Вирус AdSubscribe

This topic has 1 ответ, 2 участника, and was last updated 16 years, 3 months назад by Admin.

Просмотр 2 сообщений - с 1 по 2 (из 2 всего)

Автор

Сообщения
4 июля, 2009 в 8:16 пп #16858
Jagert
Participant
- Темы:1
- Сообщений:1
Добрый день..
Сегодня заразился вирусом, который выводит на экран рекламу, предлагая просмотреть всё это дело 1000 раз…
Называет себя «AdSubscribe».
Пробовал удалять из реестра, удалять папку C:Documents and SettingsUserApplication DataAdSubscribe..
Всё повторяется через час.
Заранее был бы очень благодарен за помощь…
Выкладываю логи.
LOG.TXT

Logfile of random’s system information tool 1.06 (written by random/random)
Run by Jaga at 2009-07-05 00:07:41
Microsoft Windows XP Professional Service Pack 2
System drive C: has 31 GB (76%) free of 41 GB
Total RAM: 2047 MB (54% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0:08:13, on 05.07.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesLavasoftAd-AwareAAWService.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:Program FilesASUSEPU-4 EngineFourEngine.exe
C:WINDOWSRTHDCPL.EXE
C:WINDOWSsystem32RUNDLL32.EXE
C:Program FilesLavasoftAd-AwareAAWTray.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesVtuneTBPanel.exe
C:Program FilesPunto Switcherpunto.exe
C:Program FilesSpybot — Search & DestroyTeaTimer.exe
C:WINDOWSsystem32nvsvc32.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesQIPqip.exe
C:Program FilesApolloApollo.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:Program FilesRegCleanerRegCleanr.exe
C:Program FilesVentriloVentrilo.exe
C:WINDOWSsystem32svchost.exe
D:DistrDrWebCurelt.exe
C:DOCUME~1JagaLOCALS~1TempRarSFX0hzh8b7.exe
C:DOCUME~1JagaLOCALS~1TempRarSFX0r948n.exe
C:Documents and SettingsJagaРабочий столRSIT.exe
C:Program Filestrend microJaga.exe

R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
O2 — BHO: Spybot-S&D IE Protection — {53707962-6F74-2D53-2644-206D7942484F} — C:PROGRA~1SPYBOT~1SDHelper.dll
O4 — HKLM..Run: [Six Engine] «C:Program FilesASUSEPU-4 EngineFourEngine.exe» -r
O4 — HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 — HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 — HKLM..Run: [Ad-Watch] C:Program FilesLavasoftAd-AwareAAWTray.exe
O4 — HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 — HKLM..Run: [Alcmtr] ALCMTR.EXE
O4 — HKLM..Run: [nwiz] nwiz.exe /install
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [TBPanel] C:Program FilesVtuneTBPanel.exe /A
O4 — HKCU..Run: [Punto Switcher] C:Program FilesPunto Switcherpunto.exe
O4 — HKCU..Run: [SpybotSD TeaTimer] C:Program FilesSpybot — Search & DestroyTeaTimer.exe
O4 — HKCU..RunOnce: [WiseStubReboot] MSIEXEC /quiet SKIP_PPU_DRIVER_INSTALL=1 /I «C:Program FilesCommon FilesWise Installation WizardWISDD1865F0AD7340FBB23E1822E02396FF_9_09_0203.MSI» TRANSFORMS=»C:Program FilesCommon FilesWise Installation WizardWISDD1865F0AD7340FBB23E1822E02396FF_9_09_0203.MST» WISE_SETUP_EXE_PATH=»e:win2kxpPhysX_9.09.0203_SystemSoftware.exe»
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O9 — Extra button: (no name) — {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} — C:PROGRA~1SPYBOT~1SDHelper.dll
O9 — Extra ‘Tools’ menuitem: Spybot — Search & Destroy Configuration — {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} — C:PROGRA~1SPYBOT~1SDHelper.dll
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O17 — HKLMSystemCCSServicesTcpip..{9DA3D4DB-1CCE-409A-97B2-29A062A0AEC1}: NameServer = 91.144.186.3 91.144.184.3
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: Lavasoft Ad-Aware Service — Lavasoft — C:Program FilesLavasoftAd-AwareAAWService.exe
O23 — Service: NetMeeting Remote Desktop Sharing (mnmsrvc) — Корпорация Майкрософт — C:WINDOWSsystem32mnmsrvc.exe
O23 — Service: NVIDIA Display Driver Service (NVSvc) — NVIDIA Corporation — C:WINDOWSsystem32nvsvc32.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe

—
End of file — 4974 bytes

======Scheduled tasks folder======

C:WINDOWStasksAd-Aware Update (Weekly).job

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection — C:PROGRA~1SPYBOT~1SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«Six Engine»=C:Program FilesASUSEPU-4 EngineFourEngine.exe [2008-07-23 5625344]
«NvCplDaemon»=C:WINDOWSsystem32NvCpl.dll [2009-02-19 13680640]
«NvMediaCenter»=C:WINDOWSsystem32NvMcTray.dll [2009-02-19 86016]
«Ad-Watch»=C:Program FilesLavasoftAd-AwareAAWTray.exe [2009-06-18 518488]
«RTHDCPL»=C:WINDOWSRTHDCPL.EXE [2008-09-30 16864768]
«Alcmtr»=C:WINDOWSALCMTR.EXE [2008-06-19 57344]
«nwiz»=nwiz.exe /install []

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=C:WINDOWSsystem32ctfmon.exe [2004-08-18 15360]
«TBPanel»=C:Program FilesVtuneTBPanel.exe [2009-02-03 2158592]
«Punto Switcher»=C:Program FilesPunto Switcherpunto.exe [2008-10-16 735016]
«SpybotSD TeaTimer»=C:Program FilesSpybot — Search & DestroyTeaTimer.exe [2009-01-26 2144088]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«WiseStubReboot»=MSIEXEC /quiet SKIP_PPU_DRIVER_INSTALL=1 /I C:Program FilesCommon FilesWise Installation WizardWISDD1865F0AD7340FBB23E1822E02396FF_9_09_0203.MSI TRANSFORMS=C:Program FilesCommon FilesWise Installation WizardWISDD1865F0AD7340FBB23E1822E02396FF_9_09_0203.MST WISE_SETUP_EXE_PATH=e:win2kxpPhysX_9.09.0203_SystemSoftware.exe []

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimaldwshd.sys]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalLavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkdwshd.sys]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkLavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=145

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesVentriloVentrilo.exe»=»C:Program FilesVentriloVentrilo.exe:*:Enabled:Ventrilo.exe»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»

======List of files/folders created in the last 1 months======

2009-07-05 00:07:41 —-D—- C:rsit
2009-07-05 00:07:41 —-D—- C:Program Filestrend micro
2009-07-04 23:21:37 —-D—- C:Documents and SettingsJagaApplication DataAdSubscribe
2009-07-04 21:47:09 —-D—- C:Documents and SettingsJagaApplication DataRadmin
2009-07-04 21:33:27 —-D—- C:Program FilesRegCleaner
2009-07-04 21:30:27 —-D—- C:Program FilesRadmin Viewer 3
2009-07-04 20:40:19 —-D—- C:WINDOWSsystem32LogFiles
2009-07-04 18:00:48 —-D—- C:Documents and SettingsJagaApplication DataHamachi
2009-07-02 04:19:30 —-D—- C:Program FilesRecovery Toolbox for RAR
2009-06-22 22:58:51 —-AD—- C:Documents and SettingsAll UsersApplication DataTEMP
2009-06-22 22:58:48 —-D—- C:Program FilesMultiTranse
2009-06-22 22:55:49 —-D—- C:Program FilesNeoDic
2009-06-22 21:54:35 —-D—- C:Documents and SettingsJagaApplication DataTransLite
2009-06-22 21:54:17 —-D—- C:Program FilesTransLite
2009-06-18 16:00:26 —-D—- C:Program FilesIdeal Partner
2009-06-14 13:32:24 —-D—- C:Documents and SettingsJagaApplication DataRussobit-M
2009-06-14 13:28:37 —-D—- C:Program FilesRussobit-M
2009-06-14 13:27:10 —-D—- C:Documents and SettingsJagaApplication DataНовый Диск
2009-06-14 13:25:31 —-D—- C:Program FilesНовый диск
2009-06-13 17:30:23 —-D—- C:Program FilesThe KMPlayer
2009-06-11 21:28:11 —-A—- C:WINDOWSsystem32lsdelete.exe
2009-06-11 20:43:10 —-HDC—- C:Documents and SettingsAll UsersApplication Data{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-06-11 20:43:06 —-D—- C:Program FilesLavasoft
2009-06-11 20:43:06 —-D—- C:Documents and SettingsAll UsersApplication DataLavasoft
2009-06-11 20:41:09 —-D—- C:Program FilesSpybot — Search & Destroy
2009-06-11 20:41:09 —-D—- C:Documents and SettingsAll UsersApplication DataSpybot — Search & Destroy
2009-06-11 20:40:40 —-D—- C:Program Filesxp-AntiSpy
2009-06-10 12:55:58 —-D—- C:Program FilesApollo
2009-06-10 12:37:22 —-D—- C:Documents and SettingsJagaApplication DataWinRAR
2009-06-10 12:30:36 —-D—- C:Program FilesWinRAR
2009-06-10 12:27:34 —-D—- C:Program FilesPunto Switcher
2009-06-10 12:27:34 —-D—- C:Documents and SettingsJagaApplication DataYandex
2009-06-10 03:56:23 —-D—- C:Documents and SettingsJagaApplication DataMacromedia
2009-06-10 03:56:22 —-D—- C:Documents and SettingsJagaApplication DataAdobe
2009-06-10 03:48:59 —-D—- C:Documents and SettingsJagaApplication DataMozilla
2009-06-10 02:39:36 —-A—- C:WINDOWSsystem32hidserv.dll
2009-06-10 02:37:38 —-D—- C:Documents and SettingsJagaApplication DataVentrilo
2009-06-10 02:31:18 —-D—- C:Program FilesVentrilo
2009-06-10 02:31:15 —-A—- C:WINDOWS{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
2009-06-10 02:31:00 —-D—- C:Program FilesMozilla Firefox
2009-06-10 02:22:48 —-D—- C:Program FilesQIP
2009-06-10 02:03:53 —-SHD—- C:RECYCLER
2009-06-09 23:34:59 —-D—- C:Program FilesCommon FilesWise Installation Wizard
2009-06-09 23:34:48 —-N—- C:WINDOWSsystem32spmsg.dll
2009-06-09 23:34:39 —-HDC—- C:WINDOWS$MSI31Uninstall_KB893803v2$
2009-06-09 23:33:47 —-D—- C:WINDOWSnview
2009-06-09 23:33:47 —-A—- C:WINDOWSsystem32nvudisp.exe
2009-06-09 23:33:24 —-A—- C:WINDOWSsystem32NVUNINST.EXE
2009-06-09 23:33:12 —-A—- C:WINDOWSsystem32d3dx10_40.dll
2009-06-09 23:33:12 —-A—- C:WINDOWSsystem32D3DCompiler_40.dll
2009-06-09 23:33:11 —-A—- C:WINDOWSsystem32XAudio2_3.dll
2009-06-09 23:33:11 —-A—- C:WINDOWSsystem32XAPOFX1_2.dll
2009-06-09 23:33:11 —-A—- C:WINDOWSsystem32xactengine3_3.dll
2009-06-09 23:33:11 —-A—- C:WINDOWSsystem32D3DX9_40.dll
2009-06-09 23:33:10 —-A—- C:WINDOWSsystem32XAudio2_2.dll
2009-06-09 23:33:10 —-A—- C:WINDOWSsystem32XAPOFX1_1.dll
2009-06-09 23:33:10 —-A—- C:WINDOWSsystem32X3DAudio1_5.dll
2009-06-09 23:33:09 —-A—- C:WINDOWSsystem32xactengine3_2.dll
2009-06-09 23:33:09 —-A—- C:WINDOWSsystem32D3DX9_39.dll
2009-06-09 23:33:09 —-A—- C:WINDOWSsystem32d3dx10_39.dll
2009-06-09 23:33:09 —-A—- C:WINDOWSsystem32D3DCompiler_39.dll
2009-06-09 23:33:08 —-A—- C:WINDOWSsystem32XAudio2_1.dll
2009-06-09 23:33:08 —-A—- C:WINDOWSsystem32XAPOFX1_0.dll
2009-06-09 23:33:08 —-A—- C:WINDOWSsystem32xactengine3_1.dll
2009-06-09 23:33:08 —-A—- C:WINDOWSsystem32X3DAudio1_4.dll
2009-06-09 23:33:07 —-A—- C:WINDOWSsystem32XAudio2_0.dll
2009-06-09 23:33:07 —-A—- C:WINDOWSsystem32D3DX9_38.dll
2009-06-09 23:33:07 —-A—- C:WINDOWSsystem32d3dx10_38.dll
2009-06-09 23:33:07 —-A—- C:WINDOWSsystem32D3DCompiler_38.dll
2009-06-09 23:33:06 —-A—- C:WINDOWSsystem32xactengine3_0.dll
2009-06-09 23:33:06 —-A—- C:WINDOWSsystem32X3DAudio1_3.dll
2009-06-09 23:33:06 —-A—- C:WINDOWSsystem32D3DX9_37.dll
2009-06-09 23:33:06 —-A—- C:WINDOWSsystem32d3dx10_37.dll
2009-06-09 23:33:06 —-A—- C:WINDOWSsystem32D3DCompiler_37.dll
2009-06-09 23:33:05 —-A—- C:WINDOWSsystem32xactengine2_10.dll
2009-06-09 23:33:05 —-A—- C:WINDOWSsystem32d3dx10_36.dll
2009-06-09 23:33:05 —-A—- C:WINDOWSsystem32D3DCompiler_36.dll
2009-06-09 23:33:04 —-A—- C:WINDOWSsystem32xactengine2_9.dll
2009-06-09 23:33:04 —-A—- C:WINDOWSsystem32d3dx9_36.dll
2009-06-09 23:33:04 —-A—- C:WINDOWSsystem32d3dx10_35.dll
2009-06-09 23:33:04 —-A—- C:WINDOWSsystem32D3DCompiler_35.dll
2009-06-09 23:33:03 —-A—- C:WINDOWSsystem32xactengine2_8.dll
2009-06-09 23:33:03 —-A—- C:WINDOWSsystem32X3DAudio1_2.dll
2009-06-09 23:33:03 —-A—- C:WINDOWSsystem32d3dx9_35.dll
2009-06-09 23:33:02 —-A—- C:WINDOWSsystem32xinput1_3.dll
2009-06-09 23:33:02 —-A—- C:WINDOWSsystem32d3dx9_34.dll
2009-06-09 23:33:02 —-A—- C:WINDOWSsystem32d3dx10_34.dll
2009-06-09 23:33:02 —-A—- C:WINDOWSsystem32D3DCompiler_34.dll
2009-06-09 23:33:01 —-A—- C:WINDOWSsystem32xactengine2_7.dll
2009-06-09 23:33:01 —-A—- C:WINDOWSsystem32d3dx10_33.dll
2009-06-09 23:33:01 —-A—- C:WINDOWSsystem32D3DCompiler_33.dll
2009-06-09 23:33:00 —-A—- C:WINDOWSsystem32xactengine2_6.dll
2009-06-09 23:33:00 —-A—- C:WINDOWSsystem32d3dx9_33.dll
2009-06-09 23:32:59 —-A—- C:WINDOWSsystem32xactengine2_5.dll
2009-06-09 23:32:59 —-A—- C:WINDOWSsystem32xactengine2_4.dll
2009-06-09 23:32:59 —-A—- C:WINDOWSsystem32x3daudio1_1.dll
2009-06-09 23:32:59 —-A—- C:WINDOWSsystem32d3dx9_32.dll
2009-06-09 23:32:58 —-A—- C:WINDOWSsystem32xinput1_2.dll
2009-06-09 23:32:58 —-A—- C:WINDOWSsystem32xinput1_1.dll
2009-06-09 23:32:58 —-A—- C:WINDOWSsystem32xactengine2_3.dll
2009-06-09 23:32:58 —-A—- C:WINDOWSsystem32xactengine2_2.dll
2009-06-09 23:32:58 —-A—- C:WINDOWSsystem32d3dx9_31.dll
2009-06-09 23:32:57 —-A—- C:WINDOWSsystem32xactengine2_1.dll
2009-06-09 23:32:57 —-A—- C:WINDOWSsystem32xactengine2_0.dll
2009-06-09 23:32:57 —-A—- C:WINDOWSsystem32x3daudio1_0.dll
2009-06-09 23:32:57 —-A—- C:WINDOWSsystem32d3dx9_30.dll
2009-06-09 23:32:56 —-A—- C:WINDOWSsystem32xinput9_1_0.dll
2009-06-09 23:32:56 —-A—- C:WINDOWSsystem32d3dx9_29.dll
2009-06-09 23:32:56 —-A—- C:WINDOWSsystem32d3dx9_28.dll
2009-06-09 23:32:55 —-A—- C:WINDOWSsystem32d3dx9_27.dll
2009-06-09 23:32:55 —-A—- C:WINDOWSsystem32d3dx9_26.dll
2009-06-09 23:32:55 —-A—- C:WINDOWSsystem32d3dx9_25.dll
2009-06-09 23:32:54 —-A—- C:WINDOWSsystem32d3dx9_24.dll
2009-06-09 23:32:29 —-D—- C:WINDOWSLogs
2009-06-09 23:32:27 —-D—- C:Program FilesVtune
2009-06-09 23:25:23 —-D—- C:WINDOWSAsDmiHtm
2009-06-09 23:24:36 —-D—- C:WINDOWSsystem32Atheros_L1e
2009-06-09 23:24:07 —-A—- C:WINDOWSAscd_tmp.ini
2009-06-09 23:05:25 —-D—- C:WINDOWSsystem32Lang
2009-06-09 23:02:39 —-D—- C:WINDOWSsystem32RTCOM
2009-06-09 23:02:38 —-A—- C:WINDOWSsystem32ksuser.dll
2009-06-09 23:02:12 —-A—- C:WINDOWSsystem32spupdsvc.exe
2009-06-09 23:02:11 —-HDC—- C:WINDOWS$NtUninstallKB888111WXPSP2$
2009-06-09 23:02:09 —-A—- C:WINDOWSSOUNDMAN.EXE
2009-06-09 23:02:07 —-A—- C:WINDOWSSkyTel.exe
2009-06-09 23:02:06 —-A—- C:WINDOWSRtlUpd.exe
2009-06-09 23:01:58 —-A—- C:WINDOWSRTLCPL.EXE
2009-06-09 23:01:37 —-A—- C:WINDOWSRTHDCPL.EXE
2009-06-09 23:01:33 —-A—- C:WINDOWSMicCal.exe
2009-06-09 23:01:29 —-A—- C:WINDOWSALCMTR.EXE
2009-06-09 23:01:27 —-A—- C:WINDOWSALCWZRD.EXE
2009-06-09 23:01:23 —-D—- C:Program FilesRealtek
2009-06-09 23:01:15 —-A—- C:WINDOWSHideWin.exe
2009-06-09 23:01:14 —-R—- C:WINDOWSRtlExUpd.dll
2009-06-09 23:00:53 —-RA—- C:WINDOWSsystem32AsIO.dll
2009-06-09 23:00:50 —-D—- C:Program FilesASUS
2009-06-09 23:00:44 —-D—- C:Program FilesCommon FilesInstallShield
2009-06-09 23:00:29 —-D—- C:Program FilesAtheros Communications Inc
2009-06-09 23:00:28 —-HD—- C:Program FilesInstallShield Installation Information
2009-06-09 22:52:35 —-D—- C:WINDOWSsystem32ReinstallBackups
2009-06-09 22:52:34 —-DC—- C:WINDOWSsystem32DRVSTORE
2009-06-09 22:52:33 —-RA—- C:WINDOWSsystem32CSVer.dll
2009-06-09 22:52:33 —-D—- C:Program FilesIntel
2009-06-09 22:52:11 —-D—- C:Intel
2009-06-09 22:31:21 —-D—- C:Documents and SettingsJagaApplication DataIdentities
2009-06-09 22:31:19 —-HD—- C:Program FilesUninstall Information
2009-06-09 22:29:55 —-ASH—- C:Documents and SettingsJagaApplication Datadesktop.ini
2009-06-09 22:29:54 —-SD—- C:Documents and SettingsJagaApplication DataMicrosoft
2009-06-09 22:28:44 —-D—- C:WINDOWSSoftwareDistribution
2009-06-09 22:27:35 —-D—- C:WINDOWSPrefetch
2009-06-09 22:27:34 —-SD—- C:WINDOWSsystem32Microsoft
2009-06-09 22:27:34 —-A—- C:WINDOWSSchedLgU.Txt
2009-06-09 22:23:03 —-D—- C:WINDOWSsystem32xircom
2009-06-09 22:23:03 —-D—- C:Program Filesxerox
2009-06-09 22:23:03 —-D—- C:Program Filesmicrosoft frontpage
2009-06-09 22:22:48 —-A—- C:WINDOWScontrol.ini
2009-06-09 22:22:48 —-A—- C:AUTOEXEC.BAT
2009-06-09 22:22:40 —-A—- C:WINDOWSOEWABLog.txt
2009-06-09 22:22:37 —-A—- C:WINDOWSsystem32mapi32.dll
2009-06-09 22:21:52 —-SD—- C:WINDOWSDownloaded Program Files
2009-06-09 22:21:52 —-RD—- C:WINDOWSOffline Web Pages
2009-06-09 22:21:52 —-RAH—- C:WINDOWSsystem32logonui.exe.manifest
2009-06-09 22:21:47 —-RAH—- C:WINDOWSsystem32cdplayer.exe.manifest
2009-06-09 22:21:43 —-HD—- C:Program FilesWindowsUpdate
2009-06-09 22:21:40 —-D—- C:Program FilesOnline Services
2009-06-09 22:21:27 —-D—- C:WINDOWSsystem32DirectX
2009-06-09 22:21:12 —-A—- C:WINDOWSsystem32atrace.dll
2009-06-09 22:21:10 —-A—- C:WINDOWSsystem32desktop.ini
2009-06-09 22:21:10 —-A—- C:WINDOWSdesktop.ini
2009-06-09 22:21:06 —-A—- C:WINDOWSsystem32nmevtmsg.dll
2009-06-09 22:21:05 —-D—- C:Program FilesCommon FilesServices
2009-06-09 22:21:05 —-A—- C:WINDOWSsystem32acctres.dll
2009-06-09 22:21:03 —-SD—- C:WINDOWSTasks
2009-06-09 22:21:03 —-A—- C:WINDOWSsystem32icfgnt5.dll
2009-06-09 22:21:02 —-D—- C:Program FilesCommon FilesMSSoap
2009-06-09 22:20:59 —-D—- C:WINDOWSsrchasst
2009-06-09 22:20:58 —-D—- C:WINDOWSsystem32Macromed
2009-06-09 22:20:56 —-A—- C:WINDOWSsystem32wuweb.dll
2009-06-09 22:20:56 —-A—- C:WINDOWSsystem32wucltui.dll
2009-06-09 22:20:56 —-A—- C:WINDOWSsystem32wuauserv.dll
2009-06-09 22:20:56 —-A—- C:WINDOWSsystem32wuaueng1.dll
2009-06-09 22:20:56 —-A—- C:WINDOWSsystem32wuaueng.dll
2009-06-09 22:20:55 —-A—- C:WINDOWSsystem32wups.dll
2009-06-09 22:20:55 —-A—- C:WINDOWSsystem32wuauclt1.exe
2009-06-09 22:20:55 —-A—- C:WINDOWSsystem32wuauclt.exe
2009-06-09 22:20:55 —-A—- C:WINDOWSsystem32wuapi.dll
2009-06-09 22:20:55 —-A—- C:WINDOWSsystem32qmgrprxy.dll
2009-06-09 22:20:55 —-A—- C:WINDOWSsystem32qmgr.dll
2009-06-09 22:20:55 —-A—- C:WINDOWSsystem32bitsprx3.dll
2009-06-09 22:20:55 —-A—- C:WINDOWSsystem32bitsprx2.dll
2009-06-09 22:20:51 —-D—- C:Program FilesMovie Maker
2009-06-09 22:20:49 —-A—- C:WINDOWSsystem32safrslv.dll
2009-06-09 22:20:49 —-A—- C:WINDOWSsystem32safrdm.dll
2009-06-09 22:20:49 —-A—- C:WINDOWSsystem32safrcdlg.dll
2009-06-09 22:20:49 —-A—- C:WINDOWSsystem32racpldlg.dll
2009-06-09 22:20:46 —-A—- C:WINDOWSsystem32fltlib.dll
2009-06-09 22:20:45 —-D—- C:WINDOWSsystem32Restore
2009-06-09 22:20:45 —-A—- C:WINDOWSsystem32srsvc.dll
2009-06-09 22:20:45 —-A—- C:WINDOWSsystem32srrstr.dll
2009-06-09 22:20:45 —-A—- C:WINDOWSsystem32srclient.dll
2009-06-09 22:20:45 —-A—- C:WINDOWSsystem32fltMc.exe
2009-06-09 22:20:44 —-A—- C:WINDOWSsystem32nmmkcert.dll
2009-06-09 22:20:44 —-A—- C:WINDOWSsystem32msconf.dll
2009-06-09 22:20:44 —-A—- C:WINDOWSsystem32mnmsrvc.exe
2009-06-09 22:20:44 —-A—- C:WINDOWSsystem32mnmdd.dll
2009-06-09 22:20:44 —-A—- C:WINDOWSsystem32isrdbg32.dll
2009-06-09 22:20:44 —-A—- C:WINDOWSsystem32ils.dll
2009-06-09 22:20:42 —-D—- C:Program FilesNetMeeting
2009-06-09 22:20:42 —-A—- C:WINDOWSsystem32msoert2.dll
2009-06-09 22:20:42 —-A—- C:WINDOWSsystem32msoeacct.dll
2009-06-09 22:20:41 —-A—- C:WINDOWSsystem32inetres.dll
2009-06-09 22:20:41 —-A—- C:WINDOWSsystem32inetcomm.dll
2009-06-09 22:20:39 —-D—- C:Program FilesOutlook Express
2009-06-09 22:20:39 —-A—- C:WINDOWSsystem32schedsvc.dll
2009-06-09 22:20:39 —-A—- C:WINDOWSsystem32mstinit.exe
2009-06-09 22:20:39 —-A—- C:WINDOWSsystem32mstask.dll
2009-06-09 22:20:39 —-A—- C:WINDOWSsystem32isign32.dll
2009-06-09 22:20:39 —-A—- C:WINDOWSsystem32inetcfg.dll
2009-06-09 22:20:39 —-A—- C:WINDOWSsystem32icwphbk.dll
2009-06-09 22:20:39 —-A—- C:WINDOWSsystem32icwdial.dll
2009-06-09 22:20:34 —-D—- C:Program FilesCommon FilesSystem
2009-06-09 22:20:33 —-D—- C:Program FilesInternet Explorer
2009-06-09 22:20:05 —-D—- C:Program FilesComPlus Applications
2009-06-09 22:20:04 —-A—- C:WINDOWSvbaddin.ini
2009-06-09 22:20:04 —-A—- C:WINDOWSvb.ini
2009-06-09 22:20:00 —-D—- C:WINDOWSRegistration
2009-06-09 22:19:53 —-D—- C:Program FilesWindows Media Player
2009-06-09 22:19:48 —-D—- C:Program FilesMessenger
2009-06-09 22:19:45 —-D—- C:Program FilesMSN Gaming Zone
2009-06-09 22:19:45 —-A—- C:WINDOWSsystem32write.exe
2009-06-09 22:19:39 —-A—- C:WINDOWSsystem32sndvol32.exe
2009-06-09 22:19:39 —-A—- C:WINDOWSsystem32hticons.dll
2009-06-09 22:19:38 —-A—- C:WINDOWSsystem32winchat.exe
2009-06-09 22:19:38 —-A—- C:WINDOWSsystem32avwav.dll
2009-06-09 22:19:38 —-A—- C:WINDOWSsystem32avtapi.dll
2009-06-09 22:19:38 —-A—- C:WINDOWSsystem32avmeter.dll
2009-06-09 22:19:34 —-A—- C:WINDOWSsystem32getuname.dll
2009-06-09 22:19:33 —-A—- C:WINDOWSsystem32winmine.exe
2009-06-09 22:19:33 —-A—- C:WINDOWSsystem32sol.exe
2009-06-09 22:19:33 —-A—- C:WINDOWSsystem32mshearts.exe
2009-06-09 22:19:33 —-A—- C:WINDOWSsystem32charmap.exe
2009-06-09 22:19:33 —-A—- C:WINDOWSsystem32calc.exe
2009-06-09 22:19:32 —-A—- C:WINDOWSsystem32usrlogon.cmd
2009-06-09 22:19:32 —-A—- C:WINDOWSsystem32tsshutdn.exe
2009-06-09 22:19:32 —-A—- C:WINDOWSsystem32tslabels.ini
2009-06-09 22:19:32 —-A—- C:WINDOWSsystem32tskill.exe
2009-06-09 22:19:32 —-A—- C:WINDOWSsystem32tsdiscon.exe
2009-06-09 22:19:32 —-A—- C:WINDOWSsystem32tscon.exe
2009-06-09 22:19:32 —-A—- C:WINDOWSsystem32shadow.exe
2009-06-09 22:19:32 —-A—- C:WINDOWSsystem32rwinsta.exe
2009-06-09 22:19:32 —-A—- C:WINDOWSsystem32reset.exe
2009-06-09 22:19:32 —-A—- C:WINDOWSsystem32regini.exe
2009-06-09 22:19:32 —-A—- C:WINDOWSsystem32rdpcfgex.dll
2009-06-09 22:19:32 —-A—- C:WINDOWSsystem32qwinsta.exe
2009-06-09 22:19:32 —-A—- C:WINDOWSsystem32qappsrv.exe
2009-06-09 22:19:32 —-A—- C:WINDOWSsystem32msg.exe
2009-06-09 22:19:32 —-A—- C:WINDOWSsystem32logoff.exe
2009-06-09 22:19:32 —-A—- C:WINDOWSsystem32freecell.exe
2009-06-09 22:19:31 —-A—- C:WINDOWSsystem32mtxlegih.dll
2009-06-09 22:19:31 —-A—- C:WINDOWSsystem32mtxex.dll
2009-06-09 22:19:31 —-A—- C:WINDOWSsystem32mtxdm.dll
2009-06-09 22:19:31 —-A—- C:WINDOWSsystem32msdtcprf.ini
2009-06-09 22:19:31 —-A—- C:WINDOWSsystem32dcomcnfg.exe
2009-06-09 22:19:31 —-A—- C:WINDOWSsystem32comrepl.dll
2009-06-09 22:19:31 —-A—- C:WINDOWSsystem32comaddin.dll
2009-06-09 22:19:31 —-A—- C:WINDOWSsystem32cdmodem.dll
2009-06-09 22:19:30 —-A—- C:WINDOWSsystem32stclient.dll
2009-06-09 22:19:30 —-A—- C:WINDOWSsystem32comsnap.dll
2009-06-09 22:19:27 —-A—- C:WINDOWSsystem32wmimgmt.msc
2009-06-09 22:19:26 —-A—- C:WINDOWSsystem32sndrec32.exe
2009-06-09 22:19:26 —-A—- C:WINDOWSsystem32mplay32.exe
2009-06-09 22:19:26 —-A—- C:WINDOWSsystem32hypertrm.dll
2009-06-09 22:19:26 —-A—- C:WINDOWSsystem32accwiz.exe
2009-06-09 22:19:25 —-D—- C:Program FilesWindows NT
2009-06-09 22:19:25 —-A—- C:WINDOWSsystem32spider.exe
2009-06-09 22:19:25 —-A—- C:WINDOWSsystem32mspaint.exe
2009-06-09 22:19:25 —-A—- C:WINDOWSsystem32clipbrd.exe
2009-06-09 22:19:24 —-A—- C:WINDOWSsystem32tscupgrd.exe
2009-06-09 22:19:24 —-A—- C:WINDOWSsystem32tscfgwmi.dll
2009-06-09 22:19:24 —-A—- C:WINDOWSsystem32sessmgr.exe
2009-06-09 22:19:24 —-A—- C:WINDOWSsystem32remotepg.dll
2009-06-09 22:19:24 —-A—- C:WINDOWSsystem32rdshost.exe
2009-06-09 22:19:24 —-A—- C:WINDOWSsystem32rdsaddin.exe
2009-06-09 22:19:24 —-A—- C:WINDOWSsystem32rdchost.dll
2009-06-09 22:19:24 —-A—- C:WINDOWSsystem32mstscax.dll
2009-06-09 22:19:24 —-A—- C:WINDOWSsystem32mstsc.exe
2009-06-09 22:19:23 —-D—- C:WINDOWSsystem32MsDtc
2009-06-09 22:19:23 —-A—- C:WINDOWSsystem32termsrv.dll
2009-06-09 22:19:23 —-A—- C:WINDOWSsystem32rdpwsx.dll
2009-06-09 22:19:23 —-A—- C:WINDOWSsystem32rdpsnd.dll
2009-06-09 22:19:23 —-A—- C:WINDOWSsystem32rdpclip.exe
2009-06-09 22:19:23 —-A—- C:WINDOWSsystem32qprocess.exe
2009-06-09 22:19:23 —-A—- C:WINDOWSsystem32mtxoci.dll
2009-06-09 22:19:23 —-A—- C:WINDOWSsystem32msdtcuiu.dll
2009-06-09 22:19:23 —-A—- C:WINDOWSsystem32msdtcprx.dll
2009-06-09 22:19:23 —-A—- C:WINDOWSsystem32icaapi.dll
2009-06-09 22:19:23 —-A—- C:WINDOWSsystem32cfgbkend.dll
2009-06-09 22:19:22 —-D—- C:WINDOWSsystem32Com
2009-06-09 22:19:22 —-A—- C:WINDOWSsystem32xolehlp.dll
2009-06-09 22:19:22 —-A—- C:WINDOWSsystem32msdtctm.dll
2009-06-09 22:19:22 —-A—- C:WINDOWSsystem32msdtclog.dll
2009-06-09 22:19:22 —-A—- C:WINDOWSsystem32msdtc.exe
2009-06-09 22:19:22 —-A—- C:WINDOWSsystem32colbact.dll
2009-06-09 22:19:22 —-A—- C:WINDOWSsystem32catsrvps.dll
2009-06-09 22:19:21 —-A—- C:WINDOWSsystem32comuid.dll
2009-06-09 22:19:21 —-A—- C:WINDOWSsystem32comsvcs.dll
2009-06-09 22:19:21 —-A—- C:WINDOWSsystem32clbcatex.dll
2009-06-09 22:19:21 —-A—- C:WINDOWSsystem32catsrvut.dll
2009-06-09 22:19:21 —-A—- C:WINDOWSsystem32catsrv.dll
2009-06-09 22:19:20 —-A—- C:WINDOWSsystem32clbcatq.dll
2009-06-09 22:19:16 —-A—- C:WINDOWSsystem32servdeps.dll
2009-06-09 22:19:15 —-A—- C:WINDOWSsystem32mmfutil.dll
2009-06-09 22:19:15 —-A—- C:WINDOWSsystem32licwmi.dll
2009-06-09 22:19:15 —-A—- C:WINDOWSsystem32cmprops.dll
2009-06-09 06:20:35 —-A—- C:WINDOWSsystem32h323log.txt
2009-06-09 06:11:37 —-A—- C:WINDOWSsystem32usbui.dll
2009-06-09 06:08:55 —-A—- C:WINDOWSimsins.BAK
2009-06-09 06:08:53 —-SHD—- C:WINDOWSInstaller
2009-06-09 06:08:53 —-A—- C:WINDOWSsystem32PerfStringBackup.INI
2009-06-09 06:08:52 —-D—- C:Program FilesCommon FilesODBC
2009-06-09 06:08:52 —-A—- C:WINDOWSODBCINST.INI
2009-06-09 06:08:49 —-RD—- C:Program Files
2009-06-09 06:08:49 —-D—- C:Program FilesCommon FilesSpeechEngines
2009-06-09 06:08:49 —-D—- C:Program FilesCommon FilesMicrosoft Shared
2009-06-09 06:08:49 —-D—- C:Program FilesCommon Files
2009-06-09 06:08:46 —-RA—- C:WINDOWSsystem32kbdtuq.dll
2009-06-09 06:08:46 —-RA—- C:WINDOWSsystem32kbdtuf.dll
2009-06-09 06:08:46 —-RA—- C:WINDOWSsystem32kbdazel.dll
2009-06-09 06:08:45 —-RA—- C:WINDOWSsystem32kbdhept.dll
2009-06-09 06:08:45 —-RA—- C:WINDOWSsystem32kbdhela3.dll
2009-06-09 06:08:45 —-RA—- C:WINDOWSsystem32kbdhela2.dll
2009-06-09 06:08:45 —-RA—- C:WINDOWSsystem32kbdhe319.dll
2009-06-09 06:08:45 —-RA—- C:WINDOWSsystem32kbdhe220.dll
2009-06-09 06:08:45 —-RA—- C:WINDOWSsystem32kbdhe.dll
2009-06-09 06:08:45 —-RA—- C:WINDOWSsystem32kbdgkl.dll
2009-06-09 06:08:44 —-RA—- C:WINDOWSsystem32kbdlv1.dll
2009-06-09 06:08:44 —-RA—- C:WINDOWSsystem32kbdlv.dll
2009-06-09 06:08:44 —-RA—- C:WINDOWSsystem32kbdlt1.dll
2009-06-09 06:08:44 —-RA—- C:WINDOWSsystem32kbdlt.dll
2009-06-09 06:08:44 —-RA—- C:WINDOWSsystem32kbdest.dll
2009-06-09 06:08:43 —-RA—- C:WINDOWSsystem32kbdycl.dll
2009-06-09 06:08:43 —-RA—- C:WINDOWSsystem32kbdsl1.dll
2009-06-09 06:08:43 —-RA—- C:WINDOWSsystem32kbdsl.dll
2009-06-09 06:08:43 —-RA—- C:WINDOWSsystem32kbdro.dll
2009-06-09 06:08:43 —-RA—- C:WINDOWSsystem32kbdpl1.dll
2009-06-09 06:08:43 —-RA—- C:WINDOWSsystem32kbdpl.dll
2009-06-09 06:08:43 —-RA—- C:WINDOWSsystem32kbdhu1.dll
2009-06-09 06:08:43 —-RA—- C:WINDOWSsystem32kbdhu.dll
2009-06-09 06:08:43 —-RA—- C:WINDOWSsystem32kbdcz2.dll
2009-06-09 06:08:43 —-RA—- C:WINDOWSsystem32kbdcz1.dll
2009-06-09 06:08:43 —-RA—- C:WINDOWSsystem32kbdcz.dll
2009-06-09 06:08:43 —-RA—- C:WINDOWSsystem32kbdcr.dll
2009-06-09 06:08:43 —-RA—- C:WINDOWSsystem32KBDAL.DLL
2009-06-09 06:08:40 —-A—- C:WINDOWSsystem32kbdycc.dll
2009-06-09 06:08:40 —-A—- C:WINDOWSsystem32kbduzb.dll
2009-06-09 06:08:40 —-A—- C:WINDOWSsystem32kbdur.dll
2009-06-09 06:08:40 —-A—- C:WINDOWSsystem32kbdtat.dll
2009-06-09 06:08:40 —-A—- C:WINDOWSsystem32kbdmon.dll
2009-06-09 06:08:40 —-A—- C:WINDOWSsystem32kbdkyr.dll
2009-06-09 06:08:40 —-A—- C:WINDOWSsystem32kbdkaz.dll
2009-06-09 06:08:40 —-A—- C:WINDOWSsystem32kbdbu.dll
2009-06-09 06:08:40 —-A—- C:WINDOWSsystem32kbdblr.dll
2009-06-09 06:08:40 —-A—- C:WINDOWSsystem32kbdaze.dll
2009-06-09 06:08:39 —-A—- C:WINDOWSsystem32spxcoins.dll
2009-06-09 06:08:39 —-A—- C:WINDOWSsystem32irclass.dll
2009-06-09 06:08:39 —-A—- C:WINDOWSsystem32EqnClass.Dll
2009-06-09 06:08:39 —-A—- C:WINDOWSsystem32dgsetup.dll
2009-06-09 06:08:39 —-A—- C:WINDOWSsystem32dgrpsetu.dll
2009-06-09 06:08:38 —-N—- C:WINDOWSsystem32CONFIG.TMP
2009-06-09 06:08:38 —-A—- C:WINDOWSTASKMAN.EXE
2009-06-09 06:08:37 —-A—- C:WINDOWSsystem32batt.dll
2009-06-09 06:08:37 —-A—- C:WINDOWSNOTEPAD.EXE
2009-06-09 06:08:36 —-A—- C:WINDOWSsystem32storprop.dll
2009-06-09 06:08:30 —-ASH—- C:Documents and SettingsAll UsersApplication Datadesktop.ini
2009-06-09 06:08:27 —-RA—- C:WINDOWSSET8.tmp
2009-06-09 06:08:25 —-RA—- C:WINDOWSSET4.tmp
2009-06-09 06:08:24 —-RA—- C:WINDOWSSET3.tmp
2009-06-09 06:08:20 —-D—- C:WINDOWSsystem32CatRoot2
2009-06-09 06:08:20 —-D—- C:WINDOWSsystem32CatRoot
2009-06-09 06:08:14 —-SD—- C:Documents and SettingsAll UsersApplication DataMicrosoft
2009-06-09 06:08:01 —-A—- C:WINDOWSsetuplog.txt
2009-06-09 06:00:13 —-D—- C:Documents and Settings
2009-06-09 06:00:12 —-SHD—- C:System Volume Information
2009-06-09 05:59:00 —-ASH—- C:boot.ini
2009-06-09 05:53:00 —-RSHDC—- C:WINDOWSsystem32dllcache
2009-06-09 05:53:00 —-RSD—- C:WINDOWSFonts
2009-06-09 05:53:00 —-RD—- C:WINDOWSWeb
2009-06-09 05:53:00 —-HD—- C:WINDOWSinf
2009-06-09 05:53:00 —-D—- C:WINDOWSWinSxS
2009-06-09 05:53:00 —-D—- C:WINDOWStwain_32
2009-06-09 05:53:00 —-D—- C:WINDOWSTemp
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem32wins
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem32wbem
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem32usmt
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem32spool
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem32ShellExt
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem32Setup
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem32ras
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem32oobe
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem32npp
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem32mui
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem32inetsrv
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem32IME
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem32icsxml
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem32ias
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem32export
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem32drivers
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem32dhcp
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem32config
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem323com_dmi
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem323076
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem322052
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem321054
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem321049
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem321042
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem321041
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem321037
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem321033
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem321031
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem321028
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem321025
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem32
2009-06-09 05:53:00 —-D—- C:WINDOWSsystem
2009-06-09 05:53:00 —-D—- C:WINDOWSsecurity
2009-06-09 05:53:00 —-D—- C:WINDOWSResources
2009-06-09 05:53:00 —-D—- C:WINDOWSrepair
2009-06-09 05:53:00 —-D—- C:WINDOWSProvisioning
2009-06-09 05:53:00 —-D—- C:WINDOWSPeerNet
2009-06-09 05:53:00 —-D—- C:WINDOWSpchealth
2009-06-09 05:53:00 —-D—- C:WINDOWSmui
2009-06-09 05:53:00 —-D—- C:WINDOWSmsapps
2009-06-09 05:53:00 —-D—- C:WINDOWSmsagent
2009-06-09 05:53:00 —-D—- C:WINDOWSMedia
2009-06-09 05:53:00 —-D—- C:WINDOWSjava
2009-06-09 05:53:00 —-D—- C:WINDOWSime
2009-06-09 05:53:00 —-D—- C:WINDOWSHelp
2009-06-09 05:53:00 —-D—- C:WINDOWSehome
2009-06-09 05:53:00 —-D—- C:WINDOWSDriver Cache
2009-06-09 05:53:00 —-D—- C:WINDOWSDebug
2009-06-09 05:53:00 —-D—- C:WINDOWSCursors
2009-06-09 05:53:00 —-D—- C:WINDOWSConnection Wizard
2009-06-09 05:53:00 —-D—- C:WINDOWSConfig
2009-06-09 05:53:00 —-D—- C:WINDOWSAppPatch
2009-06-09 05:53:00 —-D—- C:WINDOWSaddins
2009-06-09 05:53:00 —-D—- C:WINDOWS

======List of files/folders modified in the last 1 months======

2009-06-09 22:22:48 —-A—- C:WINDOWSwin.ini
2009-06-09 06:08:48 —-A—- C:WINDOWSsystem.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AsIO;AsIO; C:WINDOWSsystem32driversAsIO.sys [2007-12-17 12400]
R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2004-08-18 40448]
R2 TBPanel;TBPanel; C:WINDOWSsystem32driversTBPanel.sys [2007-03-16 12256]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:WINDOWSsystem32DRIVERSHDAudBus.sys [2006-02-26 138752]
R3 hidusb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2004-08-18 9600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:WINDOWSsystem32driversRtkHDAud.sys [2008-10-02 4878336]
R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller; C:WINDOWSsystem32DRIVERSl1e51x86.sys [2008-09-23 38400]
R3 mouhid;Драйвер мыши HID; C:WINDOWSsystem32DRIVERSmouhid.sys [2004-08-18 12160]
R3 MTsensor;ATK0110 ACPI UTILITY; C:WINDOWSsystem32DRIVERSASACPI.sys [2006-02-26 5810]
R3 nv;nv; C:WINDOWSsystem32DRIVERSnv4_mini.sys [2009-02-19 6307328]
R3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver; C:WINDOWSsystem32DRIVERSRtnicxp.sys [2007-06-02 95488]
R3 usbaudio;Аудио драйвер USB (WDM); C:WINDOWSsystem32driversusbaudio.sys [2004-08-03 59264]
R3 usbccgp;Драйвер универсального родительского устройства USB (Microsoft); C:WINDOWSsystem32DRIVERSusbccgp.sys [2004-08-03 31616]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2004-08-03 26624]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2004-08-03 57600]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2004-08-03 20480]
S3 aujasnkj;aujasnkj; ??C:DOCUME~1JagaLOCALS~1Tempaujasnkj.sys []
S3 Cardex;Cardex; ??C:WINDOWSsystem32driversTBPANEL.SYS []
S3 hamachi;Hamachi Network Interface; C:WINDOWSsystem32DRIVERShamachi.sys [2009-07-04 25280]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2004-08-03 26496]
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:Program FilesLavasoftAd-AwareAAWService.exe [2009-06-18 1003344]
R2 NVSvc;NVIDIA Display Driver Service; C:WINDOWSsystem32nvsvc32.exe [2009-02-19 163908]

EOF

INFO.TXT

info.txt logfile of random’s system information tool 1.06 2009-07-05 00:08:16

======Uninstall list======

—>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:WINDOWSINFPCHealth.inf
Ad-Aware—>»C:Documents and SettingsAll UsersApplication Data{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}Ad-AwareAE.exe» REMOVE=TRUE MODIFY=FALSE
Ad-Aware—>C:Documents and SettingsAll UsersApplication Data{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}Ad-AwareAE.exe
Apollo 37zz—>»C:Program FilesApollounins000.exe»
Atheros Communications Inc.(R) AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver—>»C:Program FilesInstallShield Installation Information{3108C217-BE83-42E4-AE9E-A56A2A92E549}Setup.exe» -runfromtemp -l0x0009 -removeonly
Atheros Ethernet Utility—>»C:Program FilesInstallShield Installation Information{FB686487-C637-4EEF-BCB1-C92463F2CC05}setup.exe» -runfromtemp -l0x0009 -removeonly
EPU-4 Engine—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{8F66047B-1AF3-40D9-80D7-106E2EDC2C2A}setup.exe» -l0x9
High Definition Audio Driver Package — KB888111—>»C:WINDOWS$NtUninstallKB888111WXPSP2$spuninstspuninst.exe»
HijackThis 2.0.2—>»C:Program Filestrend microHijackThis.exe» /uninstall
Ideal Partner v2.75 PRO—>»C:Program FilesIdeal Partneruninst.exe»
Mozilla Firefox (3.0.11)—>C:Program FilesMozilla Firefoxuninstallhelper.exe
MultiTranse 5.5.1—>»C:Program FilesMultiTranseunins000.exe»
NeoDic 1.2—>»C:Program FilesNeoDicunins000.exe»
NVIDIA Drivers—>C:WINDOWSsystem32nvuninst.exe UninstallGUI
Punto Switcher 3.0—>C:Program FilesPunto Switcheruninstall.exe
Radmin Viewer 3.3—>MsiExec.exe /X{EEAA3E5E-1296-45AD-A59E-5D63F604867D}
Realtek High Definition Audio Driver—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime1150Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}setup.exe» -l0x19 -removeonly
Recovery Toolbox for RAR 1.1—>»C:Program FilesRecovery Toolbox for RARunins000.exe»
Spybot — Search & Destroy—>»C:Program FilesSpybot — Search & Destroyunins000.exe»
The KMPlayer (remove only)—>»C:Program FilesThe KMPlayeruninstall.exe»
Ventrilo Client—>MsiExec.exe /I{789289CA-F73A-4A16-A331-54D498CE069F}
Visual C++ 2008 x86 Runtime — (v9.0.30729)—>MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27}
Visual C++ 2008 x86 Runtime — v9.0.30729.01—>C:WINDOWSsystem32msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27} /qb+ REBOOTPROMPT=»»
Vtune 7.2—>»C:Program FilesVtuneunins000.exe»
Windows Installer 3.1 (KB893803)—>»C:WINDOWS$MSI31Uninstall_KB893803v2$spuninstspuninst.exe»
xp-AntiSpy 3.96-8—>C:Program Filesxp-AntiSpyUninstall.exe
Архиватор WinRAR—>C:Program FilesWinRARuninstall.exe
Культуризм—>»C:Program FilesRussobit-MКультуризмuninstall.exe»
Словарь TransLite—>»C:Program FilesTransLitetranslite_uninst.exe»
Энциклопедия бодибилдинга—>MsiExec.exe /X{05453205-EFB3-490C-A576-F996B0C0CEEE}

======Hosts File======

127.0.0.1 http://www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 http://www.008k.com
127.0.0.1 008k.com
127.0.0.1 http://www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 http://www.032439.com
127.0.0.1 032439.com

======System event log======

Computer Name: JAGERT
Event Code: 1007
Message: Компьютер автоматически настроил IP-адрес для сетевого адаптера
с адресом 00E04C1089B1. Используется IP-адрес 169.254.83.238.

Record Number: 5
Source Name: Dhcp
Time Written: 20090609221906.000000+240
Event Type: предупреждение
User:

Computer Name: JAGERT
Event Code: 6011
Message: NetBIOS-имя и имя DNS-узла этого компьютера были изменены с «MACHINENAME» на «JAGERT».

Record Number: 4
Source Name: EventLog
Time Written: 20090609221751.000000+240
Event Type: информация
User:

Computer Name: MACHINENAME
Event Code: 2
Message: При проверке, что DeviceSerial0 является последовательным портом, обнаружена и будет использоваться прямая очередь.

Record Number: 3
Source Name: Serial
Time Written: 20090609060040.000000+240
Event Type: информация
User:

Computer Name: MACHINENAME
Event Code: 6005
Message: Запущена служба журнала событий.

Record Number: 2
Source Name: EventLog
Time Written: 20090609060018.000000+240
Event Type: информация
User:

Computer Name: MACHINENAME
Event Code: 6009
Message: Microsoft (R) Windows 2000 (R) 5.01. 2600 Service Pack 2 Multiprocessor Free.

Record Number: 1
Source Name: EventLog
Time Written: 20090609060018.000000+240
Event Type: информация
User:

=====Application event log=====

Computer Name: JAGERT
Event Code: 102
Message: wuaueng.dll (2628) SUS20ClientDataStore: Ядро базы данных запустило новый экземпляр (0).

Record Number: 315
Source Name: ESENT
Time Written: 20090628204420.000000+240
Event Type: информация
User:

Computer Name: JAGERT
Event Code: 100
Message: wuauclt (2628) Ядро базы данных 5.01.2600.2180 запущено.

Record Number: 314
Source Name: ESENT
Time Written: 20090628204420.000000+240
Event Type: информация
User:

Computer Name: JAGERT
Event Code: 1800
Message: Служба центра обеспечения безопасности Windows запущена.

Record Number: 313
Source Name: SecurityCenter
Time Written: 20090628204335.000000+240
Event Type: информация
User:

Computer Name: JAGERT
Event Code: 101
Message: wuauclt (2804) Ядро базы данных остановлено.

Record Number: 312
Source Name: ESENT
Time Written: 20090628142919.000000+240
Event Type: информация
User:

Computer Name: JAGERT
Event Code: 103
Message: wuaueng.dll (2804) SUS20ClientDataStore: Ядро базы данных остановило работу экземпляра (0).

Record Number: 311
Source Name: ESENT
Time Written: 20090628142919.000000+240
Event Type: информация
User:

======Environment variables======

«ComSpec»=%SystemRoot%system32cmd.exe
«Path»=%SystemRoot%system32;%SystemRoot%;%SystemRoot%System32Wbem
«windir»=%SystemRoot%
«FP_NO_HOST_CHECK»=NO
«OS»=Windows_NT
«PROCESSOR_ARCHITECTURE»=x86
«PROCESSOR_LEVEL»=6
«PROCESSOR_IDENTIFIER»=x86 Family 6 Model 15 Stepping 13, GenuineIntel
«PROCESSOR_REVISION»=0f0d
«NUMBER_OF_PROCESSORS»=2
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP

EOF
6 июля, 2009 в 2:22 пп #24765
Admin
Keymaster
- Темы:40
- Сообщений:5676
Здравствуйте, добро пожаловать на Spyware-ru форум.

Для начала выполните эту инструкцию: Как удалить AdSubscribe.
Скачайте OTM by OldTimer кликнув по этой ссылке.
Запустите OTM и в большое поле ввода (заголовок этого поля выделен желтым цветом) скопируйте следующий текст.
```
:Processes

explorer.exe



:services

aujasnkj



:reg

[-HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimaldwshd.sys]

[-HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkdwshd.sys]



:Commands

[emptytemp]

[start explorer]

[Reboot]
```
Проверьте вставленный скрипт, если слева перед директивами появились пробелы, то удалите их, скрипт должен выглядеть так же как в сообщении. Кликните по кнопке MoveIt!. В процессе работы возможна перезагрузка компьютера.
По-завершении работы программы должен будет показан лог. Если лог не будет показан, то его можно найти в папке C:_OTMMovedFiles.

Вставьте в ваше ответное сообщение содержимое этого лога. И приложите свежий RSIT лог.
Автор

Сообщения

Просмотр 2 сообщений - с 1 по 2 (из 2 всего)

Для ответа в этой теме необходимо авторизоваться.

Вирус AdSubscribe

Добро пожаловать

Поиск

Последние темы

СПАЙВАРЕ РУ

Нужна помощь?

Ссылки