удалить Internet Antivirus PRo

This topic has 3 ответа, 2 участника, and was last updated 16 years, 1 month назад by Admin.

Просмотр 4 сообщений - с 1 по 4 (из 4 всего)

Автор

Сообщения
29 марта, 2009 в 10:07 дп #16509
ipol
Participant
- Темы:1
- Сообщений:2
Добрый день.
Помогите удалить Internet Antivirus PRo
протоколы RSIT
Logfile of random’s system information tool 1.06 (written by random/random)
Run by Admin at 2009-03-29 13:52:42
Microsoft Windows XP Professional Service Pack 3
System drive C: has 23 GB (33%) free of 70 GB
Total RAM: 2047 MB (65% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:52:51, on 29.03.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20861)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
C:Program FilesAlwil SoftwareAvast4ashServ.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:PROGRA~1ALWILS~1Avast4ashDisp.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:Program FilesFlashGetFlashGet.exe
C:WINDOWSSOUNDMAN.EXE
C:WINDOWSsystem32ctfmon.exe
C:Program FilesVistaDriveIconVistaDrv.exe
C:Program FilesDAEMON Tools Litedaemon.exe
C:Program FilesCommon FilesYandexYupdateyupdate.exe
C:Program FilesCommon FilesAheadLibNMBgMonitor.exe
C:Program FilesCommon FilesAheadLibNMIndexStoreSvr.exe
C:Program FilesSkypePhoneSkype.exe
C:program filesInternet Antivirus ProIAPro.exe
C:Program FilesSippointMSippointM.exe
C:Program FilesSkypePlugin ManagerskypePM.exe
C:Documents and SettingsAdminLocal SettingsApplication DataMicrosoftWindowsservices.exe
C:WINDOWSsystem32nvsvc32.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:Documents and SettingsAdminРабочий столRSIT.exe
C:Program Filestrend microAdmin.exe

R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.yandex.ru/?clid=41127&yasoft=barie
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: (no name) — — (no file)
O2 — BHO: Adobe PDF Reader Link Helper — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 — BHO: flashget urlcatch — {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} — C:Program FilesFlashGetjccatch.dll
O2 — BHO: SSVHelper Class — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — C:Program FilesJavajre1.6.0_07binssv.dll
O2 — BHO: FlashGet GetFlash Class — {F156768E-81EF-470C-9057-481BA8380DBA} — C:Program FilesFlashGetgetflash.dll
O3 — Toolbar: Яндекс.Бар — {91397D20-1446-11D4-8AF4-0040CA1127B6} — C:Program FilesYandexYandexBarIEyndbar.dll
O4 — HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 — HKLM..Run: [nwiz] nwiz.exe /install
O4 — HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 — HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 — HKLM..Run: [Flashget] C:Program FilesFlashGetFlashGet.exe /min
O4 — HKLM..Run: [Adobe Reader Speed Launcher] «C:Program FilesAdobeReader 8.0ReaderReader_sl.exe»
O4 — HKLM..Run: [NeroFilterCheck] C:Program FilesCommon FilesAheadLibNeroCheck.exe
O4 — HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe
O4 — HKCU..Run: [DAEMON Tools Lite] «C:Program FilesDAEMON Tools Litedaemon.exe» -autorun
O4 — HKCU..Run: [Yupdate!] «C:Program FilesCommon FilesYandexYupdateyupdate.exe»
O4 — HKCU..Run: [ICQ] «C:Program FilesICQ6ICQ.exe» silent
O4 — HKCU..Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] «C:Program FilesCommon FilesAheadLibNMBgMonitor.exe»
O4 — HKCU..Run: [ChristmasTree] C:DOCUME~1AdminLOCALS~1TempRar$EX00.890Christmas.exe
O4 — HKCU..Run: [Skype] «C:Program FilesSkypePhoneSkype.exe» /nosplash /minimized
O4 — HKCU..Run: [Microsoft Windows logon process] C:Documents and SettingsAdminApplication DataMicrosoftWindowswinlogon.exe
O4 — HKCU..Run: [Internet Antivirus Pro] «C:program filesInternet Antivirus ProIAPro.exe» /s
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..RunOnce: [ZZZZ1_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,OnceFirstLogonInstall,0 (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..RunOnce: [IE7_012] rundll32 advpack.dll,LaunchINFSectionEx IE7int.inf,AfterUserStart,,4,N (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-20..RunOnce: [ZZZZ1_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,OnceFirstLogonInstall,0 (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,NewUserFirstLogonInstall,0 (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — HKUS.DEFAULT..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,NewUserFirstLogonInstall,0 (User ‘Default user’)
O4 — Global Startup: Sippoint Mini.lnk = C:Program FilesSippointMSippointM.exe
O8 — Extra context menu item: &Закачать все при помощи FlashGet — C:Program FilesFlashGetjc_all.htm
O8 — Extra context menu item: &Закачать при помощи FlashGet — C:Program FilesFlashGetjc_link.htm
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~1OFFICE11EXCEL.EXE/3000
O9 — Extra button: (no name) — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_07binssv.dll
O9 — Extra ‘Tools’ menuitem: Sun Java Console — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_07binssv.dll
O9 — Extra button: Справочные материалы — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~1OFFICE11REFIEBAR.DLL
O9 — Extra button: ICQ 4.1 — {B863453A-26C3-4e1f-A54D-A2CD196348E9} — C:Program FilesICQLiteICQLite.exe (file missing)
O9 — Extra ‘Tools’ menuitem: ICQ Lite — {B863453A-26C3-4e1f-A54D-A2CD196348E9} — C:Program FilesICQLiteICQLite.exe (file missing)
O9 — Extra button: FlashGet — {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} — C:Program FilesFlashGetFlashGet.exe
O9 — Extra ‘Tools’ menuitem: FlashGet — {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} — C:Program FilesFlashGetFlashGet.exe
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O17 — HKLMSystemCCSServicesTcpip..{F0449380-F08D-4253-AD38-F0BD1598073A}: NameServer = 212.1.230.111 212.1.224.34
O18 — Protocol: skype4com — {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} — C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O23 — Service: Application Driver Auto Removal Service (01) (appdrvrem01) — Protection Technology — C:WINDOWSSystem32appdrvrem01.exe
O23 — Service: avast! iAVS4 Control Service (aswUpdSv) — ALWIL Software — C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 — Service: avast! Antivirus — ALWIL Software — C:Program FilesAlwil SoftwareAvast4ashServ.exe
O23 — Service: avast! Mail Scanner — ALWIL Software — C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
O23 — Service: avast! Web Scanner — ALWIL Software — C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: Guard Service (ITGrdEngine) — Unknown owner — C:Documents and SettingsAdminLocal SettingsApplication DataMicrosoftWindowsservices.exe
O23 — Service: NBService — Nero AG — C:Program FilesNeroNero 7Nero BackItUpNBService.exe
O23 — Service: NVIDIA Display Driver Service (NVSvc) — NVIDIA Corporation — C:WINDOWSsystem32nvsvc32.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: ServiceLayer — Unknown owner — C:Program FilesPC Connectivity SolutionServiceLayer.exe (file missing)
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe

—
End of file — 9915 bytes

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}]
FGCatchUrl — C:Program FilesFlashGetjccatch.dll [2007-08-06 94308]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class — C:Program FilesJavajre1.6.0_07binssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{F156768E-81EF-470C-9057-481BA8380DBA}]
FlashGet GetFlash Class — C:Program FilesFlashGetgetflash.dll [2007-05-18 163840]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{91397D20-1446-11D4-8AF4-0040CA1127B6} — Яндекс.Бар — C:Program FilesYandexYandexBarIEyndbar.dll [2008-06-02 1553672]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«NvCplDaemon»=C:WINDOWSsystem32NvCpl.dll [2008-05-16 13529088]
«nwiz»=nwiz.exe /install []
«avast!»=C:PROGRA~1ALWILS~1Avast4ashDisp.exe [2009-02-06 81000]
«NvMediaCenter»=C:WINDOWSsystem32NvMcTray.dll [2008-05-16 86016]
«Flashget»=C:Program FilesFlashGetFlashGet.exe [2007-09-25 2007088]
«Adobe Reader Speed Launcher»=C:Program FilesAdobeReader 8.0ReaderReader_sl.exe [2008-01-11 39792]
«NeroFilterCheck»=C:Program FilesCommon FilesAheadLibNeroCheck.exe [2006-01-12 155648]
«SoundMan»=C:WINDOWSSOUNDMAN.EXE [2007-04-17 577536]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=C:WINDOWSsystem32ctfmon.exe [2008-08-19 30208]
«VistaIcon»=C:Program FilesVistaDriveIconVistaDrv.exe [2008-01-02 132096]
«DAEMON Tools Lite»=C:Program FilesDAEMON Tools Litedaemon.exe [2008-07-24 490952]
«Yupdate!»=C:Program FilesCommon FilesYandexYupdateyupdate.exe [2008-05-30 460040]
«ICQ»=C:Program FilesICQ6ICQ.exe silent []
«BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=C:Program FilesCommon FilesAheadLibNMBgMonitor.exe [2006-10-09 139264]
«ChristmasTree»=C:DOCUME~1AdminLOCALS~1TempRar$EX00.890Christmas.exe []
«Skype»=C:Program FilesSkypePhoneSkype.exe [2009-02-04 23975720]
«Microsoft Windows logon process»=C:Documents and SettingsAdminApplication DataMicrosoftWindowswinlogon.exe [2009-03-28 28672]
«Internet Antivirus Pro»=C:program filesInternet Antivirus ProIAPro.exe [2009-03-27 1501184]

C:Documents and SettingsAll UsersГлавное менюПрограммыАвтозагрузка
Sippoint Mini.lnk — C:Program FilesSippointMSippointM.exe

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32wpdshserviceobj.dll [2008-03-02 133632]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetwork{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=145
«NoSharedDocuments»=1
«NoSMConfigurePrograms»=1

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«D:Program FilesValvehl.exe»=»D:Program FilesValvehl.exe:*:Enabled:Half-Life Launcher»
«D:GamesValvehl.exe»=»D:GamesValvehl.exe:*:Enabled:Half-Life Launcher»
«C:Program FilesFlashGetflashget.exe»=»C:Program FilesFlashGetflashget.exe:*:Enabled:Flashget»
«C:Program FilesNETBYNETDCnbnDC.exe»=»C:Program FilesNETBYNETDCnbnDC.exe:*:Enabled:nbnDC»
«C:Program FilesICQLiteICQLite.exe»=»C:Program FilesICQLiteICQLite.exe:*:Disabled:ICQLite»
«C:WINDOWSsystem32rundll32.exe»=»C:WINDOWSsystem32rundll32.exe:*:Enabled:Запуск библиотеки DLL как приложения»
«C:WINDOWSsystem32dpvsetup.exe»=»C:WINDOWSsystem32dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test»
«C:Program FilesSippointMSippointM.exe»=»C:Program FilesSippointMSippointM.exe:*:Enabled:SippointM»
«C:Program FilesNeroNero 7Nero HomeNeroHome.exe»=»C:Program FilesNeroNero 7Nero HomeNeroHome.exe:*:Enabled:Nero Home»
«C:Program FilesCommon FilesAheadNero WebSetupX.exe»=»C:Program FilesCommon FilesAheadNero WebSetupX.exe:*:Enabled:Nero ProductSetup»
«C:Program FilesSkypePhoneSkype.exe»=»C:Program FilesSkypePhoneSkype.exe:*:Enabled:Skype»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{225354fa-9832-11dd-91f2-0013d33bcefd}]
shellAutoRuncommand — I:
shellopencommand — rundll32.exe .\3ivs.dll,InstallM

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{39d84b4c-7f6b-11dd-91b6-0013d33bcefd}]
shellAutoRuncommand — RECYCLERS-1-6-21-2434476501-1644491937-600003330-1213autorunme.exe
shellopencommand — RECYCLERS-1-6-21-2434476501-1644491937-600003330-1213autorunme.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{966f93b8-e6e2-11dd-92a9-0013d33bcefd}]
shellAutoRuncommand — RESTORES-1-5-21-1482476501-1644491937-682003330-1013rise.exe
shellopencommand — RESTORES-1-5-21-1482476501-1644491937-682003330-1013rise.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{966f93b9-e6e2-11dd-92a9-0013d33bcefd}]
shellAutoRuncommand — C:WINDOWSsystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe killVBS.vbs

======List of files/folders created in the last 1 months======

2009-03-29 13:52:42 —-D—- C:rsit
2009-03-29 13:52:42 —-D—- C:Program Filestrend micro
2009-03-28 17:15:03 —-A—- C:WINDOWSsystem32log.txt
2009-03-28 17:14:46 —-D—- C:Documents and SettingsAdminApplication DataInternet Antivirus Pro
2009-03-28 17:14:45 —-D—- C:Program FilesInternet Antivirus Pro
2009-03-27 03:29:21 —-A—- C:Program FilesCommon Filesfile.exe
2009-03-27 03:29:16 —-A—- C:Program FilesCommon FilesInternetAntivirusPro.exe
2009-03-16 21:15:34 —-D—- C:Documents and SettingsAll UsersApplication DataFreshGames
2009-03-16 20:44:57 —-D—- C:Documents and SettingsAll UsersApplication DataВеселаяФерма-ПечемПиццу
2009-03-16 00:01:29 —-A—- C:WINDOWSODBC.INI
2009-03-16 00:01:27 —-A—- C:WINDOWSsystem32mdimon.dll
2009-03-16 00:00:30 —-D—- C:Program FilesCommon FilesDESIGNER
2009-03-16 00:00:22 —-D—- C:WINDOWSSHELLNEW
2009-03-16 00:00:22 —-D—- C:Program FilesMicrosoft.NET
2009-03-15 21:11:52 —-SHD—- C:Config.Msi
2009-03-01 17:02:51 —-D—- C:Documents and SettingsAdminApplication DataskypePM
2009-03-01 16:58:29 —-D—- C:Documents and SettingsAdminApplication DataSkype
2009-03-01 16:58:23 —-D—- C:Program FilesCommon FilesSkype
2009-03-01 16:58:21 —-RD—- C:Program FilesSkype
2009-03-01 16:58:13 —-D—- C:Documents and SettingsAll UsersApplication DataSkype

======List of files/folders modified in the last 1 months======

2009-03-29 13:52:42 —-AD—- C:Program Files
2009-03-29 13:43:27 —-D—- C:Program FilesFlashGet
2009-03-29 13:20:20 —-D—- C:Program FilesMozilla Firefox
2009-03-29 13:19:16 —-D—- C:WINDOWS
2009-03-29 13:16:18 —-D—- C:WINDOWSTemp
2009-03-29 13:15:26 —-AD—- C:WINDOWSsystem32
2009-03-29 13:15:26 —-A—- C:WINDOWSsystem32PerfStringBackup.INI
2009-03-28 22:23:06 —-D—- C:WINDOWSsystem32CatRoot2
2009-03-28 22:23:06 —-A—- C:WINDOWSSchedLgU.Txt
2009-03-28 17:14:11 —-AD—- C:Program FilesCommon Files
2009-03-16 22:20:56 —-A—- C:WINDOWSNeroDigital.ini
2009-03-16 21:15:10 —-D—- C:Program FilesAlawar.ru
2009-03-16 00:01:30 —-SHD—- C:WINDOWSInstaller
2009-03-16 00:01:05 —-RSD—- C:WINDOWSassembly
2009-03-16 00:01:01 —-A—- C:WINDOWSwin.ini
2009-03-16 00:00:35 —-RSD—- C:WINDOWSFonts
2009-03-16 00:00:35 —-AD—- C:Program FilesCommon FilesMicrosoft Shared
2009-03-16 00:00:29 —-HD—- C:WINDOWSinf
2009-03-16 00:00:26 —-D—- C:Program FilesMicrosoft Office
2009-03-16 00:00:23 —-D—- C:Program FilesCommon FilesSystem
2009-03-15 23:57:09 —-D—- C:WINDOWSsystem
2009-03-15 21:14:13 —-D—- C:Documents and SettingsAll UsersApplication DataMicrosoft Help
2009-03-15 21:14:08 —-SD—- C:Documents and SettingsAll UsersApplication DataMicrosoft
2009-03-12 21:30:57 —-D—- C:Documents and SettingsAll UsersApplication DataAlawarWrapper

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:WINDOWSsystem32driversAavmker4.sys [2009-02-06 26944]
R1 appdrv01;Application Driver (01); C:WINDOWSSystem32Driversappdrv01.sys [2008-11-29 2911848]
R1 aswSP;avast! Self Protection; C:WINDOWSsystem32driversaswSP.sys [2009-02-06 114768]
R1 aswTdi;avast! Network Shield Support; C:WINDOWSsystem32driversaswTdi.sys [2009-02-06 51376]
R2 aswFsBlk;aswFsBlk; C:WINDOWSsystem32DRIVERSaswFsBlk.sys [2009-02-06 20560]
R2 aswMon2;avast! Standard Shield Support; C:WINDOWSsystem32driversaswMon2.sys [2009-02-06 94032]
R2 rspndr;Ответчик обнаружения топологии уровня связи; C:WINDOWSsystem32DRIVERSrspndr.sys [2008-07-08 62848]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:WINDOWSsystem32driversALCXWDM.SYS [2008-01-25 4127488]
R3 Arp1394;Протокол клиента 1394 ARP; C:WINDOWSsystem32DRIVERSarp1394.sys [2008-08-19 60800]
R3 aswRdr;aswRdr; C:WINDOWSsystem32driversaswRdr.sys [2009-02-06 23152]
R3 hidusb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2008-04-15 10368]
R3 ltmodem5;LT Modem Driver; C:WINDOWSsystem32DRIVERSltmdmnt.sys [2008-08-20 606940]
R3 MODEMCSA;Устройство фильтрации потока Unimodem; C:WINDOWSsystem32driversMODEMCSA.sys [2001-08-18 16128]
R3 mouhid;Драйвер мыши HID; C:WINDOWSsystem32DRIVERSmouhid.sys [2008-04-15 12160]
R3 NIC1394;Сетевой драйвер 1394; C:WINDOWSsystem32DRIVERSnic1394.sys [2008-08-19 61824]
R3 nv;nv; C:WINDOWSsystem32DRIVERSnv4_mini.sys [2008-05-16 6557408]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:WINDOWSsystem32DRIVERSNVENETFD.sys [2005-04-06 33536]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:WINDOWSsystem32DRIVERSnvnetbus.sys [2005-04-06 12928]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2008-04-15 30208]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2008-04-15 59520]
R3 usbohci;Драйвер минипорта Microsoft USB открытого хост-контроллера; C:WINDOWSsystem32DRIVERSusbohci.sys [2008-04-15 17152]
S3 atbd5tb7;atbd5tb7; C:WINDOWSsystem32driversatbd5tb7.sys []
S3 Dot4;Драйвер MS IEEE-1284.4; C:WINDOWSsystem32DRIVERSDot4.sys [2008-08-19 206976]
S3 Dot4Print;Драйвер класса принтеров для IEEE-1284.4; C:WINDOWSsystem32DRIVERSDot4Prt.sys [2001-08-17 12928]
S3 k750bus;Sony Ericsson 750 driver (WDM); C:WINDOWSsystem32DRIVERSk750bus.sys [2005-07-07 55216]
S3 k750mdfl;Sony Ericsson 750 USB WMC Modem Filter; C:WINDOWSsystem32DRIVERSk750mdfl.sys [2005-07-07 6576]
S3 k750mdm;Sony Ericsson 750 USB WMC Modem Drivers; C:WINDOWSsystem32DRIVERSk750mdm.sys [2005-07-07 89872]
S3 k750mgmt;Sony Ericsson 750 USB WMC Device Management Drivers; C:WINDOWSsystem32DRIVERSk750mgmt.sys [2005-07-07 81728]
S3 nmwcd;Nokia USB Phone Parent; C:WINDOWSsystem32driversnmwcd.sys [2007-02-22 137216]
S3 nmwcdc;Nokia USB Generic; C:WINDOWSsystem32driversnmwcdc.sys [2007-02-22 8320]
S3 nmwcdcj;Nokia USB Port; C:WINDOWSsystem32driversnmwcdcj.sys [2007-02-22 12288]
S3 nmwcdcm;Nokia USB Modem; C:WINDOWSsystem32driversnmwcdcm.sys [2007-02-22 12288]
S3 usbprint;Класс принтеров Microsoft USB; C:WINDOWSsystem32DRIVERSusbprint.sys [2008-08-19 25856]
S3 usbscan;Драйвер USB-сканера; C:WINDOWSsystem32DRIVERSusbscan.sys [2008-08-19 15104]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2008-08-19 26368]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2006-09-15 82688]
S4 atapi;atapi; C:WINDOWSsystem32driversatapi.sys [2008-04-15 96512]
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe [2009-02-06 18752]
R2 avast! Antivirus;avast! Antivirus; C:Program FilesAlwil SoftwareAvast4ashServ.exe [2009-02-06 138680]
R2 ITGrdEngine;Guard Service; C:Documents and SettingsAdminLocal SettingsApplication DataMicrosoftWindowsservices.exe [2009-03-27 193024]
R2 NVSvc;NVIDIA Display Driver Service; C:WINDOWSsystem32nvsvc32.exe [2008-05-16 159812]
R2 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2008-04-15 14336]
R3 avast! Mail Scanner;avast! Mail Scanner; C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe [2009-02-06 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:Program FilesAlwil SoftwareAvast4ashWebSv.exe [2009-02-06 352920]
S2 appdrvrem01;Application Driver Auto Removal Service (01); C:WINDOWSSystem32appdrvrem01.exe [2008-11-29 304528]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2007-10-24 70144]
S3 NBService;NBService; C:Program FilesNeroNero 7Nero BackItUpNBService.exe [2006-10-09 724992]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2006-10-26 145184]
S3 ServiceLayer;ServiceLayer; C:Program FilesPC Connectivity SolutionServiceLayer.exe []
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:Program FilesWindows Media Playerwmpnetwk.exe [2006-10-18 913408]

EOF

info.txt logfile of random’s system information tool 1.06 2009-03-29 13:52:52

======Uninstall list======

—>C:Program FilesNeroNero 7nerouninstallUNNERO.exe /UNINSTALL
—>C:WINDOWSUNNeroBackItUp.exe /UNINSTALL
—>C:WINDOWSUNNeroMediaHome.exe /UNINSTALL
—>C:WINDOWSUNNeroShowTime.exe /UNINSTALL
—>C:WINDOWSUNNeroVision.exe /UNINSTALL
—>C:WINDOWSUNRecode.exe /UNINSTALL
—>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:WINDOWSINFPCHealth.inf
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)—>MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe Flash Player ActiveX—>C:WINDOWSsystem32MacromedFlashuninstall_activeX.exe
Adobe Flash Player Plugin—>C:WINDOWSsystem32MacromedFlashuninstall_plugin.exe
Adobe Reader 8 — Russian—>MsiExec.exe /I{AC76BA86-7AD7-1049-7B44-A81200000003}
avast! Antivirus—>C:Program FilesAlwil SoftwareAvast4aswRunDll.exe «C:Program FilesAlwil SoftwareAvast4Setupsetiface.dll»,RunSetup
DVDStyler v1.6.0—>»C:Program FilesDVDStylerunins000.exe»
Fallout 3 v1.0—>»D:GamesFallout 3unins000.exe»
FinalBurner Free v2.8.0.148—>»C:Program FilesFinalBurnerUninstall.exe» «C:Program FilesFinalBurnerinstall.log» -u
FlashGet 1.9.6.1073—>C:Program FilesFlashGetuninst.exe
HijackThis 2.0.2—>»C:Program Filestrend microHijackThis.exe» /uninstall
Java(TM) 6 Update 7—>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
K-Lite Mega Codec Pack 4.1.7—>»C:Program FilesK-Lite Codec Packunins000.exe»
Microsoft .NET Framework 1.1 Russian Language Pack—>MsiExec.exe /X{2BB372D9-52B4-410A-BC1A-FEAB63181EEF}
Microsoft .NET Framework 1.1—>msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1—>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 1—>MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft Games for Windows — LIVE Redistributable—>MsiExec.exe /X{929CE49F-1CA7-4CF3-A9A1-6D757443C63F}
Microsoft Office — профессиональный выпуск версии 2003—>MsiExec.exe /I{90110419-6000-11D3-8CFE-0150048383C9}
Microsoft Office Word Viewer 2003—>MsiExec.exe /I{90850419-6000-11D3-8CFE-0150048383C9}
Microsoft User-Mode Driver Framework Feature Pack 1.5—>»C:WINDOWS$NtUninstallWudf01005$spuninstspuninst.exe»
Mozilla Firefox (3.0.7)—>C:Program FilesMozilla Firefoxuninstallhelper.exe
MSXML 4.0 SP2 (KB941833)—>MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
Nero 7 Ultra Edition—>MsiExec.exe /I{ACE0935B-2B99-4D0A-B173-8CACC6051049}
NETBYNET DC—>»C:Program FilesNETBYNETDCunins000.exe»
NVIDIA Drivers—>C:WINDOWSsystem32nvuninst.exe UninstallGUI
Paint.NET v3.35—>rundll32.exe advpack.dll,LaunchINFSection PaintDN.inf,Uninstall
PC Connectivity Solution—>MsiExec.exe /I{066D65EA-ED53-44E4-A96A-F81B6E409D2E}
Realtek AC’97 Audio—>Alcrmv.exe -r -m
Sippoint Mini 1.0.1.124 (beta)—>»C:Program FilesSippointMunins000.exe»
Skype™ 4.0—>MsiExec.exe /X{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}
Super Video Converter 5.7.6—>»C:Program FilesWitcobberSuper Video Converterunins000.exe»
Video Download Studio—>C:Program FilesaHisoftVideo Download StudioUninstall.exe
Vista Drive Icon—>rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFVistaDrv.inf,Uninstall
Winamp—>»C:Program FilesWinampUninstWA.exe»
Архиватор WinRAR—>C:Program FilesWinRARuninstall.exe
Веселая ферма. Печем пиццу—>C:Program FilesAlawar.ruВеселая ферма. Печем пиццуUninstall.exe
Натали Брукс. Сокровища затерянного королевства—>C:Program FilesAlawar.ruНатали Брукс. Сокровища затерянного королевстваUninstall.exe
Переполох на ранчо—>C:Program FilesAlawar.ruПереполох на ранчоUninstall.exe
Построй-ка—>D:GamesПострой-каUninstall.exe
Яндекс.Бар для Internet Explorer 3.5.1—>»C:Program FilesYandexYandexBarIEunins000.exe»

======Security center information======

AV: avast! antivirus 4.8.1335 [VPS 090328-0]

======System event log======

Computer Name: MICROSOF-741FDF
Event Code: 7035
Message: Служба «avast! Web Scanner» успешно отправила управляющий элемент «запустить».

Record Number: 18982
Source Name: Service Control Manager
Time Written: 20090130235111.000000+180
Event Type: информация
User: NT AUTHORITYSYSTEM

Computer Name: MICROSOF-741FDF
Event Code: 7036
Message: Служба «avast! Mail Scanner» перешла в состояние Работает.

Record Number: 18981
Source Name: Service Control Manager
Time Written: 20090130235111.000000+180
Event Type: информация
User:

Computer Name: MICROSOF-741FDF
Event Code: 7035
Message: Служба «avast! Mail Scanner» успешно отправила управляющий элемент «запустить».

Record Number: 18980
Source Name: Service Control Manager
Time Written: 20090130235111.000000+180
Event Type: информация
User: NT AUTHORITYSYSTEM

Computer Name: MICROSOF-741FDF
Event Code: 7036
Message: Служба «Совместимость быстрого переключения пользователей» перешла в состояние Работает.

Record Number: 18979
Source Name: Service Control Manager
Time Written: 20090130235111.000000+180
Event Type: информация
User:

Computer Name: MICROSOF-741FDF
Event Code: 7035
Message: Служба «Совместимость быстрого переключения пользователей» успешно отправила управляющий элемент «запустить».

Record Number: 18978
Source Name: Service Control Manager
Time Written: 20090130235111.000000+180
Event Type: информация
User: NT AUTHORITYSYSTEM

=====Application event log=====

Computer Name: MICROSOF-741FDF
Event Code: 1000
Message: Счетчики производительности для службы MSDTC (MSDTC) загружены успешно.
Данные записи содержат новые значение индекса,
назначенного этой службе.

Record Number: 5
Source Name: LoadPerf
Time Written: 20080831021624.000000+240
Event Type: информация
User:

Computer Name: MICROSOF-741FDF
Event Code: 1000
Message: Счетчики производительности для службы TermService (Службы терминалов) загружены успешно.
Данные записи содержат новые значение индекса,
назначенного этой службе.

Record Number: 4
Source Name: LoadPerf
Time Written: 20080831021621.000000+240
Event Type: информация
User:

Computer Name: MICROSOF-741FDF
Event Code: 1000
Message: Счетчики производительности для службы RemoteAccess (Маршрутизация и удаленный доступ) загружены успешно.
Данные записи содержат новые значение индекса,
назначенного этой службе.

Record Number: 3
Source Name: LoadPerf
Time Written: 20080831021534.000000+240
Event Type: информация
User:

Computer Name: MICROSOF-741FDF
Event Code: 1000
Message: Счетчики производительности для службы PSched (PSched) загружены успешно.
Данные записи содержат новые значение индекса,
назначенного этой службе.

Record Number: 2
Source Name: LoadPerf
Time Written: 20080831021530.000000+240
Event Type: информация
User:

Computer Name: MICROSOF-741FDF
Event Code: 1000
Message: Счетчики производительности для службы RSVP (QoS RSVP) загружены успешно.
Данные записи содержат новые значение индекса,
назначенного этой службе.

Record Number: 1
Source Name: LoadPerf
Time Written: 20080831021443.000000+240
Event Type: информация
User:

======Environment variables======

«ComSpec»=%SystemRoot%system32cmd.exe
«Path»=C:Program FilesPC Connectivity Solution;%SystemRoot%system32;%SystemRoot%;%SystemRoot%System32Wbem
«windir»=%SystemRoot%
«FP_NO_HOST_CHECK»=NO
«OS»=Windows_NT
«PROCESSOR_ARCHITECTURE»=x86
«PROCESSOR_LEVEL»=15
«PROCESSOR_IDENTIFIER»=x86 Family 15 Model 47 Stepping 2, AuthenticAMD
«PROCESSOR_REVISION»=2f02
«NUMBER_OF_PROCESSORS»=1
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP

EOF
31 марта, 2009 в 7:16 дп #23106
Admin
Keymaster
- Темы:40
- Сообщений:5676
Здравствуйте, добро пожаловать на Spyware-ru форум.

Ваш компьютер так же заражён autorun.inf трояном.
Прочитайте эту инструкцию Flash_Disinfector ещё одно оружие против autorun.inf троянов.

* Отключите ваш антивирус.
* Скачайте и запустите Flash_Disinfector.
* По требованию программы вставьте ваш флэш диск или подключите другие внешние устройства хранения информации.

Примечание: запускайте программу столько раз, сколько нужно чтобы очистить все ваши подключаемые диски.

Скачайте OTMoveIt3 by OldTimer кликнув по этой ссылке.
Запустите OTMoveIt3 и в большое поле ввода (заголовок этого поля выделен желтым цветом) скопируйте следующий текст.
```
:Processes

explorer.exe



:services

atbd5tb7

ITGrdEngine



:reg

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]

"ChristmasTree"=-

"Microsoft Windows logon process"=-

"Internet Antivirus Pro"=-



[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{225354fa-9832-11dd-91f2-0013d33bcefd}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{39d84b4c-7f6b-11dd-91b6-0013d33bcefd}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{966f93b8-e6e2-11dd-92a9-0013d33bcefd}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{966f93b9-e6e2-11dd-92a9-0013d33bcefd}]



:files

C:Documents and SettingsAdminApplication DataInternet Antivirus Pro

C:Program FilesInternet Antivirus Pro

C:Program FilesCommon Filesfile.exe

C:Program FilesCommon FilesInternetAntivirusPro.exe

c:RECYCLERS-1-6-21-2434476501-1644491937-600003330-1213

C:Documents and SettingsAdminLocal SettingsApplication DataMicrosoftWindowsservices.exe

C:Documents and SettingsAdminApplication DataMicrosoftWindowswinlogon.exe



:Commands

[emptytemp]

[start explorer]

[Reboot]
```
Проверьте вставленный скрипт, если слева перед директивами появились пробелы, то удалите их, скрипт должен выглядеть так же как в сообщении. Кликните по кнопке MoveIt!. В процессе работы возможна перезагрузка компьютера.
По-завершении работы программы должен будет показан лог. Если лог не будет показан, то его можно найти в папке C:_OTMoveItMovedFiles.

Вставьте в ваше ответное сообщение содержимое этого лога. И ещё приложите свежий RSIT лог.
31 марта, 2009 в 6:47 пп #23107
ipol
Participant
- Темы:1
- Сообщений:2
Спасибо Valeri за Ваше участие к моей проблеме.
Сделал все, как просили.
Высылаю лог OTMoveIt3
PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
ServiceDriver atbd5tb7 not found.
ServiceDriver atbd5tb7 not found.
ServiceDriver ITGrdEngine stopped successfully.
ServiceDriver ITGrdEngine deleted successfully.
========== REGISTRY ==========
Registry value HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun\ChristmasTree deleted successfully.
Registry value HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun\Microsoft Windows logon process deleted successfully.
Registry value HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun\Internet Antivirus Pro deleted successfully.
Registry key HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{225354fa-9832-11dd-91f2-0013d33bcefd}\ deleted successfully.
Registry key HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{39d84b4c-7f6b-11dd-91b6-0013d33bcefd}\ deleted successfully.
Registry key HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{966f93b8-e6e2-11dd-92a9-0013d33bcefd}\ deleted successfully.
Registry key HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{966f93b9-e6e2-11dd-92a9-0013d33bcefd}\ deleted successfully.
========== FILES ==========
C:Documents and SettingsAdminApplication DataInternet Antivirus Prodb moved successfully.
C:Documents and SettingsAdminApplication DataInternet Antivirus Pro moved successfully.
C:Program FilesInternet Antivirus ProLanguages moved successfully.
C:Program FilesInternet Antivirus Prodb moved successfully.
C:Program FilesInternet Antivirus Pro moved successfully.
C:Program FilesCommon Filesfile.exe moved successfully.
File/Folder C:Program FilesCommon FilesInternetAntivirusPro.exe not found.
File/Folder c:RECYCLERS-1-6-21-2434476501-1644491937-600003330-1213 not found.
C:Documents and SettingsAdminLocal SettingsApplication DataMicrosoftWindowsservices.exe moved successfully.
C:Documents and SettingsAdminApplication DataMicrosoftWindowswinlogon.exe moved successfully.
========== COMMANDS ==========
File delete failed. C:DOCUME~1AdminLOCALS~1Tempetilqs_fBGcocps76NW58w7PUI8 scheduled to be deleted on reboot.
File delete failed. C:DOCUME~1AdminLOCALS~1Tempetilqs_MTk7Ho6ngXQGcoeoXjiG scheduled to be deleted on reboot.
File delete failed. C:DOCUME~1AdminLOCALS~1Tempetilqs_MTk7Ho6ngXQGcoeoXjiG-journal scheduled to be deleted on reboot.
File delete failed. C:DOCUME~1AdminLOCALS~1Temp~DFC17C.tmp scheduled to be deleted on reboot.
User’s Temp folder emptied.
User’s Internet Explorer cache folder emptied.
File delete failed. C:Documents and SettingsAdminLocal SettingsTemporary Internet FilesContent.IE5index.dat scheduled to be deleted on reboot.
User’s Temporary Internet Files folder emptied.
Local Service Temp folder emptied.
File delete failed. C:Documents and SettingsLocalServiceLocal SettingsTemporary Internet FilesContent.IE5index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:WINDOWStempPerflib_Perfdata_624.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:Documents and SettingsAdminLocal SettingsApplication DataMozillaFirefoxProfiles9vf96daw.defaultCache_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsAdminLocal SettingsApplication DataMozillaFirefoxProfiles9vf96daw.defaultCache_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsAdminLocal SettingsApplication DataMozillaFirefoxProfiles9vf96daw.defaultCache_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsAdminLocal SettingsApplication DataMozillaFirefoxProfiles9vf96daw.defaultCache_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsAdminLocal SettingsApplication DataMozillaFirefoxProfiles9vf96daw.defaulturlclassifier3.sqlite scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer — Version 1.0.9.0 log created on 03312009_222422

Files moved on Reboot…
File C:DOCUME~1AdminLOCALS~1Tempetilqs_fBGcocps76NW58w7PUI8 not found!
File C:DOCUME~1AdminLOCALS~1Tempetilqs_MTk7Ho6ngXQGcoeoXjiG not found!
File C:DOCUME~1AdminLOCALS~1Tempetilqs_MTk7Ho6ngXQGcoeoXjiG-journal not found!
C:DOCUME~1AdminLOCALS~1Temp~DFC17C.tmp moved successfully.
C:Documents and SettingsAdminLocal SettingsTemporary Internet FilesContent.IE5index.dat moved successfully.
C:Documents and SettingsLocalServiceLocal SettingsTemporary Internet FilesContent.IE5index.dat moved successfully.
C:WINDOWStempPerflib_Perfdata_624.dat moved successfully.
C:Documents and SettingsAdminLocal SettingsApplication DataMozillaFirefoxProfiles9vf96daw.defaultCache_CACHE_001_ moved successfully.
C:Documents and SettingsAdminLocal SettingsApplication DataMozillaFirefoxProfiles9vf96daw.defaultCache_CACHE_002_ moved successfully.
C:Documents and SettingsAdminLocal SettingsApplication DataMozillaFirefoxProfiles9vf96daw.defaultCache_CACHE_003_ moved successfully.
C:Documents and SettingsAdminLocal SettingsApplication DataMozillaFirefoxProfiles9vf96daw.defaultCache_CACHE_MAP_ moved successfully.
C:Documents and SettingsAdminLocal SettingsApplication DataMozillaFirefoxProfiles9vf96daw.defaulturlclassifier3.sqlite moved successfully.

и последний log RSIT

Logfile of random’s system information tool 1.06 (written by random/random)
Run by Admin at 2009-03-31 22:40:27
Microsoft Windows XP Professional Service Pack 3
System drive C: has 42 GB (60%) free of 70 GB
Total RAM: 2047 MB (74% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:40:32, on 31.03.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20861)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
C:Program FilesAlwil SoftwareAvast4ashServ.exe
C:WINDOWSExplorer.EXE
C:WINDOWSnotepad.exe
C:WINDOWSsystem32spoolsv.exe
C:PROGRA~1ALWILS~1Avast4ashDisp.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:Program FilesFlashGetFlashGet.exe
C:WINDOWSSOUNDMAN.EXE
C:WINDOWSsystem32ctfmon.exe
C:Program FilesVistaDriveIconVistaDrv.exe
C:Program FilesDAEMON Tools Litedaemon.exe
C:Program FilesCommon FilesYandexYupdateyupdate.exe
C:Program FilesCommon FilesAheadLibNMBgMonitor.exe
C:Program FilesCommon FilesAheadLibNMIndexStoreSvr.exe
C:Program FilesSkypePhoneSkype.exe
C:Program FilesSippointMSippointM.exe
C:Program FilesSkypePlugin ManagerskypePM.exe
C:WINDOWSsystem32nvsvc32.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:Documents and SettingsAdminРабочий столRSIT.exe
C:Program Filestrend microAdmin.exe

R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.yandex.ru/?clid=41127&yasoft=barie
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: (no name) — — (no file)
O2 — BHO: Adobe PDF Reader Link Helper — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 — BHO: flashget urlcatch — {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} — C:Program FilesFlashGetjccatch.dll
O2 — BHO: SSVHelper Class — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — C:Program FilesJavajre1.6.0_07binssv.dll
O2 — BHO: FlashGet GetFlash Class — {F156768E-81EF-470C-9057-481BA8380DBA} — C:Program FilesFlashGetgetflash.dll
O3 — Toolbar: Яндекс.Бар — {91397D20-1446-11D4-8AF4-0040CA1127B6} — C:Program FilesYandexYandexBarIEyndbar.dll
O4 — HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 — HKLM..Run: [nwiz] nwiz.exe /install
O4 — HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 — HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 — HKLM..Run: [Flashget] C:Program FilesFlashGetFlashGet.exe /min
O4 — HKLM..Run: [Adobe Reader Speed Launcher] «C:Program FilesAdobeReader 8.0ReaderReader_sl.exe»
O4 — HKLM..Run: [NeroFilterCheck] C:Program FilesCommon FilesAheadLibNeroCheck.exe
O4 — HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe
O4 — HKCU..Run: [DAEMON Tools Lite] «C:Program FilesDAEMON Tools Litedaemon.exe» -autorun
O4 — HKCU..Run: [Yupdate!] «C:Program FilesCommon FilesYandexYupdateyupdate.exe»
O4 — HKCU..Run: [ICQ] «C:Program FilesICQ6ICQ.exe» silent
O4 — HKCU..Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] «C:Program FilesCommon FilesAheadLibNMBgMonitor.exe»
O4 — HKCU..Run: [Skype] «C:Program FilesSkypePhoneSkype.exe» /nosplash /minimized
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..RunOnce: [ZZZZ1_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,OnceFirstLogonInstall,0 (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..RunOnce: [IE7_012] rundll32 advpack.dll,LaunchINFSectionEx IE7int.inf,AfterUserStart,,4,N (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-20..RunOnce: [ZZZZ1_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,OnceFirstLogonInstall,0 (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,NewUserFirstLogonInstall,0 (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — HKUS.DEFAULT..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,NewUserFirstLogonInstall,0 (User ‘Default user’)
O4 — Global Startup: Sippoint Mini.lnk = C:Program FilesSippointMSippointM.exe
O8 — Extra context menu item: &Закачать все при помощи FlashGet — C:Program FilesFlashGetjc_all.htm
O8 — Extra context menu item: &Закачать при помощи FlashGet — C:Program FilesFlashGetjc_link.htm
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~1OFFICE11EXCEL.EXE/3000
O9 — Extra button: (no name) — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_07binssv.dll
O9 — Extra ‘Tools’ menuitem: Sun Java Console — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_07binssv.dll
O9 — Extra button: Справочные материалы — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~1OFFICE11REFIEBAR.DLL
O9 — Extra button: ICQ 4.1 — {B863453A-26C3-4e1f-A54D-A2CD196348E9} — C:Program FilesICQLiteICQLite.exe (file missing)
O9 — Extra ‘Tools’ menuitem: ICQ Lite — {B863453A-26C3-4e1f-A54D-A2CD196348E9} — C:Program FilesICQLiteICQLite.exe (file missing)
O9 — Extra button: FlashGet — {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} — C:Program FilesFlashGetFlashGet.exe
O9 — Extra ‘Tools’ menuitem: FlashGet — {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} — C:Program FilesFlashGetFlashGet.exe
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O17 — HKLMSystemCCSServicesTcpip..{F0449380-F08D-4253-AD38-F0BD1598073A}: NameServer = 212.1.230.111 212.1.224.34
O18 — Protocol: skype4com — {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} — C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O23 — Service: Application Driver Auto Removal Service (01) (appdrvrem01) — Protection Technology — C:WINDOWSSystem32appdrvrem01.exe
O23 — Service: avast! iAVS4 Control Service (aswUpdSv) — ALWIL Software — C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 — Service: avast! Antivirus — ALWIL Software — C:Program FilesAlwil SoftwareAvast4ashServ.exe
O23 — Service: avast! Mail Scanner — ALWIL Software — C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
O23 — Service: avast! Web Scanner — ALWIL Software — C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: NBService — Nero AG — C:Program FilesNeroNero 7Nero BackItUpNBService.exe
O23 — Service: NVIDIA Display Driver Service (NVSvc) — NVIDIA Corporation — C:WINDOWSsystem32nvsvc32.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: ServiceLayer — Unknown owner — C:Program FilesPC Connectivity SolutionServiceLayer.exe (file missing)
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe

—
End of file — 9308 bytes
2 апреля, 2009 в 3:27 пп #23108
Admin
Keymaster
- Темы:40
- Сообщений:5676
RSIT лог не полный. Перезапустите программу и получившийся лог вставьте в ваш ответ.
Так же сообщите как работает ваш компьютер.
Автор

Сообщения

Просмотр 4 сообщений - с 1 по 4 (из 4 всего)

Для ответа в этой теме необходимо авторизоваться.

удалить Internet Antivirus PRo

Добро пожаловать

Поиск

Последние темы

СПАЙВАРЕ РУ

Нужна помощь?

Ссылки