- This topic has 9 ответов, 2 участника, and was last updated 14 years, 10 months назад by
.
-
Сообщения
-
сканирование :
info.txt logfile of random’s system information tool 1.08 2010-08-14 19:04:34======Uninstall list======
—>»C:Program FilesCreative ProfessionalDigital Audio SystemProgramSETUP.EXE» /S /U /W
—>C:Program FilesNeroNero8\nerouninstallUNNERO.exe /UNINSTALL
—>C:WINDOWSsystem32\MSIEXEC.EXE /x {7B91CBFD-0671-4819-9724-CABE3014E886}
—>C:WINDOWSUNNeroBackItUp.exe /UNINSTALL
—>C:WINDOWSUNNeroMediaHome.exe /UNINSTALL
—>C:WINDOWSUNNeroShowTime.exe /UNINSTALL
—>C:WINDOWSUNNeroVision.exe /UNINSTALL
—>C:WINDOWSUNRecode.exe /UNINSTALL
—>msiexec /package {90120000-0012-0000-0000-0000000FF1CE} /uninstall {744C859F-C225-48A9-A524-4DED432F36C7}
—>MsiExec /X{A7E07C2B-2220-4415-87E3-784D5814BC93}
—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{4475840A-BEB5-4F64-808D-EA73D20ECA35}Setup.exe» -l0x9
—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime 9 1Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{5633D266-6BAE-41CE-987F-0FE5F5F92D64}setup.exe» -l0x9
—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime 9 1Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{5633D266-6BAE-41CE-987F-0FE5F5F92D64}setup.exe» -l0x9 /remove
—>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:WINDOWSINFPCHealth.inf
1.2—>»H:GamesNHL 2009unins000.exe»
ACDSee 10 Photo Manager—>MsiExec.exe /I{119E769A-C45B-47E1-A43C-14581D6058F9}
Adobe Flash Player 10 ActiveX—>C:WINDOWSsystem32MacromedFlashuninstall_activeX.exe
Adobe Flash Player 10 Plugin—>C:WINDOWSsystem32MacromedFlashFlashUtil10h_Plugin.exe -maintain plugin
Adobe Reader 9.3.3—>MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A93000000001}
Adobe Shockwave Player—>C:WINDOWSsystem32MacromedSHOCKW~1UNWISE.EXE C:WINDOWSsystem32MacromedSHOCKW~1Install.log
AdStoper 1.3—>»C:Program FilesAdStoperunins000.exe»
AmpliTube LE—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime 701Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{216EAAD9-D733-4141-BEAF-2C0B6F6B1D04}Setup.exe» -l0x9 uninstall
Antares Autotune DX v4.12—>C:PROGRA~1AntaresAUTOTU~1ANTARE~1UNWISE.EXE C:PROGRA~1AntaresAUTOTU~1ANTARE~1INSTALL.LOG
Antares Autotune VST RTAS TDM v5.08—>»C:Program FilesAntares Audio Technologiesunins000.exe»
Apple Application Support—>MsiExec.exe /I{A93944F2-D2D4-4750-BFE7-9A288FEAF2CF}
Apple Mobile Device Support—>MsiExec.exe /I{85991ED2-010C-4930-96FA-52F43C2CE98A}
Apple Software Update—>MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Ask Toolbar—>MsiExec.exe /I{86D4B82A-ABED-442A-BE86-96357B70F4FE}
AudioEase Speakersphone VST RTAS v1.03—>»C:Program FilesAudio EaseSpeakerphoneUninstallunins000.exe»
AVS DVDMenu Editor 1.2.1.19—>»C:Program FilesCommon FilesAVSMediaAVS DVDMenu Editorunins000.exe»
AVS Video Tools 5.6—>»C:Program FilesAVSMediaVideoToolsunins000.exe»
Bonjour—>MsiExec.exe /X{0CB9668D-F979-4F31-B8B8-67FE90F929F8}
CH_Alarm—>C:Program FilesCH Будильник 1.0.1uninstall.exe
Clip2Net 0.8.2b—>»C:Program FilesClip2Netunins000.exe»
Counter Strike 1.6 V34—>»C:Program FilesCounter-strikeuninstall.exe»
Cross Fire En—>»C:Program FilesG4boxCrossFireunins000.exe»
Data Doctor KeyLogger-Advanced Version 2.0.1.5—>C:Program FilesKeyLogUninstall1.exe
Digital Audio System—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime 9 1Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{6D420D94-7B4A-4213-B8D4-AEC3B45B5158}SETUP.EXE» -l0x9 /remove
DirectX 10 RP (RePack)—>»C:Program FilesCommon Filesunins000.exe»
DirectX 9 Runtime—>MsiExec.exe /I{AF9E97C1-7431-426D-A8D5-ABE40995C0B1}
Disciples 3: Ренессанс v. 1.04—>»H:GamesDisciples 3 RenaissanceUninstallunins000.exe»
discWelder BRONZE (E-MU)—>C:WINDOWSIsUninst.exe -f»C:Program FilesMinnetonka Audio SoftwarediscWelder BRONZE (E-MU)Uninst.isu»
EA Download Manager—>C:Program FilesElectronic ArtsEADMUninstall.exe
eMule—>»C:Program FileseMuleUninstall.exe»
FIFA MANAGER 10—>H:GamesFIFA MANAGER 10eauninstall.exe
foobar2000 v0.9.6.9—>»C:Program Filesfoobar2000uninstall.exe» _?=C:Program Filesfoobar2000
Fraps (Только удаление)—>C:Program FilesFrapsuninstall.exe
GEAR 32bit Driver Installer—>MsiExec.exe /X{E89B484C-B913-49A0-959B-89E836001658}
Google Earth Pro—>MsiExec.exe /X{9578C0CD-8108-4379-9026-4601F59859A0}
Google Update Helper—>MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Google Планета Земля—>MsiExec.exe /X{C2D129C0-7508-11DF-9F1B-005056806466}
High Definition Audio Driver Package — KB835221—>C:WINDOWS$NtUninstallKB835221WXP$spuninstspuninst.exe
High Definition Audio Driver Package — KB888111—>»C:WINDOWS$NtUninstallKB888111WXPSP2$spuninstspuninst.exe»
HijackThis 2.0.2—>»C:Program FilesTrend MicroHijackThisHijackThis.exe» /uninstall
Hotfix for Windows XP (KB926239)—>»C:WINDOWS$NtUninstallKB926239$spuninstspuninst.exe»
iTunes—>MsiExec.exe /I{91F7F3F3-CE80-48C3-8327-7D24A0A5716A}
iWheelWorks 7.80—>C:Program FilesA4TechMouseUninst32.exe
Java(TM) 6 Update 21—>MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216020FF}
L&H TTS3000 Deutsch—>RunDll32 advpack.dll,LaunchINFSection C:WINDOWSINFLHTTSGED.inf, Uninstall
L&H TTS3000 Espaсol—>RunDll32 advpack.dll,LaunchINFSection C:WINDOWSINFLHTTSSPE.inf, Uninstall
L&H TTS3000 Franзais—>RunDll32 advpack.dll,LaunchINFSection C:WINDOWSINFLHTTSFRF.inf, Uninstall
L&H TTS3000 Italiano—>RunDll32 advpack.dll,LaunchINFSection C:WINDOWSINFLHTTSITI.inf, Uninstall
L&H TTS3000 Russian—>RunDll32 advpack.dll,LaunchINFSection C:WINDOWSINFLHTTSRUR.inf, Uninstall
Lernout & Hauspie TruVoice American English TTS Engine—>RunDll32 advpack.dll,LaunchINFSection C:WINDOWSINFtv_enua.inf, Uninstall
LG PC Suite III—>C:Program FilesInstallShield Installation Information{C0E18DC4-C74A-4889-AE3A-933471023787}setup.exe -runfromtemp -l0x0019 -removeonly
LG USB Modem Drivers—>MsiExec.exe /I{FA02ACAC-9E14-4878-A257-92A22A647C2C}
Live 4.1.5—>C:PROGRA~1AbletonLIVE41~1.5InstallUNWISE.EXE C:PROGRA~1AbletonLIVE41~1.5InstallINSTALL.LOG
MacDrive 6—>MsiExec.exe /I {3829960D-73DA-479B-BBE1-BF0FBC35999B}
Matrox VfW DV CODEC—>RunDLL32.exe advpack.dll,LaunchINFSection SWCDVVfW.inf, UnInstall
MediaCoder 0.6.1—>C:Program FilesMediaCoderuninst.exe
Medieval CUE Splitter—>MsiExec.exe /I{B96D2269-568B-4CBF-9332-12FAE8B158F7}
Microsoft .NET Framework 1.1—>msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1—>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 1 Language Pack — RUS—>MsiExec.exe /I{34AB2437-1B34-3E2D-9DE8-3E2D35335B3F}
Microsoft .NET Framework 2.0 Service Pack 1—>MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft .NET Framework 3.0 Service Pack 1 Language Pack — RUS—>MsiExec.exe /I{CFF15B94-E062-3701-869A-4CDF4590461E}
Microsoft .NET Framework 3.0 Service Pack 1—>MsiExec.exe /I{2BA00471-0328-3743-93BD-FA813353A783}
Microsoft .NET Framework 3.5 Language Pack — rus—>MsiExec.exe /I{95E44F11-19F0-39EA-A894-792E054AA1CF}
Microsoft .NET Framework 3.5—>C:WINDOWSMicrosoft.NETFrameworkv3.5Microsoft .NET Framework 3.5setup.exe
Microsoft .NET Framework 3.5—>MsiExec.exe /I{2FC099BD-AC9B-33EB-809C-D332E1B27C40}
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7—>»C:WINDOWS$NtUninstallWdf01007$spuninstspuninst.exe»
Microsoft Kernel-Mode Driver Framework Feature Pack 1.9—>»C:WINDOWS$NtUninstallWdf01009$spuninstspuninst.exe»
Microsoft Office Excel MUI (Russian) 2007—>MsiExec.exe /X{90120000-0016-0419-0000-0000000FF1CE}
Microsoft Office Outlook MUI (Russian) 2007—>MsiExec.exe /X{90120000-001A-0419-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (Russian) 2007—>MsiExec.exe /X{90120000-0018-0419-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007—>MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007—>MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Russian) 2007—>MsiExec.exe /X{90120000-001F-0419-0000-0000000FF1CE}
Microsoft Office Proof (Ukrainian) 2007—>MsiExec.exe /X{90120000-001F-0422-0000-0000000FF1CE}
Microsoft Office Proofing (Russian) 2007—>MsiExec.exe /X{90120000-002C-0419-0000-0000000FF1CE}
Microsoft Office Shared MUI (Russian) 2007—>MsiExec.exe /X{90120000-006E-0419-0000-0000000FF1CE}
Microsoft Office Standard 2007—>MsiExec.exe /X{90120000-0012-0000-0000-0000000FF1CE}
Microsoft Office Word MUI (Russian) 2007—>MsiExec.exe /X{90120000-001B-0419-0000-0000000FF1CE}
Microsoft Office Стандартный 2007—>»C:Program FilesCommon FilesMicrosoft SharedOFFICE12Office Setup Controllersetup.exe» /uninstall STANDARD /dll OSETUP.DLL
Microsoft User-Mode Driver Framework Feature Pack 1.0—>»C:WINDOWS$NtUninstallWudf01000$spuninstspuninst.exe»
Microsoft Visual C++ 2005 Redistributable—>MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
Microsoft Visual C++ 2008 Redistributable — x86 9.0.30729.17—>MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Microsoft Visual Studio 2005 Tools for Office Runtime—>MsiExec.exe /X{388E4B09-3E71-4649-8921-F44A3A2954A7}
Mozilla Firefox (3.6.8)—>C:Program FilesMozilla Firefoxuninstallhelper.exe
MSVC80_x86_v2—>MsiExec.exe /I{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}
MSVC80_x86—>MsiExec.exe /I{212748BB-0DA5-46DE-82A1-403736DC9F27}
MSVC90_x86—>MsiExec.exe /I{AF111648-99A1-453E-81DD-80DBBF6DAD0D}
MSXML 6.0 Parser (KB933579)—>MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
Nero 8—>MsiExec.exe /X{5FCCD531-1B38-4A94-924C-127F722F1049}
neroxml—>MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
Nokia Connectivity Cable Driver—>MsiExec.exe /I{1B9B5B3B-28E7-4E59-A80D-D670AA984514}
Nokia Ovi Player—>MsiExec.exe /I{50D25574-2C48-4AEC-8FFC-32AEAD2EAEFF}
Nokia Ovi Suite Software Updater—>MsiExec.exe /X{4FFD1AB4-54F0-4069-88D9-3A55B38F874B}
Nokia Ovi Suite—>C:Documents and SettingsAll UsersApplication DataOviInstallerCache{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}NokiaOviSuite2Installer.exe
Nokia Ovi Suite—>MsiExec.exe /X{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}
Nokia PC Suite—>C:Documents and SettingsAll UsersApplication DataInstallations{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}Nokia_PC_Suite_7_1_40_1_rus_web.exe
Nokia PC Suite—>MsiExec.exe /I{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}
Nokia Software Updater—>MsiExec.exe /X{09C468CA-2940-466A-AAE8-DCC0C6E9323C}
Nokia_Multimedia_Common_Components_2_5—>MsiExec.exe /I{70B31335-50EE-4834-8431-27412CDE62BD}
NVIDIA Drivers—>C:WINDOWSsystem32nvuninst.exe UninstallGUI
NVIDIA PhysX v8.09.04—>MsiExec.exe /X{A7E07C2B-2220-4415-87E3-784D5814BC93}
Opera 10.60—>MsiExec.exe /X{1D2C96C3-A3F3-49E7-B839-95279DED837F}
Ovi Desktop Sync Engine—>MsiExec.exe /X{60DED9C2-22BF-47A3-B6C8-6B141BA31DFD}
OviMPlatform—>MsiExec.exe /I{4E1CD3D5-D4EE-4246-AE24-F0FD5A60390D}
PC Connectivity Solution—>MsiExec.exe /I{DCD22647-6D31-479D-8F97-16D0AA934D9E}
Pivim Multibar—>C:Program FilesPivim Multibaruninstall.exe
PROMT Expert 8.5 Giant Try-Buy—>MsiExec.exe /I{2DCA33FE-72DD-4045-B839-3FED353E5083}
ProSonice mixCiter v1.001—>C:audiomixCiterUNWISE.EXE C:audiomixCiterINSTALL.LOG
Proteus X LE—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{4475840A-BEB5-4F64-808D-EA73D20ECA35}Setup.exe» -l0x9 /remove
Punto Switcher 3.1—>C:Program FilesYandexPunto Switcheruninstall.exe
QuickTime—>MsiExec.exe /I{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}
RAR Recovery Toolbox 1.1—>»C:Program FilesRAR Recovery Toolboxunins000.exe»
REALTEK GbE & FE Ethernet PCI-E NIC Driver—>C:Program FilesInstallShield Installation Information{C9BED750-1211-4480-B1A5-718A3BE15525}setup.exe -runfromtemp -l0x0019 -removeonly
Realtek High Definition Audio Driver—>RtlUpd.exe -r -m -nrg2709
RocketDock 1.3.5—>»C:Program FilesRocketDockunins000.exe»
Roxio Activation Module—>MsiExec.exe /I{1D53B6F9-E66E-42D8-A221-4FF8AC134FD7}
Roxio BackOnTrack—>MsiExec.exe /I{5A06423A-210C-49FB-950E-CB0EB8C5CEC7}
Roxio CinePlayer Decoder Pack—>MsiExec.exe /I{C0FE37FA-0886-4B66-B01B-76CF70FB77AB}
Roxio CinePlayer—>MsiExec.exe /I{AA749D64-3741-4D5F-B804-B0BC05D179D1}
Roxio Creator 2009—>C:Documents and SettingsAll UsersApplication DataUninstall{7919D8D9-69FB-4E94-B330-04C4AF251867}setup.exe /x {7919D8D9-69FB-4E94-B330-04C4AF251867}
Roxio Creator 2009—>MsiExec.exe /I{3383136B-4F86-4F05-8612-DD4BB16A1EAE}
Roxio Creator 2009—>MsiExec.exe /I{7A7B3764-7F17-4AB1-A1D3-3B01F5F07445}
Roxio File Backup—>MsiExec.exe /I{60B2315F-680F-4EB3-B8DD-CCDC86A7CCAB}
Safari—>MsiExec.exe /I{EAFEF30E-3789-49C7-A6D9-77C12E005BAC}
Sid Meier’s Civilization 4—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime11 0Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}setup.exe» -l0x19 -removeonly
Skype™ 4.2—>MsiExec.exe /X{D103C4BA-F905-437A-8049-DB24763BBE36}
SmartSound Quicktracks Plugin—>C:PROGRA~1COMMON~1INSTAL~1Driver9INTEL3~1IDriver.exe /M{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}
Sonic Foundry XFX3 v1.0c—>C:WINDOWSUNWISE.EXE C:audioSONICF~1xfx3INSTALL.LOG
Sony Noise Reduction Plug-In 2.0e—>MsiExec.exe /X{D533C9D4-ED96-4191-B9C3-279C0DD6BABA}
Sony Sound Forge 8.0d—>MsiExec.exe /X{5636E517-8100-4E2A-B69E-2B16AFFA2360}
Sony Sound Forge 9.0—>MsiExec.exe /X{6842DCCB-2840-4E46-8AF3-BEA9CFF3455B}
Sony Vegas Pro 8.0—>MsiExec.exe /X{1246FF64-3035-4A92-8FE6-A968275495EB}
SopCast 3.2.4—>C:Program FilesSopCastuninst.exe
Starplugs-2-2-SiX 1.00 —>C:WINDOWSuninstallStarplugs-2-2-SiXsetup.exe
Startup Defender 1.9.5—>C:Program FilesZards softwareStartup Defenderuninst.exe
Steinberg Magneto VST v1.5—>C:PROGRA~1STEINB~1VSTPLU~1MagnetoUNWISE.EXE C:PROGRA~1STEINB~1VSTPLU~1MagnetoINSTALL.LOG
Steinberg Mastering Edition v1.0—>C:WINDOWSUNWISE.EXE C:audioSTEINB~1MASTER~1INSTALL.LOG
Steinberg Nuendo v3.2.0.1128—>C:PROGRA~1STEINB~1NUENDO~1UNWISE.EXE C:PROGRA~1STEINB~1NUENDO~1INSTALL.LOG
Stronghold 2—>»H:GamesStronghold 2unins000.exe»
Super Audio Grabber 3.0—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{DAF61295-6822-4E40-B26C-19C281A7DE2A}Setup.exe» -l0x9
SyncroSoft Emu (Remove only)—>C:Program FilesSyncroSoftPosH2OUninst.exe
Syncrosoft’s License Control—>C:PROGRA~1SYNCRO~1UNWISE.EXE C:PROGRA~1SYNCRO~1INSTALL.LOG
The KMPlayer (remove only)—>»C:Program FilesThe KMPlayeruninstall.exe»
TimeFactory—>C:WINDOWSuninst.exe -f»C:Program FilesPROSONIQTimeFactoryDeIsL1.isu» -c»C:Program FilesPROSONIQTimeFactory_ISREG32.DLL»
T-RackS EQ—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime 701Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{7AA63BC3-D35B-41A3-BF61-1AD4B3CB37E2}Setup.exe» -l0x9 uninstall
TVUPlayer 2.5.0.1—>C:Program FilesTVUPlayeruninst.exe
VCRedistSetup—>MsiExec.exe /I{3921A67A-5AB1-4E48-9444-C71814CF3027}
VisualRoute—>»C:Program FilesVisualRouteUninstall.exe» «C:Program FilesVisualRoute»
Wave MP3 Editor v11.0—>MsiExec.exe /I{AEC01EFA-2C3B-40F1-8F5B-AA49D2490979}
Waves 360 Surround Tools Bundle v5.03—>C:PROGRA~1WavesUNINST~2UNWISE.EXE C:PROGRA~1WavesUNINST~2INSTALL.LOG
Waves Diamond Bundle v5.0—>C:PROGRA~1WavesUNINST~1UNWISE.EXE C:PROGRA~1WavesUNINST~1INSTALL.LOG
Waves L3 16—>C:PROGRA~1WavesLogsWAVESL~1UNWISE.EXE C:PROGRA~1WavesLogsWAVESL~1INSTALL.LOG
Waves L3 LL—>C:PROGRA~1WavesLogsWAVESL~2UNWISE.EXE C:PROGRA~1WavesLogsWAVESL~2INSTALL.LOG
WinDjView 1.0.1—>C:Program FilesWinDjViewuninstall.exe
Windows Imaging Component—>»C:WINDOWS$NtUninstallWIC$spuninstspuninst.exe»
Windows Installer 3.1 (KB893803)—>»C:WINDOWS$MSI31Uninstall_KB893803v2$spuninstspuninst.exe»
Windows Media Format 11 runtime—>»C:Program FilesWindows Media Playerwmsetsdk.exe» /UninstallAll
Windows Media Format 11 runtime—>»C:WINDOWS$NtUninstallWMFDist11$spuninstspuninst.exe»
WinRAR archiver—>C:Program FilesWinRARuninstall.exe
XML Paper Specification Shared Components Language Pack 1.0—>»C:WINDOWS$NtUninstallXPSEPSCLP$spuninstspuninst.exe»
XP Codec Pack—>C:Program FilesXP Codec PackUninstall.exe
еда выполнения Visual Studio 2005 Tools for Office, второй выпуск—>c:Program FilesCommon FilesMicrosoft SharedVSTO8.0Microsoft Visual Studio 2005 Tools for Office Runtimeinstall.exe
Пакет драйверов Windows — Nokia Modem (06/01/2009 7.01.0.4)—>C:PROGRA~1DIFX270581355A767BF1dpinst.exe /u C:WINDOWSsystem32DRVSTOREnokbtmdm_0777326F40B753DD4E385F058ADB286B70A301FEnokbtmdm.inf
Пакет драйверов Windows — Nokia Modem (10/05/2009 4.2)—>C:PROGRA~1DIFX270581355A767BF1dpinst.exe /u C:WINDOWSsystem32DRVSTOREnokia_blue_AAB746D5658CCF4CAE7A35CED5F0ADA3C447A973nokia_bluetooth.inf
Пакет драйверов Windows — Nokia pccsmcfd (08/22/2008 7.0.0.0)—>C:PROGRA~1DIFXB4723E9A0713E5B1dpinst.exe /u C:WINDOWSsystem32DRVSTOREpccsmcfd_A3B3916E5D8138F59EE218321B27B044D3B18294pccsmcfd.inf
Персональный поиск Яндекса 2.6.0—>»C:Program FilesYandexDesktopunins000.exe»
расширение The Bat! для Персонального поиска Яндекса 2.6—>»C:Program FilesYandexDesktoppluginsthebatdsunins000.exe»
Языковой пакет Microsoft .NET Framework 3.5 — RUS—>C:WINDOWSMicrosoft.NETFrameworkv3.5Microsoft .NET Framework 3.5 Language Pack — russetup.exe======Security center information======
AV: ESET NOD32 Antivirus 4.2
======System event log======
Computer Name: HOME
Event Code: 7036
Message: Служба «Совместимость быстрого переключения пользователей» перешла в состояние Работает.Record Number: 31939
Source Name: Service Control Manager
Time Written: 20100723201924.000000+240
Event Type: информация
User:Computer Name: HOME
Event Code: 7035
Message: Служба «Совместимость быстрого переключения пользователей» успешно отправила управляющий элемент «запустить».Record Number: 31938
Source Name: Service Control Manager
Time Written: 20100723201924.000000+240
Event Type: информация
User: NT AUTHORITYSYSTEMComputer Name: HOME
Event Code: 7036
Message: Служба «Службы терминалов» перешла в состояние Работает.Record Number: 31937
Source Name: Service Control Manager
Time Written: 20100723201924.000000+240
Event Type: информация
User:Computer Name: HOME
Event Code: 7036
Message: Служба «Google Update Service (gupdate)» перешла в состояние Остановлена.Record Number: 31936
Source Name: Service Control Manager
Time Written: 20100723201924.000000+240
Event Type: информация
User:Computer Name: HOME
Event Code: 6005
Message: Запущена служба журнала событий.Record Number: 31935
Source Name: EventLog
Time Written: 20100723201754.000000+240
Event Type: информация
User:=====Application event log=====
Computer Name: HOME
Event Code: 1
Message:
Record Number: 10517531
Source Name: nview_info
Time Written: 20100814190243.000000+240
Event Type: ошибка
User:Computer Name: HOME
Event Code: 1
Message:
Record Number: 10517530
Source Name: nview_info
Time Written: 20100814190243.000000+240
Event Type: ошибка
User:Computer Name: HOME
Event Code: 1
Message:
Record Number: 10517529
Source Name: nview_info
Time Written: 20100814190243.000000+240
Event Type: ошибка
User:Computer Name: HOME
Event Code: 1
Message:
Record Number: 10517528
Source Name: nview_info
Time Written: 20100814190243.000000+240
Event Type: ошибка
User:Computer Name: HOME
Event Code: 1
Message:
Record Number: 10517527
Source Name: nview_info
Time Written: 20100814190243.000000+240
Event Type: ошибка
User:======Environment variables======
«ComSpec»=%SystemRoot%system32cmd.exe
«Path»=%SystemRoot%system32;%SystemRoot%;%SystemRoot%system32wbem;C:Program FilesPC Connectivity Solution;C:Program FilesCommon FilesRoxio SharedDLLShared;C:Program FilesCommon FilesRoxio Shared11.0DLLShared;C:Program FilesQuickTimeQTSystem
«windir»=%SystemRoot%
«FP_NO_HOST_CHECK»=NO
«OS»=Windows_NT
«PROCESSOR_ARCHITECTURE»=x86
«PROCESSOR_LEVEL»=15
«PROCESSOR_IDENTIFIER»=x86 Family 15 Model 6 Stepping 5, GenuineIntel
«PROCESSOR_REVISION»=0605
«NUMBER_OF_PROCESSORS»=2
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP
«RCAUTOPLAY»=C:Program FilesRoxio Creator 2009Roxio Central 4
«EMC_AUTOPLAY»=C:Program FilesCommon FilesRoxio Shared
«asl.log»=Destination=file;OnFirstLog=command,environment
«CLASSPATH»=.;C:Program FilesJavajre6libextQTJava.zip
«QTJAVA»=C:Program FilesJavajre6libextQTJava.zip
EOF
Logfile of random’s system information tool 1.08 (written by random/random)
Run by German at 2010-08-14 19:04:27
Microsoft Windows XP Home Edition Service Pack 2
System drive C: has 7 GB (25%) free of 30 GB
Total RAM: 2047 MB (48% free)Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:04:32, on 14.08.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: NormalRunning processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:Program FilesCommon FilesAppleMobile Device SupportAppleMobileDeviceService.exe
C:Program FilesBonjourmDNSResponder.exe
C:Program FilesESETESET NOD32 Antivirusekrn.exe
C:Program FilesJavajre6binjqs.exe
C:Program FilesNeroNero8Nero BackItUpNBService.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:WINDOWSsystem32rundll32.exe
C:Program FilesRoxio Creator 20095.0CPMonitor.exe
C:Program FilesSyncroSoftPosH2Ocledx.exe
C:Program FilesAdStoperAdStopperTrayApp.exe
C:Program FilesKeyLogmsdtsf.exe
C:Program FilesMediafourMacDriveMDDiskProtect.exe
C:Program FilesCommon FilesMediafourMACVNTFY.EXE
C:WINDOWSsystem32nvsvc32.exe
C:WINDOWSRTHDCPL.EXE
C:Program FilesCommon FilesNokiaMPlatformNokiaMServer.exe
C:Program FilesESETESET NOD32 Antivirusegui.exe
C:Program FilesCommon FilesJavaJava Updatejusched.exe
C:Program FilesiTunesiTunesHelper.exe
C:Program FilesYandexDesktopyandesk.exe
C:Program FilesCommon FilesNeroLibNMIndexStoreSvr.exe
C:Program FilesRocketDockRocketDock.exe
C:Program FilesPRMT8PRMTEDEDLauncher.exe
C:Program FilesSkypePhoneSkype.exe
C:Program FilesNokiaNokia Ovi SuiteNokiaOviSuite.exe
C:Documents and SettingsGermanApplication DataQipGuardQipGuard.exe
C:Program FilesQIP 2010qip.exe
C:Program FilesQIPqip.exe
C:Program FilesYandexPunto Switcherpunto.exe
C:Program FilesZards softwareStartup DefenderStartup Defender.exe
C:Program FilesCreative ProfessionalDigital Audio SystemE-MU PatchMix DSPEmuPatchMixDSP.exe
C:Program FilesPRMT8PRMTEDprmedsvr.exe
C:Program FilesAlcohol SoftAlcohol 120StarWindStarWindServiceAE.exe
C:Program FilesiPodbiniPodService.exe
C:Program FilesCommon FilesNeroLibNMIndexingService.exe
C:Program FilesCommon FilesNokiaNoAnokiaaserver.exe
C:WINDOWSsystem32wscntfy.exe
C:WINDOWSsystem32wbemwmiapsrv.exe
C:Program FilesPC Connectivity SolutionServiceLayer.exe
C:Program FilesPC Connectivity SolutionTransportsNclUSBSrv.exe
C:Program FilesPC Connectivity SolutionTransportsNclRSSrv.exe
C:Program FilesSkypePlugin ManagerskypePM.exe
C:Program FilesOperaopera.exe
C:Program FilesSafariSafari.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:Program FilesMozilla Firefoxplugin-container.exe
C:Documents and SettingsGermanРабочий столRSIT.exe
C:Program Filestrend microGerman.exeR1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://search.qip.ru
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://qip.ru
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://search.qip.ru/ie
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: UrlSearchHook Class — {00000000-6E41-4FD3-8538-502F5495E5FC} — C:Program FilesAsk.comGenericAskToolbar.dll
R3 — URLSearchHook: (no name) — {9CB65206-89C4-402c-BA80-02D8C59F9B1D} — C:Program FilesAskTBarSrchAstt1.binA5SRCHAS.DLL (file missing)
R3 — URLSearchHook: (no name) — — (no file)
O2 — BHO: AcroIEHelperStub — {18DF081C-E8AD-4283-A596-FA578C2EBDC3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelperShim.dll
O2 — BHO: Ask Search Assistant BHO — {9CB65201-89C4-402c-BA80-02D8C59F9B1D} — (no file)
O2 — BHO: Ask Toolbar BHO — {D4027C7F-154A-4066-A1AD-4243D8127440} — C:Program FilesAsk.comGenericAskToolbar.dll
O2 — BHO: Java(tm) Plug-In 2 SSV Helper — {DBC80044-A445-435b-BC74-9C25C1C588A9} — C:Program FilesJavajre6binjp2ssv.dll
O2 — BHO: JQSIEStartDetectorImpl — {E7E6F031-17CE-4C07-BC86-EABFE594F69C} — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll
O2 — BHO: XBTBPos00 — {FCBCCB87-9224-4B8D-B117-F56D924BEB18} — C:Program FilesPivim Multibarpivim.dll
O2 — BHO: Ask Toolbar BHO — {FE063DB1-4EC0-403e-8DD8-394C54984B2C} — (no file)
O3 — Toolbar: Pivim Multibar — {1BB22D38-A411-4B13-A746-C2A4F4EC7344} — C:Program FilesPivim Multibarpivim.dll
O3 — Toolbar: Ask Toolbar — {D4027C7F-154A-4066-A1AD-4243D8127440} — C:Program FilesAsk.comGenericAskToolbar.dll
O4 — HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 — HKLM..Run: [nwiz] nwiz.exe /install
O4 — HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 — HKLM..Run: [CTHelper] CTHELPER.EXE
O4 — HKLM..Run: [CTxfiHlp] CTXFIHLP.EXE
O4 — HKLM..Run: [UpdReg] C:WINDOWSUpdReg.EXE
O4 — HKLM..Run: [NeroFilterCheck] C:Program FilesCommon FilesNeroLibNeroCheck.exe
O4 — HKLM..Run: [NBKeyScan] «C:Program FilesNeroNero8Nero BackItUpNBKeyScan.exe»
O4 — HKLM..Run: [RoxWatchTray] «C:Program FilesCommon FilesRoxio Shared11.0SharedCOMRoxWatchTray11.exe»
O4 — HKLM..Run: [CPMonitor] «C:Program FilesRoxio Creator 20095.0CPMonitor.exe»
O4 — HKLM..Run: [WheelMouse] C:Program FilesA4TechMouseAmoumain.exe
O4 — HKLM..Run: [H2O] C:Program FilesSyncroSoftPosH2Ocledx.exe
O4 — HKLM..Run: [adstopper] C:Program FilesAdStoperAdStopperTrayApp.exe
O4 — HKLM..Run: [DDKL] C:Program FilesKeyLogmsdtsf.exe
O4 — HKLM..Run: [MDDiskProtect.exe] C:Program FilesMediafourMacDriveMDDiskProtect.exe
O4 — HKLM..Run: [MediafourGettingStartedWithMacDrive6] «C:Program FilesMediafourMacDriveMacDrive.exe» /runonce
O4 — HKLM..Run: [Mediafour Mac Volume Notifications] «C:Program FilesCommon FilesMediafourMACVNTFY.EXE» /auto
O4 — HKLM..Run: [EssSpkPhone] essspk1.exe -c
O4 — HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 — HKLM..Run: [NokiaMServer] C:Program FilesCommon FilesNokiaMPlatformNokiaMServer /watchfiles startup
O4 — HKLM..Run: [Adobe Reader Speed Launcher] «C:Program FilesAdobeReader 9.0ReaderReader_sl.exe»
O4 — HKLM..Run: [Adobe ARM] «C:Program FilesCommon FilesAdobeARM1.0AdobeARM.exe»
O4 — HKLM..Run: [QuickTime Task] «C:Program FilesQuickTimeQTTask.exe» -atboottime
O4 — HKLM..Run: [NokiaMusic FastStart] «C:Program FilesNokiaOvi PlayerNokiaOviPlayer.exe» /command:faststart
O4 — HKLM..Run: [egui] «C:Program FilesESETESET NOD32 Antivirusegui.exe» /hide /waitservice
O4 — HKLM..Run: [SunJavaUpdateSched] «C:Program FilesCommon FilesJavaJava Updatejusched.exe»
O4 — HKLM..Run: [iTunesHelper] «C:Program FilesiTunesiTunesHelper.exe»
O4 — HKCU..Run: [YandexDesktopSearch] «C:Program FilesYandexDesktopyandesk.exe»
O4 — HKCU..Run: [SetDefaultMIDI] MIDIDef.exe
O4 — HKCU..Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] «C:Program FilesCommon FilesNeroLibNMIndexStoreSvr.exe» ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 — HKCU..Run: [AlcoholAutomount] «C:Program FilesAlcohol SoftAlcohol 120axcmd.exe» /automount
O4 — HKCU..Run: [RocketDock] «C:Program FilesRocketDockRocketDock.exe»
O4 — HKCU..Run: [Google Update] «C:Documents and SettingsGermanLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe» /c
O4 — HKCU..Run: [EDLauncher] C:Program FilesPRMT8PRMTEDEDLauncher.exe
O4 — HKCU..Run: [Skype] «C:Program FilesSkypePhoneSkype.exe» /nosplash /minimized
O4 — HKCU..Run: [EA Core] «C:Program FilesElectronic ArtsEADMCore.exe» -silent
O4 — HKCU..Run: [NokiaOviSuite2] C:Program FilesNokiaNokia Ovi SuiteNokiaOviSuite.exe -tray
O4 — HKCU..Run: [QIP Internet Guardian] C:Documents and SettingsGermanApplication DataQipGuardQipGuard.exe
O4 — HKCU..Run: [Infium] «C:Program FilesQIP 2010qip.exe» /autorun
O4 — HKCU..Run: [QIP2005] C:Program FilesQIPqip.exe
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — Startup: Punto Switcher.lnk = C:Program FilesYandexPunto Switcherpunto.exe
O4 — Startup: Startup Defender.lnk = C:Program FilesZards softwareStartup DefenderStartup Defender.exe
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2Office12EXCEL.EXE/3000
O9 — Extra button: Research — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2Office12REFIEBAR.DLL
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra button: QIP Infium — {1EF681F7-A04B-4D6D-9012-A307CCA55610} — C:Program FilesQIP Infiuminfium.exe (HKCU)
O17 — HKLMSystemCCSServicesTcpip..{BC0E28E8-823A-4932-A164-02403F14FFF2}: NameServer = 195.34.32.116 212.188.4.10
O18 — Protocol: skype4com — {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} — C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O20 — Winlogon Notify: MacDrive-iTunes compatibility — C:Program FilesCommon FilesMediafourMacDriveiTunesPatch.dll
O22 — SharedTaskScheduler: Предзагрузчик Browseui — {438755C2-A8BA-11D1-B96B-00A0C90312E1} — C:WINDOWSsystem32browseui.dll
O22 — SharedTaskScheduler: Демон кэша категорий компонентов — {8C7461EF-2B13-11d2-BE35-3078302C2030} — C:WINDOWSsystem32browseui.dll
O23 — Service: Apple Mobile Device — Apple Inc. — C:Program FilesCommon FilesAppleMobile Device SupportAppleMobileDeviceService.exe
O23 — Service: Служба Bonjour (Bonjour Service) — Apple Inc. — C:Program FilesBonjourmDNSResponder.exe
O23 — Service: ESET HTTP Server (EhttpSrv) — ESET — C:Program FilesESETESET NOD32 AntivirusEHttpSrv.exe
O23 — Service: ESET Service (ekrn) — ESET — C:Program FilesESETESET NOD32 Antivirusekrn.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Google Update Service (gupdate) (gupdate) — Google Inc. — C:Program FilesGoogleUpdateGoogleUpdate.exe
O23 — Service: InstallDriver Table Manager (IDriverT) — Macrovision Corporation — C:Program FilesCommon FilesInstallShieldDriver1050Intel 32IDriverT.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: Сервис iPod (iPod Service) — Apple Inc. — C:Program FilesiPodbiniPodService.exe
O23 — Service: Java Quick Starter (JavaQuickStarterService) — Sun Microsystems, Inc. — C:Program FilesJavajre6binjqs.exe
O23 — Service: NetMeeting Remote Desktop Sharing (mnmsrvc) — Корпорация Майкрософт — C:WINDOWSsystem32mnmsrvc.exe
O23 — Service: Nero BackItUp Scheduler 3 — Nero AG — C:Program FilesNeroNero8Nero BackItUpNBService.exe
O23 — Service: NMIndexingService — Nero AG — C:Program FilesCommon FilesNeroLibNMIndexingService.exe
O23 — Service: NVIDIA Display Driver Service (NVSvc) — NVIDIA Corporation — C:WINDOWSsystem32nvsvc32.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Roxio UPnP Renderer 11 — Sonic Solutions — C:Program FilesRoxio Creator 2009Digital Home 11RoxioUPnPRenderer11.exe
O23 — Service: Roxio Upnp Server 11 — Sonic Solutions — C:Program FilesRoxio Creator 2009Digital Home 11RoxioUpnpService11.exe
O23 — Service: LiveShare P2P Server 11 (RoxLiveShare11) — Sonic Solutions — C:Program FilesCommon FilesRoxio Shared11.0SharedCOMRoxLiveShare11.exe
O23 — Service: RoxMediaDB11 — Sonic Solutions — C:Program FilesCommon FilesRoxio Shared11.0SharedCOMRoxMediaDB11.exe
O23 — Service: Roxio Hard Drive Watcher 11 (RoxWatch11) — Sonic Solutions — C:Program FilesCommon FilesRoxio Shared11.0SharedCOMRoxWatch11.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: ServiceLayer — Nokia — C:Program FilesPC Connectivity SolutionServiceLayer.exe
O23 — Service: StarWind AE Service (StarWindServiceAE) — Rocket Division Software — C:Program FilesAlcohol SoftAlcohol 120StarWindStarWindServiceAE.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe—
End of file — 13331 bytes======Scheduled tasks folder======
C:WINDOWStasksAppleSoftwareUpdate.job
C:WINDOWStasksGoogleUpdateTaskMachineCore.job
C:WINDOWStasksGoogleUpdateTaskMachineUA.job
C:WINDOWStasksGoogleUpdateTaskUserS-1-5-21-790525478-583907252-725345543-1004Core.job
C:WINDOWStasksGoogleUpdateTaskUserS-1-5-21-790525478-583907252-725345543-1004UA.job
C:WINDOWStasksScheduled Update for Ask Toolbar.job======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelperShim.dll [2010-06-19 75200][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9CB65201-89C4-402c-BA80-02D8C59F9B1D}]
Ask Search Assistant BHO[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{D4027C7F-154A-4066-A1AD-4243D8127440}]
Ask Toolbar — C:Program FilesAsk.comGenericAskToolbar.dll [2010-05-26 1385864][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper — C:Program FilesJavajre6binjp2ssv.dll [2010-07-17 41760][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll [2010-07-17 79648][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{FCBCCB87-9224-4B8D-B117-F56D924BEB18}]
XBTBPos00 Class — C:Program FilesPivim Multibarpivim.dll [2009-07-09 2175488][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{FE063DB1-4EC0-403e-8DD8-394C54984B2C}]
Ask Toolbar BHO[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{1BB22D38-A411-4B13-A746-C2A4F4EC7344} — Pivim Multibar — C:Program FilesPivim Multibarpivim.dll [2009-07-09 2175488]
{D4027C7F-154A-4066-A1AD-4243D8127440} — Ask Toolbar — C:Program FilesAsk.comGenericAskToolbar.dll [2010-05-26 1385864][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«NvCplDaemon»=C:WINDOWSsystem32NvCpl.dll [2008-10-07 13574144]
«nwiz»=nwiz.exe /install []
«NvMediaCenter»=C:WINDOWSsystem32NvMcTray.dll [2008-10-07 86016]
«CTHelper»=C:WINDOWSsystem32CTHELPER.EXE [2008-03-20 23040]
«CTxfiHlp»=C:WINDOWSsystem32CTXFIHLP.EXE [2008-03-20 23552]
«UpdReg»=C:WINDOWSUpdReg.EXE [2000-05-11 90112]
«NeroFilterCheck»=C:Program FilesCommon FilesNeroLibNeroCheck.exe [2007-03-01 153136]
«NBKeyScan»=C:Program FilesNeroNero8Nero BackItUpNBKeyScan.exe [2007-12-03 2213160]
«RoxWatchTray»=C:Program FilesCommon FilesRoxio Shared11.0SharedCOMRoxWatchTray11.exe [2008-08-14 240112]
«CPMonitor»=C:Program FilesRoxio Creator 20095.0CPMonitor.exe [2008-08-10 80368]
«WheelMouse»=C:Program FilesA4TechMouseAmoumain.exe [2008-03-06 188416]
«H2O»=C:Program FilesSyncroSoftPosH2Ocledx.exe [2007-12-11 307200]
«adstopper»=C:Program FilesAdStoperAdStopperTrayApp.exe [2009-07-21 588800]
«DDKL»=C:Program FilesKeyLogmsdtsf.exe [2007-06-15 2809856]
«MDDiskProtect.exe»=C:Program FilesMediafourMacDriveMDDiskProtect.exe [2005-03-27 94208]
«MediafourGettingStartedWithMacDrive6″=C:Program FilesMediafourMacDriveMacDrive.exe [2005-03-27 86016]
«Mediafour Mac Volume Notifications»=C:Program FilesCommon FilesMediafourMACVNTFY.EXE [2005-03-27 61440]
«EssSpkPhone»=essspk1.exe -c []
«RTHDCPL»=C:WINDOWSRTHDCPL.EXE [2009-09-22 18749440]
«NokiaMServer»=C:Program FilesCommon FilesNokiaMPlatformNokiaMServer /watchfiles startup []
«Adobe Reader Speed Launcher»=C:Program FilesAdobeReader 9.0ReaderReader_sl.exe [2010-06-20 35760]
«Adobe ARM»=C:Program FilesCommon FilesAdobeARM1.0AdobeARM.exe [2010-06-09 976832]
«QuickTime Task»=C:Program FilesQuickTimeQTTask.exe [2010-03-17 421888]
«NokiaMusic FastStart»=C:Program FilesNokiaOvi PlayerNokiaOviPlayer.exe [2010-03-04 2192672]
«egui»=C:Program FilesESETESET NOD32 Antivirusegui.exe [2010-04-07 2145000]
«SunJavaUpdateSched»=C:Program FilesCommon FilesJavaJava Updatejusched.exe [2010-05-14 248552]
«iTunesHelper»=C:Program FilesiTunesiTunesHelper.exe [2010-07-21 141608][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«YandexDesktopSearch»=C:Program FilesYandexDesktopyandesk.exe [2007-12-10 7456256]
«SetDefaultMIDI»=C:WINDOWSsystem32MIDIDef.exe [2008-03-20 31232]
«IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=C:Program FilesCommon FilesNeroLibNMIndexStoreSvr.exe [2007-12-13 1688872]
«AlcoholAutomount»=C:Program FilesAlcohol SoftAlcohol 120axcmd.exe [2007-08-01 222592]
«RocketDock»=C:Program FilesRocketDockRocketDock.exe [2007-09-02 495616]
«Google Update»=C:Documents and SettingsGermanLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe [2009-07-16 133104]
«EDLauncher»=C:Program FilesPRMT8PRMTEDEDLauncher.exe [2007-08-17 122880]
«Skype»=C:Program FilesSkypePhoneSkype.exe [2010-05-13 26192168]
«EA Core»=C:Program FilesElectronic ArtsEADMCore.exe [2009-09-04 3342336]
«NokiaOviSuite2″=C:Program FilesNokiaNokia Ovi SuiteNokiaOviSuite.exe [2010-02-24 385928]
«QIP Internet Guardian»=C:Documents and SettingsGermanApplication DataQipGuardQipGuard.exe [2010-06-10 190416]
«Infium»=C:Program FilesQIP 2010qip.exe [2010-06-16 5813200]
«QIP2005″=C:Program FilesQIPqip.exe [2009-08-13 3276288]C:Documents and SettingsGermanГлавное менюПрограммыАвтозагрузка
Punto Switcher.lnk — C:Program FilesYandexPunto Switcherpunto.exe
Startup Defender.lnk — C:Program FilesZards softwareStartup DefenderStartup Defender.exe[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyMacDrive-iTunes compatibility]
C:Program FilesCommon FilesMediafourMacDriveiTunesPatch.dll [2005-03-27 61440][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32WPDShServiceObj.dll [2006-10-18 133632][HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalWdf01000.sys]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkWdf01000.sys]
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=323
«NoDriveAutoRun»=67108863
«NoDrives»=0[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveAutoRun»=67108863
«NoDriveTypeAutoRun»=323
«NoDrives»=0[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesMicrosoft OfficeOffice12OUTLOOK.EXE»=»C:Program FilesMicrosoft OfficeOffice12OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook»
«C:DOCUME~1GermanLOCALS~1Tempe.exe»=»C:DOCUME~1GermanLOCALS~1Tempe.exe:*:Enabled:RASS Server»
«C:DOCUME~1GermanLOCALS~1Temp10B9.tmp»=»C:DOCUME~1GermanLOCALS~1Temp10B9.tmp:*:Enabled:RASS Server»
«C:DOCUME~1GermanLOCALS~1Temp3B5C.exe»=»C:DOCUME~1GermanLOCALS~1Temp3B5C.exe:*:Enabled:Microsoft Windows Update Platform»
«C:DOCUME~1GermanLOCALS~1Temp3B76.exe»=»C:DOCUME~1GermanLOCALS~1Temp3B76.exe:*:Enabled:Microsoft Windows Update Platform»
«C:DOCUME~1GermanLOCALS~1Temp4E02.exe»=»C:DOCUME~1GermanLOCALS~1Temp4E02.exe:*:Enabled:Microsoft Windows Update Platform»
«C:DOCUME~1GermanLOCALS~1Temp4DF8.tmp»=»C:DOCUME~1GermanLOCALS~1Temp4DF8.tmp:*:Enabled:RASS Server»
«C:DOCUME~1GermanLOCALS~1Temp5F12.tmp»=»C:DOCUME~1GermanLOCALS~1Temp5F12.tmp:*:Enabled:RASS Server»
«C:DOCUME~1GermanLOCALS~1Temp5F16.tmp»=»C:DOCUME~1GermanLOCALS~1Temp5F16.tmp:*:Enabled:RASS Server»
«C:DOCUME~1GermanLOCALS~1Temp693C.exe»=»C:DOCUME~1GermanLOCALS~1Temp693C.exe:*:Enabled:Microsoft Windows Update Platform»
«C:DOCUME~1GermanLOCALS~1Temp6939.tmp»=»C:DOCUME~1GermanLOCALS~1Temp6939.tmp:*:Enabled:RASS Server»
«C:DOCUME~1GermanLOCALS~1Temp7017.exe»=»C:DOCUME~1GermanLOCALS~1Temp7017.exe:*:Enabled:Microsoft Windows Update Platform»
«C:DOCUME~1GermanLOCALS~1Temp701A.exe»=»C:DOCUME~1GermanLOCALS~1Temp701A.exe:*:Enabled:Microsoft Windows Update Platform»
«C:DOCUME~1GermanLOCALS~1Temp8026.exe»=»C:DOCUME~1GermanLOCALS~1Temp8026.exe:*:Enabled:Microsoft Windows Update Platform»
«C:DOCUME~1GermanLOCALS~1Temp802C.exe»=»C:DOCUME~1GermanLOCALS~1Temp802C.exe:*:Enabled:Microsoft Windows Update Platform»
«C:DOCUME~1GermanLOCALS~1Temp8741.exe»=»C:DOCUME~1GermanLOCALS~1Temp8741.exe:*:Enabled:Microsoft Windows Update Platform»
«C:DOCUME~1GermanLOCALS~1Temp8747.exe»=»C:DOCUME~1GermanLOCALS~1Temp8747.exe:*:Enabled:Microsoft Windows Update Platform»
«C:DOCUME~1GermanLOCALS~1Temp94C9.exe»=»C:DOCUME~1GermanLOCALS~1Temp94C9.exe:*:Enabled:Microsoft Windows Update Platform»
«C:DOCUME~1GermanLOCALS~1Temp94CC.tmp»=»C:DOCUME~1GermanLOCALS~1Temp94CC.tmp:*:Enabled:RASS Server»
«C:DOCUME~1GermanLOCALS~1Temp9E4C.exe»=»C:DOCUME~1GermanLOCALS~1Temp9E4C.exe:*:Enabled:Microsoft Windows Update Platform»
«C:DOCUME~1GermanLOCALS~1Temp9E39.tmp»=»C:DOCUME~1GermanLOCALS~1Temp9E39.tmp:*:Enabled:RASS Server»
«C:DOCUME~1GermanLOCALS~1TempA34F.exe»=»C:DOCUME~1GermanLOCALS~1TempA34F.exe:*:Enabled:Microsoft Windows Update Platform»
«C:DOCUME~1GermanLOCALS~1TempA355.tmp»=»C:DOCUME~1GermanLOCALS~1TempA355.tmp:*:Enabled:RASS Server»
«C:DOCUME~1GermanLOCALS~1TempAB3F.tmp»=»C:DOCUME~1GermanLOCALS~1TempAB3F.tmp:*:Enabled:RASS Server»
«C:DOCUME~1GermanLOCALS~1TempAB3B.tmp»=»C:DOCUME~1GermanLOCALS~1TempAB3B.tmp:*:Enabled:RASS Server»
«C:DOCUME~1GermanLOCALS~1Temp8F63.exe»=»C:DOCUME~1GermanLOCALS~1Temp8F63.exe:*:Enabled:Microsoft Windows Update Platform»
«C:DOCUME~1GermanLOCALS~1Temp8CCE.tmp»=»C:DOCUME~1GermanLOCALS~1Temp8CCE.tmp:*:Enabled:RASS Server»
«C:DOCUME~1GermanLOCALS~1TempAB58.exe»=»C:DOCUME~1GermanLOCALS~1TempAB58.exe:*:Enabled:Microsoft Windows Update Platform»
«C:DOCUME~1GermanLOCALS~1TempAA14.tmp»=»C:DOCUME~1GermanLOCALS~1TempAA14.tmp:*:Enabled:RASS Server»
«C:DOCUME~1GermanLOCALS~1TempABAB.exe»=»C:DOCUME~1GermanLOCALS~1TempABAB.exe:*:Enabled:Microsoft Windows Update Platform»
«C:DOCUME~1GermanLOCALS~1TempABAE.tmp»=»C:DOCUME~1GermanLOCALS~1TempABAE.tmp:*:Enabled:RASS Server»
«C:DOCUME~1GermanLOCALS~1TempA548.tmp»=»C:DOCUME~1GermanLOCALS~1TempA548.tmp:*:Enabled:RASS Server»
«C:DOCUME~1GermanLOCALS~1TempA61B.tmp»=»C:DOCUME~1GermanLOCALS~1TempA61B.tmp:*:Enabled:RASS Server»
«C:DOCUME~1GermanLOCALS~1Temp7325.exe»=»C:DOCUME~1GermanLOCALS~1Temp7325.exe:*:Enabled:Microsoft Windows Update Platform»
«C:DOCUME~1GermanLOCALS~1Temp7328.tmp»=»C:DOCUME~1GermanLOCALS~1Temp7328.tmp:*:Enabled:RASS Server»
«C:DOCUME~1GermanLOCALS~1Temp6619.exe»=»C:DOCUME~1GermanLOCALS~1Temp6619.exe:*:Enabled:Microsoft Windows Update Platform»
«C:DOCUME~1GermanLOCALS~1Temp661D.tmp»=»C:DOCUME~1GermanLOCALS~1Temp661D.tmp:*:Enabled:RASS Server»
«C:DOCUME~1GermanLOCALS~1Temp4F9F.exe»=»C:DOCUME~1GermanLOCALS~1Temp4F9F.exe:*:Enabled:Microsoft Windows Update Platform»
«C:DOCUME~1GermanLOCALS~1Temp5131.tmp»=»C:DOCUME~1GermanLOCALS~1Temp5131.tmp:*:Enabled:RASS Server»
«C:DOCUME~1GermanLOCALS~1Temp585F.exe»=»C:DOCUME~1GermanLOCALS~1Temp585F.exe:*:Enabled:Microsoft Windows Update Platform»
«C:DOCUME~1GermanLOCALS~1Temp5862.tmp»=»C:DOCUME~1GermanLOCALS~1Temp5862.tmp:*:Enabled:RASS Server»
«C:DOCUME~1GermanLOCALS~1Temp6436.exe»=»C:DOCUME~1GermanLOCALS~1Temp6436.exe:*:Enabled:Microsoft Windows Update Platform»
«C:DOCUME~1GermanLOCALS~1Temp6439.exe»=»C:DOCUME~1GermanLOCALS~1Temp6439.exe:*:Enabled:Microsoft Windows Update Platform»
«C:DOCUME~1GermanLOCALS~1Temp6D26.exe»=»C:DOCUME~1GermanLOCALS~1Temp6D26.exe:*:Enabled:Microsoft Windows Update Platform»
«C:DOCUME~1GermanLOCALS~1Temp6D2A.tmp»=»C:DOCUME~1GermanLOCALS~1Temp6D2A.tmp:*:Enabled:RASS Server»
«C:DOCUME~1GermanLOCALS~1Temp7794.tmp»=»C:DOCUME~1GermanLOCALS~1Temp7794.tmp:*:Enabled:RASS Server»
«C:DOCUME~1GermanLOCALS~1Temp7797.tmp»=»C:DOCUME~1GermanLOCALS~1Temp7797.tmp:*:Enabled:RASS Server»
«C:DOCUME~1GermanLOCALS~1Temp7F98.exe»=»C:DOCUME~1GermanLOCALS~1Temp7F98.exe:*:Enabled:Microsoft Windows Update Platform»
«C:DOCUME~1GermanLOCALS~1Temp7F9C.tmp»=»C:DOCUME~1GermanLOCALS~1Temp7F9C.tmp:*:Enabled:RASS Server»
«C:DOCUME~1GermanLOCALS~1Temp86BD.exe»=»C:DOCUME~1GermanLOCALS~1Temp86BD.exe:*:Enabled:Microsoft Windows Update Platform»
«C:DOCUME~1GermanLOCALS~1Temp86C1.exe»=»C:DOCUME~1GermanLOCALS~1Temp86C1.exe:*:Enabled:Microsoft Windows Update Platform»
«C:DOCUME~1GermanLOCALS~1Temp8F88.exe»=»C:DOCUME~1GermanLOCALS~1Temp8F88.exe:*:Enabled:Microsoft Windows Update Platform»
«C:DOCUME~1GermanLOCALS~1Temp8F8B.tmp»=»C:DOCUME~1GermanLOCALS~1Temp8F8B.tmp:*:Enabled:RASS Server»
«C:WINDOWSsystem328F88.exe»=»C:WINDOWSsystem328F88.exe:*:Enabled:Microsoft Windows Update Platform»
«C:Program FilesSkypePlugin ManagerskypePM.exe»=»C:Program FilesSkypePlugin ManagerskypePM.exe:*:Enabled:Skype Extras Manager»
«C:Program FilesOperaopera.exe»=»C:Program FilesOperaopera.exe:*:Enabled:Opera Internet Browser»
«C:Program FilesBonjourmDNSResponder.exe»=»C:Program FilesBonjourmDNSResponder.exe:*:Enabled:Служба Bonjour»
«H:GamesSid Meier’s Civilization 4Civilization4.exe»=»H:GamesSid Meier’s Civilization 4Civilization4.exe:*:Enabled:Sid Meier’s Civilization 4»
«C:Program FilesiTunesiTunes.exe»=»C:Program FilesiTunesiTunes.exe:*:Enabled:iTunes»
«C:Program FilesSkypePhoneSkype.exe»=»C:Program FilesSkypePhoneSkype.exe:*:Enabled:Skype»[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»======List of files/folders created in the last 1 months======
2010-08-14 19:04:27 —-D—- C:rsit
2010-08-14 18:28:02 —-D—- C:RECYCLER
2010-08-14 17:59:27 —-D—- C:WINDOWSERDNT
2010-08-09 22:09:53 —-D—- C:Program FilesiPod
2010-08-09 22:09:49 —-D—- C:Program FilesiTunes
2010-08-02 09:43:32 —-D—- C:Program FilesCommon FilesJava
2010-08-02 09:43:20 —-A—- C:WINDOWSsystem32javaws.exe
2010-08-02 09:43:20 —-A—- C:WINDOWSsystem32javaw.exe
2010-08-02 09:43:20 —-A—- C:WINDOWSsystem32java.exe
2010-07-27 21:16:04 —-A—- C:WINDOWSsystem32NMSDVDXU.dll
2010-07-27 21:16:00 —-D—- C:Documents and SettingsGermanApplication DataLG Electronics
2010-07-27 21:15:35 —-D—- C:Program FilesLG Electronics
2010-07-16 13:50:26 —-D—- C:Documents and SettingsGermanApplication DataMy Games
2010-07-15 03:46:26 —-A—- C:WINDOWSIE4 Error Log.txt======List of files/folders modified in the last 1 months======
2010-08-14 19:04:32 —-D—- C:Program FilesTrend Micro
2010-08-14 19:04:27 —-D—- C:WINDOWSTemp
2010-08-14 19:03:48 —-D—- C:Documents and SettingsGermanApplication DataSkype
2010-08-14 18:50:59 —-D—- C:WINDOWS
2010-08-14 18:30:02 —-D—- C:Documents and SettingsGermanApplication DataskypePM
2010-08-14 18:28:55 —-A—- C:WINDOWSsystem.ini
2010-08-14 18:27:42 —-D—- C:WINDOWSsystem32driversetc
2010-08-14 18:27:28 —-D—- C:WINDOWSsystem32drivers
2010-08-14 18:26:35 —-D—- C:WINDOWSsystem32config
2010-08-14 18:23:14 —-D—- C:WINDOWSsystem32
2010-08-14 18:21:34 —-D—- C:WINDOWSAppPatch
2010-08-14 18:21:31 —-D—- C:Program FilesCommon Files
2010-08-14 18:19:12 —-D—- C:WINDOWSsystem32CatRoot2
2010-08-14 17:59:55 —-A—- C:WINDOWSSchedLgU.Txt
2010-08-14 17:57:13 —-D—- C:WINDOWSPrefetch
2010-08-13 02:06:16 —-D—- C:Documents and SettingsGermanApplication DataThe Bat!
2010-08-12 18:13:58 —-D—- C:Documents and SettingsAll UsersApplication DatanView_Profiles
2010-08-10 23:25:32 —-D—- C:Documents and SettingsAll UsersApplication DataSonic
2010-08-09 22:11:44 —-SHD—- C:WINDOWSInstaller
2010-08-09 22:09:53 —-RD—- C:Program Files
2010-08-09 22:09:51 —-D—- C:Program FilesCommon FilesApple
2010-08-09 22:00:16 —-D—- C:Program FilesSafari
2010-08-08 20:02:43 —-A—- C:WINDOWSNeroDigital.ini
2010-08-02 09:43:06 —-D—- C:Program FilesJava
2010-07-28 09:41:55 —-HD—- C:WINDOWSinf
2010-07-27 21:15:35 —-HD—- C:Program FilesInstallShield Installation Information
2010-07-25 11:18:56 —-D—- C:Program FilesMozilla Firefox
2010-07-17 05:00:04 —-A—- C:WINDOWSsystem32deployJava1.dll
2010-07-16 13:30:12 —-RSD—- C:WINDOWSFonts
2010-07-15 14:50:01 —-A—- C:WINDOWScdplayer.ini======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 MDPMGRNT;MDPMGRNT; C:WINDOWSsystem32driversMDPMGRNT.sys [2005-03-27 44404]
R0 PxHelp20;PxHelp20; C:WINDOWSSystem32DriversPxHelp20.sys [2008-06-16 44944]
R0 WudfPf;Windows Driver Foundation — User-mode Driver Framework Platform Driver; C:WINDOWSsystem32DRIVERSWudfPf.sys [2006-09-28 77568]
R1 ehdrv;ehdrv; C:WINDOWSsystem32DRIVERSehdrv.sys [2010-04-07 114984]
R1 epfwtdir;epfwtdir; C:WINDOWSsystem32DRIVERSepfwtdir.sys [2010-04-07 95872]
R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2004-08-17 40448]
R1 kbdhid;Драйвер клавиатуры HID; C:WINDOWSsystem32DRIVERSkbdhid.sys [2004-08-17 14848]
R1 MDFSYSNT;MDFSYSNT; C:WINDOWSsystem32driversMDFSYSNT.sys [2005-03-27 277352]
R1 prodrv04;Star Force copy protection driver v4; C:WINDOWSSystem32driversprodrv04.sys [2009-08-08 114496]
R2 eamon;eamon; C:WINDOWSsystem32DRIVERSeamon.sys [2010-04-07 139192]
R2 PfModNT;PfModNT; ??C:WINDOWSsystem32driversPfModNT.sys []
R3 Amps2prt;A4Tech PS/2 Port Mouse Driver; C:WINDOWSsystem32DRIVERSAmps2prt.sys [2007-06-17 14336]
R3 CLEDX;Team H2O CLEDX service; C:WINDOWSsystem32DRIVERScledx.sys [2005-05-09 33792]
R3 ctac32k;Creative AC3 Software Decoder; C:WINDOWSsystem32driversctac32k.sys [2006-08-04 502272]
R3 ctaud2k;Creative Audio Driver (WDM); C:WINDOWSsystem32driversctaud2k.sys [2006-08-04 499584]
R3 ctprxy2k;Creative Proxy Driver; C:WINDOWSsystem32driversctprxy2k.sys [2006-08-04 7168]
R3 ctsfm2k;Creative SoundFont Management Device Driver; C:WINDOWSsystem32driversctsfm2k.sys [2006-08-04 143872]
R3 emupia;E-mu Plug-in Architecture Driver; C:WINDOWSsystem32driversemupia2k.sys [2006-08-04 78336]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:WINDOWSSystem32DriversGEARAspiWDM.sys [2009-05-18 26600]
R3 ha10kx2k;Creative Hardware Abstract Layer Driver; C:WINDOWSsystem32driversha10kx2k.sys [2006-08-04 766976]
R3 HDAudBus;Драйвер шины Microsoft UAA для High Definition Audio; C:WINDOWSsystem32DRIVERSHDAudBus.sys [2005-01-07 138752]
R3 hidusb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2001-10-20 9600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:WINDOWSsystem32driversRtkHDAud.sys [2009-09-22 5915136]
R3 nv;nv; C:WINDOWSsystem32DRIVERSnv4_mini.sys [2008-10-07 6133856]
R3 ossrv;Creative OS Services Driver; C:WINDOWSsystem32driversctoss2k.sys [2006-08-04 116224]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:WINDOWSsystem32DRIVERSRtenicxp.sys [2006-08-14 83200]
R3 usbccgp;Драйвер универсального родительского устройства USB (Microsoft); C:WINDOWSsystem32DRIVERSusbccgp.sys [2004-08-04 31616]
R3 usbstor;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2004-08-04 26496]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2004-08-03 20480]
S0 sptd;sptd; C:WINDOWSSystem32Driverssptd.sys [2009-06-18 685816]
S3 Ambfilt;Ambfilt; C:WINDOWSsystem32driversAmbfilt.sys [2008-08-05 1684736]
S3 catchme;catchme; ??C:DOCUME~1GermanLOCALS~1Tempcatchme.sys []
S3 COMMONFX.SYS;COMMONFX.SYS; C:WINDOWSSystem32driversCOMMONFX.SYS [2008-03-20 98328]
S3 COMMONFX;COMMONFX; C:WINDOWSsystem32driversCOMMONFX.SYS [2008-03-20 98328]
S3 CT20XUT.SYS;CT20XUT.SYS; C:WINDOWSSystem32driversCT20XUT.SYS [2008-03-20 171032]
S3 CT20XUT;CT20XUT; C:WINDOWSsystem32driversCT20XUT.SYS [2008-03-20 171032]
S3 CTAUDFX.SYS;CTAUDFX.SYS; C:WINDOWSSystem32driversCTAUDFX.SYS [2008-03-20 528920]
S3 CTAUDFX;CTAUDFX; C:WINDOWSsystem32driversCTAUDFX.SYS [2008-03-20 528920]
S3 CTEAPSFX.SYS;CTEAPSFX.SYS; C:WINDOWSSystem32driversCTEAPSFX.SYS [2008-03-20 163352]
S3 CTEAPSFX;CTEAPSFX; C:WINDOWSsystem32driversCTEAPSFX.SYS [2008-03-20 163352]
S3 CTEDSPFX.SYS;CTEDSPFX.SYS; C:WINDOWSSystem32driversCTEDSPFX.SYS [2008-03-20 259096]
S3 CTEDSPFX;CTEDSPFX; C:WINDOWSsystem32driversCTEDSPFX.SYS [2008-03-20 259096]
S3 CTEDSPIO.SYS;CTEDSPIO.SYS; C:WINDOWSSystem32driversCTEDSPIO.SYS [2008-03-20 134168]
S3 CTEDSPIO;CTEDSPIO; C:WINDOWSsystem32driversCTEDSPIO.SYS [2008-03-20 134168]
S3 CTEDSPSY.SYS;CTEDSPSY.SYS; C:WINDOWSSystem32driversCTEDSPSY.SYS [2008-03-20 309784]
S3 CTEDSPSY;CTEDSPSY; C:WINDOWSsystem32driversCTEDSPSY.SYS [2008-03-20 309784]
S3 CTERFXFX.SYS;CTERFXFX.SYS; C:WINDOWSSystem32driversCTERFXFX.SYS [2008-03-20 99352]
S3 CTERFXFX;CTERFXFX; C:WINDOWSsystem32driversCTERFXFX.SYS [2008-03-20 99352]
S3 CTEXFIFX.SYS;CTEXFIFX.SYS; C:WINDOWSSystem32driversCTEXFIFX.SYS [2008-03-20 1324056]
S3 CTEXFIFX;CTEXFIFX; C:WINDOWSsystem32driversCTEXFIFX.SYS [2008-03-20 1324056]
S3 CTHWIUT.SYS;CTHWIUT.SYS; C:WINDOWSSystem32driversCTHWIUT.SYS [2008-03-20 72728]
S3 CTHWIUT;CTHWIUT; C:WINDOWSsystem32driversCTHWIUT.SYS [2008-03-20 72728]
S3 CTSBLFX.SYS;CTSBLFX.SYS; C:WINDOWSSystem32driversCTSBLFX.SYS [2008-03-20 534040]
S3 CTSBLFX;CTSBLFX; C:WINDOWSsystem32driversCTSBLFX.SYS [2008-03-20 534040]
S3 mbr;mbr; ??C:DOCUME~1GermanLOCALS~1Tempmbr.sys []
S3 Monfilt;Monfilt; C:WINDOWSsystem32driversMonfilt.sys [2006-01-04 1389056]
S3 mouhid;Драйвер мыши HID; C:WINDOWSsystem32DRIVERSmouhid.sys [2001-10-20 12160]
S3 nmwcd;Nokia USB Phone Parent; C:WINDOWSsystem32driversccdcmb.sys [2010-02-26 18176]
S3 nmwcdc;Nokia USB Generic; C:WINDOWSsystem32driversccdcmbo.sys [2010-02-26 22528]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:WINDOWSsystem32DRIVERSpccsmcfd.sys [2008-08-26 18816]
S3 RTL8169;Realtek 8169 NT Driver; C:WINDOWSsystem32DRIVERSRtlh86.sys [2006-12-08 67072]
S3 Tosrfcom;Tosrfcom; C:WINDOWSsystem32driversTosrfcom.sys []
S3 upperdev;upperdev; C:WINDOWSsystem32DRIVERSusbser_lowerflt.sys [2010-02-26 8192]
S3 usbser;USB Modem Driver; C:WINDOWSsystem32driversusbser.sys [2004-08-04 25600]
S3 UsbserFilt;UsbserFilt; C:WINDOWSsystem32DRIVERSusbser_lowerfltj.sys [2010-02-26 8192]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:WINDOWSSystem32Driverswdf01000.sys [2009-07-14 444136]
S3 WpdUsb;WpdUsb; C:WINDOWSSystem32Driverswpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2006-09-28 82944]
S4 RxFilter;RxFilter; C:WINDOWSsystem32DRIVERSRxFilter.sys [2008-08-11 57328]
S4 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:WINDOWSSystem32driversws2ifsl.sys [2001-10-20 12032]======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 Apple Mobile Device;Apple Mobile Device; C:Program FilesCommon FilesAppleMobile Device SupportAppleMobileDeviceService.exe [2010-06-10 144176]
R2 Bonjour Service;Служба Bonjour; C:Program FilesBonjourmDNSResponder.exe [2010-05-18 345376]
R2 ekrn;ESET Service; C:Program FilesESETESET NOD32 Antivirusekrn.exe [2010-04-07 810120]
R2 JavaQuickStarterService;Java Quick Starter; C:Program FilesJavajre6binjqs.exe [2010-07-17 153376]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:Program FilesNeroNero8Nero BackItUpNBService.exe [2007-12-03 869672]
R2 NVSvc;NVIDIA Display Driver Service; C:WINDOWSsystem32nvsvc32.exe [2008-10-07 163908]
R2 StarWindServiceAE;StarWind AE Service; C:Program FilesAlcohol SoftAlcohol 120StarWindStarWindServiceAE.exe [2007-05-28 275968]
R2 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2004-08-17 14336]
R3 iPod Service;Сервис iPod; C:Program FilesiPodbiniPodService.exe [2010-07-21 540968]
R3 NMIndexingService;NMIndexingService; C:Program FilesCommon FilesNeroLibNMIndexingService.exe [2007-12-13 447784]
R3 ServiceLayer;ServiceLayer; C:Program FilesPC Connectivity SolutionServiceLayer.exe [2010-04-27 611840]
S2 gupdate;Google Update Service (gupdate); C:Program FilesGoogleUpdateGoogleUpdate.exe [2010-06-23 136176]
S2 Roxio Upnp Server 11;Roxio Upnp Server 11; C:Program FilesRoxio Creator 2009Digital Home 11RoxioUpnpService11.exe [2008-08-14 367088]
S2 RoxLiveShare11;LiveShare P2P Server 11; C:Program FilesCommon FilesRoxio Shared11.0SharedCOMRoxLiveShare11.exe [2008-08-14 309744]
S2 RoxWatch11;Roxio Hard Drive Watcher 11; C:Program FilesCommon FilesRoxio Shared11.0SharedCOMRoxWatch11.exe [2008-08-14 170480]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2007-10-24 70144]
S3 EhttpSrv;ESET HTTP Server; C:Program FilesESETESET NOD32 AntivirusEHttpSrv.exe [2010-04-07 33560]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:WINDOWSMicrosoft.NetFrameworkv3.0WPFPresentationFontCache.exe [2007-10-09 36864]
S3 IDriverT;InstallDriver Table Manager; C:Program FilesCommon FilesInstallShieldDriver1050Intel 32IDriverT.exe [2005-02-24 73728]
S3 idsvc;Windows CardSpace; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication Foundationinfocard.exe [2007-10-11 864256]
S3 odserv;Microsoft Office Diagnostics Service; C:Program FilesCommon FilesMicrosoft SharedOFFICE12ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2006-10-26 145184]
S3 Roxio UPnP Renderer 11;Roxio UPnP Renderer 11; C:Program FilesRoxio Creator 2009Digital Home 11RoxioUPnPRenderer11.exe [2008-08-14 313840]
S3 RoxMediaDB11;RoxMediaDB11; C:Program FilesCommon FilesRoxio Shared11.0SharedCOMRoxMediaDB11.exe [2008-08-14 1124848]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication FoundationSMSvcHost.exe [2007-10-11 122880]
EOF
Здравствуйте.
клинкните сюда, вы перейдете а страницу.Там написано, как сделать лог комбофикс.Сделайте его и приложите
Прочитайте описание программы Malwarebytes Anti-malware (MBAM).
Скачайте и выполните сканирование вашего компьютера. Удалите всё что будет найдено. В конце работы будет показан лог.
Его содержимое вставьте в ваше следующее сообщение и приложите так же лог Combofix.ComboFix 10-08-18.04 — German 20.08.2010 11:09:42.2.2 — x86
Microsoft Windows XP Home Edition 5.1.2600.2.1251.7.1049.18.2047.1544 [GMT 4:00]
Running from: c:documents and settingsGermanРабочий столComboFix.exe
AV: ESET NOD32 Antivirus 4.2 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Created a new restore point
* Resident AV is activeWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr0.dat
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr1.dat
BITS: Possible infected sites
hxxp://soft.export.yandex.ru
hxxp://download.yandex.ru
c:windowssystem32winlogon.exe . . . is infected!!.
((((((((((((((((((((((((( Files Created from 2010-07-20 to 2010-08-20 )))))))))))))))))))))))))))))))
.2010-08-14 15:04 . 2010-08-14 15:04
d
w- C:rsit
2010-08-09 18:09 . 2010-08-09 18:09
d
w- c:program filesiPod
2010-08-09 18:09 . 2010-08-09 18:11
d
w- c:program filesiTunes
2010-08-09 18:01 . 2010-08-09 18:01 73000 —-a-w- c:documents and settingsAll UsersApplication DataApple ComputerInstaller CacheiTunes 9.2.1.5SetupAdmin.exe
2010-08-09 17:57 . 2010-08-09 17:57 72488 —-a-w- c:documents and settingsAll UsersApplication DataApple ComputerInstaller CacheSafari 5.33.17.8SetupAdmin.exe
2010-08-04 10:50 . 2010-08-04 10:50 503808 —-a-w- c:documents and settingsGermanApplication DataSunJavaDeploymentSystemCache6.047ec4bf04-2917284f-nmsvcp71.dll
2010-08-04 10:50 . 2010-08-04 10:50 499712 —-a-w- c:documents and settingsGermanApplication DataSunJavaDeploymentSystemCache6.047ec4bf04-2917284f-njmc.dll
2010-08-04 10:50 . 2010-08-04 10:50 348160 —-a-w- c:documents and settingsGermanApplication DataSunJavaDeploymentSystemCache6.047ec4bf04-2917284f-nmsvcr71.dll
2010-08-04 10:50 . 2010-08-04 10:50 61440 —-a-w- c:documents and settingsGermanApplication DataSunJavaDeploymentSystemCache6.0424488892a-2d317ec0-ndecora-sse.dll
2010-08-04 10:50 . 2010-08-04 10:50 12800 —-a-w- c:documents and settingsGermanApplication DataSunJavaDeploymentSystemCache6.0424488892a-2d317ec0-ndecora-d3d.dll
2010-08-02 05:43 . 2010-08-02 05:43
d
w- c:program filesCommon FilesJava
2010-07-27 17:16 . 2007-11-08 12:26 1164728 —-a-w- c:windowssystem32NMSDVDXU.dll
2010-07-27 17:16 . 2010-07-27 17:16
d
w- c:documents and settingsGermanApplication DataLG Electronics
2010-07-27 17:15 . 2010-07-27 17:16
d
w- c:program filesLG Electronics.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-20 07:03 . 2009-10-21 14:56
d
w- c:documents and settingsGermanApplication DataSkype
2010-08-20 06:15 . 2009-10-21 15:02
d
w- c:documents and settingsGermanApplication DataskypePM
2010-08-18 05:28 . 2009-07-10 05:50
d
w- c:program filesOpera
2010-08-17 20:10 . 2009-06-17 18:06
d
w- c:documents and settingsGermanApplication DataThe Bat!
2010-08-14 15:04 . 2009-07-29 18:30
d
w- c:program filesTrend Micro
2010-08-12 14:13 . 2009-06-19 10:11
d
w- c:documents and settingsAll UsersApplication DatanView_Profiles
2010-08-10 19:25 . 2009-06-17 21:11
d
w- c:documents and settingsAll UsersApplication DataSonic
2010-08-09 18:09 . 2009-06-22 17:58
d
w- c:program filesCommon FilesApple
2010-08-09 18:00 . 2009-06-17 20:07
d
w- c:program filesSafari
2010-08-02 05:43 . 2009-06-20 22:56
d
w- c:program filesJava
2010-07-27 17:15 . 2009-06-17 17:45
d—h—w- c:program filesInstallShield Installation Information
2010-07-18 08:36 . 2009-06-20 15:20 33212 —ha-w- c:windowssystem32mlfcache.dat
2010-07-17 01:00 . 2010-04-20 20:10 423656 —-a-w- c:windowssystem32deployJava1.dll
2010-07-16 09:50 . 2010-07-16 09:50
d
w- c:documents and settingsGermanApplication DataMy Games
2010-07-16 09:50 . 2004-07-17 10:36 163644 —-a-w- c:windowssystem32driverssecdrv.sys
2010-07-16 09:43 . 2009-06-17 16:48 42184 —-a-w- c:documents and settingsGermanLocal SettingsApplication DataGDIPFONTCACHEV1.DAT
2010-07-09 08:42 . 2010-02-15 14:13 69222840 —-a-w- c:documents and settingsGermanApplication DataNokiaOvi SuiteSoftware UpdaterNokiaOviSuite2Installer.exe
2010-07-04 00:41 . 2009-08-04 18:21 1704528 —-a-w- c:documents and settingsLocalServiceLocal SettingsApplication DataFontCache3.0.0.0.dat
2010-07-01 17:32 . 2010-05-31 20:03
d
w- c:documents and settingsGermanApplication DataQipGuard
2010-07-01 17:30 . 2009-06-17 17:59
d
w- c:program filesQIP Infium
2010-06-27 17:55 . 2010-06-27 17:55
d
w- c:program filesQIP
2010-06-27 17:42 . 2010-06-27 17:42
d
w- c:program filesQIP 2010
2010-06-26 08:35 . 2009-06-21 18:42
d—a-w- c:documents and settingsAll UsersApplication DataTEMP
2010-06-22 22:08 . 2009-08-06 00:58
d
w- c:program filesGoogle
2010-06-21 18:17 . 2010-06-21 18:17
d
w- c:program filesBonjour
2010-06-21 17:59 . 2010-06-21 17:59 71992 —-a-w- c:documents and settingsAll UsersApplication DataApple ComputerInstaller CacheSafari 5.33.16.0SetupAdmin.exe
2010-06-21 09:47 . 2009-06-21 17:43
d
w- c:program filesEset
2010-06-10 11:07 . 2010-05-31 20:02 127440 —-a-w- c:documents and settingsGermanApplication DataMozillaFirefoxProfilesy8vhokyw.defaultextensions{32a1fd71-835e-4b11-8e54-886fda0b4c89}componentsqippipe.dll
2010-06-10 11:07 . 2010-05-31 20:03 190416 —-a-w- c:documents and settingsGermanApplication DataQipGuardQipGuard.exe
2010-06-10 11:07 . 2010-05-31 20:03 280440 —-a-w- c:documents and settingsGermanApplication DataQipGuardsqlite3.dll
2010-06-10 11:07 . 2010-05-31 20:03 48080 —-a-w- c:documents and settingsGermanApplication DataMicrosoftInternet Explorerqstatsrv.dll
2010-06-10 11:07 . 2010-05-31 20:03 20944 —-a-w- c:documents and settingsGermanApplication DataQipGuardchrome.dll
2010-06-03 20:54 . 2010-06-03 20:54 2944904 —-a-w- c:documents and settingsGermanApplication DataMozillaFirefoxProfilesy8vhokyw.defaultextensionstoolbar@ask.comchrometempaskToolbar.exe
2010-05-27 07:50 . 2010-05-27 07:50 503808 —-a-w- c:documents and settingsGermanApplication DataSunJavaDeploymentSystemCache6.046f84c6ae-678beb51-nmsvcp71.dll
2010-05-27 07:50 . 2010-05-27 07:50 499712 —-a-w- c:documents and settingsGermanApplication DataSunJavaDeploymentSystemCache6.046f84c6ae-678beb51-njmc.dll
2010-05-27 07:50 . 2010-05-27 07:50 348160 —-a-w- c:documents and settingsGermanApplication DataSunJavaDeploymentSystemCache6.046f84c6ae-678beb51-nmsvcr71.dll
2010-05-27 07:50 . 2010-05-27 07:50 61440 —-a-w- c:documents and settingsGermanApplication DataSunJavaDeploymentSystemCache6.0505535ab32-7f49b3e5-ndecora-sse.dll
2010-05-27 07:50 . 2010-05-27 07:50 12800 —-a-w- c:documents and settingsGermanApplication DataSunJavaDeploymentSystemCache6.0505535ab32-7f49b3e5-ndecora-d3d.dll
2010-05-25 13:52 . 2001-10-20 12:00 88404 —-a-w- c:windowssystem32perfc019.dat
2010-05-25 13:52 . 2001-10-20 12:00 493976 —-a-w- c:windowssystem32perfh019.dat
2010-05-24 19:11 . 2010-05-24 19:11 3351812 —-a-w- c:documents and settingsAll UsersApplication DataInstallations{09C468CA-2940-466A-AAE8-DCC0C6E9323C}InstallerCommonCustomActionsmsxml6Exec.exe
2010-05-24 19:11 . 2010-05-24 19:11 36864 —-a-w- c:documents and settingsAll UsersApplication DataInstallations{09C468CA-2940-466A-AAE8-DCC0C6E9323C}InstallerCommonCustomActionsSleep.exe
2010-05-24 19:10 . 2010-05-24 19:10 3203453 —-a-w- c:documents and settingsAll UsersApplication DataInstallations{09C468CA-2940-466A-AAE8-DCC0C6E9323C}InstallerCommonCustomActionsvcredistExec.exe
2010-05-24 19:10 . 2010-05-24 19:12 35768328 —-a-w- c:documents and settingsAll UsersApplication DataInstallations{09C468CA-2940-466A-AAE8-DCC0C6E9323C}NokiaSoftwareUpdaterSetup_ru.exe
2010-03-31 08:31 . 2010-03-31 08:18 35859752 —-a-w- c:program files42fs4hff.exe
2009-11-09 10:30 . 2009-06-20 22:53 21377872 —-a-w- c:program fileslaunch.exe
2009-07-21 19:19 . 2009-07-09 23:15 3 —-a-w- c:program filesCommon Filestime.cv
2009-06-20 23:22 . 2009-06-20 23:22 4649 —-a-w- c:program filesCommon Filesunins000.dat
2009-06-20 23:21 . 2009-06-20 23:22 1214827 —-a-w- c:program filesCommon Filesunins000.exe
2004-07-22 06:51 . 2004-07-22 06:51 3432656 —-a-w- c:program filesManagedDX.CAB
2004-07-19 18:58 . 2004-07-19 18:58 1156363 —-a-w- c:program filesBDANT.cab
2004-07-19 18:53 . 2004-07-19 18:53 976020 —-a-w- c:program filesBDAXP.cab
2004-07-09 10:17 . 2004-07-09 10:17 13265040 —-a-w- c:program filesdxnt.cab
2004-07-09 05:13 . 2004-07-09 05:13 15493481 —-a-w- c:program filesDirectX.cab
2004-07-09 05:13 . 2004-07-09 05:13 703080 —-a-w- c:program filesBDA.cab
2004-07-09 00:08 . 2004-07-09 00:08 472576 —-a-w- c:program filesdxsetup.exe
2004-07-09 00:08 . 2004-07-09 00:08 2242560 —-a-w- c:program filesdsetup32.dll
2004-07-08 23:03 . 2004-07-08 23:03 62976 —-a-w- c:program filesDSETUP.dll
2003-11-13 12:31 . 2003-11-13 12:31 1388544 —-a-w- c:program filesSFX Machine LT.dll
2003-11-05 17:37 . 2003-11-05 17:37 11838 —-a-w- c:program filesSFX Machine LT Read Me.rtf
.
Sigcheck
[-] 2009-06-17 . BC260ED748748149DB05B29B256A0500 . 503808 . . [5.1.2600.2180] . . c:windowssystem32winlogon.exe[-] 2007-02-06 . BA6FBEBD54BA6F80A330C4BE69A137F8 . 1548288 . . [5.1.2600.2180] . . c:windowssystem32sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]
«{00000000-6E41-4FD3-8538-502F5495E5FC}»= «c:program filesAsk.comGenericAskToolbar.dll» [2010-05-26 1385864][HKEY_CLASSES_ROOTclsid{00000000-6e41-4fd3-8538-502f5495e5fc}]
[HKEY_LOCAL_MACHINE~Browser Helper Objects{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-05-26 11:23 1385864 —-a-w- c:program filesAsk.comGenericAskToolbar.dll[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{D4027C7F-154A-4066-A1AD-4243D8127440}»= «c:program filesAsk.comGenericAskToolbar.dll» [2010-05-26 1385864][HKEY_CLASSES_ROOTclsid{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOTGenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOTTypeLib{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOTGenericAskToolbar.ToolbarWnd][HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{D4027C7F-154A-4066-A1AD-4243D8127440}»= «c:program filesAsk.comGenericAskToolbar.dll» [2010-05-26 1385864][HKEY_CLASSES_ROOTclsid{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOTGenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOTTypeLib{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOTGenericAskToolbar.ToolbarWnd][HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«YandexDesktopSearch»=»c:program filesYandexDesktopyandesk.exe» [2007-12-10 7456256]
«SetDefaultMIDI»=»MIDIDef.exe» [2008-03-20 31232]
«IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=»c:program filesCommon FilesNeroLibNMIndexStoreSvr.exe» [2007-12-13 1688872]
«AlcoholAutomount»=»c:program filesAlcohol SoftAlcohol 120axcmd.exe» [2007-08-01 222592]
«RocketDock»=»c:program filesRocketDockRocketDock.exe» [2007-09-02 495616]
«Google Update»=»c:documents and settingsGermanLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe» [2009-07-15 133104]
«EDLauncher»=»c:program filesPRMT8PRMTEDEDLauncher.exe» [2007-08-17 122880]
«Skype»=»c:program filesSkypePhoneSkype.exe» [2010-05-13 26192168]
«EA Core»=»c:program filesElectronic ArtsEADMCore.exe» [2009-09-03 3342336]
«NokiaOviSuite2″=»c:program filesNokiaNokia Ovi SuiteNokiaOviSuite.exe» [2010-02-24 385928]
«QIP Internet Guardian»=»c:documents and settingsGermanApplication DataQipGuardQipGuard.exe» [2010-06-10 190416]
«Infium»=»c:program filesQIP 2010qip.exe» [2010-06-16 5813200]
«QIP2005″=»c:program filesQIPqip.exe» [2009-08-13 3276288][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«EssSpkPhone»=»essspk1.exe -c» [X]
«NokiaMServer»=»c:program filesCommon FilesNokiaMPlatformNokiaMServer» [X]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2008-10-07 13574144]
«nwiz»=»nwiz.exe» [2008-10-07 1630208]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2008-10-07 86016]
«CTHelper»=»CTHELPER.EXE» [2008-03-20 23040]
«CTxfiHlp»=»CTXFIHLP.EXE» [2008-03-20 23552]
«UpdReg»=»c:windowsUpdReg.EXE» [2000-05-10 90112]
«NeroFilterCheck»=»c:program filesCommon FilesNeroLibNeroCheck.exe» [2007-03-01 153136]
«NBKeyScan»=»c:program filesNeroNero8Nero BackItUpNBKeyScan.exe» [2007-12-03 2213160]
«RoxWatchTray»=»c:program filesCommon FilesRoxio Shared11.0SharedCOMRoxWatchTray11.exe» [2008-08-13 240112]
«CPMonitor»=»c:program filesRoxio Creator 20095.0CPMonitor.exe» [2008-08-09 80368]
«WheelMouse»=»c:program filesA4TechMouseAmoumain.exe» [2008-03-05 188416]
«H2O»=»c:program filesSyncroSoftPosH2Ocledx.exe» [2007-12-11 307200]
«adstopper»=»c:program filesAdStoperAdStopperTrayApp.exe» [2009-07-21 588800]
«DDKL»=»c:program filesKeyLogmsdtsf.exe» [2007-06-15 2809856]
«MDDiskProtect.exe»=»c:program filesMediafourMacDriveMDDiskProtect.exe» [2005-03-27 94208]
«MediafourGettingStartedWithMacDrive6″=»c:program filesMediafourMacDriveMacDrive.exe» [2005-03-27 86016]
«Mediafour Mac Volume Notifications»=»c:program filesCommon FilesMediafourMACVNTFY.EXE» [2005-03-27 61440]
«RTHDCPL»=»RTHDCPL.EXE» [2009-09-22 18749440]
«Adobe Reader Speed Launcher»=»c:program filesAdobeReader 9.0ReaderReader_sl.exe» [2010-06-20 35760]
«Adobe ARM»=»c:program filesCommon FilesAdobeARM1.0AdobeARM.exe» [2010-06-09 976832]
«QuickTime Task»=»c:program filesQuickTimeQTTask.exe» [2010-03-17 421888]
«NokiaMusic FastStart»=»c:program filesNokiaOvi PlayerNokiaOviPlayer.exe» [2010-03-04 2192672]
«egui»=»c:program filesESETESET NOD32 Antivirusegui.exe» [2010-04-07 2145000]
«SunJavaUpdateSched»=»c:program filesCommon FilesJavaJava Updatejusched.exe» [2010-05-14 248552]
«iTunesHelper»=»c:program filesiTunesiTunesHelper.exe» [2010-07-21 141608][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2004-08-17 15360]c:documents and settingsGermanѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
Punto Switcher.lnk — c:program filesYandexPunto Switcherpunto.exe [2009-8-27 831272]
Startup Defender.lnk — c:program filesZards softwareStartup DefenderStartup Defender.exe [2009-1-26 1045504][HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotifyMacDrive-iTunes compatibility]
2005-03-27 18:18 61440 —-a-r- c:program filesCommon FilesMediafourMacDriveiTunesPatch.dll[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalWdf01000.sys]
@=»Driver»[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE»=
«c:\Program Files\Skype\Plugin Manager\skypePM.exe»=
«c:\Program Files\Opera\opera.exe»=
«c:\Program Files\Bonjour\mDNSResponder.exe»=
«h:\Games\Sid Meier’s Civilization 4\Civilization4.exe»=
«c:\Program Files\iTunes\iTunes.exe»=
«c:\Program Files\Skype\Phone\Skype.exe»=R0 MDPMGRNT;MDPMGRNT;c:windowssystem32driversMDPMGRNT.SYS [27.03.2005 22:18 44404]
R1 ehdrv;ehdrv;c:windowssystem32driversehdrv.sys [14.05.2009 15:47 114984]
R1 epfwtdir;epfwtdir;c:windowssystem32driversepfwtdir.sys [14.05.2009 15:49 95872]
R1 MDFSYSNT;MDFSYSNT;c:windowssystem32driversMDFSYSNT.SYS [27.03.2005 22:18 277352]
R1 prodrv04;Star Force copy protection driver v4;c:windowssystem32driversprodrv04.sys [08.08.2009 19:14 114496]
R2 ekrn;ESET Service;c:program filesEsetESET NOD32 Antivirusekrn.exe [07.04.2010 21:07 810120]
R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;c:windowssystem32driversAmps2prt.sys [19.06.2009 14:21 14336]
R3 CLEDX;Team H2O CLEDX service;c:windowssystem32driverscledx.sys [21.06.2009 21:53 33792]
S2 gupdate;Google Update Service (gupdate);c:program filesGoogleUpdateGoogleUpdate.exe [23.06.2010 2:02 136176]
S2 Roxio Upnp Server 11;Roxio Upnp Server 11;c:program filesRoxio Creator 2009Digital Home 11RoxioUpnpService11.exe [14.08.2008 0:25 367088]
S2 RoxLiveShare11;LiveShare P2P Server 11;c:program filesCommon FilesRoxio Shared11.0SharedCOMRoxLiveShare11.exe [14.08.2008 0:24 309744]
S2 RoxWatch11;Roxio Hard Drive Watcher 11;c:program filesCommon FilesRoxio Shared11.0SharedCOMRoxWatch11.exe [14.08.2008 0:24 170480]
S3 Ambfilt;Ambfilt;c:windowssystem32driversAmbfilt.sys [28.10.2009 21:08 1684736]
S3 COMMONFX.SYS;COMMONFX.SYS;c:windowssystem32driversCOMMONFX.sys [20.03.2008 17:23 98328]
S3 COMMONFX;COMMONFX;c:windowssystem32driversCOMMONFX.sys [20.03.2008 17:23 98328]
S3 CT20XUT.SYS;CT20XUT.SYS;c:windowssystem32driversCT20XUT.sys [20.03.2008 17:36 171032]
S3 CT20XUT;CT20XUT;c:windowssystem32driversCT20XUT.sys [20.03.2008 17:36 171032]
S3 CTAUDFX.SYS;CTAUDFX.SYS;c:windowssystem32driversCTAUDFX.sys [20.03.2008 17:23 528920]
S3 CTAUDFX;CTAUDFX;c:windowssystem32driversCTAUDFX.sys [20.03.2008 17:23 528920]
S3 CTEAPSFX.SYS;CTEAPSFX.SYS;c:windowssystem32driversCTEAPSFX.sys [20.03.2008 17:26 163352]
S3 CTEAPSFX;CTEAPSFX;c:windowssystem32driversCTEAPSFX.sys [20.03.2008 17:26 163352]
S3 CTEDSPFX.SYS;CTEDSPFX.SYS;c:windowssystem32driversCTEDSPFX.sys [20.03.2008 17:32 259096]
S3 CTEDSPFX;CTEDSPFX;c:windowssystem32driversCTEDSPFX.sys [20.03.2008 17:32 259096]
S3 CTEDSPIO.SYS;CTEDSPIO.SYS;c:windowssystem32driversCTEDSPIO.sys [20.03.2008 17:38 134168]
S3 CTEDSPIO;CTEDSPIO;c:windowssystem32driversCTEDSPIO.sys [20.03.2008 17:38 134168]
S3 CTEDSPSY.SYS;CTEDSPSY.SYS;c:windowssystem32driversCTEDSPSY.sys [20.03.2008 17:37 309784]
S3 CTEDSPSY;CTEDSPSY;c:windowssystem32driversCTEDSPSY.sys [20.03.2008 17:37 309784]
S3 CTERFXFX.SYS;CTERFXFX.SYS;c:windowssystem32driversCTERFXFX.sys [20.03.2008 17:36 99352]
S3 CTERFXFX;CTERFXFX;c:windowssystem32driversCTERFXFX.sys [20.03.2008 17:36 99352]
S3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:windowssystem32driversCTEXFIFX.sys [20.03.2008 17:40 1324056]
S3 CTEXFIFX;CTEXFIFX;c:windowssystem32driversCTEXFIFX.sys [20.03.2008 17:40 1324056]
S3 CTHWIUT.SYS;CTHWIUT.SYS;c:windowssystem32driversCTHWIUT.sys [20.03.2008 17:37 72728]
S3 CTHWIUT;CTHWIUT;c:windowssystem32driversCTHWIUT.sys [20.03.2008 17:37 72728]
S3 CTSBLFX.SYS;CTSBLFX.SYS;c:windowssystem32driversCTSBLFX.sys [20.03.2008 17:25 534040]
S3 CTSBLFX;CTSBLFX;c:windowssystem32driversCTSBLFX.sys [20.03.2008 17:25 534040]
S3 Roxio UPnP Renderer 11;Roxio UPnP Renderer 11;c:program filesRoxio Creator 2009Digital Home 11RoxioUPnPRenderer11.exe [14.08.2008 0:25 313840]
S3 RoxMediaDB11;RoxMediaDB11;c:program filesCommon FilesRoxio Shared11.0SharedCOMRoxMediaDB11.exe [14.08.2008 0:23 1124848]
S4 sptd;sptd;c:windowssystem32driverssptd.sys [18.06.2009 0:37 685816]
.
Contents of the ‘Scheduled Tasks’ folder2010-08-16 c:windowsTasksAppleSoftwareUpdate.job
— c:program filesApple Software UpdateSoftwareUpdate.exe [2008-07-30 08:34]2010-08-20 c:windowsTasksGoogleUpdateTaskMachineCore.job
— c:program filesGoogleUpdateGoogleUpdate.exe [2010-06-22 22:01]2010-08-19 c:windowsTasksGoogleUpdateTaskMachineUA.job
— c:program filesGoogleUpdateGoogleUpdate.exe [2010-06-22 22:01]2010-08-17 c:windowsTasksGoogleUpdateTaskUserS-1-5-21-790525478-583907252-725345543-1004Core.job
— c:documents and settingsGermanLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe [2009-07-15 21:36]2010-08-20 c:windowsTasksGoogleUpdateTaskUserS-1-5-21-790525478-583907252-725345543-1004UA.job
— c:documents and settingsGermanLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe [2009-07-15 21:36]2010-08-20 c:windowsTasksScheduled Update for Ask Toolbar.job
— c:program filesAsk.comUpdateTask.exe [2010-05-26 11:23]
.
.
Supplementary Scan
.
uStart Page = hxxp://qip.ru
uDefault_Search_URL = hxxp://search.qip.ru
uSearchAssistant = hxxp://search.qip.ru/ie
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
FF — ProfilePath — c:documents and settingsGermanApplication DataMozillaFirefoxProfilesy8vhokyw.default
FF — prefs.js: browser.search.selectedEngine — Ask.com
FF — prefs.js: browser.startup.homepage — hxxp://qip.ru
FF — component: c:documents and settingsGermanApplication DataMozillaFirefoxProfilesy8vhokyw.defaultextensions{32a1fd71-835e-4b11-8e54-886fda0b4c89}componentsqippipe.dll
FF — component: c:program filesNokiaNokia Ovi SuiteConnectorsBookmarks ConnectorFirefoxExtensioncomponentsFirefoxExtension.dll
FF — plugin: c:documents and settingsGermanApplication DataMozillaFirefoxProfilesy8vhokyw.defaultextensionsfirefox@tvunetworks.compluginsnpTVUAx.dll
FF — plugin: c:documents and settingsGermanLocal SettingsApplication DataGoogleUpdate1.2.183.29npGoogleOneClick8.dll
FF — plugin: c:program filesGoogleGoogle Earthpluginnpgeplugin.dll
FF — plugin: c:program filesGoogleUpdate1.2.183.23npGoogleOneClick8.dll
FF — plugin: c:program filesJavajre6binnew_pluginnpdeployJava1.dll—- FIREFOX POLICIES —-
c:program filesMozilla Firefoxgreprefsall.js — pref(«ui.use_native_colors», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.IDN.whitelist.lu», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.IDN.whitelist.nu», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.IDN.whitelist.nz», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.IDN.whitelist.xn--mgbaam7a8h», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.IDN.whitelist.xn--mgberp4a5d4ar», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.IDN.whitelist.xn--p1ai», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.IDN.whitelist.xn--mgbayh7gpa», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.IDN.whitelist.tel», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.auth.force-generic-ntlm», false);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.proxy.type», 5);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.buffer.cache.count», 24);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.buffer.cache.size», 4096);
c:program filesMozilla Firefoxgreprefsall.js — pref(«dom.ipc.plugins.timeoutSecs», 45);
c:program filesMozilla Firefoxgreprefsall.js — pref(«svg.smil.enabled», false);
c:program filesMozilla Firefoxgreprefsall.js — pref(«accelerometer.enabled», true);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js — pref(«security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref», true);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js — pref(«security.ssl.renego_unrestricted_hosts», «»);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js — pref(«security.ssl.treat_unsafe_negotiation_as_broken», false);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js — pref(«security.ssl.require_safe_negotiation», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name», «chrome://browser/locale/browser.properties»);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description», «chrome://browser/locale/browser.properties»);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«plugins.update.notifyUser», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«dom.ipc.plugins.enabled.nptest.dll», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«dom.ipc.plugins.enabled.npswf32.dll», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«dom.ipc.plugins.enabled.npctrl.dll», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«dom.ipc.plugins.enabled.npqtplugin.dll», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«dom.ipc.plugins.enabled», false);
.
— — — — ORPHANS REMOVED — — — —URLSearchHooks-{9CB65206-89C4-402c-BA80-02D8C59F9B1D} — c:program filesAskTBarSrchAstt1.binA5SRCHAS.DLL
ShellIconOverlayIdentifiers-Mediafour Mac Volume Icons — (no file)**************************************************************************
scanning hidden processes …scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files:**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(720)
c:program filesCommon FilesMediafourMacDriveiTunesPatch.dll
.
Completion time: 2010-08-20 11:17:51
ComboFix-quarantined-files.txt 2010-08-20 07:17Pre-Run: 7 551 250 432 байт свободно
Post-Run: 7 537 602 560 байт свободно— — End Of File — — AF3DD534E6EF5AD7497540F598C387AC
Скопируйте текст ниже в блокнот и сохраните как файл с названием CFScript.txt на рабочий стол.
KillAll::
File::
c:windowsTasksScheduled Update for Ask Toolbar.job
Driver::
Folder::
c:program filesAsk.com
Registry::
[-HKEY_LOCAL_MACHINE~Browser Helper Objects{D4027C7F-154A-4066-A1AD-4243D8127440}]
FileLook::
c:program files42fs4hff.exe
c:program fileslaunch.exe
c:program filesCommon Filestime.cv
c:program filesCommon Filesunins000.dat
c:program filesCommon Filesunins000.exe
DirLook::
c:program filesZards softwareStartup Defender
После сохранения переместите CFScript.txt на пиктограмму ComboFix.exe.
Когда сохранится новый отчет ComboFix, запакуйте ComboFix.txt и прикрепите к сообщению.ComboFix 10-08-18.04 — German 21.08.2010 16:38:19.3.2 — x86
Microsoft Windows XP Home Edition 5.1.2600.2.1251.7.1049.18.2047.1175 [GMT 4:00]
Running from: c:documents and settingsGermanРабочий столComboFix.exe
Command switches used :: c:documents and settingsGermanРабочий столCFScript.txt
AV: ESET NOD32 Antivirus 4.2 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}FILE ::
«c:windowsTasksScheduled Update for Ask Toolbar.job»
.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr0.dat
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr1.dat
c:program filesAsk.com
c:program filesAsk.comcobrand.ico
c:program filesAsk.comconfig.xml
c:program filesAsk.comfavicon.ico
c:program filesAsk.comfv_1afa.ico
c:program filesAsk.comGenericAskToolbar.dll
c:program filesAsk.commupcfg.xml
c:program filesAsk.comSaUpdate.exe
c:program filesAsk.comUpdateTask.exe
c:windowsTasksScheduled Update for Ask Toolbar.job
BITS: Possible infected sites
hxxp://soft.export.yandex.ru
hxxp://download.yandex.ru
c:windowssystem32winlogon.exe . . . is infected!!.
((((((((((((((((((((((((( Files Created from 2010-07-21 to 2010-08-21 )))))))))))))))))))))))))))))))
.2010-08-14 15:04 . 2010-08-14 15:04
d
w- C:rsit
2010-08-09 18:09 . 2010-08-09 18:09
d
w- c:program filesiPod
2010-08-09 18:09 . 2010-08-09 18:11
d
w- c:program filesiTunes
2010-08-02 05:43 . 2010-08-02 05:43
d
w- c:program filesCommon FilesJava
2010-07-27 17:16 . 2007-11-08 12:26 1164728 —-a-w- c:windowssystem32NMSDVDXU.dll
2010-07-27 17:16 . 2010-07-27 17:16
d
w- c:documents and settingsGermanApplication DataLG Electronics
2010-07-27 17:15 . 2010-07-27 17:16
d
w- c:program filesLG Electronics.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-21 12:38 . 2009-10-21 14:56
d
w- c:documents and settingsGermanApplication DataSkype
2010-08-21 12:07 . 2009-10-21 15:02
d
w- c:documents and settingsGermanApplication DataskypePM
2010-08-20 17:32 . 2009-06-17 18:06
d
w- c:documents and settingsGermanApplication DataThe Bat!
2010-08-18 05:28 . 2009-07-10 05:50
d
w- c:program filesOpera
2010-08-14 15:04 . 2009-07-29 18:30
d
w- c:program filesTrend Micro
2010-08-12 14:13 . 2009-06-19 10:11
d
w- c:documents and settingsAll UsersApplication DatanView_Profiles
2010-08-10 19:25 . 2009-06-17 21:11
d
w- c:documents and settingsAll UsersApplication DataSonic
2010-08-09 18:09 . 2009-06-22 17:58
d
w- c:program filesCommon FilesApple
2010-08-09 18:01 . 2010-08-09 18:01 73000 —-a-w- c:documents and settingsAll UsersApplication DataApple ComputerInstaller CacheiTunes 9.2.1.5SetupAdmin.exe
2010-08-09 18:00 . 2009-06-17 20:07
d
w- c:program filesSafari
2010-08-09 17:57 . 2010-08-09 17:57 72488 —-a-w- c:documents and settingsAll UsersApplication DataApple ComputerInstaller CacheSafari 5.33.17.8SetupAdmin.exe
2010-08-04 10:50 . 2010-08-04 10:50 503808 —-a-w- c:documents and settingsGermanApplication DataSunJavaDeploymentSystemCache6.047ec4bf04-2917284f-nmsvcp71.dll
2010-08-04 10:50 . 2010-08-04 10:50 499712 —-a-w- c:documents and settingsGermanApplication DataSunJavaDeploymentSystemCache6.047ec4bf04-2917284f-njmc.dll
2010-08-04 10:50 . 2010-08-04 10:50 348160 —-a-w- c:documents and settingsGermanApplication DataSunJavaDeploymentSystemCache6.047ec4bf04-2917284f-nmsvcr71.dll
2010-08-04 10:50 . 2010-08-04 10:50 61440 —-a-w- c:documents and settingsGermanApplication DataSunJavaDeploymentSystemCache6.0424488892a-2d317ec0-ndecora-sse.dll
2010-08-04 10:50 . 2010-08-04 10:50 12800 —-a-w- c:documents and settingsGermanApplication DataSunJavaDeploymentSystemCache6.0424488892a-2d317ec0-ndecora-d3d.dll
2010-08-02 05:43 . 2009-06-20 22:56
d
w- c:program filesJava
2010-07-27 17:15 . 2009-06-17 17:45
d—h—w- c:program filesInstallShield Installation Information
2010-07-18 08:36 . 2009-06-20 15:20 33212 —ha-w- c:windowssystem32mlfcache.dat
2010-07-17 01:00 . 2010-04-20 20:10 423656 —-a-w- c:windowssystem32deployJava1.dll
2010-07-16 09:50 . 2010-07-16 09:50
d
w- c:documents and settingsGermanApplication DataMy Games
2010-07-16 09:50 . 2004-07-17 10:36 163644 —-a-w- c:windowssystem32driverssecdrv.sys
2010-07-16 09:43 . 2009-06-17 16:48 42184 —-a-w- c:documents and settingsGermanLocal SettingsApplication DataGDIPFONTCACHEV1.DAT
2010-07-09 08:42 . 2010-02-15 14:13 69222840 —-a-w- c:documents and settingsGermanApplication DataNokiaOvi SuiteSoftware UpdaterNokiaOviSuite2Installer.exe
2010-07-04 00:41 . 2009-08-04 18:21 1704528 —-a-w- c:documents and settingsLocalServiceLocal SettingsApplication DataFontCache3.0.0.0.dat
2010-07-01 17:32 . 2010-05-31 20:03
d
w- c:documents and settingsGermanApplication DataQipGuard
2010-07-01 17:30 . 2009-06-17 17:59
d
w- c:program filesQIP Infium
2010-06-27 17:55 . 2010-06-27 17:55
d
w- c:program filesQIP
2010-06-27 17:42 . 2010-06-27 17:42
d
w- c:program filesQIP 2010
2010-06-26 08:35 . 2009-06-21 18:42
d—a-w- c:documents and settingsAll UsersApplication DataTEMP
2010-06-22 22:08 . 2009-08-06 00:58
d
w- c:program filesGoogle
2010-06-21 17:59 . 2010-06-21 17:59 71992 —-a-w- c:documents and settingsAll UsersApplication DataApple ComputerInstaller CacheSafari 5.33.16.0SetupAdmin.exe
2010-06-10 11:07 . 2010-05-31 20:02 127440 —-a-w- c:documents and settingsGermanApplication DataMozillaFirefoxProfilesy8vhokyw.defaultextensions{32a1fd71-835e-4b11-8e54-886fda0b4c89}componentsqippipe.dll
2010-06-10 11:07 . 2010-05-31 20:03 190416 —-a-w- c:documents and settingsGermanApplication DataQipGuardQipGuard.exe
2010-06-10 11:07 . 2010-05-31 20:03 280440 —-a-w- c:documents and settingsGermanApplication DataQipGuardsqlite3.dll
2010-06-10 11:07 . 2010-05-31 20:03 48080 —-a-w- c:documents and settingsGermanApplication DataMicrosoftInternet Explorerqstatsrv.dll
2010-06-10 11:07 . 2010-05-31 20:03 20944 —-a-w- c:documents and settingsGermanApplication DataQipGuardchrome.dll
2010-06-03 20:54 . 2010-06-03 20:54 2944904 —-a-w- c:documents and settingsGermanApplication DataMozillaFirefoxProfilesy8vhokyw.defaultextensionstoolbar@ask.comchrometempaskToolbar.exe
2010-05-27 07:50 . 2010-05-27 07:50 503808 —-a-w- c:documents and settingsGermanApplication DataSunJavaDeploymentSystemCache6.046f84c6ae-678beb51-nmsvcp71.dll
2010-05-27 07:50 . 2010-05-27 07:50 499712 —-a-w- c:documents and settingsGermanApplication DataSunJavaDeploymentSystemCache6.046f84c6ae-678beb51-njmc.dll
2010-05-27 07:50 . 2010-05-27 07:50 348160 —-a-w- c:documents and settingsGermanApplication DataSunJavaDeploymentSystemCache6.046f84c6ae-678beb51-nmsvcr71.dll
2010-05-27 07:50 . 2010-05-27 07:50 61440 —-a-w- c:documents and settingsGermanApplication DataSunJavaDeploymentSystemCache6.0505535ab32-7f49b3e5-ndecora-sse.dll
2010-05-27 07:50 . 2010-05-27 07:50 12800 —-a-w- c:documents and settingsGermanApplication DataSunJavaDeploymentSystemCache6.0505535ab32-7f49b3e5-ndecora-d3d.dll
2010-05-25 13:52 . 2001-10-20 12:00 88404 —-a-w- c:windowssystem32perfc019.dat
2010-05-25 13:52 . 2001-10-20 12:00 493976 —-a-w- c:windowssystem32perfh019.dat
2010-05-24 19:11 . 2010-05-24 19:11 3351812 —-a-w- c:documents and settingsAll UsersApplication DataInstallations{09C468CA-2940-466A-AAE8-DCC0C6E9323C}InstallerCommonCustomActionsmsxml6Exec.exe
2010-05-24 19:11 . 2010-05-24 19:11 36864 —-a-w- c:documents and settingsAll UsersApplication DataInstallations{09C468CA-2940-466A-AAE8-DCC0C6E9323C}InstallerCommonCustomActionsSleep.exe
2010-05-24 19:10 . 2010-05-24 19:10 3203453 —-a-w- c:documents and settingsAll UsersApplication DataInstallations{09C468CA-2940-466A-AAE8-DCC0C6E9323C}InstallerCommonCustomActionsvcredistExec.exe
2010-05-24 19:10 . 2010-05-24 19:12 35768328 —-a-w- c:documents and settingsAll UsersApplication DataInstallations{09C468CA-2940-466A-AAE8-DCC0C6E9323C}NokiaSoftwareUpdaterSetup_ru.exe
2010-03-31 08:31 . 2010-03-31 08:18 35859752 —-a-w- c:program files42fs4hff.exe
2009-11-09 10:30 . 2009-06-20 22:53 21377872 —-a-w- c:program fileslaunch.exe
2009-07-21 19:19 . 2009-07-09 23:15 3 —-a-w- c:program filesCommon Filestime.cv
2009-06-20 23:22 . 2009-06-20 23:22 4649 —-a-w- c:program filesCommon Filesunins000.dat
2009-06-20 23:21 . 2009-06-20 23:22 1214827 —-a-w- c:program filesCommon Filesunins000.exe
2004-07-22 06:51 . 2004-07-22 06:51 3432656 —-a-w- c:program filesManagedDX.CAB
2004-07-19 18:58 . 2004-07-19 18:58 1156363 —-a-w- c:program filesBDANT.cab
2004-07-19 18:53 . 2004-07-19 18:53 976020 —-a-w- c:program filesBDAXP.cab
2004-07-09 10:17 . 2004-07-09 10:17 13265040 —-a-w- c:program filesdxnt.cab
2004-07-09 05:13 . 2004-07-09 05:13 15493481 —-a-w- c:program filesDirectX.cab
2004-07-09 05:13 . 2004-07-09 05:13 703080 —-a-w- c:program filesBDA.cab
2004-07-09 00:08 . 2004-07-09 00:08 472576 —-a-w- c:program filesdxsetup.exe
2004-07-09 00:08 . 2004-07-09 00:08 2242560 —-a-w- c:program filesdsetup32.dll
2004-07-08 23:03 . 2004-07-08 23:03 62976 —-a-w- c:program filesDSETUP.dll
2003-11-13 12:31 . 2003-11-13 12:31 1388544 —-a-w- c:program filesSFX Machine LT.dll
2003-11-05 17:37 . 2003-11-05 17:37 11838 —-a-w- c:program filesSFX Machine LT Read Me.rtf
.(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.— c:program files42fs4hff.exe —
Company:
File Description:
File Version:
Product Name:
Copyright:
Original Filename:
File size: 35859752
Created time: 2010-03-31 08:18
Modified time: 2010-03-31 08:31
MD5: 67011E26BB55FC0EECD84CA7CC2FEC22
SHA1: F796BB2A77A3C72BE1DB44989A438FBE943CC246— c:program filesCommon Filestime.cv —
Company:
File Description:
File Version:
Product Name:
Copyright:
Original Filename:
File size: 3
Created time: 2009-07-09 23:15
Modified time: 2009-07-21 19:19
MD5: ABA3B6FD5D186D28E06FF97135CADE7F
SHA1: 0707DCC10EC1CFEE92B537A96FAAB0A38F7BC5A1— c:program filesCommon Filesunins000.dat —
Company:
File Description:
File Version:
Product Name:
Copyright:
Original Filename:
File size: 4649
Created time: 2009-06-20 23:22
Modified time: 2009-06-20 23:22
MD5: 2CE2A38D967D4D697E255CAD4546A70A
SHA1: 84AB867C58C7B85C5EAE7BF0D9B03E2EBD26D8BE— c:program filesCommon Filesunins000.exe —
Company:
File Description: Setup/Uninstall
File Version: 51.1048.0.0
Product Name:
Copyright:
Original Filename:
File size: 1214827
Created time: 2009-06-20 23:22
Modified time: 2009-06-20 23:21
MD5: 2CA5CAD1CE8AF35BE3427EA05C1F4493
SHA1: 4F7AD79B23F8A2749D1AC805CB31A676BDDCF865— c:program fileslaunch.exe —
Company: Doctor Web, Ltd.
File Description: Dr.Web® CureIt!®
File Version: 5.0.2.11099
Product Name: Dr.Web CureIt!
Copyright: © Doctor Web, Ltd., 2004-2009
Original Filename: cureit.exe
File size: 21377872
Created time: 2009-06-20 22:53
Modified time: 2009-11-09 10:30
MD5: EA54F8E3D398E29816F7A5347183A5F1
SHA1: F5EA7411C5C4EF8705DBE87525A9456240F85CCC—- Directory of c:program filesZards softwareStartup Defender —-
2009-07-29 22:27 . 2009-07-29 22:27 0 —-a-w- c:program filesZards softwareStartup DefenderBanPrc.dat
2009-07-29 22:27 . 2009-07-29 22:27 64148 —-a-w- c:program filesZards softwareStartup Defenderuninst.exe
2009-07-29 22:27 . 2009-07-29 22:27 54 —-a-w- c:program filesZards softwareStartup DefenderStartup Defender .url
2009-01-26 02:45 . 2009-01-26 02:45 1045504 —-a-w- c:program filesZards softwareStartup DefenderStartup Defender.exe
2008-04-09 22:11 . 2008-04-09 22:11 10370 —-a-w- c:program filesZards softwareStartup DefenderStartup Defender.exe.manifest
2008-03-27 19:36 . 2008-03-27 19:36 49152 —-a-w- c:program filesZards softwareStartup DefenderInterop.IWshRuntimeLibrary.dll
2008-03-27 19:36 . 2008-03-27 19:36 49152 —-a-w- c:program filesZards softwareStartup DefenderInterop.Shell32.dll
2008-03-13 03:14 . 2008-03-13 03:14 1150 —-a-w- c:program filesZards softwareStartup Defenderstop.ico
2008-03-13 03:13 . 2008-03-13 03:13 1150 —-a-w- c:program filesZards softwareStartup Defenderstart.ico
2007-03-09 21:44 . 2007-03-09 21:44 4643 —-a-w- c:program filesZards softwareStartup DefenderLicense.txt
Sigcheck
[-] 2009-06-17 . BC260ED748748149DB05B29B256A0500 . 503808 . . [5.1.2600.2180] . . c:windowssystem32winlogon.exe[-] 2007-02-06 . BA6FBEBD54BA6F80A330C4BE69A137F8 . 1548288 . . [5.1.2600.2180] . . c:windowssystem32sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-08-20_07.16.43 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-08-21 12:50 . 2010-08-21 12:50 16384 c:windowstempPerflib_Perfdata_4ec.dat
+ 2009-10-01 08:51 . 2010-08-20 07:49 25214 c:windowsInstaller{3829960D-73DA-479B-BBE1-BF0FBC35999B}PeaceShieldIcon.exe
— 2009-10-01 08:51 . 2009-10-01 08:51 25214 c:windowsInstaller{3829960D-73DA-479B-BBE1-BF0FBC35999B}PeaceShieldIcon.exe
+ 2009-10-01 08:51 . 2010-08-20 07:49 34304 c:windowsInstaller{3829960D-73DA-479B-BBE1-BF0FBC35999B}Icon3829960D.exe
— 2009-10-01 08:51 . 2009-10-01 08:51 34304 c:windowsInstaller{3829960D-73DA-479B-BBE1-BF0FBC35999B}Icon3829960D.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«YandexDesktopSearch»=»c:program filesYandexDesktopyandesk.exe» [2007-12-10 7456256]
«SetDefaultMIDI»=»MIDIDef.exe» [2008-03-20 31232]
«IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=»c:program filesCommon FilesNeroLibNMIndexStoreSvr.exe» [2007-12-13 1688872]
«AlcoholAutomount»=»c:program filesAlcohol SoftAlcohol 120axcmd.exe» [2007-08-01 222592]
«RocketDock»=»c:program filesRocketDockRocketDock.exe» [2007-09-02 495616]
«Google Update»=»c:documents and settingsGermanLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe» [2009-07-15 133104]
«EDLauncher»=»c:program filesPRMT8PRMTEDEDLauncher.exe» [2007-08-17 122880]
«Skype»=»c:program filesSkypePhoneSkype.exe» [2010-05-13 26192168]
«EA Core»=»c:program filesElectronic ArtsEADMCore.exe» [2009-09-03 3342336]
«NokiaOviSuite2″=»c:program filesNokiaNokia Ovi SuiteNokiaOviSuite.exe» [2010-02-24 385928]
«QIP Internet Guardian»=»c:documents and settingsGermanApplication DataQipGuardQipGuard.exe» [2010-06-10 190416]
«Infium»=»c:program filesQIP 2010qip.exe» [2010-06-16 5813200]
«QIP2005″=»c:program filesQIPqip.exe» [2009-08-13 3276288][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«EssSpkPhone»=»essspk1.exe -c» [X]
«NokiaMServer»=»c:program filesCommon FilesNokiaMPlatformNokiaMServer» [X]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2008-10-07 13574144]
«nwiz»=»nwiz.exe» [2008-10-07 1630208]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2008-10-07 86016]
«CTHelper»=»CTHELPER.EXE» [2008-03-20 23040]
«CTxfiHlp»=»CTXFIHLP.EXE» [2008-03-20 23552]
«UpdReg»=»c:windowsUpdReg.EXE» [2000-05-10 90112]
«NeroFilterCheck»=»c:program filesCommon FilesNeroLibNeroCheck.exe» [2007-03-01 153136]
«NBKeyScan»=»c:program filesNeroNero8Nero BackItUpNBKeyScan.exe» [2007-12-03 2213160]
«RoxWatchTray»=»c:program filesCommon FilesRoxio Shared11.0SharedCOMRoxWatchTray11.exe» [2008-08-13 240112]
«CPMonitor»=»c:program filesRoxio Creator 20095.0CPMonitor.exe» [2008-08-09 80368]
«WheelMouse»=»c:program filesA4TechMouseAmoumain.exe» [2008-03-05 188416]
«H2O»=»c:program filesSyncroSoftPosH2Ocledx.exe» [2007-12-11 307200]
«adstopper»=»c:program filesAdStoperAdStopperTrayApp.exe» [2009-07-21 588800]
«DDKL»=»c:program filesKeyLogmsdtsf.exe» [2007-06-15 2809856]
«MDDiskProtect.exe»=»c:program filesMediafourMacDriveMDDiskProtect.exe» [2005-03-27 94208]
«MediafourGettingStartedWithMacDrive6″=»c:program filesMediafourMacDriveMacDrive.exe» [2005-03-27 86016]
«Mediafour Mac Volume Notifications»=»c:program filesCommon FilesMediafourMACVNTFY.EXE» [2005-03-27 61440]
«RTHDCPL»=»RTHDCPL.EXE» [2009-09-22 18749440]
«Adobe Reader Speed Launcher»=»c:program filesAdobeReader 9.0ReaderReader_sl.exe» [2010-06-20 35760]
«Adobe ARM»=»c:program filesCommon FilesAdobeARM1.0AdobeARM.exe» [2010-06-09 976832]
«QuickTime Task»=»c:program filesQuickTimeQTTask.exe» [2010-03-17 421888]
«NokiaMusic FastStart»=»c:program filesNokiaOvi PlayerNokiaOviPlayer.exe» [2010-03-04 2192672]
«egui»=»c:program filesESETESET NOD32 Antivirusegui.exe» [2010-04-07 2145000]
«SunJavaUpdateSched»=»c:program filesCommon FilesJavaJava Updatejusched.exe» [2010-05-14 248552]
«iTunesHelper»=»c:program filesiTunesiTunesHelper.exe» [2010-07-21 141608][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2004-08-17 15360]c:documents and settingsGermanѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
Punto Switcher.lnk — c:program filesYandexPunto Switcherpunto.exe [2009-8-27 831272]
Startup Defender.lnk — c:program filesZards softwareStartup DefenderStartup Defender.exe [2009-1-26 1045504][HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotifyMacDrive-iTunes compatibility]
2005-03-27 18:18 61440 —-a-r- c:program filesCommon FilesMediafourMacDriveiTunesPatch.dll[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalWdf01000.sys]
@=»Driver»[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE»=
«c:\Program Files\Skype\Plugin Manager\skypePM.exe»=
«c:\Program Files\Opera\opera.exe»=
«c:\Program Files\Bonjour\mDNSResponder.exe»=
«h:\Games\Sid Meier’s Civilization 4\Civilization4.exe»=
«c:\Program Files\iTunes\iTunes.exe»=
«c:\Program Files\Skype\Phone\Skype.exe»=R0 MDPMGRNT;MDPMGRNT;c:windowssystem32driversMDPMGRNT.SYS [27.03.2005 22:18 44404]
R1 ehdrv;ehdrv;c:windowssystem32driversehdrv.sys [14.05.2009 15:47 114984]
R1 epfwtdir;epfwtdir;c:windowssystem32driversepfwtdir.sys [14.05.2009 15:49 95872]
R1 MDFSYSNT;MDFSYSNT;c:windowssystem32driversMDFSYSNT.SYS [27.03.2005 22:18 277352]
R1 prodrv04;Star Force copy protection driver v4;c:windowssystem32driversprodrv04.sys [08.08.2009 19:14 114496]
R2 ekrn;ESET Service;c:program filesEsetESET NOD32 Antivirusekrn.exe [07.04.2010 21:07 810120]
R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;c:windowssystem32driversAmps2prt.sys [19.06.2009 14:21 14336]
R3 CLEDX;Team H2O CLEDX service;c:windowssystem32driverscledx.sys [21.06.2009 21:53 33792]
S2 gupdate;Google Update Service (gupdate);c:program filesGoogleUpdateGoogleUpdate.exe [23.06.2010 2:02 136176]
S2 Roxio Upnp Server 11;Roxio Upnp Server 11;c:program filesRoxio Creator 2009Digital Home 11RoxioUpnpService11.exe [14.08.2008 0:25 367088]
S2 RoxLiveShare11;LiveShare P2P Server 11;c:program filesCommon FilesRoxio Shared11.0SharedCOMRoxLiveShare11.exe [14.08.2008 0:24 309744]
S2 RoxWatch11;Roxio Hard Drive Watcher 11;c:program filesCommon FilesRoxio Shared11.0SharedCOMRoxWatch11.exe [14.08.2008 0:24 170480]
S3 Ambfilt;Ambfilt;c:windowssystem32driversAmbfilt.sys [28.10.2009 21:08 1684736]
S3 COMMONFX.SYS;COMMONFX.SYS;c:windowssystem32driversCOMMONFX.sys [20.03.2008 17:23 98328]
S3 COMMONFX;COMMONFX;c:windowssystem32driversCOMMONFX.sys [20.03.2008 17:23 98328]
S3 CT20XUT.SYS;CT20XUT.SYS;c:windowssystem32driversCT20XUT.sys [20.03.2008 17:36 171032]
S3 CT20XUT;CT20XUT;c:windowssystem32driversCT20XUT.sys [20.03.2008 17:36 171032]
S3 CTAUDFX.SYS;CTAUDFX.SYS;c:windowssystem32driversCTAUDFX.sys [20.03.2008 17:23 528920]
S3 CTAUDFX;CTAUDFX;c:windowssystem32driversCTAUDFX.sys [20.03.2008 17:23 528920]
S3 CTEAPSFX.SYS;CTEAPSFX.SYS;c:windowssystem32driversCTEAPSFX.sys [20.03.2008 17:26 163352]
S3 CTEAPSFX;CTEAPSFX;c:windowssystem32driversCTEAPSFX.sys [20.03.2008 17:26 163352]
S3 CTEDSPFX.SYS;CTEDSPFX.SYS;c:windowssystem32driversCTEDSPFX.sys [20.03.2008 17:32 259096]
S3 CTEDSPFX;CTEDSPFX;c:windowssystem32driversCTEDSPFX.sys [20.03.2008 17:32 259096]
S3 CTEDSPIO.SYS;CTEDSPIO.SYS;c:windowssystem32driversCTEDSPIO.sys [20.03.2008 17:38 134168]
S3 CTEDSPIO;CTEDSPIO;c:windowssystem32driversCTEDSPIO.sys [20.03.2008 17:38 134168]
S3 CTEDSPSY.SYS;CTEDSPSY.SYS;c:windowssystem32driversCTEDSPSY.sys [20.03.2008 17:37 309784]
S3 CTEDSPSY;CTEDSPSY;c:windowssystem32driversCTEDSPSY.sys [20.03.2008 17:37 309784]
S3 CTERFXFX.SYS;CTERFXFX.SYS;c:windowssystem32driversCTERFXFX.sys [20.03.2008 17:36 99352]
S3 CTERFXFX;CTERFXFX;c:windowssystem32driversCTERFXFX.sys [20.03.2008 17:36 99352]
S3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:windowssystem32driversCTEXFIFX.sys [20.03.2008 17:40 1324056]
S3 CTEXFIFX;CTEXFIFX;c:windowssystem32driversCTEXFIFX.sys [20.03.2008 17:40 1324056]
S3 CTHWIUT.SYS;CTHWIUT.SYS;c:windowssystem32driversCTHWIUT.sys [20.03.2008 17:37 72728]
S3 CTHWIUT;CTHWIUT;c:windowssystem32driversCTHWIUT.sys [20.03.2008 17:37 72728]
S3 CTSBLFX.SYS;CTSBLFX.SYS;c:windowssystem32driversCTSBLFX.sys [20.03.2008 17:25 534040]
S3 CTSBLFX;CTSBLFX;c:windowssystem32driversCTSBLFX.sys [20.03.2008 17:25 534040]
S3 Roxio UPnP Renderer 11;Roxio UPnP Renderer 11;c:program filesRoxio Creator 2009Digital Home 11RoxioUPnPRenderer11.exe [14.08.2008 0:25 313840]
S3 RoxMediaDB11;RoxMediaDB11;c:program filesCommon FilesRoxio Shared11.0SharedCOMRoxMediaDB11.exe [14.08.2008 0:23 1124848]
S4 sptd;sptd;c:windowssystem32driverssptd.sys [18.06.2009 0:37 685816]
.
Contents of the ‘Scheduled Tasks’ folder2010-08-16 c:windowsTasksAppleSoftwareUpdate.job
— c:program filesApple Software UpdateSoftwareUpdate.exe [2008-07-30 08:34]2010-08-21 c:windowsTasksGoogleUpdateTaskMachineCore.job
— c:program filesGoogleUpdateGoogleUpdate.exe [2010-06-22 22:01]2010-08-21 c:windowsTasksGoogleUpdateTaskMachineUA.job
— c:program filesGoogleUpdateGoogleUpdate.exe [2010-06-22 22:01]2010-08-20 c:windowsTasksGoogleUpdateTaskUserS-1-5-21-790525478-583907252-725345543-1004Core.job
— c:documents and settingsGermanLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe [2009-07-15 21:36]2010-08-21 c:windowsTasksGoogleUpdateTaskUserS-1-5-21-790525478-583907252-725345543-1004UA.job
— c:documents and settingsGermanLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe [2009-07-15 21:36]
.
.
Supplementary Scan
.
uStart Page = hxxp://qip.ru
uDefault_Search_URL = hxxp://search.qip.ru
uSearchAssistant = hxxp://search.qip.ru/ie
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
FF — ProfilePath — c:documents and settingsGermanApplication DataMozillaFirefoxProfilesy8vhokyw.default
FF — prefs.js: browser.search.selectedEngine — Ask.com
FF — prefs.js: browser.startup.homepage — hxxp://qip.ru
FF — component: c:documents and settingsGermanApplication DataMozillaFirefoxProfilesy8vhokyw.defaultextensions{32a1fd71-835e-4b11-8e54-886fda0b4c89}componentsqippipe.dll
FF — component: c:program filesNokiaNokia Ovi SuiteConnectorsBookmarks ConnectorFirefoxExtensioncomponentsFirefoxExtension.dll
FF — plugin: c:documents and settingsGermanApplication DataMozillaFirefoxProfilesy8vhokyw.defaultextensionsfirefox@tvunetworks.compluginsnpTVUAx.dll
FF — plugin: c:documents and settingsGermanLocal SettingsApplication DataGoogleUpdate1.2.183.29npGoogleOneClick8.dll
FF — plugin: c:program filesGoogleGoogle Earthpluginnpgeplugin.dll
FF — plugin: c:program filesGoogleUpdate1.2.183.23npGoogleOneClick8.dll
FF — plugin: c:program filesJavajre6binnew_pluginnpdeployJava1.dll—- FIREFOX POLICIES —-
c:program filesMozilla Firefoxgreprefsall.js — pref(«ui.use_native_colors», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.IDN.whitelist.lu», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.IDN.whitelist.nu», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.IDN.whitelist.nz», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.IDN.whitelist.xn--mgbaam7a8h», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.IDN.whitelist.xn--mgberp4a5d4ar», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.IDN.whitelist.xn--p1ai», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.IDN.whitelist.xn--mgbayh7gpa», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.IDN.whitelist.tel», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.auth.force-generic-ntlm», false);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.proxy.type», 5);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.buffer.cache.count», 24);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.buffer.cache.size», 4096);
c:program filesMozilla Firefoxgreprefsall.js — pref(«dom.ipc.plugins.timeoutSecs», 45);
c:program filesMozilla Firefoxgreprefsall.js — pref(«svg.smil.enabled», false);
c:program filesMozilla Firefoxgreprefsall.js — pref(«accelerometer.enabled», true);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js — pref(«security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref», true);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js — pref(«security.ssl.renego_unrestricted_hosts», «»);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js — pref(«security.ssl.treat_unsafe_negotiation_as_broken», false);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js — pref(«security.ssl.require_safe_negotiation», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name», «chrome://browser/locale/browser.properties»);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description», «chrome://browser/locale/browser.properties»);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«plugins.update.notifyUser», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«dom.ipc.plugins.enabled.nptest.dll», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«dom.ipc.plugins.enabled.npswf32.dll», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«dom.ipc.plugins.enabled.npctrl.dll», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«dom.ipc.plugins.enabled.npqtplugin.dll», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«dom.ipc.plugins.enabled», false);
.
— — — — ORPHANS REMOVED — — — —URLSearchHooks-{00000000-6E41-4FD3-8538-502F5495E5FC} — c:program filesAsk.comGenericAskToolbar.dll
ShellIconOverlayIdentifiers-Mediafour Mac Volume Icons — (no file)**************************************************************************
catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-21 16:51
Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(724)
c:program filesCommon FilesMediafourMacDriveiTunesPatch.dll— — — — — — — > ‘explorer.exe'(3656)
c:program filesRocketDockRocketDock.dll
c:program filesYandexPunto Switcherpshook.dll
c:program filesPRMT8PRMTEDEDSel.dll
c:windowssystem32nview.dll
c:windowssystem32NVWRSRU.DLL
c:program filesCommon FilesMediafourMACVICON.DLL
c:windowssystem32MSCTF.dll
c:windowssystem32ctagent.dll
c:windowssystem32WPDShServiceObj.dll
c:program filesNokiaNokia PC Suite 7PhoneBrowser.dll
c:program filesNokiaNokia PC Suite 7NGSCM.DLL
c:program filesNokiaNokia PC Suite 7LangPhoneBrowser_rus.nlr
c:program filesNokiaNokia PC Suite 7ResourcePhoneBrowser_Nokia.ngr
c:windowssystem32PortableDeviceTypes.dll
c:windowssystem32PortableDeviceApi.dll
.
Other Running Processes
.
c:program filesCommon FilesAppleMobile Device SupportAppleMobileDeviceService.exe
c:program filesBonjourmDNSResponder.exe
c:program filesJavajre6binjqs.exe
c:program filesNeroNero8Nero BackItUpNBService.exe
c:windowssystem32nvsvc32.exe
c:program filesAlcohol SoftAlcohol 120StarWindStarWindServiceAE.exe
c:windowssystem32rundll32.exe
c:windowssystem32wscntfy.exe
c:windowssystem32RUNDLL32.EXE
c:windowssystem32CTHELPER.EXE
c:windowssystem32rundll32.exe
c:program filesCreative ProfessionalDigital Audio SystemE-MU PatchMix DSPEmuPatchMixDSP.exe
c:windowsRTHDCPL.EXE
c:program filesCommon FilesNokiaMPlatformNokiaMServer.exe
c:windowssystem32wbemwmiapsrv.exe
c:program filesCommon FilesNeroLibNMIndexingService.exe
c:program filesPRMT8PRMTEDprmedsvr.exe
c:program filesiPodbiniPodService.exe
c:program filesCommon FilesNokiaNoAnokiaaserver.exe
c:program filesPC Connectivity SolutionServiceLayer.exe
c:program filesPC Connectivity SolutionTransportsNclUSBSrv.exe
c:program filesPC Connectivity SolutionTransportsNclRSSrv.exe
c:program filesSkypePlugin ManagerskypePM.exe
.
**************************************************************************
.
Completion time: 2010-08-21 16:56:29 — machine was rebooted
ComboFix-quarantined-files.txt 2010-08-21 12:56
ComboFix2.txt 2010-08-20 07:17Pre-Run: 6 036 934 656 байт свободно
Post-Run: 6 005 014 528 байт свободно— — End Of File — — 049BB5CCF88CCBE5373F840A38800A09
Для начала проверьте эти файлы на http://www.virustotal.com и ссылки на результаты выложите:
c:program files42fs4hff.exe
c:program filesCommon Filestime.cv
c:program filesCommon Filesunins000.exe
c:windowssystem32winlogon.exe
c:program filesCommon Filesunins000.dat
http://www.virustotal.com/file-scan/report.html?id=74de057f768beb42de17ffc4b8a56100f0bed85947ecacaef111e3d3ec997950-1282453829
http://www.virustotal.com/file-scan/report.html?id=2b02e22d2d6b8cfde428132ef148e8f50dcaec55bcedcb9fdf32f80a0aea6832-1282510087
http://www.virustotal.com/file-scan/report.html?id=af19c930f984cbd4cd7a5a16e74e4bd86c495b0376ce0a0faeab368e456a80a2-1276194629
http://www.virustotal.com/file-scan/report.html?id=9a69eafb4544fb1e4eb3b2083a3a73e31ad3bc26b92d19b22528a03e103babd4-1282510965первый файл — древний антивирь какой-то…. на нем проверялка виснет
Удалим его.
Скопируйте текст ниже в блокнот и сохраните как файл с названием CFScript.txt на рабочий стол.
KillAll::
File::
c:program files42fs4hff.exe
После сохранения переместите CFScript.txt на пиктограмму ComboFix.exe.
Когда сохранится новый отчет ComboFix, запакуйте ComboFix.txt и прикрепите к сообщению.
Кликните Пуск -> Выполнить
В строке ввода введите notepad и нажмите Enter.
Вствавьте в блокнот следующий текст:dir winlogon.exe /a h /s > File.txtКликните Файл, Сохранить как.
Смените тип файла на: Все файлы.
Введите имя файла find_file.bat и кликните Ok.
Сохраните файл на ваш рабочий стол.
Закройте блокнот.
Дважды кликните по созданному файлу find_file.bat.
По-завершению работы на рабочем столе появится файл File.txt, вставьте его содержимое в ваш ответ.
- Для ответа в этой теме необходимо авторизоваться.
