddiskVolume3WindowsSystem32driverstcpip.sys
Record Number: 55493
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100223181730.893395-000
Event Type: Audit Failure
User:Computer Name: Vostro1510
Event Code: 5038
Message: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.File Name: DeviceHarddiskVolume3WindowsSystem32driverstcpip.sys
Record Number: 55494
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100223181730.939400-000
Event Type: Audit Failure
User:Computer Name: Vostro1510
Event Code: 5038
Message: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.File Name: DeviceHarddiskVolume3WindowsSystem32driverstcpip.sys
Record Number: 55495
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100223181731.005407-000
Event Type: Audit Failure
User:Computer Name: Vostro1510
Event Code: 5038
Message: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.File Name: DeviceHarddiskVolume3WindowsSystem32driverstcpip.sys
Record Number: 55496
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100223181731.050411-000
Event Type: Audit Failure
User:======Environment variables======
«ComSpec»=%SystemRoot%system32cmd.exe
«FP_NO_HOST_CHECK»=NO
«OS»=Windows_NT
«Path»=%SystemRoot%system32;%SystemRoot%;%SystemRoot%System32Wbem;C:Program FilesCommon FilesRoxio SharedDLLShared;C:Program FilesCommon FilesRoxio Shared9.0DLLShared;C:Program FilesCommon FilesDivX Shared;C:Program FilesQuickTimeQTSystem
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
«PROCESSOR_ARCHITECTURE»=x86
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP
«USERNAME»=SYSTEM
«windir»=%SystemRoot%
«PROCESSOR_LEVEL»=6
«PROCESSOR_IDENTIFIER»=x86 Family 6 Model 15 Stepping 13, GenuineIntel
«PROCESSOR_REVISION»=0f0d
«NUMBER_OF_PROCESSORS»=2
«TRACE_FORMAT_SEARCH_PATH»=\NTREL202.ntdev.corp.microsoft.com4F18C3A5-CA09-4DBD-B6FC-219FDD4C6BE0TraceFormat
«DFSTRACINGON»=FALSE
«CLASSPATH»=.;C:Program FilesJavajre1.6.0_05libextQTJava.zip
«QTJAVA»=C:Program FilesJavajre1.6.0_05libextQTJava.zip
EOF
Скачайте программу TDSSKiller кликнув по этой ссылке и распакуйте на ваш рабочий стол.
Откройте каталог tdsskiller и кликните дважды по иконке TDSSKiller.
Следуйте указаниям.Скачайте программу GMER кликнув по этой ссылке.
Распакуйте программу на ваш рабочий стол.
Отключите Интернет и все антивирусы.
Запустите программу.
В правой части программы, в небольшом окошке будут перечислены все ваши диски, пожалуйста выделите их галочками.
Кликните по кнопке Scan.
Когда сканирование закончится, кликните по кнопке Copy.
Запустите Блокнот (Пуск -> Выполнить, введите notepad и нажмите Enter).
Вставьте результаты сканирования в блокнот (CTRL + V). Сохраните получившийся файл на ваш рабочий стол.
Жду от вас содержимое этого лога и свежий RSIT лог.
- Для ответа в этой теме необходимо авторизоваться.
