- This topic has 1 ответ, 2 участника, and was last updated 16 years, 5 months назад by
.
-
Сообщения
-
Здравствуйте!помогите пожалуйста!я в первый раз с таким столкнулась)))срочно нужно проверить почту а второй день при вводе адреса http://www.mail.ru открывается страничка входа vkontakte.ru.Установила AVAST искал вирусы что-то нашел но ничего не изменилось.вот результаты сканирования RSIT
info.txt logfile of random’s system information tool 1.06 2009-06-06 13:33:54======Uninstall list======
@BIOS Ver.2.03—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime11 0Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{B2DC3F08-2EB2-49A5-AA24-15DFC8B1CB83}Setup.exe» -l0x9 -removeonly
—>C:Program FilesNeroNero8\nerouninstallUNNERO.exe /UNINSTALL
—>C:WINDOWSUNNeroBackItUp.exe /UNINSTALL
—>C:WINDOWSUNNeroMediaHome.exe /UNINSTALL
—>C:WINDOWSUNNeroShowTime.exe /UNINSTALL
—>C:WINDOWSUNNeroVision.exe /UNINSTALL
—>C:WINDOWSUNRecode.exe /UNINSTALL
—>MsiExec.exe /I{9A346205-EA92-4406-B1AB-50379DA3F057}
—>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:WINDOWSINFPCHealth.inf
3dsmax ancillary install—>MsiExec.exe /I{7C8B5E63-821A-4DFB-BDFA-19854D88EC5C}
ABBYY Lingvo 12 Multilingual Edition—>MsiExec.exe /I{A1200000-0004-0000-0000-074957833700}
ACDSee 5.0 PowerPack—>MsiExec.exe /I{5058B085-AA79-41E5-A726-681B4C4B846E}
Ad-Aware—>MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe Bridge 1.0—>MsiExec.exe /I{B74D4E10-1033-0000-0000-000000000001}
Adobe Common File Installer—>MsiExec.exe /I{8EDBA74D-0686-4C99-BFDD-F894678E5B39}
Adobe Flash Player 10 Plugin—>C:WINDOWSsystem32MacromedFlashuninstall_plugin.exe
Adobe Flash Player 9 ActiveX—>C:WINDOWSsystem32MacromedFlashUninstFl.exe -q
Adobe Help Center 1.0—>MsiExec.exe /I{E9787678-1033-0000-8E67-000000000001}
Adobe Photoshop CS2—>msiexec /I {236BB7C4-4419-42FD-0409-1E257A25E34D}
Adobe Reader 8 — Russian—>MsiExec.exe /I{AC76BA86-7AD7-1049-7B44-A80000000000}
Adobe Stock Photos 1.0—>MsiExec.exe /I{786C5747-1033-0000-B58E-000000000001}
AIMP Classic—>C:Program FilesAIMP ClassicUnInstall.exe
Apple Software Update—>MsiExec.exe /I{55FA89BD-21D3-42F7-9249-C94C0094A83C}
ArchiCAD 10 R1 INT—>C:Program FilesGraphisoftArchiCAD 10Uninstall.ACuninstaller.exe
ArchiCAD 11 INT—>C:Program FilesGraphisoftArchiCAD 11Uninstall.ACuninstaller.exe
Autodesk 3ds Max 9 32-bit—>MsiExec.exe /I{E96D4088-AAC5-437F-9E39-EC0E387897B4}
Autodesk DWF Viewer 7—>MsiExec.exe /I{9A346205-EA92-4406-B1AB-50379DA3F057}
avast! Antivirus—>C:Program FilesAlwil SoftwareAvast4aswRunDll.exe «C:Program FilesAlwil SoftwareAvast4Setupsetiface.dll»,RunSetup
AVIcodec (remove only)—>»C:Program FilesAVIcodecuninst.exe»
Backburner—>MsiExec.exe /I{3D347E6D-5A03-4342-B5BA-6A771885F379}
Canon LBP2900—>C:Program FilesCanonPrnUninstallCanon LBP2900CNAB4UN.EXE
Codec Pack — All In 1 6.0.2.1—>C:WINDOWSiun6002.exe «C:Program FilesCodec Pack — All In 1irunin.ini»
Cooking Academy—>»C:Program FilesGamesCooking Academyunins000.exe»
CorelDRAW Graphics Suite 12—>MsiExec.exe /I{505AFDC0-5E72-4928-8368-5DEA385E3647}
DivX Pro v5.2.1 Video CODEC—>RunDLL32.exe advpack.dll,LaunchINFSection DivX5.inf, UnInstall
FBX Plugin 2006.08 for Max 9.0—>C:Program FilesAutodeskFBXFbxPlugins2006.08Max90Uninstall.exe
ffdshow [rev 1738] [2008-01-01]—>»C:Program Filesffdshowunins000.exe»
GlacierїнґшІ¦єЕїН»§¶Л Р¶ФШіМРт—>C:Program FilesGlacierїнґшІ¦єЕїН»§¶ЛUninstall.exe
GOM Player—>»C:Program FilesGRETECHGomPlayerUninstall.exe»
HijackThis 2.0.2—>»C:Program Filestrend microHijackThis.exe» /uninstall
Hotfix для Microsoft .NET Framework 2.0 (КБ918842)—>C:WINDOWSsystem32msiexec.exe /promptrestart /uninstall {5FD48194-AD97-46A1-ABDB-12FC85916742} /package {7131646D-CD3C-40F4-97B9-CD9E4E6262EF}
ICQ Toolbar—>C:Program FilesICQ6ToolbarICQUnToolbar.exe
ICQ6—>»C:Program FilesInstallShield Installation Information{60DE4033-9503-48D1-A483-7846BD217CA9}setup.exe» -runfromtemp -l0x0009 -removeonly
J2SE Runtime Environment 5.0 Update 6—>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150060}
Java(TM) 6 Update 13—>MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216013FF}
Java(TM) SE Runtime Environment 6—>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160000}
KWorld PVR-TV 883 Utilities—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime 701Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{477AB148-138C-46D2-820B-0DBFA744CEE8}Setup.exe» -l0x19 -uninst
KWorld TV883 WDM Drivers—>C:WINDOWSc8xunist.exe
Lizardtech DjVu Control—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{105CFC7C-6992-11D5-BD9D-000102C10FD8}Setup.exe» -l0x9
Microsoft .NET Framework 1.1 Hotfix (KB886903)—>»C:WINDOWSMicrosoft.NETFrameworkv1.1.4322Updateshotfix.exe» «C:WINDOWSMicrosoft.NETFrameworkv1.1.4322UpdatesM886903M886903Uninstall.msp»
Microsoft .NET Framework 1.1 Russian Language Pack—>MsiExec.exe /X{2BB372D9-52B4-410A-BC1A-FEAB63181EEF}
Microsoft .NET Framework 1.1—>msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1—>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0—>MsiExec.exe /X{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}
Nero 8—>MsiExec.exe /X{8AEA4BE2-2B52-41C0-BB7D-9F2D17AF1049}
NVIDIA Drivers—>C:WINDOWSsystem32nvudisp.exe UninstallGUI
Opera 9.60—>MsiExec.exe /X{D2F5287E-5F0E-447B-9157-B08AA4E2AC76}
Pivim Multibar—>C:Program FilesPivim Multibaruninstall.exe
QuickTime—>C:PROGRA~1COMMON~1INSTAL~1Driver11INTEL3~1IDriver.exe /M{C21D5524-A970-42FA-AC8A-59B8C7CDCA31} /l1033
REALTEK GbE & FE Ethernet PCI-E NIC Driver—>C:Program FilesInstallShield Installation Information{C9BED750-1211-4480-B1A5-718A3BE15525}SETUP.EXE -runfromtemp -l0x0019 -removeonly
Realtek High Definition Audio Driver—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime1150Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}Setup.exe» -l0x19 -removeonly
Skype™ 4.0—>MsiExec.exe /X{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}
SmartCamera Ver 2.1—>MsiExec.exe /X{9527450C-64B3-11D5-9B31-000021116B62}
SmartFTP Client 3.0 Setup Files (remove only)—>C:Program FilesSmartFTP Client 3.0 Setup Filesuninst-sftp.exe
V-Ray for 3dsmax R9 for x86—>»C:Program FilesChaos GroupV-Ray3dsmax R9 for x86uninstallwininstaller.exe»-uninstall=»C:Program FilesChaos GroupV-Ray3dsmax R9 for x86uninstallinstall.log» -uninstallApp=»V-Ray for 3dsmax R9 for x86″
WIBU-KEY Setup (WIBU-KEY Remove)—>C:Program FilesWIBUKEYSetupSetup32.exe /R:{00060000-0000-1004-8002-0000C06B5161}
Архиватор WinRAR (только удаление)—>C:Program FilesWinRARuninstall.exe
Расширенный выпуск Microsoft Office 2000—>MsiExec.exe /I{00000419-78E1-11D2-B60F-006097C998E7}
Час Земли 2009 Screensaver—>C:Program FilesWWF РоссииЧас Земли 2009Uninstall.exe======Hosts File======
79.174.66.136 http://www.vkontakte.ru
79.174.66.136 vkontakte.ru
79.174.66.136 mail.ru
79.174.66.136 http://www.mail.ru
79.174.66.136 http://www.yandex.ru
79.174.66.136 yandex.ru
79.174.66.136 http://www.odnoklasniki.ru
79.174.66.136 odnoklasniki.ru
79.174.66.136 rambler.ru
79.174.66.136 google.ru======Security center information======
AV: avast! antivirus 4.8.1335 [VPS 090510-0] (outdated)
AV: Антивирус Касперского (outdated)======System event log======
Computer Name: JANE
Event Code: 32
Message: Зависимая совокупность Microsoft.VC80.MFCLOC не может быть найдена, последняя ошибка Указанная совокупность не установлена в системе.Record Number: 16689
Source Name: SideBySide
Time Written: 20090529154855.000000+240
Event Type: ошибка
User:Computer Name: JANE
Event Code: 59
Message: Generate Activation Context завершилась не удачно для C:WINDOWSWinSxSx86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05MFC80.DLL.
Соответствующее сообщение об ошибке: Операция успешно завершена.
.Record Number: 16688
Source Name: SideBySide
Time Written: 20090529154855.000000+240
Event Type: ошибка
User:Computer Name: JANE
Event Code: 59
Message: Resolve Partial Assembly завершилась не удачно для Microsoft.VC80.MFCLOC.
Соответствующее сообщение об ошибке: Указанная совокупность не установлена в системе.
.Record Number: 16687
Source Name: SideBySide
Time Written: 20090529154855.000000+240
Event Type: ошибка
User:Computer Name: JANE
Event Code: 32
Message: Зависимая совокупность Microsoft.VC80.MFCLOC не может быть найдена, последняя ошибка Указанная совокупность не установлена в системе.Record Number: 16686
Source Name: SideBySide
Time Written: 20090529154855.000000+240
Event Type: ошибка
User:Computer Name: JANE
Event Code: 59
Message: Generate Activation Context завершилась не удачно для C:WINDOWSWinSxSx86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05MFC80.DLL.
Соответствующее сообщение об ошибке: Операция успешно завершена.
.Record Number: 16685
Source Name: SideBySide
Time Written: 20090529154852.000000+240
Event Type: ошибка
User:=====Application event log=====
Computer Name: JANE
Event Code: 3
Message:
Record Number: 671
Source Name: RaySat_3dsmax9_32 Server
Time Written: 20090328093507.000000+180
Event Type: информация
User:Computer Name: JANE
Event Code: 2
Message:
Record Number: 670
Source Name: RaySat_3dsmax9_32 Server
Time Written: 20090328093507.000000+180
Event Type: ошибка
User:Computer Name: JANE
Event Code: 3
Message:
Record Number: 669
Source Name: RaySat_3dsmax9_32 Server
Time Written: 20090328093507.000000+180
Event Type: информация
User:Computer Name: JANE
Event Code: 1010
Message: User profile hive cleanup service stopped successfully.Record Number: 668
Source Name: UPHClean
Time Written: 20090327222231.000000+180
Event Type: информация
User:Computer Name: JANE
Event Code: 0
Message:
Record Number: 667
Source Name: NMIndexingService
Time Written: 20090327201754.000000+180
Event Type: информация
User:======Environment variables======
«ComSpec»=%SystemRoot%system32cmd.exe
«Path»=%SystemRoot%system32;%SystemRoot%;%SystemRoot%System32Wbem;C:Program FilesAutodeskBackburner;C:Program FilesCommon FilesAutodesk Shared;C:Program FilesCommon FilesAdobeAGL;C:Program FilesQuickTimeQTSystem
«windir»=%SystemRoot%
«FP_NO_HOST_CHECK»=NO
«OS»=Windows_NT
«PROCESSOR_ARCHITECTURE»=x86
«PROCESSOR_LEVEL»=6
«PROCESSOR_IDENTIFIER»=x86 Family 6 Model 15 Stepping 11, GenuineIntel
«PROCESSOR_REVISION»=0f0b
«NUMBER_OF_PROCESSORS»=2
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP
«DEVMGR_SHOW_DETAILS»=1
«DEVMGR_SHOW_NONPRESENT_DEVICES»=1
«CLASSPATH»=.;C:Program FilesJavajre1.6.0libextQTJava.zip
«QTJAVA»=C:Program FilesJavajre1.6.0libextQTJava.zip
EOF
Logfile of random’s system information tool 1.06 (written by random/random)
Run by Admin at 2009-06-06 13:33:18
Microsoft Windows XP Professional Service Pack 2
System drive C: has 18 GB (58%) free of 31 GB
Total RAM: 2046 MB (67% free)Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:33:53, on 06.06.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: NormalRunning processes:
C:WINDOWSsystem32csrss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesLavasoftAd-Awareaawservice.exe
C:WINDOWSsystem32riodrv.exe
C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
C:Program FilesAlwil SoftwareAvast4ashServ.exe
C:WINDOWSexplorer.exe
C:program filespunto switcherps.exe
C:program filesVolumeControlvolume.exe
C:Program FilesJavajre6binjusched.exe
C:Program FilesQuickTimeqttask.exe
C:Program FilesABBYY Lingvo 12Lvagent.exe
C:WINDOWSvsnpstd2.exe
C:PROGRA~1ALWILS~1Avast4ashDisp.exe
C:Program FilesCommon FilesNeroLibNMBgMonitor.exe
C:Program FilesSkypePhoneSkype.exe
C:Program FilesICQ6ICQ.exe
C:Program FilesKWorld MultimediaPVR-TV 883 UtilitiesC8XRCtl.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesCommon FilesAutodesk SharedServiceAdskScSrv.exe
C:Program FilesICQ6ToolbarICQ Service.exe
C:Program FilesJavajre6binjqs.exe
C:Program FilesNeroNero8Nero BackItUpNBService.exe
C:WINDOWSsystem32nvsvc32.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32uphclean.exe
C:Program FilesCommon FilesNeroLibNMIndexingService.exe
C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
C:WINDOWSsystem32CNAB4RPK.EXE
C:Program FilesCommon FilesNeroLibNMIndexStoreSvr.exe
C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
C:Program FilesGlacierїнґшІ¦єЕїН»§¶ЛGlaclient.exe
C:WINDOWSTEMPrdl1D.tmp.exe
C:Program FilesAlwil SoftwareAvast4setupavast.setup
C:Program FilesOperaopera.exe
C:WINDOWSTEMPrdl1D.tmp.exe
C:Documents and SettingsAdminРабочий столRSIT.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:Program Filestrend microAdmin.exeR1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = about:blank
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://start.icq.com/
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: (no name) — — (no file)
R3 — URLSearchHook: ICQToolBar — {855F3B16-6D32-4fe6-8A56-BBB695989046} — C:Program FilesICQ6ToolbarICQToolBar.dll
F2 — REG:system.ini: Shell=Explorer.exe riodrv.exe
F2 — REG:system.ini: UserInit=userinit.exe,riodrv.exe,C:WINDOWSsystem32sdra64.exe,
O1 — Hosts: 79.174.66.136 http://www.vkontakte.ru
O1 — Hosts: 79.174.66.136 vkontakte.ru
O1 — Hosts: 79.174.66.136 mail.ru
O1 — Hosts: 79.174.66.136 http://www.mail.ru
O1 — Hosts: 79.174.66.136 http://www.yandex.ru
O1 — Hosts: 79.174.66.136 yandex.ru
O1 — Hosts: 79.174.66.136 http://www.odnoklasniki.ru
O1 — Hosts: 79.174.66.136 odnoklasniki.ru
O1 — Hosts: 79.174.66.136 rambler.ru
O1 — Hosts: 79.174.66.136 google.ru
O1 — Hosts: 79.174.66.136 mamba.ru
O1 — Hosts: 79.174.66.136 http://www.a1agragator.ru
O1 — Hosts: 79.174.66.136 http://www.a1help.ru
O1 — Hosts: 79.174.66.136 a1agragator.ru
O1 — Hosts: 79.174.66.136 a1help.ru
O2 — BHO: (no name) — {04BAFC59-79C6-4C12-9305-87DE6D8AC6F2} — C:WINDOWSsystem32mzfhvxis.dll (file missing)
O2 — BHO: Adobe PDF Reader Link Helper — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 — BHO: Java(tm) Plug-In 2 SSV Helper — {DBC80044-A445-435b-BC74-9C25C1C588A9} — C:Program FilesJavajre6binjp2ssv.dll
O2 — BHO: (no name) — {E65EE8C3-F8D5-43CF-9CDF-443E56CB135F} — c:windowssystem32ufffbxc.dll (file missing)
O2 — BHO: JQSIEStartDetectorImpl — {E7E6F031-17CE-4C07-BC86-EABFE594F69C} — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll
O2 — BHO: XBTBPos00 — {FCBCCB87-9224-4B8D-B117-F56D924BEB18} — C:Program FilesPivim Multibarpivim.dll
O3 — Toolbar: Pivim Multibar — {1BB22D38-A411-4B13-A746-C2A4F4EC7344} — C:Program FilesPivim Multibarpivim.dll
O3 — Toolbar: ICQToolBar — {855F3B16-6D32-4fe6-8A56-BBB695989046} — C:Program FilesICQ6ToolbarICQToolBar.dll
O4 — HKLM..Run: [Punto Switcher] C:program filespunto switcherps.exe
O4 — HKLM..Run: [VolumeControl] C:program filesVolumeControlvolume.exe
O4 — HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 — HKLM..Run: [nwiz] nwiz.exe /install
O4 — HKLM..Run: [WinSys2] C:WINDOWSsystem32winsys2.exe
O4 — HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 — HKLM..Run: [PVR Agent] C:Program FilesKWorld MultimediaPVR PlusTVRScheduled.exe
O4 — HKLM..Run: [SunJavaUpdateSched] «C:Program FilesJavajre6binjusched.exe»
O4 — HKLM..Run: [trafinspag.exe] C:Program FilesTrafInspAgenttrafinspag.exe
O4 — HKLM..Run: [NeroFilterCheck] C:Program FilesCommon FilesNeroLibNeroCheck.exe
O4 — HKLM..Run: [NBKeyScan] «C:Program FilesNeroNero8Nero BackItUpNBKeyScan.exe»
O4 — HKLM..Run: [QuickTime Task] «C:Program FilesQuickTimeqttask.exe» -atboottime
O4 — HKLM..Run: [Lingvo Launcher] «C:Program FilesABBYY Lingvo 12Lvagent.exe» /STARTUP
O4 — HKLM..Run: [SNPSTD2] C:WINDOWSvsnpstd2.exe
O4 — HKLM..Run: [WinDLL (service.exe)] service.exe
O4 — HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 — HKCU..Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] «C:Program FilesCommon FilesNeroLibNMBgMonitor.exe»
O4 — HKCU..Run: [Skype] «C:Program FilesSkypePhoneSkype.exe» /nosplash /minimized
O4 — HKCU..Run: [ICQ] «C:Program FilesICQ6ICQ.exe» silent
O4 — HKUSS-1-5-19..Run: [LinkDel] linkdel.cmd (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [LinkDel] linkdel.cmd (User ‘NETWORK SERVICE’)
O4 — Startup: Adobe Gamma.lnk = C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe
O4 — Global Startup: Adobe Reader Speed Launch.lnk = C:Program FilesAdobeReader 8.0Readerreader_sl.exe
O4 — Global Startup: Adobe Reader Synchronizer.lnk = C:Program FilesAdobeReader 8.0ReaderAdobeCollabSync.exe
O4 — Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOfficeOSA9.EXE
O4 — Global Startup: Remote Control.lnk = C:Program FilesKWorld MultimediaPVR-TV 883 UtilitiesC8XRCtl.exe
O8 — Extra context menu item: &Перевести с помощью ABBYY Lingvo… — res://C:Program FilesABBYY Lingvo 12Lingvo.exe/3000
O9 — Extra button: (no name) — {85d1f590-48f4-11d9-9669-0800200c9a66} — C:WINDOWSbdoscandel.exe
O9 — Extra ‘Tools’ menuitem: Uninstall BitDefender Online Scanner — {85d1f590-48f4-11d9-9669-0800200c9a66} — C:WINDOWSbdoscandel.exe
O9 — Extra button: ICQ6 — {E59EB121-F339-4851-A3BA-FE49C35617C2} — C:Program FilesICQ6ICQ.exe
O9 — Extra ‘Tools’ menuitem: ICQ6 — {E59EB121-F339-4851-A3BA-FE49C35617C2} — C:Program FilesICQ6ICQ.exe
O16 — DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) — http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 — DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) — http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
O16 — DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) — http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O17 — HKLMSystemCCSServicesTcpip..{76CD2D8E-B65E-405F-9EE9-59093572F71F}: NameServer = 194.44.156.18,194.44.156.30
O18 — Protocol: skype4com — {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} — C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O20 — Winlogon Notify: xzdnjtvl — ufffbxc.dll (file missing)
O21 — SSODL: oledll — {99045B67-9132-9234-D429-7F84D923BC79} — C:WINDOWSsystem32wrZ2tokl.dll
O21 — SSODL: SysRun — {D7FFD784-5276-42D1-887B-00267870A4C7} — C:WINDOWSsystem32svshost.dll (file missing)
O23 — Service: Lavasoft Ad-Aware Service (aawservice) — Lavasoft — C:Program FilesLavasoftAd-Awareaawservice.exe
O23 — Service: Lavasoft Ad-Aware Service aawservice LM Service (aawservice LM Service) — Unknown owner — C:WINDOWSTEMPrdl1D.tmp.exe
O23 — Service: Adobe LM Service — Adobe Systems — C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe
O23 — Service: avast! iAVS4 Control Service (aswUpdSv) — ALWIL Software — C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 — Service: Autodesk Licensing Service — Autodesk — C:Program FilesCommon FilesAutodesk SharedServiceAdskScSrv.exe
O23 — Service: avast! Antivirus — ALWIL Software — C:Program FilesAlwil SoftwareAvast4ashServ.exe
O23 — Service: avast! Mail Scanner — ALWIL Software — C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
O23 — Service: avast! Web Scanner — ALWIL Software — C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: ICQ Service — Unknown owner — C:Program FilesICQ6ToolbarICQ Service.exe
O23 — Service: InstallDriver Table Manager (IDriverT) — Macrovision Corporation — C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe
O23 — Service: Java Quick Starter (JavaQuickStarterService) — Sun Microsystems, Inc. — C:Program FilesJavajre6binjqs.exe
O23 — Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) — Unknown owner — C:Program FilesAutodesk3ds Max 9mentalraysatelliteraysat_3dsmax9_32server.exe
O23 — Service: Nero BackItUp Scheduler 3 — Nero AG — C:Program FilesNeroNero8Nero BackItUpNBService.exe
O23 — Service: NMIndexingService — Nero AG — C:Program FilesCommon FilesNeroLibNMIndexingService.exe
O23 — Service: NVIDIA Display Driver Service (NVSvc) — NVIDIA Corporation — C:WINDOWSsystem32nvsvc32.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe—
End of file — 10164 bytes======Scheduled tasks folder======
C:WINDOWStasksAppleSoftwareUpdate.job
======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{04BAFC59-79C6-4C12-9305-87DE6D8AC6F2}]
C:WINDOWSsystem32mzfhvxis.dll [][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll [2006-10-23 62080][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper — C:Program FilesJavajre6binjp2ssv.dll [2009-05-26 35840][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{E65EE8C3-F8D5-43CF-9CDF-443E56CB135F}]
c:windowssystem32ufffbxc.dll [][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll [2009-05-26 73728][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{FCBCCB87-9224-4B8D-B117-F56D924BEB18}]
XBTBPos00 Class — C:Program FilesPivim Multibarpivim.dll [2009-05-19 2181632][HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{1BB22D38-A411-4B13-A746-C2A4F4EC7344} — Pivim Multibar — C:Program FilesPivim Multibarpivim.dll [2009-05-19 2181632]
{855F3B16-6D32-4fe6-8A56-BBB695989046} — ICQToolBar — C:Program FilesICQ6ToolbarICQToolBar.dll [2008-06-12 958712][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«Punto Switcher»=C:program filespunto switcherps.exe [2004-11-14 205824]
«VolumeControl»=C:program filesVolumeControlvolume.exe [2003-09-16 36864]
«NvCplDaemon»=C:WINDOWSsystem32NvCpl.dll [2007-06-28 8466432]
«nwiz»=nwiz.exe /install []
«WinSys2″=C:WINDOWSsystem32winsys2.exe [2006-04-29 208896]
«NvMediaCenter»=C:WINDOWSsystem32NvMcTray.dll [2007-06-28 81920]
«PVR Agent»=C:Program FilesKWorld MultimediaPVR PlusTVRScheduled.exe []
«SunJavaUpdateSched»=C:Program FilesJavajre6binjusched.exe [2009-05-26 148888]
«trafinspag.exe»=C:Program FilesTrafInspAgenttrafinspag.exe []
«NeroFilterCheck»=C:Program FilesCommon FilesNeroLibNeroCheck.exe [2007-03-01 153136]
«NBKeyScan»=C:Program FilesNeroNero8Nero BackItUpNBKeyScan.exe [2007-08-08 1828136]
«QuickTime Task»=C:Program FilesQuickTimeqttask.exe [2009-02-28 282624]
«Lingvo Launcher»=C:Program FilesABBYY Lingvo 12Lvagent.exe [2006-12-14 258048]
«SNPSTD2″=C:WINDOWSvsnpstd2.exe [2004-08-30 286720]
«WinDLL (service.exe)»=service.exe []
«avast!»=C:PROGRA~1ALWILS~1Avast4ashDisp.exe [2009-02-06 81000][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=C:Program FilesCommon FilesNeroLibNMBgMonitor.exe [2007-08-03 202024]
«Skype»=C:Program FilesSkypePhoneSkype.exe [2009-04-21 24264488]
«ICQ»=C:Program FilesICQ6ICQ.exe [2008-09-01 173304]C:Documents and SettingsAll UsersГлавное менюПрограммыАвтозагрузка
Adobe Reader Speed Launch.lnk — C:Program FilesAdobeReader 8.0Readerreader_sl.exe
Adobe Reader Synchronizer.lnk — C:Program FilesAdobeReader 8.0ReaderAdobeCollabSync.exe
Microsoft Office.lnk — C:Program FilesMicrosoft OfficeOfficeOSA9.EXE
Remote Control.lnk — C:Program FilesKWorld MultimediaPVR-TV 883 UtilitiesC8XRCtl.exeC:Documents and SettingsAdminГлавное менюПрограммыАвтозагрузка
Adobe Gamma.lnk — C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyxzdnjtvl]
ufffbxc.dll [][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
UPnPMonitor — {e57ce738-33e8-4c51-8354-bb4de9d215d1} — C:WINDOWSsystem32upnpui.dll [2004-08-18 239616]
oledll — {99045B67-9132-9234-D429-7F84D923BC79} — C:WINDOWSsystem32wrZ2tokl.dll [2009-06-03 81920]
SysRun — {D7FFD784-5276-42D1-887B-00267870A4C7} — C:WINDOWSsystem32svshost.dll [][HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalaawservice]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkaawservice]
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1
«InstallVisualStyle»=C:WINDOWSResourcesThemesRoyaleRoyale.msstyles
«InstallTheme»=C:WINDOWSResourcesThemesRoyale.theme
«SynchronousMachineGroupPolicy»=0
«SynchronousUserGroupPolicy»=0[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=145
«ForceClassicControlPanel»=1
«NoSMConfigurePrograms»=1
«NoSMHelp»=1
«NoDrives»=262144
«ForceCopyACLWithFile»=1[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:WINDOWSsystem32wininet.exe»=»C:WINDOWSsystem32wininet.exe:*:Enabled:Windows XP Update»[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{42d1d157-d2b9-11dd-85cb-001a4d4ed2d8}]
shellAutoRuncommand — G:CONFIGS-1-5-21-1482476501-1644491937-682003330-1013ConfDriver.exe
shellopencommand — G:CONFIGS-1-5-21-1482476501-1644491937-682003330-1013ConfDriver.exe[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{42d1d159-d2b9-11dd-85cb-001a4d4ed2d8}]
shellAutocommand — Start.exe
shellAutoRuncommand — C:WINDOWSsystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe
shellexplorecommand — F:mapraputa.exe
shellopencommand — F:mapraputa.exe[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{51b98004-cc2e-11dd-85bf-001a4d4ed2d8}]
shellAutoRuncommand — F:CONFIGS-1-5-21-1482476501-1644491937-682003330-1013ConfDriver.exe
shellopencommand — F:CONFIGS-1-5-21-1482476501-1644491937-682003330-1013ConfDriver.exe[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{531321c1-3faf-11de-862f-001a4d4ed2d8}]
shellAutoRuncommand — CONFIGS-1-5-21-1482476501-1644491937-682003330-1013ConfDriver.exe
shellopencommand — CONFIGS-1-5-21-1482476501-1644491937-682003330-1013ConfDriver.exe[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{6c58e460-cdaf-11dd-85c1-001a4d4ed2d8}]
shellAutoRuncommand — mapraputa.exe
shellexplorecommand — mapraputa.exe
shellopencommand — mapraputa.exe[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{80027419-4ed1-11de-8653-001a4d4ed2d8}]
shellAutoRuncommand — C:WINDOWSsystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL .\\name\\\\\\less.exe
shellexplorecommand — G:name\\\\\\less.exe
shellopencommand — G:name\\\\\\less.exe[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{8e0f548d-08bb-11de-85ec-001a4d4ed2d8}]
shellAutoRuncommand — C:WINDOWSsystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL autorun.exe
shellExplorecommand — F:autorun.exe
shellOpencommand — F:autorun.exe[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{8e70ba94-0423-11de-85e2-001a4d4ed2d8}]
shellAutoRuncommand — F:mapraputa.exe
shellexplorecommand — F:mapraputa.exe
shellopencommand — F:mapraputa.exe[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{c65176ca-d0f1-11dd-85c7-001a4d4ed2d8}]
shellAutoRuncommand — C:WINDOWSsystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL .\\name\\\\\\less.exe
shellexplorecommand — F:name\\\\\\less.exe
shellopencommand — F:name\\\\\\less.exe[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{e8332d76-cbff-11dd-85be-001a4d4ed2d8}]
shellAutoRuncommand — C:WINDOWSsystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL autorun.exe
shellExplorecommand — F:autorun.exe
shellOpencommand — F:autorun.exe[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{f9f49bc2-d026-11dd-85c6-001a4d4ed2d8}]
shellAutoRuncommand — F:mapraputa.exe
shellexplorecommand — F:mapraputa.exe
shellopencommand — F:mapraputa.exe======List of files/folders created in the last 3 months======
2009-06-06 13:33:19 —-D—- C:Program Filestrend micro
2009-06-06 13:33:18 —-D—- C:rsit
2009-06-05 10:40:29 —-A—- C:WINDOWSsystem32aswBoot.exe
2009-06-05 10:40:27 —-D—- C:Program FilesAlwil Software
2009-06-05 09:54:10 —-D—- C:Documents and SettingsAdminApplication Datakgnusucq
2009-06-04 18:38:22 —-SHD—- C:WINDOWSsystem32lowsec
2009-06-03 18:37:12 —-RSH—- C:WINDOWSsystem32sys32net.dll
2009-06-03 18:29:11 —-RSH—- C:WINDOWSsystem32riodrv.exe
2009-06-03 18:28:39 —-A—- C:Program Filesxehuxik.dll
2009-06-03 18:28:21 —-A—- C:WINDOWSsystem32wrZ2tokl.dll
2009-06-03 18:28:21 —-A—- C:WINDOWSsystem32syZ3h.dll
2009-06-03 00:15:53 —-D—- C:WINDOWSBDOSCAN8
2009-06-03 00:09:01 —-A—- C:WINDOWSsystem32kbdkor.dll
2009-06-03 00:09:01 —-A—- C:WINDOWSsystem32kbdjpn.dll
2009-06-03 00:09:01 —-A—- C:WINDOWSsystem32kbd106.dll
2009-06-03 00:09:01 —-A—- C:WINDOWSsystem32kbd103.dll
2009-06-03 00:09:01 —-A—- C:WINDOWSsystem32kbd101c.dll
2009-06-03 00:09:01 —-A—- C:WINDOWSsystem32kbd101b.dll
2009-06-01 13:51:15 —-A—- C:WINDOWSsystem32msvcrt57.dll
2009-06-01 13:50:54 —-D—- C:Program FilesMicrosoft Common
2009-05-31 00:15:14 —-D—- C:Program FilesICQ6Toolbar
2009-05-31 00:15:14 —-D—- C:Documents and SettingsAll UsersApplication DataICQ
2009-05-31 00:15:11 —-D—- C:Documents and SettingsAdminApplication DataMozilla
2009-05-31 00:11:15 —-D—- C:Documents and SettingsAdminApplication DataICQ
2009-05-31 00:10:57 —-D—- C:Program FilesICQ6
2009-05-29 17:52:52 —-D—- C:Program FilesGoogle
2009-05-27 06:44:42 —-D—- C:Program FilesSmartFTP Client 3.0 Setup Files
2009-05-26 20:02:18 —-A—- C:WINDOWSIE4 Error Log.txt
2009-05-26 18:32:34 —-D—- C:Program FilesPivim Multibar
2009-05-26 09:48:20 —-A—- C:WINDOWSsystem32deploytk.dll
2009-05-22 15:06:25 —-HD—- C:WINDOWSmsdownld.tmp
2009-05-22 15:06:22 —-D—- C:Program FilesWindows Media Components
2009-05-22 15:06:22 —-D—- C:Program FilesMingjong
2009-05-22 15:03:36 —-D—- C:pnp
2009-05-19 10:06:46 —-D—- C:Program FilesuTorrent
2009-05-18 21:20:50 —-D—- C:Documents and SettingsAdminApplication DatauTorrent
2009-05-18 14:30:18 —-D—- C:WINDOWSsystem32appmgmt
2009-05-17 22:37:40 —-D—- C:Documents and SettingsAdminApplication DataskypePM
2009-05-17 22:36:44 —-D—- C:Documents and SettingsAdminApplication DataSkype
2009-05-17 22:36:42 —-D—- C:Program FilesCommon FilesSkype
2009-05-17 22:36:41 —-RD—- C:Program FilesSkype
2009-05-17 22:36:31 —-D—- C:Documents and SettingsAll UsersApplication DataSkype
2009-05-17 21:56:24 —-D—- C:Program FilesGlacierїнґшІ¦єЕїН»§¶Л
2009-04-11 16:49:47 —-D—- C:Documents and SettingsAll UsersApplication DataABBYY
2009-04-11 16:46:26 —-D—- C:Program FilesABBYY Lingvo 12
2009-04-11 14:56:11 —-D—- C:Documents and SettingsAll UsersApplication DataFugazo
2009-04-11 14:55:58 —-D—- C:Program FilesGames
2009-04-07 20:58:43 —-D—- C:Program FilesWWF России
2009-04-04 21:25:44 —-A—- C:WINDOWSlibrary3.ini
2009-03-23 17:19:30 —-RSHD—- C:CONFIG
2009-03-16 22:48:38 —-D—- C:Program FilesLizardTech======List of files/folders modified in the last 3 months======
2009-06-06 13:33:19 —-RD—- C:Program Files
2009-06-06 13:31:36 —-D—- C:WINDOWSTemp
2009-06-06 12:30:29 —-D—- C:WINDOWSsystem32CatRoot2
2009-06-06 12:22:45 —-D—- C:WINDOWSsystem32drivers
2009-06-06 11:16:46 —-SHD—- C:WINDOWSInstaller
2009-06-06 11:16:46 —-D—- C:Program FilesOpera
2009-06-06 11:11:28 —-AD—- C:WINDOWSsystem32
2009-06-06 11:09:34 —-D—- C:WINDOWSsystem32config
2009-06-06 10:56:26 —-D—- C:WINDOWS
2009-06-06 10:52:24 —-D—- C:Program FilesWinRAR
2009-06-05 22:11:59 —-A—- C:vraylog.txt
2009-06-05 10:00:38 —-D—- C:WINDOWSsystem32Restore
2009-06-05 09:27:20 —-SHD—- C:System Volume Information
2009-06-04 20:15:45 —-D—- C:Program FilesCommon Files
2009-06-04 18:03:05 —-RSHD—- C:RECYCLER
2009-06-03 00:15:55 —-SD—- C:WINDOWSDownloaded Program Files
2009-06-03 00:15:53 —-AHD—- C:WINDOWSinf
2009-06-03 00:09:06 —-RSHDC—- C:WINDOWSsystem32dllcache
2009-06-02 17:05:29 —-A—- C:WINDOWSNeroDigital.ini
2009-06-01 20:13:19 —-A—- C:VRLServer.txt
2009-05-31 00:21:42 —-HD—- C:Program FilesInstallShield Installation Information
2009-05-26 20:04:31 —-D—- C:Program FilesInternet Explorer
2009-05-26 09:48:13 —-A—- C:WINDOWSsystem32javaws.exe
2009-05-26 09:48:13 —-A—- C:WINDOWSsystem32javaw.exe
2009-05-26 09:48:13 —-A—- C:WINDOWSsystem32java.exe
2009-05-26 09:48:10 —-D—- C:Program FilesJava
2009-05-18 14:30:08 —-DC—- C:WINDOWSsystem32DRVSTORE
2009-05-18 14:30:05 —-D—- C:Program FilesTrafInsp
2009-05-18 14:30:02 —-RSD—- C:WINDOWSassembly
2009-05-18 14:29:37 —-A—- C:WINDOWSwin.ini
2009-05-18 14:29:36 —-D—- C:Program FilesKWorld Multimedia
2009-05-11 14:23:46 —-SD—- C:Documents and SettingsAdminApplication DataMicrosoft
2009-04-11 16:51:57 —-D—- C:WINDOWSWinSxS
2009-04-07 22:44:21 —-D—- C:обновления
2009-03-29 18:07:31 —-A—- C:WINDOWSsystem32PerfStringBackup.INI======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:WINDOWSsystem32driversAavmker4.sys [2009-02-06 26944]
R1 aswSP;avast! Self Protection; C:WINDOWSsystem32driversaswSP.sys [2009-02-06 114768]
R1 aswTdi;avast! Network Shield Support; C:WINDOWSsystem32driversaswTdi.sys [2009-02-06 51376]
R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2006-04-14 40448]
R2 aswFsBlk;aswFsBlk; C:WINDOWSsystem32DRIVERSaswFsBlk.sys [2009-02-06 20560]
R2 aswMon2;avast! Standard Shield Support; C:WINDOWSsystem32driversaswMon2.sys [2009-02-06 94032]
R2 CX23880;KWorld TV88X Video Capture; C:WINDOWSsystem32driverscx88vid.sys [2005-01-18 186880]
R2 CX88XBAR;KWorld TV88X Crossbar; C:WINDOWSsystem32driversCX88XBAR.sys [2005-01-18 9728]
R2 CXTUNE;KWorld TV88X Tuner; C:WINDOWSsystem32driversCX88TUNE.sys [2005-01-18 37504]
R2 WIBUKEY;WIBU-KEY Kernel Driver; C:WINDOWSSYSTEM32DRIVERSWibuKey.sys [2007-05-09 72704]
R3 aswRdr;aswRdr; C:WINDOWSsystem32driversaswRdr.sys [2009-02-06 23152]
R3 es1371;Creative AudioPCI (ES1371,ES1373) (WDM); C:WINDOWSsystem32driverses1371mp.sys [2001-08-18 40704]
R3 NPF;WinPcap Packet Driver (NPF); C:WINDOWSsystem32driversNPF.sys [2007-01-25 42000]
R3 nv;nv; C:WINDOWSsystem32DRIVERSnv4_mini.sys [2007-06-28 6807328]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:WINDOWSsystem32DRIVERSRtenicxp.sys [2007-03-01 90496]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2005-10-26 27264]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2006-02-13 57984]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2004-08-04 20480]
S3 CCDECODE;Closed Caption декодер; C:WINDOWSsystem32DRIVERSCCDECODE.sys [2004-08-04 17024]
S3 gdrv;gdrv; ??C:WINDOWSgdrv.sys []
S3 GMSIPCI;GMSIPCI; ??E:INSTALLGMSIPCI.SYS []
S3 HidUsb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2001-08-17 9600]
S3 mouhid;Драйвер мыши HID; C:WINDOWSsystem32DRIVERSmouhid.sys [2001-10-19 12160]
S3 MSTEE;Преобразователь потоков Tee/Sink-to-Sink Microsoft; C:WINDOWSsystem32driversMSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI кодек; C:WINDOWSsystem32DRIVERSNABTSFEC.sys [2004-08-04 85376]
S3 NdisIP;Microsoft видео или ТВ подключение; C:WINDOWSsystem32DRIVERSNdisIP.sys [2004-08-04 10880]
S3 SLIP;BDA Slip De-Framer; C:WINDOWSsystem32DRIVERSSLIP.sys [2004-08-04 11136]
S3 SLIP;BDA Slip De-Framer; C:WINDOWSsystem32DRIVERSSLIP.sys [2004-08-04 11136]
S3 SLIP;BDA Slip De-Framer; C:WINDOWSsystem32DRIVERSSLIP.sys [2004-08-04 11136]
S3 snpstd2;GE 98067 MiniCam Pro; C:WINDOWSsystem32DRIVERSsnpstd2.sys [2004-12-16 347264]
S3 streamip;BDA IPSink; C:WINDOWSsystem32DRIVERSStreamIP.sys [2004-08-04 15360]
S3 ticapdrv;Traffic Inspector network driver; C:WINDOWSsystem32DRIVERSticap.sys []
S3 usbaudio;Аудио драйвер USB (WDM); C:WINDOWSsystem32driversusbaudio.sys [2004-08-03 59264]
S3 usbccgp;Драйвер универсального родительского устройства USB (Microsoft); C:WINDOWSsystem32DRIVERSusbccgp.sys [2005-06-16 31744]
S3 usbprint;Класс принтеров Microsoft USB; C:WINDOWSsystem32DRIVERSusbprint.sys [2004-08-04 25856]
S3 usbscan;Драйвер USB-сканера; C:WINDOWSsystem32DRIVERSusbscan.sys [2004-08-03 15104]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2004-12-28 26368]
S3 WSTCODEC;World Standard Teletext кодек; C:WINDOWSsystem32DRIVERSWSTCODEC.SYS [2004-08-04 19328]
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 aawservice;Lavasoft Ad-Aware Service; C:Program FilesLavasoftAd-Awareaawservice.exe [2008-05-12 611664]
R2 aswUpdSv;avast! iAVS4 Control Service; C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe [2009-02-06 18752]
R2 Autodesk Licensing Service;Autodesk Licensing Service; C:Program FilesCommon FilesAutodesk SharedServiceAdskScSrv.exe [2008-12-16 72704]
R2 avast! Antivirus;avast! Antivirus; C:Program FilesAlwil SoftwareAvast4ashServ.exe [2009-02-06 138680]
R2 ICQ Service;ICQ Service; C:Program FilesICQ6ToolbarICQ Service.exe [2008-06-10 222456]
R2 JavaQuickStarterService;Java Quick Starter; C:Program FilesJavajre6binjqs.exe [2009-05-26 152984]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:Program FilesNeroNero8Nero BackItUpNBService.exe [2007-08-08 836904]
R2 NVSvc;NVIDIA Display Driver Service; C:WINDOWSsystem32nvsvc32.exe [2007-06-28 155716]
R2 UPHClean;User Profile Hive Cleanup; C:WINDOWSsystem32uphclean.exe [2006-01-16 241725]
R3 avast! Mail Scanner;avast! Mail Scanner; C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe [2009-02-06 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:Program FilesAlwil SoftwareAvast4ashWebSv.exe [2009-02-06 352920]
R3 NMIndexingService;NMIndexingService; C:Program FilesCommon FilesNeroLibNMIndexingService.exe [2007-08-03 382248]
S2 aawservice LM Service;Lavasoft Ad-Aware Service aawservice LM Service; C:WINDOWSTEMPrdl1D.tmp.exe [2009-06-06 12288]
S2 Ivtfoxyuc;Ivtfoxyuc; C:WINDOWSSystem32svchost.exe [2004-08-18 14336]
S2 jjhraerv;USB Bus md71a Monitor; C:WINDOWSSystem32svchost.exe [2004-08-18 14336]
S2 mi-raysat_3dsmax9_32;mental ray 3.5 Satellite (32-bit); C:Program FilesAutodesk3ds Max 9mentalraysatelliteraysat_3dsmax9_32server.exe [2006-09-29 65536]
S3 Adobe LM Service;Adobe LM Service; C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe [2008-12-16 72704]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2005-09-23 66240]
S3 IDriverT;InstallDriver Table Manager; C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe [2005-04-04 69632]
S3 UMWdf;Компонент драйверов пользовательского режима Windows; C:WINDOWSsystem32wdfmgr.exe [2005-01-28 38912]
EOF
вообщем я не знаю что это значит но переустанавливатьсистему сейчас возможности нет,помогите пожалуйстаЗдравствуйте, добро пожаловать на Spyware-ru форум.
Компьютер заражён несколькими вирусами, включая autorun.inf троян.
Прочитайте эту инструкцию Flash_Disinfector ещё одно оружие против autorun.inf троянов.* Отключите ваш антивирус.
* Скачайте и запустите Flash_Disinfector.
* По требованию программы вставьте ваш флэш диск или подключите другие внешние устройства хранения информации.Примечание: запускайте программу столько раз, сколько нужно чтобы очистить все ваши подключаемые диски.
Запустите HijackThis, для этого кликните Пуск, Выполнить, введите
C:Program Filestrend microAdmin.exeи нажмите Enter.
Кликните по кнопке Do a system scan only.
Далее отметьте галочкой (слева) следующие строки, если они присутствуют:R3 - URLSearchHook: (no name) - - (no file)
F2 - REG:system.ini: Shell=Explorer.exe riodrv.exe
F2 - REG:system.ini: UserInit=userinit.exe,riodrv.exe,C:WINDOWSsystem32sdra64.exe,
O1 - Hosts: 79.174.66.136 http://www.vkontakte.ru
O1 - Hosts: 79.174.66.136 vkontakte.ru
O1 - Hosts: 79.174.66.136 mail.ru
O1 - Hosts: 79.174.66.136 http://www.mail.ru
O1 - Hosts: 79.174.66.136 http://www.yandex.ru
O1 - Hosts: 79.174.66.136 yandex.ru
O1 - Hosts: 79.174.66.136 http://www.odnoklasniki.ru
O1 - Hosts: 79.174.66.136 odnoklasniki.ru
O1 - Hosts: 79.174.66.136 rambler.ru
O1 - Hosts: 79.174.66.136 google.ru
O1 - Hosts: 79.174.66.136 mamba.ru
O1 - Hosts: 79.174.66.136 http://www.a1agragator.ru
O1 - Hosts: 79.174.66.136 http://www.a1help.ru
O1 - Hosts: 79.174.66.136 a1agragator.ru
O1 - Hosts: 79.174.66.136 a1help.ruЗакройте все запущенные программы (включая InternetExplorer) и окна Windows.
Кликните по кнопке Fix checked и подтвердите свои действия выбрав YES.
Перезагрузите компьютер.Скачайте OTMoveIt3 by OldTimer кликнув по этой ссылке.
Запустите OTMoveIt3 и в большое поле ввода (заголовок этого поля выделен желтым цветом) скопируйте следующий текст.:Processes
explorer.exe
:services
Ivtfoxyuc
jjhraerv
:reg
[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{04BAFC59-79C6-4C12-9305-87DE6D8AC6F2}]
[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{E65EE8C3-F8D5-43CF-9CDF-443E56CB135F}]
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
"WinDLL (service.exe)"=-
[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyxzdnjtvl]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
"oledll"=-
"SysRun"=-
[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{42d1d157-d2b9-11dd-85cb-001a4d4ed2d8}]
[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{42d1d159-d2b9-11dd-85cb-001a4d4ed2d8}]
[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{51b98004-cc2e-11dd-85bf-001a4d4ed2d8}]
[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{531321c1-3faf-11de-862f-001a4d4ed2d8}]
[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{6c58e460-cdaf-11dd-85c1-001a4d4ed2d8}]
[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{80027419-4ed1-11de-8653-001a4d4ed2d8}]
[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{8e0f548d-08bb-11de-85ec-001a4d4ed2d8}]
[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{8e70ba94-0423-11de-85e2-001a4d4ed2d8}]
[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{c65176ca-d0f1-11dd-85c7-001a4d4ed2d8}]
[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{e8332d76-cbff-11dd-85be-001a4d4ed2d8}]
[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{f9f49bc2-d026-11dd-85c6-001a4d4ed2d8}]
:files
C:Documents and SettingsAdminApplication Datakgnusucq
C:WINDOWSsystem32lowsec
C:WINDOWSsystem32sys32net.dll
C:WINDOWSsystem32riodrv.exe
C:Program Filesxehuxik.dll
C:WINDOWSsystem32wrZ2tokl.dll
C:WINDOWSsystem32syZ3h.dll
:Commands
[emptytemp]
[start explorer]
[Reboot]Проверьте вставленный скрипт, если слева перед директивами появились пробелы, то удалите их, скрипт должен выглядеть так же как в сообщении. Кликните по кнопке MoveIt!. В процессе работы возможна перезагрузка компьютера.
По-завершении работы программы должен будет показан лог. Если лог не будет показан, то его можно найти в папке C:_OTMoveItMovedFiles.Вставьте в ваше ответное сообщение содержимое этого лога. И приложите свежий RSIT лог (только log.txt).
- Для ответа в этой теме необходимо авторизоваться.
