Созданные ответы форума
-
Сообщения
-
Касперский:
26 Июль 2009 г.
Операционная система: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Версия Kaspersky Online Scanner: 7.0.26.13
Последнее обновление баз: Saturday, July 25, 2009 21:30:40
Количество записей в базах: 2532350Параметры проверки
проверять, используя следующие базы расширенные
Проверять архивы да
Проверять почтовые базы даОбласть проверки Критические области
C:Documents and SettingsAll UsersГлавное менюПрограммыАвтозагрузка
C:Documents and SettingsNEXTГлавное менюПрограммыАвтозагрузка
C:Program Files
C:WINDOWSСтатистика проверки
Проверено объектов 55219
Обнаружено угроз 1
Обнаружено зараженных объектов 1
Обнаружено подозрительных объектов 0
Время проверки 01:26:38Имя файла Имя угрозы Количество угроз
C:WINDOWSsystem32wbemproquota.exe Зараженный: Trojan.Win32.Agent.cqwy 1Выбранная область проверена.
RSIT log
Logfile of random’s system information tool 1.06 (written by random/random)
Run by NEXT at 2009-07-26 01:52:59
Microsoft Windows XP Professional Service Pack 3
System drive C: has 28 GB (24%) free of 114 GB
Total RAM: 1014 MB (30% free)Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:53:14, on 26.07.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: NormalRunning processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32igfxtray.exe
C:WINDOWSsystem32hkcmd.exe
C:WINDOWSsystem32igfxpers.exe
C:WINDOWSRTHDCPL.EXE
C:WINDOWSsystem32igfxsrvc.exe
C:Program FilesESETESET NOD32 Antivirusegui.exe
C:Program FilesCyberLinkPowerDVD8PDVD8Serv.exe
C:Program FilesCyberlinkShared Filesbrs.exe
C:Program FilesAdobeAdobe Acrobat 7.0DistillrAcrotray.exe
C:Program FilesWebMoney Agentwmagent.exe
C:Program FilesChameleon ClockChamClock.exe
C:Program FilesPunto Switcherps.exe
C:Program FilesVistaDriveIconVistaDrv.exe
C:Program FilesCommon FilesAheadLibNMBgMonitor.exe
C:Program FilesSpybot — Search & DestroyTeaTimer.exe
C:Program FilesCommon FilesAheadLibNMIndexStoreSvr.exe
C:Program FilesYahoo!WidgetsYahooWidgets.exe
C:Program FilesYahoo!WidgetsYahooWidgets.exe
C:Program FilesYahoo!WidgetsYahooWidgets.exe
C:Program FilesYahoo!WidgetsYahooWidgets.exe
C:Program FilesYahoo!WidgetsYahooWidgets.exe
C:Program FilesCommon FilesABBYYFineReader9.00LicensingPENetworkLicenseServer.exe
C:Program FilesESETESET NOD32 Antivirusekrn.exe
C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
C:Program FilesOperaopera.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32wscntfy.exe
C:Documents and SettingsNEXTРабочий столФлешкаигрыРейнджерыrangers.exe
C:Documents and SettingsNEXTМои документыRSIT.exe
C:Program Filestrend microNEXT.exeR1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.yahoo.com
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://www.yahoo.com
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=13157&gct=&gc=1&q=
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.yahoo.com
R1 — HKLMSoftwareMicrosoftInternet ExplorerSearch,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=13157&gct=&gc=1&q=
R1 — HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirect?o=13157&gct=&gc=1&q=%s
R1 — HKCUSoftwareMicrosoftInternet Connection Wizard,ShellNext = http://www.yandex.ru/
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: DefaultSearchHook Class — {C94E154B-1459-4A47-966B-4B843BEFC7DB} — C:Program FilesAskSearchbinDefaultSearch.dll
O2 — BHO: AcroIEHlprObj Class — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesAdobeAdobe Acrobat 7.0ActiveXAcroIEHelper.dll
O2 — BHO: AskBar BHO — {201f27d4-3704-41d6-89c1-aa35e39143ed} — C:Program FilesAskBarDisbarbinaskBar.dll
O2 — BHO: Spybot-S&D IE Protection — {53707962-6F74-2D53-2644-206D7942484F} — C:Program FilesSpybot — Search & DestroySDHelper.dll
O2 — BHO: SSVHelper Class — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — C:Program FilesJavajre1.6.0_04binssv.dll
O2 — BHO: AcroIEToolbarHelper Class — {AE7CD045-E861-484f-8273-0445EE161910} — C:Program FilesAdobeAdobe Acrobat 7.0AcrobatAcroIEFavClient.dll
O2 — BHO: XBTBPos00 — {FCBCCB87-9224-4B8D-B117-F56D924BEB18} — C:Program FilesPivim Multibarpivim.dll
O3 — Toolbar: PROMT — {892E81F6-EC63-4d13-8422-835A7A05D6EB} — C:Program FilesPRMT8PRMTIEprmtie.dll
O3 — Toolbar: Adobe PDF — {47833539-D0C5-4125-9FA8-0819E2EAAC93} — C:Program FilesAdobeAdobe Acrobat 7.0AcrobatAcroIEFavClient.dll
O3 — Toolbar: Pivim Multibar — {1BB22D38-A411-4B13-A746-C2A4F4EC7344} — C:Program FilesPivim Multibarpivim.dll
O3 — Toolbar: Ask Toolbar — {3041d03e-fd4b-44e0-b742-2d9b88305f98} — C:Program FilesAskBarDisbarbinaskBar.dll
O4 — HKLM..Run: [IgfxTray] C:WINDOWSsystem32igfxtray.exe
O4 — HKLM..Run: [HotKeysCmds] C:WINDOWSsystem32hkcmd.exe
O4 — HKLM..Run: [Persistence] C:WINDOWSsystem32igfxpers.exe
O4 — HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 — HKLM..Run: [Alcmtr] ALCMTR.EXE
O4 — HKLM..Run: [AzMixerSel] C:Program FilesRealtekAudioInstallShieldAzMixerSel.exe
O4 — HKLM..Run: [egui] «C:Program FilesESETESET NOD32 Antivirusegui.exe» /hide /waitservice
O4 — HKLM..Run: [EsetFix] REGEDIT /S «C:Program FilesESETESET Smart SecurityEsetFix.reg»
O4 — HKLM..Run: [NeroFilterCheck] C:Program FilesCommon FilesAheadLibNeroCheck.exe
O4 — HKLM..Run: [RemoteControl8] «C:Program FilesCyberLinkPowerDVD8PDVD8Serv.exe»
O4 — HKLM..Run: [PDVD8LanguageShortcut] «C:Program FilesCyberLinkPowerDVD8LanguageLanguage.exe»
O4 — HKLM..Run: [BDRegion] C:Program FilesCyberlinkShared Filesbrs.exe
O4 — HKLM..Run: [Acrobat Assistant 7.0] «C:Program FilesAdobeAdobe Acrobat 7.0DistillrAcrotray.exe»
O4 — HKLM..Run: [wmagent.exe] «C:Program FilesWebMoney Agentwmagent.exe»
O4 — HKCU..Run: [HomeAlarm] C:Program FilesChameleon ClockChamClock.exe
O4 — HKCU..Run: [Punto Switcher] C:Program FilesPunto Switcherps.exe
O4 — HKCU..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe
O4 — HKCU..Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] «C:Program FilesCommon FilesAheadLibNMBgMonitor.exe»
O4 — HKCU..Run: [CryptoARM_Reminder.exe] C:Program FilesDigtTrustedDesktopCryptoARM_Reminder.exe
O4 — HKCU..Run: [SpybotSD TeaTimer] C:Program FilesSpybot — Search & DestroyTeaTimer.exe
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — Startup: MSVBVM60.DLL
O4 — Startup: PowerReg Scheduler V3.exe
O4 — Startup: term.exe
O4 — Startup: Yahoo! Widgets.lnk = C:Program FilesYahoo!WidgetsYahooWidgets.exe
O4 — Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 — Global Startup: Adobe Gamma.lnk = C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 — Extra context menu item: Convert link target to Adobe PDF — res://C:Program FilesAdobeAdobe Acrobat 7.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
O8 — Extra context menu item: Convert link target to existing PDF — res://C:Program FilesAdobeAdobe Acrobat 7.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
O8 — Extra context menu item: Convert selected links to Adobe PDF — res://C:Program FilesAdobeAdobe Acrobat 7.0AcrobatAcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 — Extra context menu item: Convert selected links to existing PDF — res://C:Program FilesAdobeAdobe Acrobat 7.0AcrobatAcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 — Extra context menu item: Convert selection to Adobe PDF — res://C:Program FilesAdobeAdobe Acrobat 7.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
O8 — Extra context menu item: Convert selection to existing PDF — res://C:Program FilesAdobeAdobe Acrobat 7.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
O8 — Extra context menu item: Convert to Adobe PDF — res://C:Program FilesAdobeAdobe Acrobat 7.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
O8 — Extra context menu item: Convert to existing PDF — res://C:Program FilesAdobeAdobe Acrobat 7.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
O8 — Extra context menu item: Download using Download &Express — file://C:Program FilesDownload ExpressAdd_Url.htm
O8 — Extra context menu item: Online-словари — C:Program FilesPRMT8PRMTIEoda.htm
O8 — Extra context menu item: Автоматически определить шаблон тематики — C:Program FilesPRMT8PRMTIEaot.htm
O8 — Extra context menu item: Настроить параметры перевода — C:Program FilesPRMT8PRMTIEoptions.htm
O8 — Extra context menu item: Незнакомые слова — C:Program FilesPRMT8PRMTIEinfopanel.htm
O8 — Extra context menu item: Открыть словарную статью — C:Program FilesPRMT8PRMTIEaddentry.htm
O8 — Extra context menu item: Перевести — C:Program FilesPRMT8PRMTIEtranslat.htm
O8 — Extra context menu item: Перевести страницу — C:Program FilesPRMT8PRMTIEpage.htm
O8 — Extra context menu item: Поиск в Интернете — C:Program FilesPRMT8PRMTIEsearch.htm
O9 — Extra button: (no name) — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_04binssv.dll
O9 — Extra ‘Tools’ menuitem: Sun Java Console — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_04binssv.dll
O9 — Extra button: (no name) — {4034D172-4C52-49de-A6A1-E75F8F591FEC} — C:Program FilesPRMT8PRMTIEoptions.htm
O9 — Extra ‘Tools’ menuitem: Настроить параметры перевода — {4034D172-4C52-49de-A6A1-E75F8F591FEC} — C:Program FilesPRMT8PRMTIEoptions.htm
O9 — Extra button: Справочные материалы — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 — Extra button: (no name) — {A2DA13D5-AC77-43b7-963B-40445EBCB8E0} — C:Program FilesPRMT8PRMTIEprmtie5.htm
O9 — Extra ‘Tools’ menuitem: Перевести — {A2DA13D5-AC77-43b7-963B-40445EBCB8E0} — C:Program FilesPRMT8PRMTIEprmtie5.htm
O9 — Extra button: (no name) — {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} — C:Program FilesSpybot — Search & DestroySDHelper.dll
O9 — Extra ‘Tools’ menuitem: Spybot — Search && Destroy Configuration — {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} — C:Program FilesSpybot — Search & DestroySDHelper.dll
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O15 — Trusted Zone: http://www.torgi.donland.ru
O16 — DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) — C:Program FilesYahoo!CommonYinsthelper.dll
O17 — HKLMSystemCCSServicesTcpip..{EDF369E6-6AF2-4B0D-9B4D-C400D3CEE158}: NameServer = 80.80.111.254,195.161.172.254
O23 — Service: ABBYY FineReader 9.0 PE Licensing Service (ABBYY.Licensing.FineReader.Professional.9.0) — ABBYY (BIT Software) — C:Program FilesCommon FilesABBYYFineReader9.00LicensingPENetworkLicenseServer.exe
O23 — Service: Adobe LM Service — Adobe Systems — C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe
O23 — Service: Eset HTTP Server (EhttpSrv) — ESET — C:Program FilesESETESET NOD32 AntivirusEHttpSrv.exe
O23 — Service: Eset Service (ekrn) — ESET — C:Program FilesESETESET NOD32 Antivirusekrn.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: InstallDriver Table Manager (IDriverT) — Macrovision Corporation — C:Program FilesCommon FilesInstallShieldDriver1150Intel 32IDriverT.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: NetMeeting Remote Desktop Sharing (mnmsrvc) — Корпорация Майкрософт — C:WINDOWSsystem32mnmsrvc.exe
O23 — Service: NBService — Nero AG — C:Program FilesNeroNero 7Nero BackItUpNBService.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe—
End of file — 12959 bytes======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class — C:Program FilesAdobeAdobe Acrobat 7.0ActiveXAcroIEHelper.dll [2004-12-14 63136][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{201f27d4-3704-41d6-89c1-aa35e39143ed}]
AskBar BHO — C:Program FilesAskBarDisbarbinaskBar.dll [2008-08-06 279944][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection — C:Program FilesSpybot — Search & DestroySDHelper.dll [2009-01-26 1879896][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class — C:Program FilesJavajre1.6.0_04binssv.dll [2007-12-14 509328][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{AE7CD045-E861-484f-8273-0445EE161910}]
AcroIEToolbarHelper Class — C:Program FilesAdobeAdobe Acrobat 7.0AcrobatAcroIEFavClient.dll [2004-12-14 225280][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{FCBCCB87-9224-4B8D-B117-F56D924BEB18}]
XBTBPos00 Class — C:Program FilesPivim Multibarpivim.dll [2009-07-09 2175488][HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{892E81F6-EC63-4d13-8422-835A7A05D6EB} — PROMT — C:Program FilesPRMT8PRMTIEprmtie.dll [2007-03-21 749568]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} — Adobe PDF — C:Program FilesAdobeAdobe Acrobat 7.0AcrobatAcroIEFavClient.dll [2004-12-14 225280]
{1BB22D38-A411-4B13-A746-C2A4F4EC7344} — Pivim Multibar — C:Program FilesPivim Multibarpivim.dll [2009-07-09 2175488]
{3041d03e-fd4b-44e0-b742-2d9b88305f98} — Ask Toolbar — C:Program FilesAskBarDisbarbinaskBar.dll [2008-08-06 279944][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«IgfxTray»=C:WINDOWSsystem32igfxtray.exe [2008-05-30 141848]
«HotKeysCmds»=C:WINDOWSsystem32hkcmd.exe [2008-05-30 166424]
«Persistence»=C:WINDOWSsystem32igfxpers.exe [2008-05-30 137752]
«RTHDCPL»=C:WINDOWSRTHDCPL.EXE [2008-05-30 16861696]
«Alcmtr»=C:WINDOWSALCMTR.EXE [2008-05-30 69632]
«AzMixerSel»=C:Program FilesRealtekAudioInstallShieldAzMixerSel.exe [2008-05-30 53248]
«egui»=C:Program FilesESETESET NOD32 Antivirusegui.exe [2008-03-13 1443072]
«EsetFix»=REGEDIT /S C:Program FilesESETESET Smart SecurityEsetFix.reg []
«NeroFilterCheck»=C:Program FilesCommon FilesAheadLibNeroCheck.exe [2006-01-12 155648]
«RemoteControl8″=C:Program FilesCyberLinkPowerDVD8PDVD8Serv.exe [2008-03-20 83240]
«PDVD8LanguageShortcut»=C:Program FilesCyberLinkPowerDVD8LanguageLanguage.exe [2007-12-14 50472]
«BDRegion»=C:Program FilesCyberlinkShared Filesbrs.exe [2008-05-19 91432]
«Acrobat Assistant 7.0″=C:Program FilesAdobeAdobe Acrobat 7.0DistillrAcrotray.exe [2004-12-14 483328]
«»= []
«wmagent.exe»=C:Program FilesWebMoney Agentwmagent.exe [2008-10-01 209376][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«HomeAlarm»=C:Program FilesChameleon ClockChamClock.exe [2005-10-15 865280]
«Punto Switcher»=C:Program FilesPunto Switcherps.exe [2003-11-12 207872]
«VistaIcon»=C:Program FilesVistaDriveIconVistaDrv.exe [2008-01-02 132096]
«BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=C:Program FilesCommon FilesAheadLibNMBgMonitor.exe [2006-11-16 139264]
«CryptoARM_Reminder.exe»=C:Program FilesDigtTrustedDesktopCryptoARM_Reminder.exe [2008-07-28 2404352]
«SpybotSD TeaTimer»=C:Program FilesSpybot — Search & DestroyTeaTimer.exe [2009-03-05 2260480]C:Documents and SettingsAll UsersГлавное менюПрограммыАвтозагрузка
Adobe Acrobat Speed Launcher.lnk — C:WINDOWSInstaller{AC76BA86-1033-0000-7760-000000000002}SC_Acrobat.exe
Adobe Gamma.lnk — C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exeC:Documents and SettingsNEXTГлавное менюПрограммыАвтозагрузка
MSVBVM60.DLL
PowerReg Scheduler V3.exe
term.exe
Yahoo! Widgets.lnk — C:Program FilesYahoo!WidgetsYahooWidgets.exe[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyigfxcui]
C:WINDOWSsystem32igfxdev.dll [2008-05-30 208896][HKEY_LOCAL_MACHINEsystemcurrentcontrolsetcontrolsecurityproviders]
«SecurityProviders»=msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, cpssp.dll[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«EnableProfileQuota»=1[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=145[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«HonorAutoRunSetting»=[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesITTerritory3Kingdomtksclient.exe»=»C:Program FilesITTerritory3Kingdomtksclient.exe:*:Enabled:Троецарствие»
«C:Program FilesWebMoneyWebMoney.exe»=»C:Program FilesWebMoneyWebMoney.exe:*:Enabled:WebMoney Keeper Classic Runner Module»
«C:Program FilesOperaopera.exe»=»C:Program FilesOperaopera.exe:*:Enabled:Opera Internet Browser»
«C:Program FilesBitTorrentbittorrent.exe»=»C:Program FilesBitTorrentbittorrent.exe:*:Enabled:BitTorrent»[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2F]
shellAutoRuncommand — F:LaunchU3.exe -a======List of files/folders created in the last 1 months======
2009-07-25 01:17:21 —-HDC—- C:WINDOWS$NtUninstallKB951376-v2$
2009-07-25 01:17:06 —-HDC—- C:WINDOWS$NtUninstallKB952954$
2009-07-24 15:59:02 —-D—- C:rsit
2009-07-24 15:59:02 —-D—- C:Program Filestrend micro
2009-07-24 15:54:52 —-HDC—- C:WINDOWS$NtUninstallKB959426$
2009-07-24 15:54:46 —-HDC—- C:WINDOWS$NtUninstallKB946648$
2009-07-24 15:54:40 —-HDC—- C:WINDOWS$NtUninstallKB956803$
2009-07-24 15:54:35 —-HDC—- C:WINDOWS$NtUninstallKB955839$
2009-07-24 15:54:25 —-HDC—- C:WINDOWS$NtUninstallKB951978$
2009-07-24 15:54:17 —-HDC—- C:WINDOWS$NtUninstallKB950974$
2009-07-24 15:54:11 —-HDC—- C:WINDOWS$NtUninstallKB960225$
2009-07-24 15:54:05 —-HDC—- C:WINDOWS$NtUninstallKB973346$
2009-07-24 15:53:51 —-HDC—- C:WINDOWS$NtUninstallKB956572$
2009-07-24 15:53:42 —-HDC—- C:WINDOWS$NtUninstallKB961501$
2009-07-24 15:53:31 —-HDC—- C:WINDOWS$NtUninstallKB969897$
2009-07-24 15:53:25 —-HDC—- C:WINDOWS$NtUninstallKB938464-v2$
2009-07-24 15:53:19 —-HDC—- C:WINDOWS$NtUninstallKB971633$
2009-07-24 15:53:10 —-HDC—- C:WINDOWS$NtUninstallKB952004$
2009-07-24 15:53:03 —-HDC—- C:WINDOWS$NtUninstallKB950762$
2009-07-24 15:52:56 —-HDC—- C:WINDOWS$NtUninstallKB957097$
2009-07-24 15:52:50 —-HDC—- C:WINDOWS$NtUninstallKB958687$
2009-07-24 15:52:44 —-HDC—- C:WINDOWS$NtUninstallKB952287$
2009-07-24 15:52:36 —-HDC—- C:WINDOWS$NtUninstallKB967715$
2009-07-24 15:52:30 —-HDC—- C:WINDOWS$NtUninstallKB951066$
2009-07-24 15:52:23 —-HDC—- C:WINDOWS$NtUninstallKB954459$
2009-07-24 15:52:17 —-HDC—- C:WINDOWS$NtUninstallKB952069_WM9$
2009-07-24 15:52:08 —-HDC—- C:WINDOWS$NtUninstallKB951748$
2009-07-24 15:52:01 —-HDC—- C:WINDOWS$NtUninstallKB970238$
2009-07-24 15:51:55 —-HDC—- C:WINDOWS$NtUninstallKB960803$
2009-07-24 15:51:49 —-HDC—- C:WINDOWS$NtUninstallKB968537$
2009-07-24 15:51:43 —-HDC—- C:WINDOWS$NtUninstallKB954600$
2009-07-24 15:51:37 —-HDC—- C:WINDOWS$NtUninstallKB958644$
2009-07-24 15:51:31 —-HDC—- C:WINDOWS$NtUninstallKB961371$
2009-07-24 15:51:25 —-HDC—- C:WINDOWS$NtUninstallKB955069$
2009-07-24 15:51:19 —-HDC—- C:WINDOWS$NtUninstallKB956802$
2009-07-24 15:51:15 —-D—- C:Program FilesMSXML 4.0
2009-07-24 15:50:54 —-HDC—- C:WINDOWS$NtUninstallKB923561$
2009-07-24 11:25:57 —-D—- C:WINDOWSsystem32PreInstall
2009-07-24 11:25:55 —-N—- C:WINDOWSsystem32spmsg.dll
2009-07-24 11:25:52 —-HDC—- C:WINDOWS$NtUninstallKB898461$
2009-07-24 11:25:52 —-HD—- C:WINDOWS$hf_mig$
2009-07-24 11:12:39 —-D—- C:WINDOWSsystem32SoftwareDistribution
2009-07-24 11:02:00 —-D—- C:Documents and SettingsNEXTApplication DataMalwarebytes
2009-07-24 11:01:51 —-D—- C:Program FilesMalwarebytes’ Anti-Malware
2009-07-24 11:01:51 —-D—- C:Documents and SettingsAll UsersApplication DataMalwarebytes
2009-07-24 09:52:35 —-D—- C:Program FilesSpybot — Search & Destroy
2009-07-24 09:52:35 —-D—- C:Documents and SettingsAll UsersApplication DataSpybot — Search & Destroy
2009-07-24 09:15:26 —-D—- C:Program FilesMozilla Firefox
2009-07-24 09:15:26 —-D—- C:Program FilesAskSearch
2009-07-24 09:15:26 —-D—- C:Documents and SettingsNEXTApplication DataMozilla
2009-07-24 09:15:25 —-D—- C:Program FilesAskBarDis
2009-07-24 00:09:24 —-D—- C:D
2009-07-22 21:58:46 —-D—- C:Program FilesPivim Multibar
2009-07-16 22:37:47 —-D—- C:Documents and SettingsNEXTApplication DataPanasonic
2009-07-16 22:37:25 —-A—- C:WINDOWSsystem32PICSDK2.dll
2009-07-16 22:37:25 —-A—- C:WINDOWSsystem32PICSDK.ini
2009-07-16 22:37:25 —-A—- C:WINDOWSsystem32PICSDK.dll
2009-07-16 22:37:25 —-A—- C:WINDOWSsystem32PICEntry.dll
2009-07-16 22:37:25 —-A—- C:WINDOWSsystem32EpPicPrt.dll
2009-07-16 22:37:24 —-A—- C:WINDOWSsystem32EPPicMgr.dll
2009-07-16 22:36:18 —-D—- C:Program FilesPanasonic
2009-07-15 22:52:51 —-D—- C:Documents and SettingsNEXTApplication DataU3
2009-07-04 12:57:53 —-D—- C:Program FilesISL
2009-07-02 20:12:44 —-D—- C:Program Files1C
2009-07-02 19:55:57 —-A—- C:WINDOWSsetup_rangers_2.exe======List of files/folders modified in the last 1 months======
2009-07-26 01:53:01 —-D—- C:WINDOWSPrefetch
2009-07-26 01:50:47 —-D—- C:Program FilesChameleon Clock
2009-07-26 01:32:34 —-D—- C:WINDOWSTemp
2009-07-25 23:05:26 —-D—- C:WINDOWSsystem32CatRoot2
2009-07-25 22:52:19 —-D—- C:WINDOWSsystem32
2009-07-25 22:52:19 —-A—- C:WINDOWSsystem32PerfStringBackup.INI
2009-07-25 22:47:06 —-A—- C:WINDOWSSchedLgU.Txt
2009-07-25 13:31:58 —-D—- C:WINDOWS
2009-07-25 01:17:24 —-HD—- C:WINDOWSinf
2009-07-25 01:17:23 —-RSHDC—- C:WINDOWSsystem32dllcache
2009-07-25 01:17:23 —-D—- C:WINDOWSsystem32drivers
2009-07-25 01:17:18 —-A—- C:WINDOWSimsins.BAK
2009-07-24 17:13:05 —-A—- C:WINDOWSNeroDigital.ini
2009-07-24 15:59:02 —-RD—- C:Program Files
2009-07-24 15:56:15 —-D—- C:WINDOWSsystem32wbem
2009-07-24 15:56:15 —-D—- C:WINDOWSAppPatch
2009-07-24 15:54:48 —-D—- C:Program FilesMessenger
2009-07-24 15:53:25 —-D—- C:WINDOWSWinSxS
2009-07-24 15:51:16 —-SHD—- C:WINDOWSInstaller
2009-07-24 11:13:10 —-D—- C:WINDOWSSoftwareDistribution
2009-07-24 11:13:10 —-D—- C:WINDOWSHelp
2009-07-24 00:25:59 —-SHD—- C:System Volume Information
2009-07-24 00:23:30 —-D—- C:WINDOWSrepair
2009-07-24 00:23:14 —-D—- C:WINDOWSRegistration
2009-07-22 12:30:54 —-D—- C:Program FilesX-ФАКТОР
2009-07-16 22:36:36 —-RSD—- C:WINDOWSFonts
2009-07-16 22:36:17 —-HD—- C:Program FilesInstallShield Installation Information
2009-06-29 12:07:32 —-D—- C:Documents and SettingsNEXTApplication DataAdobe======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 CProCtrl;КриптоПро CSP драйвер; C:WINDOWSsystem32DRIVERSCProCtrl.sys [2007-04-20 46080]
R1 easdrv;easdrv; C:WINDOWSsystem32DRIVERSeasdrv.sys [2008-03-13 29704]
R1 epfwtdir;epfwtdir; C:WINDOWSsystem32DRIVERSepfwtdir.sys [2008-03-13 33800]
R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2008-04-15 40704]
R1 WmiAcpi;Интерфейс управления для ACPI Microsoft Windows; C:WINDOWSsystem32DRIVERSwmiacpi.sys [2008-04-14 8832]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}; ??C:Program FilesCyberLinkPowerDVD800.fcl []
R2 eamon;EAMON; C:WINDOWSsystem32DRIVERSeamon.sys [2008-03-13 40456]
R3 b57w2k;Broadcom NetXtreme Gigabit Ethernet; C:WINDOWSsystem32DRIVERSb57xp32.sys [2008-05-30 161792]
R3 CmBatt;Драйвер батареи с ACPI-управлением (Майкрософт); C:WINDOWSsystem32DRIVERSCmBatt.sys [2008-04-14 13952]
R3 HDAudBus;Драйвер шины Microsoft UAA для High Definition Audio; C:WINDOWSsystem32DRIVERSHDAudBus.sys [2008-04-15 144384]
R3 HidUsb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2008-04-14 10368]
R3 ialm;ialm; C:WINDOWSsystem32DRIVERSigxpmp32.sys [2008-05-30 5851488]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:WINDOWSsystem32driversRtkHDAud.sys [2008-05-30 4785664]
R3 mouhid;Драйвер мыши HID; C:WINDOWSsystem32DRIVERSmouhid.sys [2001-10-19 12160]
R3 RTIFDH;RTIFDH; C:WINDOWSsystem32DRIVERSrtIFDH.sys [2008-04-16 13056]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2008-04-14 30208]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2008-04-14 59520]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2008-04-14 20608]
S3 AR5211;Atheros Wireless Network Adapter Service; C:WINDOWSsystem32DRIVERSar5211.sys [2008-05-30 547904]
S3 RTUSB;Rutoken; C:WINDOWSsystem32DRIVERSrtUSB.sys [2008-04-16 29440]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2008-04-14 26368]
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service; C:Program FilesCommon FilesABBYYFineReader9.00LicensingPENetworkLicenseServer.exe [2007-12-06 660768]
R2 ekrn;Eset Service; C:Program FilesESETESET NOD32 Antivirusekrn.exe [2008-03-13 472320]
R2 MDM;Machine Debug Manager; C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE [2003-06-19 322120]
S3 Adobe LM Service;Adobe LM Service; C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe [2009-03-28 72704]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; c:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2007-10-24 70144]
S3 EhttpSrv;Eset HTTP Server; C:Program FilesESETESET NOD32 AntivirusEHttpSrv.exe [2008-03-13 19200]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:WINDOWSMicrosoft.NetFrameworkv3.0WPFPresentationFontCache.exe [2007-10-09 36864]
S3 IDriverT;InstallDriver Table Manager; C:Program FilesCommon FilesInstallShieldDriver1150Intel 32IDriverT.exe [2005-11-14 69632]
S3 idsvc;Windows CardSpace; c:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication Foundationinfocard.exe [2007-10-11 864256]
S3 NBService;NBService; C:Program FilesNeroNero 7Nero BackItUpNBService.exe [2006-11-10 774144]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2003-07-28 89136]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication FoundationSMSvcHost.exe [2007-10-11 122880]
EOF
