[Bruce333]

что же мне дальше делать? не могу я этот лог сохранить никак

[Bruce333]

сегодня при сохранении лога говорит: недостаточно системных ресурсов для завершения операции, и опять вырубается клава и мышь
все проги закрыты во время сканирования, на С 25 Гб свободных, на D 5 ГБ, неужели мало для этого?

[Bruce333]

сегодня цел день пыталась сохранить лог GMER, при сохранении перестают работать и клавиатура и мышь, последний раз почти удалось, даже имя файла успела написать, но кнопку сохранить уже нажать не смогла, включаются только после перезагрузки, которую ессно с помощью reset приходится делать, завтра еще попробую, может получится

[Bruce333]

продолжение

NetSvcs: AppMgmt — C:WINDOWSsystem32appmgmts.dll (Корпорация Майкрософт)
NetSvcs: DMServer — C:WINDOWSsystem32dmserver.dll (Корпорация Майкрософт)
NetSvcs: DHCP — C:WINDOWSsystem32dhcpcsvc.dll (Корпорация Майкрософт)
NetSvcs: FastUserSwitchingCompatibility — C:WINDOWSsystem32shsvcs.dll (Корпорация Майкрософт)
NetSvcs: Ias — File not found
NetSvcs: Iprip — File not found
NetSvcs: Irmon — File not found
NetSvcs: Netman — C:WINDOWSsystem32netman.dll (Корпорация Майкрософт)
NetSvcs: Nla — C:WINDOWSsystem32mswsock.dll (Корпорация Майкрософт)
NetSvcs: Ntmssvc — C:WINDOWSsystem32ntmssvc.dll (Корпорация Майкрософт)
NetSvcs: NWCWorkstation — File not found
NetSvcs: Nwsapagent — File not found
NetSvcs: Schedule — C:WINDOWSsystem32schedsvc.dll (Корпорация Майкрософт)
NetSvcs: Seclogon — C:WINDOWSsystem32seclogon.dll (Корпорация Майкрософт)
NetSvcs: Sharedaccess — C:WINDOWSsystem32ipnathlp.dll (Корпорация Майкрософт)
NetSvcs: SRService — C:WINDOWSsystem32srsvc.dll (Корпорация Майкрософт)
NetSvcs: Tapisrv — C:WINDOWSsystem32tapisrv.dll (Корпорация Майкрософт)
NetSvcs: Themes — C:WINDOWSsystem32shsvcs.dll (Корпорация Майкрософт)
NetSvcs: W32Time — C:WINDOWSsystem32w32time.dll (Корпорация Майкрософт)
NetSvcs: WZCSVC — C:WINDOWSsystem32wzcsvc.dll (Корпорация Майкрософт)
NetSvcs: Wmi — C:WINDOWSsystem32advapi32.dll (Корпорация Майкрософт)
NetSvcs: WmdmPmSp — File not found
NetSvcs: winmgmt — C:WINDOWSsystem32wbemwmisvc.dll (Корпорация Майкрософт)
NetSvcs: BITS — C:WINDOWSsystem32qmgr.dll (Корпорация Майкрософт)
NetSvcs: ShellHWDetection — C:WINDOWSsystem32shsvcs.dll (Корпорация Майкрософт)

MsConfig — StartUpFolder: C:^Documents and Settings^All Users^Главное меню^Программы^Автозагрузка^Acrobat Assistant.lnk — C:Program FilesAdobeAcrobat 5.0DistillrAcroTray.exe — (Adobe Systems Inc.)
MsConfig — StartUpFolder: C:^Documents and Settings^All Users^Главное меню^Программы^Автозагрузка^Adobe Gamma Loader.lnk — C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe — (Adobe Systems, Inc.)
MsConfig — StartUpFolder: C:^Documents and Settings^All Users^Главное меню^Программы^Автозагрузка^NaturalColorLoad.lnk — C:Program FilesSECNatural ColorNaturalColorLoad.exe — ()
MsConfig — StartUpFolder: C:^Documents and Settings^All Users^Главное меню^Программы^Автозагрузка^Privoxy.lnk — C:Program FilesVidalia BundlePrivoxyprivoxy.exe — (The Privoxy team — http://www.privoxy.org)
MsConfig — StartUpReg: 36X Raid Configurer — hkey= — key= — File not found
MsConfig — StartUpReg: Adobe Reader Speed Launcher — hkey= — key= — C:Program FilesAdobeReader 8.0ReaderReader_sl.exe (Adobe Systems Incorporated)
MsConfig — StartUpReg: AdobeUpdater — hkey= — key= — C:Program FilesCommon FilesAdobeUpdater5AdobeUpdater.exe (Adobe Systems Incorporated)
MsConfig — StartUpReg: Alcmtr — hkey= — key= — C:WINDOWSAlcmtr.exe (Realtek Semiconductor Corp.)
MsConfig — StartUpReg: Beeline GPRS Explorer — hkey= — key= — C:Program FilesBeelineGPRS Explorergprsexpl.exe (Gemfor s.r.o., Czech Republic)
MsConfig — StartUpReg: CloneCDTray — hkey= — key= — C:Program FilesSlySoftCloneCDCloneCDTray.exe (SlySoft, Inc.)
MsConfig — StartUpReg: CTFMON.EXE — hkey= — key= — File not found
MsConfig — StartUpReg: EA Core — hkey= — key= — C:Program FilesElectronic ArtsEADMCore.exe (Electronic Arts)
MsConfig — StartUpReg: ISUSPM Startup — hkey= — key= — C:Program FilesCommon FilesInstallShieldUpdateServiceisuspm.exe (Macrovision Corporation)
MsConfig — StartUpReg: ISUSScheduler — hkey= — key= — C:Program FilesCommon FilesInstallShieldUpdateServiceissch.exe (Macrovision Corporation)
MsConfig — StartUpReg: JMB36X IDE Setup — hkey= — key= — C:WINDOWSRaidToolxInsIDE.exe ()
MsConfig — StartUpReg: KernelFaultCheck — hkey= — key= — File not found
MsConfig — StartUpReg: MAgent — hkey= — key= — C:Program FilesMail.RuAgentmagent.exe (Mail.Ru)
MsConfig — StartUpReg: MSMSGS — hkey= — key= — C:Program FilesMessengermsmsgs.exe (Microsoft Corporation)
MsConfig — StartUpReg: NeroFilterCheck — hkey= — key= — File not found
MsConfig — StartUpReg: NvCplDaemon — hkey= — key= — File not found
MsConfig — StartUpReg: NvMediaCenter — hkey= — key= — File not found
MsConfig — StartUpReg: nwiz — hkey= — key= — C:Program FilesNVIDIA CorporationnViewnwiz.exe ()
MsConfig — StartUpReg: QuickTime Task — hkey= — key= — C:Program FilesQuickTimeqttask.exe (Apple Computer, Inc.)
MsConfig — StartUpReg: RTHDCPL — hkey= — key= — C:WINDOWSRTHDCPL.exe (Realtek Semiconductor Corp.)
MsConfig — StartUpReg: Sony Ericsson PC Suite — hkey= — key= — C:Program FilesSony EricssonMobile2Application LauncherApplication Launcher.exe (Sony Ericsson Mobile Communications AB)
MsConfig — StartUpReg: SunJavaUpdateSched — hkey= — key= — C:Program FilesJavajre1.6.0binjusched.exe (Sun Microsystems, Inc.)
MsConfig — StartUpReg: swg — hkey= — key= — C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe (Google Inc.)
MsConfig — StartUpReg: Teleport Scheduler — hkey= — key= — C:Program FilesTeleport Proscheduler.exe (Tennyson Maxwell Information Systems, Inc.)
MsConfig — StartUpReg: UserFaultCheck — hkey= — key= — File not found
MsConfig — StartUpReg: Vidalia — hkey= — key= — C:Program FilesVidalia BundleVidaliavidalia.exe ()
MsConfig — StartUpReg: WinampAgent — hkey= — key= — C:Program FilesWinampwinampa.exe ()
MsConfig — StartUpReg: wmagent.exe — hkey= — key= — C:Program FilesWebMoney Agentwmagent.exe ()
MsConfig — State: «system.ini» — 0
MsConfig — State: «win.ini» — 0
MsConfig — State: «bootini» — 0
MsConfig — State: «services» — 0
MsConfig — State: «startup» — 2

SafeBootMin: AppMgmt — C:WINDOWSsystem32appmgmts.dll (Корпорация Майкрософт)
SafeBootMin: Base — Driver Group
SafeBootMin: Boot Bus Extender — Driver Group
SafeBootMin: Boot file system — Driver Group
SafeBootMin: dmserver — C:WINDOWSsystem32dmserver.dll (Корпорация Майкрософт)
SafeBootMin: EventLog — C:WINDOWSsystem32services.exe (Корпорация Майкрософт)
SafeBootMin: File system — Driver Group
SafeBootMin: Filter — Driver Group
SafeBootMin: PCI Configuration — Driver Group
SafeBootMin: PlugPlay — C:WINDOWSsystem32services.exe (Корпорация Майкрософт)
SafeBootMin: PNP Filter — Driver Group
SafeBootMin: Primary disk — Driver Group
SafeBootMin: SCSI Class — Driver Group
SafeBootMin: sermouse.sys — Driver
SafeBootMin: sr.sys — C:WINDOWSsystem32DRIVERSsr.sys (Корпорация Майкрософт)
SafeBootMin: SRService — C:WINDOWSsystem32srsvc.dll (Корпорация Майкрософт)
SafeBootMin: System Bus Extender — Driver Group
SafeBootMin: vds — Service
SafeBootMin: vga.sys — Driver
SafeBootMin: WinMgmt — C:WINDOWSsystem32wbemwmisvc.dll (Корпорация Майкрософт)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} — Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} — CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} — DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} — Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} — Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} — Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} — Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} — PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} — SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} — System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} — Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} — Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} — Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} — Human Interface Devices

SafeBootNet: AppMgmt — C:WINDOWSsystem32appmgmts.dll (Корпорация Майкрософт)
SafeBootNet: Base — Driver Group
SafeBootNet: Boot Bus Extender — Driver Group
SafeBootNet: Boot file system — Driver Group
SafeBootNet: Dhcp — C:WINDOWSsystem32dhcpcsvc.dll (Корпорация Майкрософт)
SafeBootNet: dmserver — C:WINDOWSsystem32dmserver.dll (Корпорация Майкрософт)
SafeBootNet: DnsCache — C:WINDOWSsystem32dnsrslvr.dll (Корпорация Майкрософт)
SafeBootNet: EventLog — C:WINDOWSsystem32services.exe (Корпорация Майкрософт)
SafeBootNet: File system — Driver Group
SafeBootNet: Filter — Driver Group
SafeBootNet: NDIS Wrapper — Driver Group
SafeBootNet: NetBIOSGroup — Driver Group
SafeBootNet: NetDDEGroup — Driver Group
SafeBootNet: NetMan — C:WINDOWSsystem32netman.dll (Корпорация Майкрософт)
SafeBootNet: Network — Driver Group
SafeBootNet: NetworkProvider — Driver Group
SafeBootNet: PCI Configuration — Driver Group
SafeBootNet: PlugPlay — C:WINDOWSsystem32services.exe (Корпорация Майкрософт)
SafeBootNet: PNP Filter — Driver Group
SafeBootNet: PNP_TDI — Driver Group
SafeBootNet: Primary disk — Driver Group
SafeBootNet: rdsessmgr — C:WINDOWSsystem32sessmgr.exe (Корпорация Майкрософт)
SafeBootNet: SCSI Class — Driver Group
SafeBootNet: sermouse.sys — Driver
SafeBootNet: SharedAccess — C:WINDOWSsystem32ipnathlp.dll (Корпорация Майкрософт)
SafeBootNet: sr.sys — C:WINDOWSsystem32DRIVERSsr.sys (Корпорация Майкрософт)
SafeBootNet: SRService — C:WINDOWSsystem32srsvc.dll (Корпорация Майкрософт)
SafeBootNet: Streams Drivers — Driver Group
SafeBootNet: System Bus Extender — Driver Group
SafeBootNet: TDI — Driver Group
SafeBootNet: termservice — C:WINDOWSsystem32termsrv.dll (Корпорация Майкрософт)
SafeBootNet: vga.sys — Driver
SafeBootNet: WinMgmt — C:WINDOWSsystem32wbemwmisvc.dll (Корпорация Майкрософт)
SafeBootNet: WZCSVC — C:WINDOWSsystem32wzcsvc.dll (Корпорация Майкрософт)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} — Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} — CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} — DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} — Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} — Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} — Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} — Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} — Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} — NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} — NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} — NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} — PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} — SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} — System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} — Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} — Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} — Human Interface Devices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} — Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} — Рендеринг векторных изображений (VML)
ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} — Macromedia Shockwave Director 9.0
ActiveX: {1F34E2EF-1C16-FB28-316D-8CD3A03BAF9D} — NetShow
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} — NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} — Проигрыватель Windows Media (Microsoft) 6.4
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} — Adobe Shockwave Director 11.0.3
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} — DirectAnimation
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} — Adobe Shockwave Director 11.0.3
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} — %SystemRoot%system32regsvr32.exe /s /n /i:/UserInstall %SystemRoot%system32themeui.dll
ActiveX: {34AB2437-1B34-3E2D-9DE8-3E2D35335B3F} — .NET Framework
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} — Динамическая привязка данных HTML для Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} — Автономный пакет просмотра
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} — Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} — Дополнительные средства разработки
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} — «%ProgramFiles%Outlook Expresssetup50.exe» /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} — rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFmsnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} — DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} — DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} — Справка по Internet Explorer
ActiveX: {4CB3FAE3-22CE-0E76-4C2A-CEECE6B8F4A4} — Outlook Express
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} — Классы Java DirectAnimation
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} — Microsoft Windows Script 5.7
ActiveX: {58425A11-AF28-FB3A-B4BD-FCD1B5E4411B} — Проигрыватель Windows Media (Microsoft) 6.4
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} — rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFmsmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} — ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} — Средства установки Internet Explorer
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} — Дополнительные средства просмотра
ActiveX: {6315BF75-B7C6-CD2F-2484-EF14FBB25835} — Настройка обозревателя
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} — Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} — Доступ к MSN
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} — .NET Framework
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} — Веб-папки
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} — «%ProgramFiles%Outlook Expresssetup50.exe» /APP:WAB /CALLER:WINNT /user /install
ActiveX: {7ABC86D1-178B-957C-4B51-0F97D27BA6B6} — Java (Sun)
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} — regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} — %SystemRoot%system32ie4uinit.exe
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} — c:WINDOWSsystem32Rundll32.exe c:WINDOWSsystem32mscories.dll,Install
ActiveX: {92119C74-21F9-8174-9270-96D1154AFBF5} — Настройка обозревателя
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} — Динамическая привязка данных HTML
ActiveX: {A219E60E-00B8-4CE4-70E3-F7A7CF1EC4A2} — Outlook Express
ActiveX: {A7614E3A-EBC7-6017-5922-41C0E2CEBE32} — Themes Setup
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} — .NET Framework
ActiveX: {BDF119E9-AEBA-468B-F9A5-CBFD30F1F79E} — Java (Sun)
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} — .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} — Базовые шрифты Internet Explorer
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} — .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} — Планировщик заданий
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} — Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} — Adobe Flash Player
ActiveX: {D4B1C1D5-922B-326B-4DC8-42EAE5B7216A} — Macromedia Shockwave Director 9.0
ActiveX: {D50344B2-E7E2-EDC9-66CE-4267E8AE7598} — Microsoft Windows Media Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} — Справка по HTML
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} — Active Directory Service Interface
ActiveX: {EF289A85-8E57-408d-BE47-73B55609861A} — RootsUpdate
ActiveX: {F4D0F248-2BF7-4912-814E-4FD751923838} — .NET Framework
ActiveX: {F69F6290-F49E-7D4A-DAFB-52E9DDFF1EB5} — Java (Sun)
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} — C:WINDOWSinfunregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} — %systemroot%system32shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS — RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} — %systemroot%system32shmgrate.exe OCInstallUserConfigOE
ActiveX: Microsoft Base Smart Card Crypto Provider Package —

Drivers32: midimapper — C:WINDOWSSystem32midimap.dll (Корпорация Майкрософт)
Drivers32: msacm.ac3acm — C:WINDOWSSystem32ac3acm.acm (fccHandler)
Drivers32: msacm.lameacm — C:WINDOWSSystem32lameACM.acm (http://www.mp3dev.org/)
Drivers32: msacm.mpega32 — C:WINDOWSSystem32Mpega32.acm (Hacked With Alex!)
Drivers32: vidc.DIVX — C:WINDOWSSystem32DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS — C:WINDOWSSystem32ff_vfw.dll ()
Drivers32: vidc.mdvd — C:WINDOWSSystem32Mpegc32f.dll (Hacked with Alex!)
Drivers32: vidc.vp60 — C:WINDOWSsystem32vp6vfw.dll (On2.com)
Drivers32: vidc.vp61 — C:WINDOWSsystem32vp6vfw.dll (On2.com)
Drivers32: VIDC.XVID — C:WINDOWSSystem32xvidvfw.dll ()
Drivers32: vidc.yv12 — C:WINDOWSSystem32yv12vfw.dll (http://www.helixcommunity.org)
Drivers32: wavemapper — C:WINDOWSSystem32msacm32.drv (Корпорация Майкрософт)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders — Created Within 30 Days ==========

[2010.09.23 12:33:43 | 000,575,488 | —- | C] (OldTimer Tools) — C:Documents and SettingsАдминистраторРабочий столOTL.exe
[2010.09.20 02:04:24 | 000,000,000 | -HSD | C] — C:RECYCLER
[2010.09.19 15:10:15 | 000,000,000 | —D | C] — C:rsit
[2010.09.19 15:06:56 | 000,000,000 | —D | C] — C:WINDOWStemp
[2010.09.19 14:54:24 | 000,000,000 | RHSD | C] — C:cmdcons
[2010.09.19 14:51:27 | 000,212,480 | —- | C] (SteelWerX) — C:WINDOWSSWXCACLS.exe
[2010.09.19 14:51:27 | 000,161,792 | —- | C] (SteelWerX) — C:WINDOWSSWREG.exe
[2010.09.19 14:51:27 | 000,136,704 | —- | C] (SteelWerX) — C:WINDOWSSWSC.exe
[2010.09.19 14:51:27 | 000,031,232 | —- | C] (NirSoft) — C:WINDOWSNIRCMD.exe
[2010.09.19 14:51:18 | 000,000,000 | —D | C] — C:WINDOWSERDNT
[2010.09.19 14:51:01 | 000,000,000 | —D | C] — C:Qoobox
[2010.09.19 14:42:32 | 004,625,640 | —- | C] (Корпорация Майкрософт) — C:Documents and SettingsАдминистраторРабочий столWindowsXP-KB310994-SP2-Pro-BootDisk-RUS.exe
[2010.09.19 13:00:33 | 000,161,296 | —- | C] (Trend Micro Inc.) — C:WINDOWSSystem32driverstmcomm.sys
[2010.09.18 21:17:15 | 000,165,584 | —- | C] (AVAST Software) — C:WINDOWSSystem32driversaswSP.sys
[2010.09.18 21:17:15 | 000,017,744 | —- | C] (AVAST Software) — C:WINDOWSSystem32driversaswFsBlk.sys
[2010.09.18 21:17:14 | 000,023,376 | —- | C] (AVAST Software) — C:WINDOWSSystem32driversaswRdr.sys
[2010.09.18 21:17:13 | 000,046,672 | —- | C] (AVAST Software) — C:WINDOWSSystem32driversaswTdi.sys
[2010.09.18 21:17:11 | 000,100,176 | —- | C] (AVAST Software) — C:WINDOWSSystem32driversaswmon2.sys
[2010.09.18 21:17:11 | 000,094,544 | —- | C] (AVAST Software) — C:WINDOWSSystem32driversaswmon.sys
[2010.09.18 21:17:11 | 000,028,880 | —- | C] (AVAST Software) — C:WINDOWSSystem32driversaavmker4.sys
[2010.09.18 21:17:07 | 000,167,592 | —- | C] (AVAST Software) — C:WINDOWSSystem32aswBoot.exe
[2010.09.18 21:17:07 | 000,038,848 | —- | C] (AVAST Software) — C:WINDOWSavastSS.scr
[2010.09.18 17:49:38 | 000,000,000 | —D | C] — C:Program FilesCommon Filesa8f9db59
[2010.09.18 15:53:37 | 000,028,552 | —- | C] (Panda Security, S.L.) — C:WINDOWSSystem32driverspavboot.sys
[2010.09.18 15:53:29 | 000,000,000 | —D | C] — C:Program FilesPanda Security
[2010.09.18 12:50:57 | 000,000,000 | —D | C] — C:WINDOWSBDOSCAN8
[2010.09.17 22:44:00 | 000,000,000 | —D | C] — C:Documents and SettingsNetworkServiceLocal SettingsApplication DataGoogle
[2010.09.17 22:39:50 | 000,000,000 | —D | C] — C:Documents and SettingsLocalServiceLocal SettingsApplication DataGoogle
[2010.09.13 17:35:43 | 000,000,000 | —D | C] — C:Documents and SettingsAll UsersApplication DataAlwil Software
[2010.09.09 12:57:18 | 000,225,280 | —- | C] (Aktiv Co.) — C:WINDOWSSystem32grddrv.dll
[2010.09.07 14:52:59 | 000,000,000 | —D | C] — C:Program FilesCommon FilesGuardant
[2010.09.07 14:52:16 | 002,081,792 | —- | C] (AlexVel) — C:WINDOWSSystem32driversd348prt.sys
[2010.09.07 14:50:25 | 000,000,000 | —D | C] — C:Program FilesGrand
[2010.09.07 12:03:31 | 000,000,000 | —D | C] — C:Documents and SettingsАдминистраторРабочий столграндсмета
[2010.09.05 18:29:49 | 000,000,000 | —D | C] — C:Documents and SettingsАдминистраторМои документыX-Lite
[2010.08.30 15:44:26 | 000,000,000 | —D | C] — C:Documents and SettingsАдминистраторМои документыЗагрузки
[2010.08.30 15:40:10 | 000,000,000 | —D | C] — C:Documents and SettingsAll UsersApplication DataMcAfee
[2010.08.27 10:10:21 | 000,000,000 | —D | C] — C:Documents and SettingsAll UsersApplication DataCounterPath
[2010.08.26 17:44:00 | 000,000,000 | —D | C] — C:Documents and SettingsАдминистраторLocal SettingsApplication DataCounterPath
[2010.08.26 17:42:02 | 000,000,000 | —D | C] — C:Program FilesCommon FilesIntel
[2010.08.26 17:42:00 | 000,000,000 | —D | C] — C:Program FilesCounterPath
[2009.01.25 17:00:50 | 000,047,360 | —- | C] (VSO Software) — C:Documents and SettingsАдминистраторApplication Datapcouffin.sys
[2004.11.24 23:25:52 | 000,335,872 | —- | C] ( ) — C:WINDOWSSystem32drvc.dll
[4 C:WINDOWS*.tmp files -> C:WINDOWS*.tmp -> ]
[1 C:WINDOWSSystem32*.tmp files -> C:WINDOWSSystem32*.tmp -> ]
[1 C:*.tmp files -> C:*.tmp -> ]

========== Files — Modified Within 30 Days ==========

[2010.09.23 12:33:45 | 000,575,488 | —- | M] (OldTimer Tools) — C:Documents and SettingsАдминистраторРабочий столOTL.exe
[2010.09.23 12:16:39 | 000,000,942 | —- | M] () — C:WINDOWStasksGoogleUpdateTaskMachineCore.job
[2010.09.23 12:16:34 | 000,243,457 | —- | M] () — C:WINDOWSSystem32NvApps.xml
[2010.09.23 12:16:33 | 000,000,006 | -H— | M] () — C:WINDOWStasksSA.DAT
[2010.09.23 12:16:30 | 000,002,048 | —S- | M] () — C:WINDOWSbootstat.dat
[2010.09.23 12:15:03 | 016,515,072 | -H— | M] () — C:Documents and SettingsАдминистраторNTUSER.DAT
[2010.09.23 12:15:03 | 000,000,278 | -HS- | M] () — C:Documents and SettingsАдминистраторntuser.ini
[2010.09.23 12:01:00 | 000,000,250 | —- | M] () — C:WINDOWStasksScheduled Update for Ask Toolbar.job
[2010.09.23 11:44:00 | 000,000,946 | —- | M] () — C:WINDOWStasksGoogleUpdateTaskMachineUA.job
[2010.09.22 21:40:25 | 000,188,416 | —- | M] () — C:Documents and SettingsАдминистраторLocal SettingsApplication DataDCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.09.22 17:27:54 | 000,000,116 | —- | M] () — C:WINDOWSNeroDigital.ini
[2010.09.20 10:19:22 | 000,069,627 | —- | M] () — C:Documents and SettingsАдминистраторРабочий столe93ee4abafec.jpg
[2010.09.19 20:22:03 | 000,032,559 | —- | M] () — C:Documents and SettingsАдминистраторРабочий стол94027bebc265.jpg
[2010.09.19 15:02:43 | 000,000,518 | —- | M] () — C:WINDOWSsystem.ini
[2010.09.19 15:02:16 | 000,000,027 | —- | M] () — C:WINDOWSSystem32driversetchosts
[2010.09.19 14:54:27 | 000,000,334 | RHS- | M] () — C:boot.ini
[2010.09.19 14:42:32 | 004,625,640 | —- | M] (Корпорация Майкрософт) — C:Documents and SettingsАдминистраторРабочий столWindowsXP-KB310994-SP2-Pro-BootDisk-RUS.exe
[2010.09.19 14:35:54 | 003,846,590 | R— | M] () — C:Documents and SettingsАдминистраторРабочий столComboFix.exe
[2010.09.19 14:33:47 | 000,087,484 | —- | M] () — C:Program FilesCommon Filesjqyrg4inedzz13m
[2010.09.19 13:00:33 | 000,161,296 | —- | M] (Trend Micro Inc.) — C:WINDOWSSystem32driverstmcomm.sys
[2010.09.19 11:18:29 | 000,000,000 | —- | M] () — C:WINDOWSSystem32МыЩсCMёа(ьЩс’Dёа
[2010.09.19 10:51:58 | 000,005,812 | —- | M] () — C:WINDOWSSystem32CONFIG.NT
[2010.09.19 00:59:11 | 000,000,000 | —- | M] () — C:WINDOWSSystem32М+WтCMёа(,Wт’Dёа
[2010.09.18 22:18:13 | 000,000,667 | —- | M] () — C:WINDOWSwin.ini
[2010.09.18 22:18:13 | 000,000,218 | —- | M] () — C:Boot.bak
[2010.09.18 21:17:15 | 000,001,700 | —- | M] () — C:Documents and SettingsAll UsersРабочий столavast! Free Antivirus.lnk
[2010.09.18 13:24:56 | 004,276,978 | -H— | M] () — C:Documents and SettingsАдминистраторLocal SettingsApplication DataIconCache.db
[2010.09.18 12:45:54 | 000,000,036 | —- | M] () — C:Documents and SettingsАдминистраторLocal SettingsApplication Datahousecall.guid.cache
[2010.09.18 11:48:34 | 000,000,000 | —- | M] () — C:WINDOWSSystem32ыјзфCMёа(l с’Dёа
[2010.09.17 21:59:19 | 000,000,000 | —- | M] () — C:WINDOWSSystem32МkoсCMёа(loс’Dёа
[2010.09.17 08:41:39 | 000,000,000 | —- | M] () — C:WINDOWSSystem32МkЙсCMёа(lЙс’Dёа
[2010.09.15 22:41:44 | 000,002,665 | —- | M] () — C:Documents and SettingsАдминистраторРабочий столABBYY FineReader 8.0 Professional Edition.lnk
[2010.09.14 13:40:34 | 000,175,842 | —- | M] () — C:Documents and SettingsАдминистраторРабочий стол[rutracker[1].org].t1946762.torrent
[2010.09.10 11:58:27 | 000,019,968 | —- | M] () — C:Documents and SettingsАдминистраторРабочий стол10175324372670.doc
[2010.09.09 12:56:01 | 000,005,758 | —- | M] () — C:WINDOWSSystem32CONFIG.GRD
[2010.09.09 12:46:49 | 000,002,479 | —- | M] () — C:Documents and SettingsAll UsersРабочий столГРАНД Смета (4.0).lnk
[2010.09.08 23:58:45 | 000,001,041 | —- | M] () — C:Documents and SettingsАдминистраторApplication Datavso_ts_preview.xml
[2010.09.08 21:36:21 | 000,062,622 | —- | M] () — C:WINDOWSFontData.fdb
[2010.09.08 21:34:03 | 000,000,848 | -HS- | M] () — C:WINDOWSSystem32KGyGaAvL.sys
[2010.09.08 21:33:35 | 000,002,549 | —- | M] () — C:Documents and SettingsАдминистраторРабочий столCorelDRAW X3.lnk
[2010.09.08 17:57:25 | 000,000,126 | -HS- | M] () — C:Documents and SettingsAll UsersApplication Data.zreglib
[2010.09.07 19:12:17 | 000,038,848 | —- | M] (AVAST Software) — C:WINDOWSavastSS.scr
[2010.09.07 19:11:54 | 000,167,592 | —- | M] (AVAST Software) — C:WINDOWSSystem32aswBoot.exe
[2010.09.07 18:52:25 | 000,046,672 | —- | M] (AVAST Software) — C:WINDOWSSystem32driversaswTdi.sys
[2010.09.07 18:52:03 | 000,165,584 | —- | M] (AVAST Software) — C:WINDOWSSystem32driversaswSP.sys
[2010.09.07 18:47:46 | 000,023,376 | —- | M] (AVAST Software) — C:WINDOWSSystem32driversaswRdr.sys
[2010.09.07 18:47:19 | 000,100,176 | —- | M] (AVAST Software) — C:WINDOWSSystem32driversaswmon2.sys
[2010.09.07 18:47:16 | 000,094,544 | —- | M] (AVAST Software) — C:WINDOWSSystem32driversaswmon.sys
[2010.09.07 18:47:07 | 000,017,744 | —- | M] (AVAST Software) — C:WINDOWSSystem32driversaswFsBlk.sys
[2010.09.07 18:46:51 | 000,028,880 | —- | M] (AVAST Software) — C:WINDOWSSystem32driversaavmker4.sys
[2010.09.04 11:30:48 | 000,002,206 | —- | M] () — C:WINDOWSSystem32wpa.dbl
[2010.09.02 11:00:40 | 000,000,779 | —- | M] () — C:Documents and SettingsАдминистраторApplication DataMicrosoftInternet ExplorerQuick LaunchЗапустить обозреватель Internet Explorer.lnk
[2010.08.30 15:33:28 | 000,001,602 | —- | M] () — C:Documents and SettingsAll UsersРабочий столMozilla Firefox.lnk
[2010.08.27 10:10:15 | 000,000,786 | —- | M] () — C:Documents and SettingsАдминистраторРабочий столX-Lite.lnk
[2010.08.26 18:07:41 | 000,002,265 | —- | M] () — C:Documents and SettingsAll UsersРабочий столSkype.lnk
[4 C:WINDOWS*.tmp files -> C:WINDOWS*.tmp -> ]
[1 C:WINDOWSSystem32*.tmp files -> C:WINDOWSSystem32*.tmp -> ]
[1 C:*.tmp files -> C:*.tmp -> ]

========== Files Created — No Company Name ==========

[2010.09.22 23:53:43 | 000,293,376 | —- | C] () — C:Documents and SettingsАдминистраторРабочий столgmer.exe
[2010.09.20 13:35:25 | 000,032,559 | —- | C] () — C:Documents and SettingsАдминистраторРабочий стол94027bebc265.jpg
[2010.09.20 13:35:17 | 000,069,627 | —- | C] () — C:Documents and SettingsАдминистраторРабочий столe93ee4abafec.jpg
[2010.09.19 14:54:27 | 000,000,218 | —- | C] () — C:Boot.bak
[2010.09.19 14:54:24 | 000,261,376 | RHS- | C] () — C:cmldr
[2010.09.19 14:51:27 | 000,256,512 | —- | C] () — C:WINDOWSPEV.exe
[2010.09.19 14:51:27 | 000,098,816 | —- | C] () — C:WINDOWSsed.exe
[2010.09.19 14:51:27 | 000,080,412 | —- | C] () — C:WINDOWSgrep.exe
[2010.09.19 14:51:27 | 000,077,312 | —- | C] () — C:WINDOWSMBR.exe
[2010.09.19 14:51:27 | 000,068,096 | —- | C] () — C:WINDOWSzip.exe
[2010.09.19 14:35:54 | 003,846,590 | R— | C] () — C:Documents and SettingsАдминистраторРабочий столComboFix.exe
[2010.09.19 10:33:32 | 000,000,000 | —- | C] () — C:WINDOWSSystem32МыЩсCMёа(ьЩс’Dёа
[2010.09.18 22:23:01 | 000,000,000 | —- | C] () — C:WINDOWSSystem32М+WтCMёа(,Wт’Dёа
[2010.09.18 21:17:15 | 000,001,700 | —- | C] () — C:Documents and SettingsAll UsersРабочий столavast! Free Antivirus.lnk
[2010.09.18 12:45:54 | 000,000,036 | —- | C] () — C:Documents and SettingsАдминистраторLocal SettingsApplication Datahousecall.guid.cache
[2010.09.18 11:16:35 | 000,000,000 | —- | C] () — C:WINDOWSSystem32ыјзфCMёа(l с’Dёа
[2010.09.17 22:39:47 | 000,000,946 | —- | C] () — C:WINDOWStasksGoogleUpdateTaskMachineUA.job
[2010.09.17 22:39:47 | 000,000,942 | —- | C] () — C:WINDOWStasksGoogleUpdateTaskMachineCore.job
[2010.09.17 11:35:24 | 000,000,000 | —- | C] () — C:WINDOWSSystem32МkoсCMёа(loс’Dёа
[2010.09.17 02:11:39 | 000,000,000 | —- | C] () — C:WINDOWSSystem32МkЙсCMёа(lЙс’Dёа
[2010.09.17 02:11:15 | 000,087,484 | —- | C] () — C:Program FilesCommon Filesjqyrg4inedzz13m
[2010.09.14 13:40:29 | 000,175,842 | —- | C] () — C:Documents and SettingsАдминистраторРабочий стол[rutracker[1].org].t1946762.torrent
[2010.09.08 11:47:07 | 000,019,968 | —- | C] () — C:Documents and SettingsАдминистраторРабочий стол10175324372670.doc
[2010.09.07 14:53:00 | 000,005,758 | —- | C] () — C:WINDOWSSystem32CONFIG.GRD
[2010.09.07 14:50:36 | 000,002,479 | —- | C] () — C:Documents and SettingsAll UsersРабочий столГРАНД Смета (4.0).lnk
[2010.09.02 11:00:40 | 000,000,779 | —- | C] () — C:Documents and SettingsАдминистраторApplication DataMicrosoftInternet ExplorerQuick LaunchЗапустить обозреватель Internet Explorer.lnk
[2010.08.26 17:42:03 | 000,000,786 | —- | C] () — C:Documents and SettingsАдминистраторРабочий столX-Lite.lnk
[2010.07.23 00:18:36 | 000,000,848 | -HS- | C] () — C:WINDOWSSystem32KGyGaAvL.sys
[2010.04.25 16:01:12 | 000,000,032 | —- | C] () — C:WINDOWSCD_Start.INI
[2010.03.29 01:07:05 | 000,004,096 | -H— | C] () — C:Documents and SettingsАдминистраторLocal SettingsApplication Datakeyfile3.drm
[2010.03.01 07:35:54 | 000,612,960 | —- | C] () — C:Documents and SettingsLocalServiceLocal SettingsApplication DataFontCache3.0.0.0.dat
[2010.01.31 11:35:57 | 000,000,043 | —- | C] () — C:WINDOWSAurora Media Workshop.INI
[2010.01.31 11:04:40 | 000,881,664 | —- | C] () — C:WINDOWSSystem32xvidcore.dll
[2010.01.31 11:04:40 | 000,205,824 | —- | C] () — C:WINDOWSSystem32xvidvfw.dll
[2009.05.25 20:46:04 | 000,000,017 | —- | C] () — C:WINDOWSwp.ini
[2009.04.08 16:06:03 | 000,000,160 | —- | C] () — C:WINDOWSmafosav.INI
[2009.02.28 23:04:28 | 000,000,231 | —- | C] () — C:WINDOWSSystem323dsmax.ini
[2009.02.28 23:04:28 | 000,000,043 | —- | C] () — C:WINDOWSSystem32InstallSettings.ini
[2009.02.24 20:12:59 | 000,003,972 | —- | C] () — C:WINDOWSSystem32driversPciBus.sys
[2009.02.17 18:12:11 | 000,000,320 | —- | C] () — C:WINDOWSGiveMeTorrent.ini
[2009.02.13 17:51:08 | 000,000,057 | —- | C] () — C:WINDOWSboxworld.ini
[2009.01.30 21:50:31 | 000,000,059 | —- | C] () — C:WINDOWSLTRDF14N.INI
[2009.01.25 21:39:27 | 000,000,038 | —- | C] () — C:WINDOWSAviSplitter.INI
[2009.01.25 18:49:33 | 000,000,170 | —- | C] () — C:WINDOWSwininit.ini
[2009.01.25 18:42:44 | 000,000,761 | —- | C] () — C:WINDOWSm3jp2k.ini
[2009.01.25 18:42:44 | 000,000,714 | —- | C] () — C:WINDOWSm3jpeg.ini
[2009.01.25 18:42:44 | 000,000,702 | —- | C] () — C:WINDOWSmmtvmj.ini
[2009.01.25 18:38:01 | 000,085,504 | —- | C] () — C:WINDOWSSystem32ff_vfw.dll
[2009.01.25 18:38:01 | 000,000,547 | —- | C] () — C:WINDOWSSystem32ff_vfw.dll.manifest
[2009.01.25 17:01:00 | 000,001,041 | —- | C] () — C:Documents and SettingsАдминистраторApplication Datavso_ts_preview.xml
[2009.01.25 17:00:53 | 000,000,034 | —- | C] () — C:Documents and SettingsАдминистраторApplication Datapcouffin.log
[2009.01.25 17:00:50 | 000,007,887 | —- | C] () — C:Documents and SettingsАдминистраторApplication Datapcouffin.cat
[2009.01.25 17:00:50 | 000,001,144 | —- | C] () — C:Documents and SettingsАдминистраторApplication Datapcouffin.inf
[2009.01.23 14:37:45 | 000,013,312 | —- | C] () — C:WINDOWSSystem32driversvdm1nji3.sys
[2009.01.05 15:44:10 | 000,000,453 | —- | C] () — C:WINDOWSbdoscandellang.ini
[2008.12.21 00:04:37 | 000,138,464 | —- | C] () — C:WINDOWSSystem32driversPnkBstrK.sys
[2008.12.18 02:19:45 | 000,001,125 | —- | C] () — C:WINDOWSSystem32sk_bho.ini
[2008.12.12 15:27:33 | 000,000,231 | —- | C] () — C:WINDOWScoolWeather_.ini
[2008.12.03 18:44:10 | 000,000,942 | —- | C] () — C:Documents and SettingsАдминистраторApplication Datafieryads.dat
[2008.11.18 23:32:38 | 000,022,328 | —- | C] () — C:Documents and SettingsАдминистраторApplication DataPnkBstrK.sys
[2008.11.11 18:30:27 | 000,019,670 | —- | C] () — C:Program FilesCommon Fileszexudylum.sys
[2008.11.11 18:30:27 | 000,018,241 | —- | C] () — C:Documents and SettingsАдминистраторApplication Dataunizy._sy
[2008.11.11 18:30:27 | 000,017,655 | —- | C] () — C:Documents and SettingsАдминистраторLocal SettingsApplication Dataditatume.vbs
[2008.11.11 18:30:27 | 000,017,575 | —- | C] () — C:Documents and SettingsАдминистраторLocal SettingsApplication Datafyxymyg.reg
[2008.11.11 18:30:27 | 000,017,496 | —- | C] () — C:Documents and SettingsАдминистраторLocal SettingsApplication Datamociwovive.pif
[2008.11.11 18:30:27 | 000,017,210 | —- | C] () — C:Program FilesCommon Filesodubejy.dl
[2008.11.11 18:30:27 | 000,016,803 | —- | C] () — C:Documents and SettingsAll UsersApplication Datazixinyjage.dll
[2008.11.11 18:30:27 | 000,016,422 | —- | C] () — C:WINDOWSSystem32xagen.sys
[2008.11.11 18:30:27 | 000,014,878 | —- | C] () — C:Documents and SettingsAll UsersApplication Dataluziju._sy
[2008.11.11 18:30:27 | 000,012,421 | —- | C] () — C:Documents and SettingsАдминистраторApplication Datazoxirahyqa.bat
[2008.11.11 18:30:27 | 000,011,522 | —- | C] () — C:Documents and SettingsАдминистраторLocal SettingsApplication Datapyxyna.lib
[2008.11.11 18:30:27 | 000,011,084 | —- | C] () — C:Documents and SettingsАдминистраторApplication Dataciduvy.lib
[2008.11.07 20:19:26 | 000,000,126 | -HS- | C] () — C:Documents and SettingsAll UsersApplication Data.zreglib
[2008.11.06 12:17:46 | 000,017,674 | —- | C] () — C:Documents and SettingsAll UsersApplication Datajodawisa.pif
[2008.11.06 12:17:46 | 000,017,397 | —- | C] () — C:Documents and SettingsАдминистраторLocal SettingsApplication Dataujusudyva.inf
[2008.11.06 12:17:46 | 000,017,161 | —- | C] () — C:Documents and SettingsАдминистраторLocal SettingsApplication Datawazezenim._dl
[2008.11.06 12:17:46 | 000,016,090 | —- | C] () — C:Documents and SettingsАдминистраторLocal SettingsApplication Dataefenot._dl
[2008.11.06 12:17:46 | 000,013,416 | —- | C] () — C:Documents and SettingsАдминистраторLocal SettingsApplication Datauhixamod.sys
[2008.11.06 12:17:46 | 000,013,025 | —- | C] () — C:Documents and SettingsАдминистраторApplication Dataunoqesocyt.db
[2008.11.06 12:17:46 | 000,012,570 | —- | C] () — C:Documents and SettingsАдминистраторLocal SettingsApplication Datauxam.sys
[2008.11.06 12:17:46 | 000,012,406 | —- | C] () — C:Documents and SettingsАдминистраторLocal SettingsApplication Dataiqetej.com
[2008.11.06 12:17:46 | 000,010,343 | —- | C] () — C:Documents and SettingsАдминистраторApplication Datalano.exe
[2008.10.28 21:46:41 | 000,001,025 | —- | C] () — C:WINDOWSSystem32sysprs7.dll
[2008.10.28 21:46:41 | 000,001,025 | —- | C] () — C:WINDOWSSystem32clauth2.dll
[2008.10.28 21:46:41 | 000,001,025 | —- | C] () — C:WINDOWSSystem32clauth1.dll
[2008.10.28 21:46:41 | 000,000,337 | —- | C] () — C:WINDOWSSystem32lsprst7.dll
[2008.10.28 21:46:41 | 000,000,073 | —- | C] () — C:WINDOWSSystem32ssprs.dll
[2008.10.28 18:40:48 | 000,173,552 | —- | C] () — C:WINDOWSSystem32xlive.dll.cat
[2008.10.19 18:48:08 | 000,065,536 | —- | C] () — C:WINDOWSSystem32Gif89.dll
[2008.10.17 14:06:37 | 000,000,084 | —- | C] () — C:WINDOWSwinamp.ini
[2008.10.17 14:04:11 | 000,000,213 | —- | C] () — C:WINDOWSiddk_mp3.ini
[2008.10.07 10:13:22 | 000,058,648 | —- | C] () — C:WINDOWSSystem32AgCPanelTraditionalChinese.dll
[2008.10.07 10:13:20 | 000,058,648 | —- | C] () — C:WINDOWSSystem32AgCPanelSwedish.dll
[2008.10.07 10:13:20 | 000,058,648 | —- | C] () — C:WINDOWSSystem32AgCPanelSpanish.dll
[2008.10.07 10:13:20 | 000,058,648 | —- | C] () — C:WINDOWSSystem32AgCPanelSimplifiedChinese.dll
[2008.10.07 10:13:20 | 000,058,648 | —- | C] () — C:WINDOWSSystem32AgCPanelPortugese.dll
[2008.10.07 10:13:20 | 000,058,648 | —- | C] () — C:WINDOWSSystem32AgCPanelKorean.dll
[2008.10.07 10:13:20 | 000,058,648 | —- | C] () — C:WINDOWSSystem32AgCPanelJapanese.dll
[2008.10.07 10:13:20 | 000,058,648 | —- | C] () — C:WINDOWSSystem32AgCPanelGerman.dll
[2008.10.07 10:13:20 | 000,058,648 | —- | C] () — C:WINDOWSSystem32AgCPanelFrench.dll
[2008.10.05 11:01:20 | 000,178,176 | —- | C] () — C:WINDOWSSystem32unrar.dll
[2008.10.02 19:37:41 | 000,000,103 | —- | C] () — C:WINDOWSpro.INI
[2008.10.02 13:43:23 | 000,000,151 | —- | C] () — C:WINDOWSPhotoSnapViewer.INI
[2008.10.02 01:04:47 | 000,210,944 | —- | C] () — C:WINDOWSSystem32Msvcrt10.dll
[2008.10.02 01:04:45 | 000,065,536 | —- | C] () — C:WINDOWSSystem32adistres.dll
[2008.10.02 00:46:14 | 000,010,752 | —- | C] () — C:WINDOWSSystem32BASSMOD.dll
[2008.10.01 11:31:39 | 000,000,136 | —- | C] () — C:Documents and SettingsАдминистраторLocal SettingsApplication Datafusioncache.dat
[2008.10.01 10:33:48 | 000,000,281 | —- | C] () — C:WINDOWSSystem32CNCMFP11.INI
[2008.09.30 22:23:15 | 000,000,116 | —- | C] () — C:WINDOWSNeroDigital.ini
[2008.09.30 22:23:10 | 000,188,416 | —- | C] () — C:Documents and SettingsАдминистраторLocal SettingsApplication DataDCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.09.30 16:09:09 | 000,002,688 | —- | C] () — C:WINDOWSSystem32io02.sys
[2008.09.30 16:02:00 | 000,000,500 | —- | C] () — C:WINDOWSODBC.INI
[2008.06.05 09:58:26 | 000,197,912 | —- | C] () — C:WINDOWSSystem32physxcudart_20.dll
[2008.04.17 16:44:02 | 006,538,067 | —- | C] () — C:WINDOWSSystem32SRPFSig.dll
[2008.04.17 16:44:02 | 000,623,157 | —- | C] () — C:WINDOWSSystem32SRPESig.dll
[2008.02.28 13:25:51 | 008,813,777 | —- | C] () — C:WINDOWSSystem32SRPRSig.dll
[2008.02.28 13:25:51 | 000,622,113 | —- | C] () — C:WINDOWSSystem32SRPList.dll
[2008.02.28 13:25:51 | 000,002,380 | —- | C] () — C:WINDOWSSystem32SRPBlkCoo.dll
[2008.02.28 13:25:51 | 000,000,162 | —- | C] () — C:WINDOWSSystem32SRPCritProc.dll
[2006.07.07 23:30:22 | 000,073,728 | —- | C] () — C:WINDOWSSystem32ts.dll
[2006.06.02 02:10:25 | 003,596,288 | —- | C] () — C:WINDOWSSystem32qt-dx331.dll
[2006.06.02 02:06:32 | 000,012,288 | —- | C] () — C:WINDOWSSystem32DivXWMPExtType.dll
[2005.09.16 15:29:30 | 000,000,624 | —- | C] () — C:WINDOWSSystem32grddos.sys
[2004.10.12 10:40:58 | 002,255,360 | —- | C] () — C:WINDOWSSystem32libavcodec.dll
[2004.10.12 10:39:48 | 000,028,160 | —- | C] () — C:WINDOWSSystem32ff_wmv9.dll
[2004.10.12 10:39:08 | 000,110,592 | —- | C] () — C:WINDOWSSystem32ff_theora.dll
[2004.10.09 10:40:16 | 000,454,144 | —- | C] () — C:WINDOWSSystem32ff_x264.dll
[2004.10.05 12:16:08 | 000,395,776 | —- | C] () — C:WINDOWSSystem32libmplayer.dll
[2004.10.03 21:50:54 | 000,129,024 | —- | C] () — C:WINDOWSSystem32ff_mpeg2enc.dll
[2003.04.10 13:43:32 | 000,005,412 | —- | C] () — C:WINDOWSSystem32OUTLPERF.INI
[2003.03.17 13:22:54 | 000,778,240 | —S- | C] () — C:WINDOWSPVPEng.dll
[2002.05.18 02:18:30 | 000,124,928 | —- | C] () — C:WINDOWSSystem32mp4fil32.dll
[2001.09.17 13:20:02 | 000,019,968 | —- | C] () — C:WINDOWSSystem32cpuinf32.dll
[1998.11.23 11:16:18 | 000,008,704 | —- | C] () — C:WINDOWSSystem32nvkeyvdd.dll
[1998.05.27 19:12:08 | 000,000,626 | —- | C] () — C:WINDOWSSystem32nvkey4nt.sys

========== Custom Scans ==========

[2004.08.17 16:16:30 | 018,796,211 | —- | M] () .cab file — C:WINDOWSDriver Cachei386sp2.cab:AGP440.sys
[2008.04.14 22:54:34 | 020,118,444 | —- | M] () .cab file — C:WINDOWSDriver Cachei386sp3.cab:AGP440.sys
[2008.04.14 22:54:34 | 020,118,444 | —- | M] () .cab file — C:WINDOWSServicePackFilesi386sp3.cab:AGP440.sys
[2008.04.14 01:06:40 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 — C:WINDOWSERDNTcacheagp440.sys
[2008.04.14 01:06:40 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 — C:WINDOWSServicePackFilesi386agp440.sys
[2008.04.14 01:06:40 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 — C:WINDOWSsystem32driversagp440.sys

[2004.08.17 16:16:30 | 018,796,211 | —- | M] () .cab file — C:WINDOWSDriver Cachei386sp2.cab:atapi.sys
[2008.04.14 22:54:34 | 020,118,444 | —- | M] () .cab file — C:WINDOWSDriver Cachei386sp3.cab:atapi.sys
[2008.04.14 22:54:34 | 020,118,444 | —- | M] () .cab file — C:WINDOWSServicePackFilesi386sp3.cab:atapi.sys
[2008.04.14 01:10:32 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 — C:WINDOWSERDNTcacheatapi.sys
[2008.04.14 01:10:32 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 — C:WINDOWSServicePackFilesi386atapi.sys
[2008.04.14 01:10:32 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 — C:WINDOWSsystem32driversatapi.sys
[2004.08.03 22:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 — C:WINDOWS$NtServicePackUninstall$atapi.sys
[2004.08.03 22:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 — C:WINDOWSsystem32ReinstallBackups007DriverFilesi386atapi.sys
[2004.08.03 22:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 — C:WINDOWSsystem32ReinstallBackups008DriverFilesi386atapi.sys

[2008.04.14 22:40:38 | 000,056,320 | —- | M] (Корпорация Майкрософт) MD5=239622CC309B9650B345893D54C4D74E — C:WINDOWSERDNTcacheeventlog.dll
[2008.04.14 22:40:38 | 000,056,320 | —- | M] (Корпорация Майкрософт) MD5=239622CC309B9650B345893D54C4D74E — C:WINDOWSServicePackFilesi386eventlog.dll
[2008.04.14 22:40:38 | 000,056,320 | —- | M] (Корпорация Майкрософт) MD5=239622CC309B9650B345893D54C4D74E — C:WINDOWSsystem32eventlog.dll
[2004.08.17 16:04:16 | 000,055,808 | —- | M] (Корпорация Майкрософт) MD5=6CD35BE0991DF15A07BC60B894E6482B — C:WINDOWS$NtServicePackUninstall$eventlog.dll

[2004.08.17 16:04:18 | 000,110,080 | —- | M] (Microsoft Corporation) MD5=318492C9327EDBBD7FAD35FB3DF65CC3 — C:WINDOWS$NtServicePackUninstall$imm32.dll
[2008.04.14 22:40:38 | 000,110,080 | —- | M] (Microsoft Corporation) MD5=A9690FD601E9F5102F0D3388DF6081BD — C:WINDOWSERDNTcacheimm32.dll
[2008.04.14 22:40:38 | 000,110,080 | —- | M] (Microsoft Corporation) MD5=A9690FD601E9F5102F0D3388DF6081BD — C:WINDOWSServicePackFilesi386imm32.dll
[2008.04.14 22:40:38 | 000,110,080 | —- | M] (Microsoft Corporation) MD5=A9690FD601E9F5102F0D3388DF6081BD — C:WINDOWSsystem32imm32.dll

[2004.08.17 16:04:28 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=4922B0C854A0B4A2CD2061BBFE29B251 — C:WINDOWS$NtServicePackUninstall$netlogon.dll
[2008.04.14 22:40:42 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=BE915B967E7CA7AE746387D2E5CDCE3B — C:WINDOWSERDNTcachenetlogon.dll
[2008.04.14 22:40:42 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=BE915B967E7CA7AE746387D2E5CDCE3B — C:WINDOWSServicePackFilesi386netlogon.dll
[2008.04.14 22:40:42 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=BE915B967E7CA7AE746387D2E5CDCE3B — C:WINDOWSsystem32netlogon.dll

[2008.04.14 22:40:44 | 000,184,832 | —- | M] (Корпорация Майкрософт) MD5=04423B01963ECF4BEEC4BD26A740D809 — C:WINDOWSERDNTcachescecli.dll
[2008.04.14 22:40:44 | 000,184,832 | —- | M] (Корпорация Майкрософт) MD5=04423B01963ECF4BEEC4BD26A740D809 — C:WINDOWSServicePackFilesi386scecli.dll
[2008.04.14 22:40:44 | 000,184,832 | —- | M] (Корпорация Майкрософт) MD5=04423B01963ECF4BEEC4BD26A740D809 — C:WINDOWSsystem32scecli.dll
[2004.08.17 16:04:30 | 000,183,808 | —- | M] (Корпорация Майкрософт) MD5=5D5A37C65A5E86ED3811A4128B3A84E4 — C:WINDOWS$NtServicePackUninstall$scecli.dll

[2008.04.14 22:40:38 | 000,357,888 | —- | M] (Microsoft Corporation) Unable to obtain MD5 — C:WINDOWSsystem32dxtmsft.dll
[2008.04.14 22:40:38 | 000,205,312 | —- | M] (Microsoft Corporation) Unable to obtain MD5 — C:WINDOWSsystem32dxtrans.dll
[2008.04.14 22:40:38 | 000,251,392 | —- | M] (Корпорация Майкрософт) Unable to obtain MD5 — C:WINDOWSsystem32iepeers.dll
[2008.04.14 22:40:46 | 001,499,136 | —- | M] (Корпорация Майкрософт) Unable to obtain MD5 — C:WINDOWSsystem32shdocvw.dll
[1 C:WINDOWSsystem32*.tmp files -> C:WINDOWSsystem32*.tmp -> ]

========== Alternate Data Streams ==========

@Alternate Data Stream — 145 bytes -> C:Documents and SettingsAll UsersApplication DataTEMP:41ADDB8A
@Alternate Data Stream — 126 bytes -> C:Documents and SettingsAll UsersApplication DataTEMP:A064CECC

[Bruce333]

у меня почему то только один лог открывается в OTL, и лог не влезает в одно сообщение, поэтому в двух
OTL logfile created on: 23.09.2010 12:33:58 — Run 5
OTL by OldTimer — Version 3.2.14.1 Folder = C:Documents and SettingsАдминистраторРабочий стол
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) — Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000419 | Country: Россия | Language: RUS | Date Format: dd.MM.yyyy

2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 76,00% Memory free
4,00 Gb Paging File | 4,00 Gb Available in Paging File | 92,00% Paging File free
Paging file location(s): C:pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:WINDOWS | %ProgramFiles% = C:Program Files
Drive C: | 195,31 Gb Total Space | 31,38 Gb Free Space | 16,07% Space Free | Partition Type: NTFS
Drive D: | 270,44 Gb Total Space | 2,88 Gb Free Space | 1,07% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: USER-BECE145756
Current User Name: Администратор
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC — [2010.09.23 12:33:45 | 000,575,488 | —- | M] (OldTimer Tools) — C:Documents and SettingsАдминистраторРабочий столOTL.exe
PRC — [2010.09.07 19:12:02 | 002,838,912 | —- | M] (AVAST Software) — C:Program FilesAlwil SoftwareAvast5AvastUI.exe
PRC — [2010.09.07 19:11:59 | 000,040,384 | —- | M] (AVAST Software) — C:Program FilesAlwil SoftwareAvast5AvastSvc.exe
PRC — [2010.09.03 11:18:01 | 000,328,568 | —- | M] (BitTorrent, Inc.) — C:Program FilesuTorrentuTorrent.exe
PRC — [2010.01.04 20:13:28 | 023,941,120 | —- | M] () — C:Program FilesCounterPathX-Litex-lite.exe
PRC — [2009.03.12 18:36:24 | 000,086,016 | —- | M] () — C:Program FilesAutodesk3ds Max 2010mentalraysatelliteraysat_3dsmax2010_32server.exe
PRC — [2009.02.28 23:04:32 | 000,079,360 | —- | M] (Autodesk) — C:Program FilesCommon FilesAutodesk SharedServiceAdskScSrv.exe
PRC — [2008.06.10 20:26:28 | 000,222,456 | —- | M] () — C:Program FilesICQ6ToolbarICQ Service.exe
PRC — [2008.04.14 22:41:14 | 000,509,440 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32winlogon.exe
PRC — [2008.04.14 22:41:10 | 000,109,056 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32services.exe
PRC — [2008.04.14 22:41:10 | 000,050,688 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32smss.exe
PRC — [2008.04.14 22:40:58 | 001,034,240 | —- | M] (Корпорация Майкрософт) — C:WINDOWSexplorer.exe
PRC — [2008.04.14 22:40:58 | 000,093,184 | —- | M] (Корпорация Майкрософт) — C:Program FilesInternet Exploreriexplore.exe
PRC — [2008.03.10 00:04:52 | 000,065,536 | —- | M] () — C:Program FilesAutodesk3ds Max 2009mentalraysatelliteraysat_3dsMax2009_32server.exe

========== Modules (SafeList) ==========

MOD — [2010.09.23 12:33:45 | 000,575,488 | —- | M] (OldTimer Tools) — C:Documents and SettingsАдминистраторРабочий столOTL.exe
MOD — [2008.04.14 22:41:18 | 000,146,944 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32winspool.drv
MOD — [2008.04.14 22:40:48 | 000,579,072 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32user32.dll
MOD — [2008.04.14 22:40:48 | 000,219,648 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32uxtheme.dll
MOD — [2008.04.14 22:40:46 | 008,478,208 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32shell32.dll
MOD — [2008.04.14 22:40:46 | 000,991,744 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32setupapi.dll
MOD — [2008.04.14 22:40:46 | 000,474,112 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32shlwapi.dll
MOD — [2008.04.14 22:40:46 | 000,067,584 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32srclient.dll
MOD — [2008.04.14 22:40:44 | 001,287,168 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32ole32.dll
MOD — [2008.04.14 22:40:40 | 000,995,840 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32kernel32.dll
MOD — [2008.04.14 22:40:36 | 000,797,696 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32comres.dll
MOD — [2008.04.14 22:40:36 | 000,279,040 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32comdlg32.dll
MOD — [2008.04.14 22:40:34 | 000,687,616 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32advapi32.dll
MOD — [2008.04.14 22:40:20 | 000,710,144 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32ntdll.dll
MOD — [2008.04.14 22:39:28 | 000,110,592 | —- | M] (Microsoft Corporation) — C:WINDOWSsystem32msscript.ocx

========== Win32 Services (SafeList) ==========

SRV — [2010.09.07 19:11:59 | 000,040,384 | —- | M] (AVAST Software) [On_Demand | Running] — C:Program FilesAlwil SoftwareAvast5AvastSvc.exe — (avast! Web Scanner)
SRV — [2010.09.07 19:11:59 | 000,040,384 | —- | M] (AVAST Software) [On_Demand | Running] — C:Program FilesAlwil SoftwareAvast5AvastSvc.exe — (avast! Mail Scanner)
SRV — [2010.09.07 19:11:59 | 000,040,384 | —- | M] (AVAST Software) [Auto | Running] — C:Program FilesAlwil SoftwareAvast5AvastSvc.exe — (avast! Antivirus)
SRV — [2010.02.28 18:00:44 | 000,651,720 | —- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] — C:Program FilesCommon FilesMacrovision SharedFLEXnet PublisherFNPLicensingService.exe — (FLEXnet Licensing Service)
SRV — [2009.03.12 18:36:24 | 000,086,016 | —- | M] () [Auto | Running] — C:Program FilesAutodesk3ds Max 2010mentalraysatelliteraysat_3dsmax2010_32server.exe — (mi-raysat_3dsmax2010_32)
SRV — [2009.02.28 23:04:32 | 000,079,360 | —- | M] (Autodesk) [Auto | Running] — C:Program FilesCommon FilesAutodesk SharedServiceAdskScSrv.exe — (Autodesk Licensing Service)
SRV — [2008.06.10 20:26:28 | 000,222,456 | —- | M] () [Auto | Running] — C:Program FilesICQ6ToolbarICQ Service.exe — (ICQ Service)
SRV — [2008.04.14 22:41:14 | 000,290,304 | —- | M] (Корпорация Майкрософт) [On_Demand | Stopped] — C:WINDOWSsystem32vssvc.exe — (VSS)
SRV — [2008.04.14 22:41:14 | 000,126,464 | —- | M] (Корпорация Майкрософт) [On_Demand | Stopped] — C:WINDOWSsystem32wbemwmiapsrv.exe — (WmiApSrv)
SRV — [2008.04.14 22:41:12 | 000,073,216 | —- | M] (Корпорация Майкрософт) [On_Demand | Stopped] — C:WINDOWSsystem32tlntsvr.exe — (TlntSvr)
SRV — [2008.04.14 22:41:10 | 000,141,824 | —- | M] (Корпорация Майкрософт) [On_Demand | Stopped] — C:WINDOWSsystem32sessmgr.exe — (RDSessMgr)
SRV — [2008.04.14 22:41:10 | 000,109,056 | —- | M] (Корпорация Майкрософт) [Auto | Running] — C:WINDOWSsystem32services.exe — (PlugPlay)
SRV — [2008.04.14 22:41:10 | 000,109,056 | —- | M] (Корпорация Майкрософт) [Auto | Running] — C:WINDOWSsystem32services.exe — (Eventlog)
SRV — [2008.04.14 22:41:10 | 000,091,648 | —- | M] (Корпорация Майкрософт) [On_Demand | Stopped] — C:WINDOWSsystem32smlogsvc.exe — (SysmonLog)
SRV — [2008.04.14 22:41:08 | 000,096,768 | —- | M] (Корпорация Майкрософт) [On_Demand | Stopped] — C:WINDOWSsystem32scardsvr.exe — (SCardSvr)
SRV — [2008.04.14 22:41:06 | 000,113,664 | —- | M] (Корпорация Майкрософт) [Disabled | Stopped] — C:WINDOWSsystem32netdde.exe — (NetDDEdsdm)
SRV — [2008.04.14 22:41:06 | 000,113,664 | —- | M] (Корпорация Майкрософт) [Disabled | Stopped] — C:WINDOWSsystem32netdde.exe — (NetDDE)
SRV — [2008.04.14 22:41:02 | 000,032,768 | —- | M] (Корпорация Майкрософт) [On_Demand | Stopped] — C:WINDOWSsystem32mnmsrvc.exe — (mnmsrvc)
SRV — [2008.04.14 22:41:00 | 000,150,528 | —- | M] (Корпорация Майкрософт) [On_Demand | Stopped] — C:WINDOWSsystem32imapi.exe — (ImapiService)
SRV — [2008.04.14 22:40:50 | 000,483,840 | —- | M] (Корпорация Майкрософт) [Auto | Running] — C:WINDOWSsystem32wzcsvc.dll — (WZCSVC)
SRV — [2008.04.14 22:40:48 | 000,333,824 | —- | M] (Корпорация Майкрософт) [Auto | Running] — C:WINDOWSsystem32wiaservc.dll — (stisvc) Служба загрузки изображений (WIA)
SRV — [2008.04.14 22:40:48 | 000,186,368 | —- | M] (Корпорация Майкрософт) [On_Demand | Stopped] — C:WINDOWSsystem32upnphost.dll — (upnphost)
SRV — [2008.04.14 22:40:48 | 000,175,616 | —- | M] (Корпорация Майкрософт) [Auto | Running] — C:WINDOWSsystem32w32time.dll — (W32Time)
SRV — [2008.04.14 22:40:48 | 000,145,408 | —- | M] (Корпорация Майкрософт) [Auto | Running] — C:WINDOWSsystem32wbemwmisvc.dll — (winmgmt)
SRV — [2008.04.14 22:40:46 | 000,295,936 | —- | M] (Корпорация Майкрософт) [On_Demand | Running] — C:WINDOWSsystem32termsrv.dll — (TermService)
SRV — [2008.04.14 22:40:46 | 000,249,856 | —- | M] (Корпорация Майкрософт) [On_Demand | Running] — C:WINDOWSsystem32tapisrv.dll — (TapiSrv)
SRV — [2008.04.14 22:40:46 | 000,193,024 | —- | M] (Корпорация Майкрософт) [Auto | Running] — C:WINDOWSsystem32schedsvc.dll — (Schedule)
SRV — [2008.04.14 22:40:46 | 000,171,008 | —- | M] (Корпорация Майкрософт) [Auto | Running] — C:WINDOWSsystem32srsvc.dll — (srservice)
SRV — [2008.04.14 22:40:46 | 000,135,680 | —- | M] (Корпорация Майкрософт) [Auto | Running] — C:WINDOWSsystem32shsvcs.dll — (Themes)
SRV — [2008.04.14 22:40:46 | 000,135,680 | —- | M] (Корпорация Майкрософт) [Auto | Running] — C:WINDOWSsystem32shsvcs.dll — (ShellHWDetection)
SRV — [2008.04.14 22:40:46 | 000,135,680 | —- | M] (Корпорация Майкрософт) [On_Demand | Running] — C:WINDOWSsystem32shsvcs.dll — (FastUserSwitchingCompatibility)
SRV — [2008.04.14 22:40:46 | 000,018,944 | —- | M] (Корпорация Майкрософт) [Auto | Running] — C:WINDOWSsystem32seclogon.dll — (seclogon)
SRV — [2008.04.14 22:40:44 | 000,436,736 | —- | M] (Корпорация Майкрософт) [On_Demand | Stopped] — C:WINDOWSsystem32ntmssvc.dll — (NtmsSvc)
SRV — [2008.04.14 22:40:44 | 000,409,088 | —- | M] (Корпорация Майкрософт) [Auto | Running] — C:WINDOWSsystem32qmgr.dll — (BITS) Фоновая интеллектуальная служба передачи (BITS)
SRV — [2008.04.14 22:40:42 | 000,247,296 | —- | M] (Корпорация Майкрософт) [On_Demand | Running] — C:WINDOWSsystem32mswsock.dll — (Nla) Служба сетевого расположения (NLA)
SRV — [2008.04.14 22:40:42 | 000,198,144 | —- | M] (Корпорация Майкрософт) [On_Demand | Running] — C:WINDOWSsystem32netman.dll — (Netman)
SRV — [2008.04.14 22:40:40 | 000,331,264 | —- | M] (Корпорация Майкрософт) [Auto | Running] — C:WINDOWSsystem32ipnathlp.dll — (SharedAccess) Брандмауэр Windows/Общий доступ к Интернету (ICS)
SRV — [2008.04.14 22:40:36 | 000,126,464 | —- | M] (Корпорация Майкрософт) [Auto | Running] — C:WINDOWSsystem32dhcpcsvc.dll — (Dhcp)
SRV — [2008.04.14 22:40:36 | 000,045,568 | —- | M] (Корпорация Майкрософт) [Auto | Running] — C:WINDOWSsystem32dnsrslvr.dll — (Dnscache)
SRV — [2008.04.14 22:40:36 | 000,024,064 | —- | M] (Корпорация Майкрософт) [Auto | Running] — C:WINDOWSsystem32dmserver.dll — (dmserver)
SRV — [2008.04.14 22:40:34 | 000,687,616 | —- | M] (Корпорация Майкрософт) [On_Demand | Stopped] — C:WINDOWSsystem32advapi32.dll — (Wmi) Расширения драйверов WMI (Windows Management Instrumentation)
SRV — [2008.04.14 22:40:34 | 000,171,008 | —- | M] (Корпорация Майкрософт) [On_Demand | Stopped] — C:WINDOWSsystem32appmgmts.dll — (AppMgmt)
SRV — [2008.03.10 00:04:52 | 000,065,536 | —- | M] () [Auto | Running] — C:Program FilesAutodesk3ds Max 2009mentalraysatelliteraysat_3dsMax2009_32server.exe — (mi-raysat_3dsMax2009_32)

========== Driver Services (SafeList) ==========

DRV — File not found [Kernel | On_Demand | Stopped] — E:INSTALLGMSIPCI.SYS — (GMSIPCI)
DRV — File not found [Kernel | On_Demand | Stopped] — C:ComboFixcatchme.sys — (catchme)
DRV — [2010.09.07 18:52:25 | 000,046,672 | —- | M] (AVAST Software) [Kernel | System | Running] — C:WINDOWSSystem32driversaswTdi.sys — (aswTdi)
DRV — [2010.09.07 18:52:03 | 000,165,584 | —- | M] (AVAST Software) [Kernel | System | Running] — C:WINDOWSSystem32driversaswSP.sys — (aswSP)
DRV — [2010.09.07 18:47:46 | 000,023,376 | —- | M] (AVAST Software) [Kernel | On_Demand | Running] — C:WINDOWSSystem32driversaswRdr.sys — (aswRdr)
DRV — [2010.09.07 18:47:19 | 000,100,176 | —- | M] (AVAST Software) [File_System | Auto | Running] — C:WINDOWSSystem32driversaswmon2.sys — (aswMon2)
DRV — [2010.09.07 18:47:07 | 000,017,744 | —- | M] (AVAST Software) [File_System | Auto | Running] — C:WINDOWSSystem32driversaswFsBlk.sys — (aswFsBlk)
DRV — [2010.09.07 18:46:51 | 000,028,880 | —- | M] (AVAST Software) [Kernel | System | Running] — C:WINDOWSSystem32driversaavmker4.sys — (Aavmker4)
DRV — [2009.07.14 22:54:00 | 007,741,664 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] — C:WINDOWSsystem32driversnv4_mini.sys — (nv)
DRV — [2009.06.30 09:37:16 | 000,028,552 | —- | M] (Panda Security, S.L.) [File_System | Boot | Running] — C:WINDOWSsystem32driverspavboot.sys — (pavboot)
DRV — [2008.10.01 12:18:01 | 000,015,600 | —- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] — C:WINDOWSgdrv.sys — (gdrv)
DRV — [2008.07.21 16:11:58 | 000,024,392 | —- | M] (Elaborate Bytes AG) [Kernel | Auto | Running] — C:WINDOWSsystem32driversElbyCDIO.sys — (ElbyCDIO)
DRV — [2008.06.17 14:59:00 | 002,081,792 | —- | M] (AlexVel) [Kernel | Auto | Running] — C:WINDOWSsystem32driversd348prt.sys — (d348prt)
DRV — [2008.04.14 22:22:46 | 000,073,472 | —- | M] (Корпорация Майкрософт) [File_System | Boot | Running] — C:WINDOWSsystem32DRIVERSsr.sys — (sr)
DRV — [2008.04.14 22:22:32 | 000,120,192 | —- | M] (Корпорация Майкрософт) [Kernel | Disabled | Stopped] — C:WINDOWSSystem32driverspcmcia.sys — (Pcmcia)
DRV — [2008.04.14 22:22:30 | 000,068,480 | —- | M] (Корпорация Майкрософт) [Kernel | Boot | Running] — C:WINDOWSsystem32DRIVERSpci.sys — (PCI)
DRV — [2008.04.14 22:22:22 | 000,080,128 | —- | M] (Корпорация Майкрософт) [Kernel | On_Demand | Running] — C:WINDOWSsystem32driversparport.sys — (Parport)
DRV — [2008.04.14 22:17:58 | 000,014,720 | —- | M] (Корпорация Майкрософт) [Kernel | System | Running] — C:WINDOWSsystem32driverskbdhid.sys — (kbdhid)
DRV — [2008.04.14 22:17:56 | 000,024,832 | —- | M] (Корпорация Майкрософт) [Kernel | System | Running] — C:WINDOWSsystem32driverskbdclass.sys — (Kbdclass)
DRV — [2008.04.14 22:17:16 | 000,037,504 | —- | M] (Корпорация Майкрософт) [Kernel | Boot | Running] — C:WINDOWSsystem32DRIVERSisapnp.sys — (isapnp)
DRV — [2008.04.14 22:14:10 | 000,053,120 | —- | M] (Корпорация Майкрософт) [Kernel | System | Stopped] — C:WINDOWSsystem32driversi8042prt.sys — (i8042prt)
DRV — [2008.04.14 22:14:02 | 000,065,024 | —- | M] (Корпорация Майкрософт) [Kernel | System | Running] — C:WINDOWSsystem32driversserial.sys — (Serial)
DRV — [2008.04.14 22:11:48 | 000,058,368 | —- | M] (Корпорация Майкрософт) [Kernel | System | Running] — C:WINDOWSsystem32driversredbook.sys — (redbook)
DRV — [2008.04.14 22:11:14 | 000,044,544 | —- | M] (Корпорация Майкрософт) [Kernel | System | Running] — C:WINDOWSSystem32driversfips.sys — (Fips)
DRV — [2008.04.14 22:10:10 | 000,051,968 | —- | M] (Корпорация Майкрософт) [Kernel | Boot | Running] — C:WINDOWSSystem32driversvolsnap.sys — (VolSnap)
DRV — [2008.04.14 22:07:44 | 000,023,296 | —- | M] (Корпорация Майкрософт) [Kernel | System | Running] — C:WINDOWSsystem32driversmouclass.sys — (Mouclass)
DRV — [2008.04.14 22:07:38 | 000,188,288 | —- | M] (Корпорация Майкрософт) [Kernel | Boot | Running] — C:WINDOWSsystem32DRIVERSACPI.sys — (ACPI)
DRV — [2008.04.14 22:07:38 | 000,030,208 | —- | M] (Корпорация Майкрософт) [Kernel | On_Demand | Stopped] — C:WINDOWSSystem32driversmodem.sys — (Modem)
DRV — [2008.04.14 01:30:04 | 000,225,664 | —- | M] (Microsoft Corporation) [Kernel | System | Running] — C:WINDOWSsystem32driverstcpip6.sys — (Tcpip6) Драйвер протокола IPv6 (Microsoft)
DRV — [2008.04.13 23:06:06 | 000,144,384 | —- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] — C:WINDOWSsystem32drivershdaudbus.sys — (HDAudBus)
DRV — [2007.11.08 19:44:52 | 001,112,832 | —- | M] (Aktiv Co.) [Kernel | On_Demand | Running] — C:WINDOWSsystem32driversgrdusb.sys — (GrdUsb)
DRV — [2007.11.08 19:44:46 | 001,189,888 | —- | M] (Aktiv Co.) [Kernel | On_Demand | Running] — C:WINDOWSsystem32driversgrdkey.sys — (GrdKey)
DRV — [2007.08.07 13:40:38 | 000,098,944 | R— | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] — C:WINDOWSsystem32driversRtenicxp.sys — (RTLE8023xp)
DRV — [2007.08.06 13:00:00 | 000,072,704 | —- | M] (WIBU-SYSTEMS AG) [Kernel | Auto | Running] — C:WINDOWSsystem32driversWibuKey.sys — (WIBUKEY)
DRV — [2007.07.18 15:26:04 | 004,547,584 | R— | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] — C:WINDOWSsystem32driversRtkHDAud.sys — (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV — [2007.06.13 19:47:12 | 000,048,256 | R— | M] (JMicron Technology Corp.) [Kernel | Boot | Running] — C:WINDOWSsystem32DRIVERSjraid.sys — (JRAID)
DRV — [2006.12.26 16:54:35 | 000,034,760 | —- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] — C:WINDOWSsystem32driversElbyCDFL.sys — (ElbyCDFL)
DRV — [2006.03.13 16:50:08 | 000,085,696 | R— | M] (MCCI) [Kernel | On_Demand | Stopped] — C:WINDOWSsystem32driversw300obex.sys — (w300obex)
DRV — [2006.03.13 16:50:06 | 000,087,824 | R— | M] (MCCI) [Kernel | On_Demand | Stopped] — C:WINDOWSsystem32driversw300mgmt.sys — (w300mgmt) Sony Ericsson W300 USB WMC Device Management Drivers (WDM)
DRV — [2006.03.13 16:50:02 | 000,096,352 | R— | M] (MCCI) [Kernel | On_Demand | Stopped] — C:WINDOWSsystem32driversw300mdm.sys — (w300mdm)
DRV — [2006.03.13 16:50:00 | 000,009,264 | R— | M] (MCCI) [Kernel | On_Demand | Stopped] — C:WINDOWSsystem32driversw300mdfl.sys — (w300mdfl)
DRV — [2006.03.13 16:49:54 | 000,060,800 | R— | M] (MCCI) [Kernel | On_Demand | Stopped] — C:WINDOWSsystem32driversw300bus.sys — (w300bus) Sony Ericsson W300 Driver driver (WDM)
DRV — [2005.09.29 21:01:51 | 000,066,048 | —- | M] (Protection Technology) [Kernel | Boot | Running] — C:WINDOWSSystem32driverssfvfs02.sys — (sfvfs02) StarForce Protection VFS Driver (version 2.x)
DRV — [2005.08.10 18:06:28 | 000,019,968 | —- | M] (Protection Technology) [Kernel | Boot | Running] — C:WINDOWSSystem32driverssfsync02.sys — (sfsync02) StarForce Protection Synchronization Driver (version 2.x)
DRV — [2005.08.10 16:44:04 | 000,050,688 | —- | M] (Protection Technology) [Kernel | Boot | Running] — C:WINDOWSSystem32driverssfdrv01.sys — (sfdrv01) StarForce Protection Environment Driver (version 1.x)
DRV — [2005.05.16 17:20:39 | 000,006,656 | —- | M] (Protection Technology) [Kernel | Boot | Running] — C:WINDOWSSystem32driverssfhlp02.sys — (sfhlp02) StarForce Protection Helper Driver (version 2.x)
DRV — [2001.10.20 16:00:00 | 000,125,440 | —- | M] (Корпорация Майкрософт) [Kernel | Boot | Running] — C:WINDOWSsystem32DRIVERSftdisk.sys — (Ftdisk)
DRV — [2001.10.20 16:00:00 | 000,011,776 | —- | M] (Корпорация Майкрософт) [Kernel | Disabled | Stopped] — C:WINDOWSSystem32driversacpiec.sys — (ACPIEC)
DRV — [2001.10.20 16:00:00 | 000,006,912 | —- | M] (Корпорация Майкрософт) [Kernel | Auto | Running] — C:WINDOWSSystem32driversparvdm.sys — (ParVdm)
DRV — [2001.10.19 20:33:10 | 000,012,160 | —- | M] (Корпорация Майкрософт) [Kernel | On_Demand | Running] — C:WINDOWSsystem32driversmouhid.sys — (mouhid)
DRV — [2001.10.19 20:32:14 | 000,003,328 | —- | M] (Корпорация Майкрософт) [Kernel | Boot | Running] — C:WINDOWSsystem32DRIVERSpciide.sys — (PCIIde)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE — HKLMSOFTWAREMicrosoftInternet ExplorerMain,Local Page = %SystemRoot%system32blank.htm
IE — HKLMSOFTWAREMicrosoftInternet ExplorerMain,Start Page = about:blank
IE — HKLMSOFTWAREMicrosoftInternet ExplorerSearch,Default_Search_URL = http://www.google.com/ie

IE — HKU.DEFAULT..URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} — C:Program FilesYahoo!CompanionInstallscpnyt.dll File not found
IE — HKU.DEFAULTSoftwareMicrosoftWindowsCurrentVersionInternet Settings: «ProxyEnable» = 0

IE — HKUS-1-5-18..URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} — C:Program FilesYahoo!CompanionInstallscpnyt.dll File not found
IE — HKUS-1-5-18SoftwareMicrosoftWindowsCurrentVersionInternet Settings: «ProxyEnable» = 0

IE — HKUS-1-5-21-1454471165-1715567821-839522115-500SOFTWAREMicrosoftInternet ExplorerMain,Default_Search_URL = http://search.qip.ru
IE — HKUS-1-5-21-1454471165-1715567821-839522115-500SOFTWAREMicrosoftInternet ExplorerMain,Start Page = http://www.yandex.ru/
IE — HKUS-1-5-21-1454471165-1715567821-839522115-500SOFTWAREMicrosoftInternet ExplorerSearch,SearchAssistant = http://search.qip.ru/ie
IE — HKUS-1-5-21-1454471165-1715567821-839522115-500..URLSearchHook: — C:Program FilesWebMoneyKeeperID.exe (ЗАО «Вычислительные силы»)
IE — HKUS-1-5-21-1454471165-1715567821-839522115-500..URLSearchHook: {24cc1362-11c6-4918-a2c0-b9ee5a563185} — C:Program FilesArchiBartbArc0.dll (Conduit Ltd.)
IE — HKUS-1-5-21-1454471165-1715567821-839522115-500..URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} — C:Program FilesICQ6ToolbarICQToolBar.dll (ICQ)
IE — HKUS-1-5-21-1454471165-1715567821-839522115-500..URLSearchHook: {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} — C:Documents and SettingsАдминистраторApplication DataMicrosoftInternet Explorerqipsearchbar.dll (qip.ru)
IE — HKUS-1-5-21-1454471165-1715567821-839522115-500..URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} — C:WINDOWSsystem32shdocvw.dll (Корпорация Майкрософт)
IE — HKUS-1-5-21-1454471165-1715567821-839522115-500..URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} — C:Program FilesYahoo!CompanionInstallscpnyt.dll File not found
IE — HKUS-1-5-21-1454471165-1715567821-839522115-500SoftwareMicrosoftWindowsCurrentVersionInternet Settings: «ProxyEnable» = 0
IE — HKUS-1-5-21-1454471165-1715567821-839522115-500SoftwareMicrosoftWindowsCurrentVersionInternet Settings: «ProxyServer» = ftp=localhost:8118;gopher=localhost:8118;http=localhost:8118;https=localhost:8118;socks=localhost:9050

========== FireFox ==========

FF — prefs.js..browser.search.defaultengine: «Ask.com»
FF — prefs.js..browser.search.defaultenginename: «QIP Search»
FF — prefs.js..browser.search.defaulturl: «http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=»
FF — prefs.js..browser.search.order.1: «Ask.com»
FF — prefs.js..browser.search.selectedEngine: «QIP Search»
FF — prefs.js..browser.search.useDBForOrder: true
FF — prefs.js..browser.startup.homepage: «http://www.yandex.ru/?clid=46751»
FF — prefs.js..extensions.enabledItems: {32a1fd71-835e-4b11-8e54-886fda0b4c89}:1.1
FF — prefs.js..keyword.URL: «http://search.qip.ru/search?from=FF&query=»
FF — prefs.js..network.proxy.type: 4

FF — HKLMsoftwaremozillaMozilla Firefox 3.6.8extensions\Components: C:Program FilesMozilla Firefoxcomponents [2010.08.30 15:33:26 | 000,000,000 | —D | M]
FF — HKLMsoftwaremozillaMozilla Firefox 3.6.8extensions\Plugins: C:Program FilesMozilla Firefoxplugins [2010.08.30 15:33:26 | 000,000,000 | —D | M]

[2009.03.23 19:22:44 | 000,000,000 | —D | M] — C:Documents and SettingsАдминистраторApplication DataMozillaExtensions
[2010.09.21 19:09:06 | 000,000,000 | —D | M] — C:Documents and SettingsАдминистраторApplication DataMozillaFirefoxProfilesedigljq4.defaultextensions
[2010.03.15 19:23:03 | 000,000,000 | —D | M] (QipAuthorizer) — C:Documents and SettingsАдминистраторApplication DataMozillaFirefoxProfilesedigljq4.defaultextensions{32a1fd71-835e-4b11-8e54-886fda0b4c89}
[2010.09.19 00:52:57 | 000,000,000 | —D | M] — C:Documents and SettingsАдминистраторApplication DataMozillaFirefoxProfilesedigljq4.defaultextensionsyasearch@yandex.ru
[2010.09.19 00:52:57 | 000,000,000 | —D | M] — C:Documents and SettingsАдминистраторApplication DataMozillaFirefoxProfilesedigljq4.defaultextensionsyasearch@yandex.ruchromeskinextensions-hacks
[2010.01.15 19:46:21 | 000,002,255 | —- | M] () — C:Documents and SettingsАдминистраторApplication DataMozillaFirefoxProfilesedigljq4.defaultsearchpluginsaskcom.xml
[2009.10.25 21:50:05 | 000,002,921 | —- | M] () — C:Documents and SettingsАдминистраторApplication DataMozillaFirefoxProfilesedigljq4.defaultsearchpluginsdaemon-search.xml
[2010.08.09 18:11:53 | 000,002,062 | —- | M] () — C:Documents and SettingsАдминистраторApplication DataMozillaFirefoxProfilesedigljq4.defaultsearchpluginsqip-search.xml
[2010.09.21 19:09:06 | 000,000,000 | —D | M] — C:Program FilesMozilla Firefoxextensions
[2009.01.25 18:47:31 | 000,000,000 | —D | M] (Google Toolbar for Firefox) — C:Program FilesMozilla Firefoxextensions{3112ca9c-de6d-4884-a869-9855de68056c}
[2010.07.23 04:33:22 | 000,001,122 | —- | M] () — C:Program FilesMozilla Firefoxsearchpluginspriceru.xml
[2010.07.23 04:33:22 | 000,002,395 | —- | M] () — C:Program FilesMozilla Firefoxsearchpluginsrambler.xml
[2010.07.23 04:33:22 | 000,001,945 | —- | M] () — C:Program FilesMozilla Firefoxsearchpluginstorgmailru.xml
[2010.07.23 04:33:22 | 000,001,304 | —- | M] () — C:Program FilesMozilla Firefoxsearchpluginswikipedia-ru.xml
[2010.07.23 04:33:22 | 000,001,384 | —- | M] () — C:Program FilesMozilla Firefoxsearchpluginsyandex-slovari.xml
[2010.07.23 04:33:22 | 000,001,495 | —- | M] () — C:Program FilesMozilla Firefoxsearchpluginsyandex.xml

O1 HOSTS File: ([2010.09.19 15:02:16 | 000,000,027 | —- | M]) — C:WINDOWSsystem32driversetchosts
O1 — Hosts: 127.0.0.1 localhost
O2 — BHO: (&Yahoo! Toolbar Helper) — {02478D38-C3F9-4efb-9B51-7695ECA05670} — C:Program FilesYahoo!CompanionInstallscpnyt.dll File not found
O2 — BHO: (ArchiBar Toolbar) — {24cc1362-11c6-4918-a2c0-b9ee5a563185} — C:Program FilesArchiBartbArc0.dll (Conduit Ltd.)
O2 — BHO: (FGCatchUrl) — {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} — C:Program FilesFlashGetjccatch.dll (http://www.flashget.com)
O2 — BHO: (QIPBHO Class) — {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} — C:Documents and SettingsАдминистраторApplication DataMicrosoftInternet Explorerqipsearchbar.dll (qip.ru)
O2 — BHO: (Google Toolbar Helper) — {AA58ED58-01DD-4d91-8333-CF10577473F7} — C:Program FilesGoogleGoogle ToolbarGoogleToolbar_32.dll (Google Inc.)
O2 — BHO: (Google Toolbar Notifier BHO) — {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} — C:Program FilesGoogleGoogleToolbarNotifier5.6.5627.1104swg.dll (Google Inc.)
O2 — BHO: (Ask Toolbar) — {D4027C7F-154A-4066-A1AD-4243D8127440} — C:Program FilesAsk.comGenericAskToolbar.dll (Ask.com)
O3 — HKLM..Toolbar: (Google Toolbar) — {2318C2B1-4965-11d4-9B18-009027A5CD4F} — C:Program FilesGoogleGoogle ToolbarGoogleToolbar_32.dll (Google Inc.)
O3 — HKLM..Toolbar: (ArchiBar Toolbar) — {24cc1362-11c6-4918-a2c0-b9ee5a563185} — C:Program FilesArchiBartbArc0.dll (Conduit Ltd.)
O3 — HKLM..Toolbar: (ICQToolBar) — {855F3B16-6D32-4fe6-8A56-BBB695989046} — C:Program FilesICQ6ToolbarICQToolBar.dll (ICQ)
O3 — HKLM..Toolbar: (Яндекс.Бар) — {91397D20-1446-11D4-8AF4-0040CA1127B6} — C:Program FilesYandexYandexBarIEyndbar.dll (ООО «ЯНДЕКС»)
O3 — HKLM..Toolbar: (Ask Toolbar) — {D4027C7F-154A-4066-A1AD-4243D8127440} — C:Program FilesAsk.comGenericAskToolbar.dll (Ask.com)
O3 — HKLM..Toolbar: (Yahoo! Toolbar) — {EF99BD32-C1FB-11D2-892F-0090271D4F88} — C:Program FilesYahoo!CompanionInstallscpnyt.dll File not found
O3 — HKUS-1-5-21-1454471165-1715567821-839522115-500..ToolbarShellBrowser: (&Адрес) — {01E04581-4EEE-11D0-BFE9-00AA005B4383} — C:WINDOWSsystem32browseui.dll (Корпорация Майкрософт)
O3 — HKUS-1-5-21-1454471165-1715567821-839522115-500..ToolbarShellBrowser: (Google Toolbar) — {2318C2B1-4965-11D4-9B18-009027A5CD4F} — C:Program FilesGoogleGoogle ToolbarGoogleToolbar_32.dll (Google Inc.)
O3 — HKUS-1-5-21-1454471165-1715567821-839522115-500..ToolbarShellBrowser: (ArchiBar Toolbar) — {24CC1362-11C6-4918-A2C0-B9EE5A563185} — C:Program FilesArchiBartbArc0.dll (Conduit Ltd.)
O3 — HKUS-1-5-21-1454471165-1715567821-839522115-500..ToolbarWebBrowser: (&Адрес) — {01E04581-4EEE-11D0-BFE9-00AA005B4383} — C:WINDOWSsystem32browseui.dll (Корпорация Майкрософт)
O3 — HKUS-1-5-21-1454471165-1715567821-839522115-500..ToolbarWebBrowser: (&Ссылки) — {0E5CBF21-D15F-11D0-8301-00AA005B4383} — C:WINDOWSsystem32shell32.dll (Корпорация Майкрософт)
O3 — HKUS-1-5-21-1454471165-1715567821-839522115-500..ToolbarWebBrowser: (Google Toolbar) — {2318C2B1-4965-11D4-9B18-009027A5CD4F} — C:Program FilesGoogleGoogle ToolbarGoogleToolbar_32.dll (Google Inc.)
O3 — HKUS-1-5-21-1454471165-1715567821-839522115-500..ToolbarWebBrowser: (ArchiBar Toolbar) — {24CC1362-11C6-4918-A2C0-B9EE5A563185} — C:Program FilesArchiBartbArc0.dll (Conduit Ltd.)
O3 — HKUS-1-5-21-1454471165-1715567821-839522115-500..ToolbarWebBrowser: (Панель &Crawler) — {4B3803EA-5230-4DC3-A7FC-33638F3D3542} — C:PROGRA~1Crawlerctbr.dll File not found
O3 — HKUS-1-5-21-1454471165-1715567821-839522115-500..ToolbarWebBrowser: (Яндекс.Бар) — {91397D20-1446-11D4-8AF4-0040CA1127B6} — C:Program FilesYandexYandexBarIEyndbar.dll (ООО «ЯНДЕКС»)
O3 — HKUS-1-5-21-1454471165-1715567821-839522115-500..ToolbarWebBrowser: (Ask Toolbar) — {D4027C7F-154A-4066-A1AD-4243D8127440} — C:Program FilesAsk.comGenericAskToolbar.dll (Ask.com)
O3 — HKUS-1-5-21-1454471165-1715567821-839522115-500..ToolbarWebBrowser: (Yahoo! Toolbar) — {EF99BD32-C1FB-11D2-892F-0090271D4F88} — C:Program FilesYahoo!CompanionInstallscpnyt.dll File not found
O4 — HKLM..Run: [avast5] C:Program FilesAlwil SoftwareAvast5avastUI.exe (AVAST Software)
O4 — HKLM..Run: [NvCplDaemon] C:WINDOWSSystem32NvCpl.DLL (NVIDIA Corporation)
O4 — HKUS-1-5-21-1454471165-1715567821-839522115-500..Run: [eyeBeam SIP Client] C:Program FilesCounterPathX-Litex-lite.exe ()
O4 — HKUS-1-5-21-1454471165-1715567821-839522115-500..Run: [uTorrent] C:Program FilesuTorrentuTorrent.exe (BitTorrent, Inc.)
O6 — HKLMSoftwarePoliciesMicrosoftInternet ExplorerLow Rights present
O6 — HKLMSoftwarePoliciesMicrosoftInternet ExplorerRestrictions present
O6 — HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoDriveAutoRun = 67108863
O6 — HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoDriveTypeAutoRun = 323
O6 — HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoDrives = 0
O7 — HKU.DEFAULTSoftwarePoliciesMicrosoftInternet ExplorerControl Panel present
O7 — HKU.DEFAULTSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoDriveTypeAutoRun = 323
O7 — HKU.DEFAULTSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoDriveAutoRun = 67108863
O7 — HKUS-1-5-18SoftwarePoliciesMicrosoftInternet ExplorerControl Panel present
O7 — HKUS-1-5-18SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoDriveTypeAutoRun = 323
O7 — HKUS-1-5-18SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoDriveAutoRun = 67108863
O7 — HKUS-1-5-19SoftwarePoliciesMicrosoftInternet ExplorerControl Panel present
O7 — HKUS-1-5-19SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoDriveTypeAutoRun = 145
O7 — HKUS-1-5-20SoftwarePoliciesMicrosoftInternet ExplorerControl Panel present
O7 — HKUS-1-5-20SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoDriveTypeAutoRun = 145
O7 — HKUS-1-5-21-1454471165-1715567821-839522115-500SoftwarePoliciesMicrosoftInternet ExplorerControl Panel present
O7 — HKUS-1-5-21-1454471165-1715567821-839522115-500SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoDriveAutoRun = 67108863
O7 — HKUS-1-5-21-1454471165-1715567821-839522115-500SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoDriveTypeAutoRun = 323
O7 — HKUS-1-5-21-1454471165-1715567821-839522115-500SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoDrives = 0
O8 — Extra context menu item: &Закачать все при помощи FlashGet — C:Program FilesFlashGetJC_ALL.HTM ()
O8 — Extra context menu item: &Закачать при помощи FlashGet — C:Program FilesFlashGetJC_LINK.HTM ()
O8 — Extra context menu item: Google ВикиКомментарии… — C:Program FilesGoogleGoogle ToolbarComponentGoogleToolbarDynamic_mui_en_2D06158FAC79A790.dll (Google Inc.)
O9 — Extra ‘Tools’ menuitem : Sun Java Console — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0binnpjpi160.dll (Sun Microsystems, Inc.)
O9 — Extra Button: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe (Mail.Ru)
O9 — Extra ‘Tools’ menuitem : Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe (Mail.Ru)
O9 — Extra Button: FlashGet — {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} — C:Program FilesFlashGetflashget.exe (FlashGet.com)
O9 — Extra ‘Tools’ menuitem : FlashGet — {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} — C:Program FilesFlashGetflashget.exe (FlashGet.com)
O10 — NameSpace_Catalog5Catalog_Entries00000000001 [] — C:WINDOWSsystem32mswsock.dll (Корпорация Майкрософт)
O10 — NameSpace_Catalog5Catalog_Entries00000000003 [] — C:WINDOWSsystem32mswsock.dll (Корпорация Майкрософт)
O10 — Protocol_Catalog9Catalog_Entries00000000001 — C:WINDOWSsystem32mswsock.dll (Корпорация Майкрософт)
O10 — Protocol_Catalog9Catalog_Entries00000000002 — C:WINDOWSsystem32mswsock.dll (Корпорация Майкрософт)
O10 — Protocol_Catalog9Catalog_Entries00000000003 — C:WINDOWSsystem32mswsock.dll (Корпорация Майкрософт)
O10 — Protocol_Catalog9Catalog_Entries00000000006 — C:WINDOWSsystem32mswsock.dll (Корпорация Майкрософт)
O10 — Protocol_Catalog9Catalog_Entries00000000007 — C:WINDOWSsystem32mswsock.dll (Корпорация Майкрософт)
O10 — Protocol_Catalog9Catalog_Entries00000000008 — C:WINDOWSsystem32mswsock.dll (Корпорация Майкрософт)
O10 — Protocol_Catalog9Catalog_Entries00000000009 — C:WINDOWSsystem32mswsock.dll (Корпорация Майкрософт)
O10 — Protocol_Catalog9Catalog_Entries00000000010 — C:WINDOWSsystem32mswsock.dll (Корпорация Майкрософт)
O10 — Protocol_Catalog9Catalog_Entries00000000011 — C:WINDOWSsystem32mswsock.dll (Корпорация Майкрософт)
O10 — Protocol_Catalog9Catalog_Entries00000000012 — C:WINDOWSsystem32mswsock.dll (Корпорация Майкрософт)
O10 — Protocol_Catalog9Catalog_Entries00000000013 — C:WINDOWSsystem32mswsock.dll (Корпорация Майкрософт)
O10 — Protocol_Catalog9Catalog_Entries00000000014 — C:WINDOWSsystem32mswsock.dll (Корпорация Майкрософт)
O10 — Protocol_Catalog9Catalog_Entries00000000015 — C:WINDOWSsystem32mswsock.dll (Корпорация Майкрософт)
O10 — Protocol_Catalog9Catalog_Entries00000000016 — C:WINDOWSsystem32mswsock.dll (Корпорация Майкрософт)
O10 — Protocol_Catalog9Catalog_Entries00000000017 — C:WINDOWSsystem32mswsock.dll (Корпорация Майкрософт)
O10 — Protocol_Catalog9Catalog_Entries00000000018 — C:WINDOWSsystem32mswsock.dll (Корпорация Майкрософт)
O10 — Protocol_Catalog9Catalog_Entries00000000019 — C:WINDOWSsystem32mswsock.dll (Корпорация Майкрософт)
O10 — Protocol_Catalog9Catalog_Entries00000000020 — C:WINDOWSsystem32mswsock.dll (Корпорация Майкрософт)
O10 — Protocol_Catalog9Catalog_Entries00000000021 — C:WINDOWSsystem32mswsock.dll (Корпорация Майкрософт)
O10 — Protocol_Catalog9Catalog_Entries00000000022 — C:WINDOWSsystem32mswsock.dll (Корпорация Майкрософт)
O10 — Protocol_Catalog9Catalog_Entries00000000023 — C:WINDOWSsystem32mswsock.dll (Корпорация Майкрософт)
O10 — Protocol_Catalog9Catalog_Entries00000000024 — C:WINDOWSsystem32mswsock.dll (Корпорация Майкрософт)
O12 — Plugin for: .spop — C:Program FilesInternet ExplorerPLUGINSNPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O16 — DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab (System Requirements Lab Class)
O16 — DPF: {5727FF4C-EF4E-4d96-A96C-03AD91910448} http://www.srtest.com/srl_bin/sysreqlab_ind.cab (System Requirements Lab Class)
O16 — DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab (BDSCANONLINE Control)
O16 — DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1233239283453 (WUWebControl Class)
O16 — DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Java Plug-in 1.6.0)
O16 — DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 — DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab (ActiveScan 2.0 Installer Class)
O16 — DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Java Plug-in 1.6.0)
O16 — DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Java Plug-in 1.6.0)
O18 — ProtocolHandlerabout {3050F406-98B5-11CF-BB82-00AA00BDCE0B} — C:WINDOWSsystem32mshtml.dll (Корпорация Майкрософт)
O18 — ProtocolHandlercdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} — C:WINDOWSsystem32urlmon.dll (Корпорация Майкрософт)
O18 — ProtocolHandlerdvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} — C:WINDOWSsystem32msvidctl.dll (Корпорация Майкрософт)
O18 — ProtocolHandlerfile {79eac9e7-baf9-11ce-8c82-00aa004ba90b} — C:WINDOWSsystem32urlmon.dll (Корпорация Майкрософт)
O18 — ProtocolHandlerftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} — C:WINDOWSsystem32urlmon.dll (Корпорация Майкрософт)
O18 — ProtocolHandlergopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} — C:WINDOWSsystem32urlmon.dll (Корпорация Майкрософт)
O18 — ProtocolHandlerhttp {79eac9e2-baf9-11ce-8c82-00aa004ba90b} — C:WINDOWSsystem32urlmon.dll (Корпорация Майкрософт)
O18 — ProtocolHandlerhttps {79eac9e5-baf9-11ce-8c82-00aa004ba90b} — C:WINDOWSsystem32urlmon.dll (Корпорация Майкрософт)
O18 — ProtocolHandlerjavascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} — C:WINDOWSsystem32mshtml.dll (Корпорация Майкрософт)
O18 — ProtocolHandlerlocal {79eac9e7-baf9-11ce-8c82-00aa004ba90b} — C:WINDOWSsystem32urlmon.dll (Корпорация Майкрософт)
O18 — ProtocolHandlermailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} — C:WINDOWSsystem32mshtml.dll (Корпорация Майкрософт)
O18 — ProtocolHandlermk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} — C:WINDOWSsystem32urlmon.dll (Корпорация Майкрософт)
O18 — ProtocolHandlerres {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} — C:WINDOWSsystem32mshtml.dll (Корпорация Майкрософт)
O18 — ProtocolHandlerskype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} — C:Program FilesCommon FilesSkypeSkype4COM.dll (Skype Technologies)
O18 — ProtocolHandlersysimage {76E67A63-06E9-11D2-A840-006008059382} — C:WINDOWSsystem32mshtml.dll (Корпорация Майкрософт)
O18 — ProtocolHandlertbr {4D25FB7A-8902-4291-960E-9ADA051CFBBF} — C:PROGRA~1Crawlerctbr.dll File not found
O18 — ProtocolHandlertv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} — C:WINDOWSsystem32msvidctl.dll (Корпорация Майкрософт)
O18 — ProtocolHandlervbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} — C:WINDOWSsystem32mshtml.dll (Корпорация Майкрософт)
O18 — ProtocolFilterClass Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} — C:WINDOWSsystem32urlmon.dll (Корпорация Майкрософт)
O18 — ProtocolFilterdeflate {8f6b0360-b80d-11d0-a9b3-006097942311} — C:WINDOWSsystem32urlmon.dll (Корпорация Майкрософт)
O18 — ProtocolFiltergzip {8f6b0360-b80d-11d0-a9b3-006097942311} — C:WINDOWSsystem32urlmon.dll (Корпорация Майкрософт)
O18 — ProtocolFilterlzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} — C:WINDOWSsystem32urlmon.dll (Корпорация Майкрософт)
O18 — ProtocolFiltertext/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} — C:WINDOWSsystem32shell32.dll (Корпорация Майкрософт)
O20 — HKLM Winlogon: Shell — (Explorer.exe) — C:WINDOWSexplorer.exe (Корпорация Майкрософт)
O20 — HKLM Winlogon: UserInit — (C:WINDOWSsystem32userinit.exe) — C:WINDOWSsystem32userinit.exe (Корпорация Майкрософт)
O20 — HKLM Winlogon: UIHost — (logonui.exe) — C:WINDOWSSystem32logonui.exe (Корпорация Майкрософт)
O20 — HKLM Winlogon: VMApplet — (rundll32 shell32) — C:WINDOWSSystem32shell32.dll (Корпорация Майкрософт)
O20 — HKLM Winlogon: VMApplet — (Control_RunDLL «sysdm.cpl») — C:WINDOWSSystem32sysdm.cpl (Корпорация Майкрософт)
O20 — WinlogonNotifycrypt32chain: DllName — crypt32.dll — C:WINDOWSSystem32crypt32.dll (Корпорация Майкрософт)
O20 — WinlogonNotifycscdll: DllName — cscdll.dll — C:WINDOWSSystem32cscdll.dll (Корпорация Майкрософт)
O20 — WinlogonNotifyScCertProp: DllName — wlnotify.dll — C:WINDOWSSystem32wlnotify.dll (Корпорация Майкрософт)
O20 — WinlogonNotifySchedule: DllName — wlnotify.dll — C:WINDOWSSystem32wlnotify.dll (Корпорация Майкрософт)
O20 — WinlogonNotifysclgntfy: DllName — sclgntfy.dll — C:WINDOWSSystem32sclgntfy.dll (Корпорация Майкрософт)
O20 — WinlogonNotifySensLogn: DllName — WlNotify.dll — C:WINDOWSSystem32wlnotify.dll (Корпорация Майкрософт)
O20 — WinlogonNotifytermsrv: DllName — wlnotify.dll — C:WINDOWSSystem32wlnotify.dll (Корпорация Майкрософт)
O20 — WinlogonNotifywlballoon: DllName — wlnotify.dll — C:WINDOWSSystem32wlnotify.dll (Корпорация Майкрософт)
O21 — SSODL: CDBurn — {fbeb8a05-beee-4442-804e-409d6c4515e9} — C:WINDOWSsystem32shell32.dll (Корпорация Майкрософт)
O21 — SSODL: PostBootReminder — {7849596a-48ea-486e-8937-a2a3009f31a9} — C:WINDOWSsystem32shell32.dll (Корпорация Майкрософт)
O21 — SSODL: SysTray — {35CEC8A3-2BE6-11D2-8773-92E220524153} — C:WINDOWSsystem32stobject.dll (Корпорация Майкрософт)
O21 — SSODL: WebCheck — {E6FB5E20-DE35-11CF-9C87-00AA005127ED} — C:WINDOWSsystem32webcheck.dll (Корпорация Майкрософт)
O22 — SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} — Предзагрузчик Browseui — C:WINDOWSsystem32browseui.dll (Корпорация Майкрософт)
O22 — SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} — Демон кэша категорий компонентов — C:WINDOWSsystem32browseui.dll (Корпорация Майкрософт)
O24 — Desktop Components:0 (Моя текущая домашняя страница) — About:Home
O28 — HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} — C:WINDOWSSystem32shell32.dll (Корпорация Майкрософт)
O29 — HKLM SecurityProviders — (digest.dll) — C:WINDOWSSystem32digest.dll (Корпорация Майкрософт)
O29 — HKLM SecurityProviders — (msnsspc.dll) — C:WINDOWSSystem32msnsspc.dll (Корпорация Майкрософт)
O32 — HKLM CDRom: AutoRun — 1
O32 — AutoRun File — [2010.02.28 17:41:37 | 000,000,000 | —D | M] — C:Autodesk — [ NTFS ]
O32 — AutoRun File — [2008.09.30 15:14:23 | 000,000,000 | —- | M] () — C:AUTOEXEC.BAT — [ NTFS ]
O32 — AutoRun File — [2009.01.23 23:26:25 | 000,000,000 | —D | M] — C:autorun.inf — [ NTFS ]
O32 — AutoRun File — [2009.01.23 23:26:25 | 000,000,000 | —D | M] — D:autorun.inf — [ NTFS ]
O34 — HKLM BootExecute: (autocheck autochk *) — File not found
O35 — HKLM..comfile [open] — «%1» %*
O35 — HKLM..exefile [open] — «%1» %*
O37 — HKLM…com [@ = ComFile] — «%1» %*
O37 — HKLM…exe [@ = exefile] — «%1» %*

[Bruce333]

проверила еще работоспособность клавиатуры, в безопасный режим так и не могу выйти, не работает клава
а еще теперь стала клавиатура вообще отключатся через некоторое время после включения компа, хотя лампочка num lock горит, но ни одна кнопка не работает
иногда вылезает сообщение что устройство usb неопознанно (видимо о клаве)
такое было раньше, я думала из-за клавиатуры, но её поменяли и тоже самое, она установки драйверов не требует, сейчас наверное опять отключится…

[Bruce333]

почти все вышеописанные проблемы устранились, кроме обновления Malwarebytes’ Anti-Malware, пишет проверить соединение с интернет, и файрволл (он отключен)
вот лог
ComboFix 10-09-17.04 — Администратор 19.09.2010 14:55:04.1.4 — x86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.2046.1392 [GMT 4:00]
Running from: c:documents and settingsАдминистраторРабочий столComboFix.exe
Command switches used :: c:documents and settingsАдминистраторРабочий столWindowsXP-KB310994-SP2-Pro-BootDisk-RUS.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
ADS — WINDOWS: deleted 48 bytes in 1 streams.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:documents and settingsАдминистраторApplication Datainst.exe
c:documents and settingsАдминистраторLocal SettingsTemporary Internet Filesimoky.vbs
c:documents and settingsАдминистраторLocal SettingsTemporary Internet Fileslysuxuc.com
c:documents and settingsАдминистраторLocal SettingsTemporary Internet Filestyhycid.dat
c:documents and settingsАдминистраторLocal SettingsTemporary Internet Fileszexyq.dat
c:documents and settingsАдминистраторRecentThumbs.db
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr0.dat
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr1.dat
C:feed.txt
c:program filesBPK
c:program filesBPKbpk.dat
c:program filesBPKdt2008-12-12_03-00-05-3066421
c:program filesBPKdt2008-12-12_03-05-05-3366406
c:program filesBPKdt2008-12-12_03-10-05-3666406
c:program filesBPKdt2008-12-12_03-15-05-3966406
c:program filesBPKdt2008-12-12_03-20-05-4266406
c:program filesBPKdtth_2008-12-12_03-00-05-3066421
c:program filesBPKdtth_2008-12-12_03-05-05-3366406
c:program filesBPKdtth_2008-12-12_03-10-05-3666406
c:program filesBPKdtth_2008-12-12_03-15-05-3966406
c:program filesBPKdtth_2008-12-12_03-20-05-4266406
c:program filesBPKpk.bin
c:program filesBPKweb.dat
c:program filesFieryAds
c:program filesMail.RuAgentMradllnewmrasearch.dll
c:program filesMyCentria
c:program filesWebMoney Advisor
c:program filesWebMoney Advisor16x16x32b.bmp
c:program filesWebMoney Advisorautosearch_plugin.dll
c:program filesWebMoney Advisorbasis.xml
c:program filesWebMoney Advisorbooble.html
c:program filesWebMoney Advisorfavicon.ico
c:program filesWebMoney Advisorinfo.txt
c:program filesWebMoney AdvisortbHElper.dll
c:program filesWebMoney Advisortbs_include_script_014708.js
c:program filesWebMoney Advisortbs_include_script_wmadvisor.js
c:program filesWebMoney Advisoruninstall.exe
c:program filesWebMoney Advisorversion.txt
c:program filesWebMoney Advisorwmadvisor.crc
c:program filesWebMoney Advisorwmadvisor.dll
c:program filesWebMoney AdvisorWMPlugin.dll
c:windowsdagezyni.dll
c:windowsigudot._sy
c:windowsogijelyli.dll
c:windowsosytycybyz._sy
c:windowssystem32driversnpf.sys
c:windowssystem32driverswdreg.exe
c:windowssystem32mxpvct22.dat
c:windowssystem32mxpvct25.dat
c:windowssystem32Packet.dll
c:windowssystem32pthreadVC.dll
c:windowssystem32WanPacket.dll
c:windowssystem32wpcap.dll
c:windowswiaservb.log
c:windowsysebeceneg._sy

---

BITS: Possible infected sites

---

hxxp://soft.export.yandex.ru
hxxp://download.yandex.ru
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

---

Legacy_NPF

---

Legacy_TDSSSERV.SYS

---

Service_NPF

---

Legacy_Winpcap

---

Service_Winpcap

((((((((((((((((((((((((( Files Created from 2010-08-19 to 2010-09-19 )))))))))))))))))))))))))))))))
.

2010-09-19 09:00 . 2010-09-19 09:00 161296 —-a-w- c:windowssystem32driverstmcomm.sys
2010-09-19 08:31 . 2010-09-19 08:31 388096 —-a-r- c:documents and settingsАдминистраторApplication DataMicrosoftInstaller{45A66726-69BC-466B-A7A4-12FCBA4883D7}HiJackThis.exe
2010-09-18 17:17 . 2010-09-07 14:52 165584 —-a-w- c:windowssystem32driversaswSP.sys
2010-09-18 17:17 . 2010-09-07 14:47 17744 —-a-w- c:windowssystem32driversaswFsBlk.sys
2010-09-18 17:17 . 2010-09-07 14:47 23376 —-a-w- c:windowssystem32driversaswRdr.sys
2010-09-18 17:17 . 2010-09-07 14:52 46672 —-a-w- c:windowssystem32driversaswTdi.sys
2010-09-18 17:17 . 2010-09-07 14:47 100176 —-a-w- c:windowssystem32driversaswmon2.sys
2010-09-18 17:17 . 2010-09-07 14:47 94544 —-a-w- c:windowssystem32driversaswmon.sys
2010-09-18 17:17 . 2010-09-07 14:46 28880 —-a-w- c:windowssystem32driversaavmker4.sys
2010-09-18 17:17 . 2010-09-07 15:12 38848 —-a-w- c:windowsavastSS.scr
2010-09-18 17:17 . 2010-09-07 15:11 167592 —-a-w- c:windowssystem32aswBoot.exe
2010-09-18 13:49 . 2010-09-18 13:49

---

d

---

w- c:program filesCommon Filesa8f9db59
2010-09-18 11:53 . 2009-06-30 05:37 28552 —-a-w- c:windowssystem32driverspavboot.sys
2010-09-18 11:53 . 2010-09-18 11:53

---

d

---

w- c:program filesPanda Security
2010-09-18 08:50 . 2010-09-19 09:51

---

d

---

w- c:windowsBDOSCAN8
2010-09-17 18:44 . 2010-09-17 18:44

---

d

---

w- c:documents and settingsNetworkServiceLocal SettingsApplication DataGoogle
2010-09-17 18:39 . 2010-09-17 18:39

---

d

---

w- c:documents and settingsLocalServiceLocal SettingsApplication DataGoogle
2010-09-13 13:35 . 2010-09-13 13:35

---

d

---

w- c:documents and settingsAll UsersApplication DataAlwil Software
2010-09-09 08:57 . 2007-11-15 08:20 225280 —-a-w- c:windowssystem32grddrv.dll
2010-09-07 10:52 . 2010-09-07 10:52

---

d

---

w- c:program filesCommon FilesGuardant
2010-09-07 10:52 . 2008-06-17 10:59 2081792 —-a-w- c:windowssystem32driversd348prt.sys
2010-09-07 10:50 . 2010-09-07 10:50

---

d

---

w- c:program filesGrand
2010-08-30 11:40 . 2010-08-30 11:40

---

d

---

w- c:documents and settingsAll UsersApplication DataMcAfee
2010-08-27 06:10 . 2010-08-27 06:10

---

d

---

w- c:documents and settingsAll UsersApplication DataCounterPath
2010-08-26 13:44 . 2010-08-26 13:44

---

d

---

w- c:documents and settingsАдминистраторLocal SettingsApplication DataCounterPath
2010-08-26 13:42 . 2010-08-26 13:42

---

d

---

w- c:program filesCommon FilesIntel
2010-08-26 13:42 . 2010-08-26 13:42

---

d

---

w- c:program filesCounterPath

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-19 11:03 . 2008-10-31 11:58

---

d

---

w- c:documents and settingsАдминистраторApplication DatauTorrent
2010-09-19 10:33 . 2010-09-16 22:11 87484 —-a-w- c:program filesCommon Filesjqyrg4inedzz13m
2010-09-19 09:32 . 2009-01-21 19:12

---

d

---

w- c:program filestrend micro
2010-09-18 20:52 . 2010-07-13 07:57

---

d

---

w- c:documents and settingsАдминистраторApplication DataYandex
2010-09-18 20:52 . 2010-07-13 07:57

---

d

---

w- c:program filesYandex
2010-09-18 13:13 . 2008-09-30 19:52

---

d

---

w- c:documents and settingsAll UsersApplication DataKaspersky Lab Setup Files
2010-09-17 18:39 . 2009-01-25 14:47

---

d

---

w- c:program filesGoogle
2010-09-17 10:24 . 2009-01-29 15:12

---

d

---

w- c:program filesMSECache
2010-09-14 21:30 . 2010-03-01 03:35 612960 —-a-w- c:documents and settingsLocalServiceLocal SettingsApplication DataFontCache3.0.0.0.dat
2010-09-13 18:45 . 2009-03-06 13:03

---

d

---

w- c:program filesAlwil Software
2010-09-09 08:22 . 2010-08-09 14:11

---

d

---

w- c:program filesQIP 2010
2010-09-09 06:01 . 2010-06-10 06:27

---

d

---

w- c:documents and settingsАдминистраторApplication Datalicenses
2010-09-08 19:58 . 2009-01-25 13:00

---

d

---

w- c:documents and settingsАдминистраторApplication DataVso
2010-09-08 17:34 . 2010-07-22 20:18 848 —sha-w- c:windowssystem32KGyGaAvL.sys
2010-09-04 14:56 . 2008-10-16 09:34

---

d

---

w- c:documents and settingsАдминистраторApplication DataCanon
2010-09-04 07:30 . 2008-10-31 13:33

---

d

---

w- c:program filesuTorrent
2010-08-26 14:33 . 2009-02-25 10:41

---

d

---

w- c:documents and settingsАдминистраторApplication DataSkype
2010-08-26 14:07 . 2009-02-21 15:05

---

d

---

w- c:documents and settingsАдминистраторApplication DataskypePM
2010-08-23 17:58 . 2008-11-19 10:41

---

d

---

w- c:program filesFlashGet
2010-08-09 13:40 . 2010-03-15 15:23 127440 —-a-w- c:documents and settingsАдминистраторApplication DataMozillaFirefoxProfilesedigljq4.defaultextensions{32a1fd71-835e-4b11-8e54-886fda0b4c89}componentsqippipe.dll
2010-07-29 09:12 . 2008-09-30 11:27 120840 —-a-w- c:documents and settingsАдминистраторLocal SettingsApplication DataGDIPFONTCACHEV1.DAT
2010-07-27 13:56 . 2008-09-30 12:03

---

d

---

w- c:program filesWinamp
2010-07-27 07:32 . 2010-07-27 07:32

---

d

---

w- c:program filesDAEMON Tools Lite
2010-07-01 17:55 . 2010-07-01 17:55 92816 —-a-w- c:documents and settingsAll UsersApplication DataKaspersky Lab Setup FilesKaspersky Anti-Virus 2011 11.0.1.400Russiansetup.exe
2008-11-11 14:30 . 2008-11-11 14:30 19670 —-a-w- c:program filesCommon Fileszexudylum.sys
2008-11-11 14:30 . 2008-11-11 14:30 17210 —-a-w- c:program filesCommon Filesodubejy.dl
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]
«{24cc1362-11c6-4918-a2c0-b9ee5a563185}»= «c:program filesArchiBartbArc0.dll» [2010-08-22 2734688]

[HKEY_CLASSES_ROOTclsid{24cc1362-11c6-4918-a2c0-b9ee5a563185}]

[HKEY_LOCAL_MACHINE~Browser Helper Objects{24cc1362-11c6-4918-a2c0-b9ee5a563185}]
2010-08-22 17:23 2734688 —-a-w- c:program filesArchiBartbArc0.dll

[HKEY_LOCAL_MACHINE~Browser Helper Objects{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-07-10 14:28 1174920 —-a-w- c:program filesAsk.comGenericAskToolbar.dll

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{24cc1362-11c6-4918-a2c0-b9ee5a563185}»= «c:program filesArchiBartbArc0.dll» [2010-08-22 2734688]
«{D4027C7F-154A-4066-A1AD-4243D8127440}»= «c:program filesAsk.comGenericAskToolbar.dll» [2009-07-10 1174920]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2009-03-04 3117856]

[HKEY_CLASSES_ROOTclsid{24cc1362-11c6-4918-a2c0-b9ee5a563185}]

[HKEY_CLASSES_ROOTclsid{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOTGenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOTTypeLib{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOTGenericAskToolbar.ToolbarWnd]

[HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar]

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{24CC1362-11C6-4918-A2C0-B9EE5A563185}»= «c:program filesArchiBartbArc0.dll» [2010-08-22 2734688]
«{D4027C7F-154A-4066-A1AD-4243D8127440}»= «c:program filesAsk.comGenericAskToolbar.dll» [2009-07-10 1174920]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2009-03-04 3117856]

[HKEY_CLASSES_ROOTclsid{24cc1362-11c6-4918-a2c0-b9ee5a563185}]

[HKEY_CLASSES_ROOTclsid{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOTGenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOTTypeLib{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOTGenericAskToolbar.ToolbarWnd]

[HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar]

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«uTorrent»=»c:program filesuTorrentuTorrent.exe» [2010-09-03 328568]
«eyeBeam SIP Client»=»c:program filesCounterPathX-Litex-lite.exe» [2010-01-04 23941120]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«avast5″=»c:program filesAlwil SoftwareAvast5avastUI.exe» [2010-09-07 2838912]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2009-07-14 13877248]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-14 15360]

[HKLM~startupfolderC:^Documents and Settings^All Users^Главное меню^Программы^Автозагрузка^Acrobat Assistant.lnk]
path=c:documents and settingsAll UsersГлавное менюПрограммыАвтозагрузкаAcrobat Assistant.lnk
backup=c:windowspssAcrobat Assistant.lnkCommon Startup

[HKLM~startupfolderC:^Documents and Settings^All Users^Главное меню^Программы^Автозагрузка^Adobe Gamma Loader.lnk]
path=c:documents and settingsAll UsersГлавное менюПрограммыАвтозагрузкаAdobe Gamma Loader.lnk
backup=c:windowspssAdobe Gamma Loader.lnkCommon Startup

[HKLM~startupfolderC:^Documents and Settings^All Users^Главное меню^Программы^Автозагрузка^NaturalColorLoad.lnk]
path=c:documents and settingsAll UsersГлавное менюПрограммыАвтозагрузкаNaturalColorLoad.lnk
backup=c:windowspssNaturalColorLoad.lnkCommon Startup

[HKLM~startupfolderC:^Documents and Settings^All Users^Главное меню^Программы^Автозагрузка^Privoxy.lnk]
path=c:documents and settingsAll UsersГлавное менюПрограммыАвтозагрузкаPrivoxy.lnk
backup=c:windowspssPrivoxy.lnkCommon Startup

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregKernelFaultCheck]
c:windowssystem32dumprep 0 -k [X]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregUserFaultCheck]
c:windowssystem32dumprep 0 -u [X]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupreg36X Raid Configurer]
2007-05-25 06:07 1953792

---

r- c:windowssystem32xRaidSetup.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe Reader Speed Launcher]
2008-01-11 18:16 39792 —-a-w- c:program filesAdobeReader 8.0Readerreader_sl.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobeUpdater]
2008-12-10 05:03 2356088 —-a-w- c:program filesCommon FilesAdobeUpdater5AdobeUpdater.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAlcmtr]
2005-05-03 10:43 69632

---

r- c:windowsAlcmtr.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregBeeline GPRS Explorer]
2007-01-12 16:03 834632 —-a-w- c:program filesBeelineGPRS Explorergprsexpl.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregCloneCDTray]
2006-09-28 19:21 57344 —-a-w- c:program filesSlySoftCloneCDCloneCDTray.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregCTFMON.EXE]
2008-04-14 18:40 15360 —-a-w- c:windowssystem32ctfmon.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregEA Core]
2008-07-22 09:34 2772992 —-a-w- c:program filesElectronic ArtsEADMCore.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregISUSPM Startup]
2005-08-11 12:30 249856 —-a-w- c:program filesCommon FilesInstallShieldUpdateServiceISUSPM.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregISUSScheduler]
2005-08-11 12:30 81920 —-a-w- c:program filesCommon FilesInstallShieldUpdateServiceissch.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregJMB36X IDE Setup]
2007-03-20 06:36 36864

---

r- c:windowsRaidToolxInsIDE.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregMAgent]
2008-12-25 19:06 5597680 —-a-w- c:program filesMail.RuAgentmagent.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregMSMSGS]
2008-04-14 18:41 1695232

---

w- c:program filesMessengermsmsgs.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNeroFilterCheck]
2006-01-12 11:40 155648 —-a-w- c:windowssystem32NeroCheck.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNvCplDaemon]
2009-07-14 09:34 13877248 —-a-w- c:windowssystem32nvcpl.dll

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNvMediaCenter]
2009-07-14 09:34 86016 —-a-w- c:windowssystem32nvmctray.dll

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregnwiz]
2009-07-08 20:03 1657376 —-a-w- c:program filesNVIDIA CorporationnViewnwiz.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregQuickTime Task]
2006-09-01 11:57 282624 —-a-w- c:program filesQuickTimeqttask.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregRTHDCPL]
2007-07-05 08:08 16380416

---

r- c:windowsRTHDCPL.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSony Ericsson PC Suite]
2005-10-26 13:17 159744 —-a-r- c:program filesSony EricssonMobile2Application LauncherApplication Launcher.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSunJavaUpdateSched]
2008-09-30 18:18 77824 —-a-w- c:program filesJavajre1.6.0binjusched.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregswg]
2010-09-17 18:39 39408 —-a-w- c:program filesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregTeleport Scheduler]
2007-11-01 11:05 327680 —-a-w- c:program filesTeleport Proscheduler.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregVidalia]
2009-01-21 02:59 4033618 —-a-w- c:program filesVidalia BundleVidaliavidalia.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregWinampAgent]
2006-10-25 05:37 35328

---

w- c:program filesWinampwinampa.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregwmagent.exe]
2008-10-01 09:45 209376 —-a-w- c:program filesWebMoney Agentwmagent.exe

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\uTorrent\uTorrent.exe»=
«c:\Program Files\Autodesk\Backburner\manager.exe»=
«c:\Program Files\Autodesk\Backburner\server.exe»=
«c:\WINDOWS\system32\PnkBstrA.exe»=
«c:\WINDOWS\system32\PnkBstrB.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«c:\Program Files\Activision\Call of Duty — World at War\CoDWaWmp.exe»=
«c:\Program Files\StrongDC++\StrongDC.exe»=
«c:\Program Files\Autodesk\3ds Max 2009\3dsmax.exe»=
«c:\3dsmax7\3dsmax.exe»=
«c:\Program Files\backburner 2\monitor.exe»=
«c:\Program Files\backburner 2\manager.exe»=
«c:\Program Files\backburner 2\server.exe»=
«c:\Program Files\Autodesk\3ds Max 2010\3dsmax.exe»=
«c:\Program Files\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_32server.exe»=
«c:\Program Files\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_32.exe»=
«c:\Program Files\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe»=
«c:\Program Files\Ubisoft\Tom Clancy’s Splinter Cell Conviction\src\system\conviction_game.exe»=
«c:\Program Files\Ubisoft\Tom Clancy’s Splinter Cell Conviction\src\system\gu.exe»=
«c:\Program Files\Skype\Phone\Skype.exe»=

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«56866:TCP»= 56866:TCP:56866
«1748:UDP»= 1748:UDP:лайк 2
«7264:TCP»= 7264:TCP:лайк
«22529:TCP»= 22529:TCP

R0 pavboot;pavboot;c:windowssystem32driverspavboot.sys [18.09.2010 15:53 28552]
R1 aswSP;aswSP;c:windowssystem32driversaswSP.sys [18.09.2010 21:17 165584]
R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [18.09.2010 21:17 17744]
R2 d348prt;Daemon Tools Bus;c:windowssystem32driversd348prt.sys [07.09.2010 14:52 2081792]
R2 ICQ Service;ICQ Service;c:program filesICQ6ToolbarICQ Service.exe [09.12.2008 15:21 222456]
R2 mi-raysat_3dsMax2009_32;mental ray 3.6 Satellite for Autodesk 3ds Max 2009 32-bit 32-bit;c:program filesAutodesk3ds Max 2009mentalraysatelliteraysat_3dsMax2009_32server.exe [10.03.2008 0:04 65536]
R2 mi-raysat_3dsmax2010_32;mental ray 3.7 Satellite for Autodesk 3ds Max 2010 32-bit 32-bit;c:program filesAutodesk3ds Max 2010mentalraysatelliteraysat_3dsmax2010_32server.exe [12.03.2009 18:36 86016]
R3 GrdKey;Guardant LPT Dongle Service;c:windowssystem32driversgrdkey.sys [08.11.2007 19:44 1189888]
R3 GrdUsb;Guardant USB Dongle Service;c:windowssystem32driversgrdusb.sys [08.11.2007 19:44 1112832]
S2 d348bus;d348bus; [x]
S2 gupdate;Служба Google Update (gupdate);c:program filesGoogleUpdateGoogleUpdate.exe [17.09.2010 22:39 136176]
S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);c:windowssystem32driversw300mgmt.sys [01.10.2008 11:58 87824]
S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;c:windowssystem32driversw300obex.sys [01.10.2008 11:58 85696]
.
Contents of the ‘Scheduled Tasks’ folder

2010-07-22 c:windowsTasksAppleSoftwareUpdate.job
— c:program filesApple Software UpdateSoftwareUpdate.exe [2006-08-29 10:21]

2010-09-19 c:windowsTasksGoogleUpdateTaskMachineCore.job
— c:program filesGoogleUpdateGoogleUpdate.exe [2010-09-17 18:39]

2010-09-19 c:windowsTasksGoogleUpdateTaskMachineUA.job
— c:program filesGoogleUpdateGoogleUpdate.exe [2010-09-17 18:39]

2010-09-19 c:windowsTasksScheduled Update for Ask Toolbar.job
— c:program filesAsk.comUpdateTask.exe [2009-07-10 14:29]
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.yandex.ru/
uDefault_Search_URL = hxxp://search.qip.ru
mStart Page = about:blank
uInternet Settings,ProxyServer = ftp=localhost:8118;gopher=localhost:8118;http=localhost:8118;https=localhost:8118;socks=localhost:9050
uSearchAssistant = hxxp://search.qip.ru/ie
IE: &Закачать все при помощи FlashGet — c:program filesFlashGetjc_all.htm
IE: &Закачать при помощи FlashGet — c:program filesFlashGetjc_link.htm
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
IE: Google ВикиКомментарии… — c:program filesGoogleGoogle ToolbarComponentGoogleToolbarDynamic_mui_en_2D06158FAC79A790.dll/cmsidewiki.html
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:program filesMail.RuAgentmagent.exe
IE: {{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — {3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — c:program filesWebMoney Advisorwmadvisor.dll
TCP: {F502E5D1-4055-4E2E-97CB-44083AF07579} = 109.60.128.2,109.60.128.3
Handler: tbr — {4D25FB7A-8902-4291-960E-9ADA051CFBBF} —
FF — ProfilePath — c:documents and settingsАдминистраторApplication DataMozillaFirefoxProfilesedigljq4.default
FF — prefs.js: browser.search.defaulturl — hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF — prefs.js: browser.search.selectedEngine — QIP Search
FF — prefs.js: browser.startup.homepage — hxxp://www.yandex.ru/?clid=46751
FF — prefs.js: keyword.URL — hxxp://search.qip.ru/search?from=FF&query=
FF — prefs.js: network.proxy.type — 4
FF — component: c:documents and settingsАдминистраторApplication DataMozillaFirefoxProfilesedigljq4.defaultextensions{32a1fd71-835e-4b11-8e54-886fda0b4c89}componentsqippipe.dll
FF — plugin: c:program filesGoogleUpdate1.2.183.29npGoogleOneClick8.dll
FF — plugin: c:program filesJavajre1.6.0binnpjpi160.dll
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnppl3260.dll
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnprpjplug.dll

—- FIREFOX POLICIES —-
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.IDN.whitelist.xn--mgbaam7a8h», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.IDN.whitelist.xn--mgberp4a5d4ar», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«dom.ipc.plugins.enabled», false);
.
.

---

File Associations

---

.
.scr=AutoCADScriptFile
.
— — — — ORPHANS REMOVED — — — —

BHO-{B4806C1A-FE8A-4008-9DA3-8CEDB6E82C10} — c:program filesWebMoney Advisorwmadvisor.dll
Toolbar-{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — c:program filesWebMoney Advisorwmadvisor.dll
WebBrowser-{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — c:program filesWebMoney Advisorwmadvisor.dll
SafeBoot-klmdb.sys
MSConfigStartUp-Antivirus Pro 2009 — c:program filesAntivirusPro2009AntivirusPro2009.exe
MSConfigStartUp-avast! — c:progra~1ALWILS~1Avast4ashDisp.exe
MSConfigStartUp-avgnt — c:program filesAviraAntiVir Desktopavgnt.exe
MSConfigStartUp-AVP — c:program filesKaspersky LabKaspersky Anti-Virus 7.0avp.exe
MSConfigStartUp-DAEMON Tools Lite — c:program filesDAEMON Tools Litedaemon.exe
MSConfigStartUp-QIP Internet Guardian — c:documents and settingsАдминистраторApplication DataQipGuardQipGuard.exe
MSConfigStartUp-RGSC — c:program filesRockstar GamesRockstar Games Social ClubRGSCLauncher.exe
MSConfigStartUp-SIA2006 — c:program filesSteganos Internet Anonym 2006SIA2006.exe
MSConfigStartUp-Torrent2Exe[5a82552bb08c8a0aeffebf56d69c815b0245188f] — c:documents and settingsАдминистраторРабочий столts[1].exe
MSConfigStartUp-wnaspid — c:windowssystem32wnaspid.exe
AddRemove-3dk-mat-pack v.1205 — c:program filesAutodesk3ds Max 2009materiallibrariesUI3dkMP1205.exe
AddRemove-DAEMON Tools Toolbar — c:program filesDAEMON Tools Toolbaruninst.exe
AddRemove-Install_PBM6_R251 1 — c:3dsmax7un-Install_PBM6_R251.exe
AddRemove-mIRC — d:прогиdc211DownloadsmIRCmirc.exe
AddRemove-neptunes_secret — c:игры от nevosoftNeptunes Secretuninstall.exe
AddRemove-Shockwave — c:windowssystem32MacromedSHOCKW~1UNWISE.EXE
AddRemove-V-Ray for 3dsmax 2009 for x86 — c:program filesChaos GroupV-Ray3dsmax 2009 for x32uninstallwininstaller.exe-uninstall=c:program filesChaos GroupV-Ray3dsmax 2009 for x32uninstallinstall.log
AddRemove-V-Ray for 3dsmax 2010 for x86 — c:program filesChaos GroupV-Ray3dsmax 2010 for x86uninstallwininstaller.exe-uninstall=c:program filesChaos GroupV-Ray3dsmax 2010 for x86uninstallinstall.log

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-19 15:03
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

c:windowssystem32wuapi.dll.wusetup.171031.bak 549720 bytes executable
c:windowssystem32wuauclt.exe.wusetup.171796.bak 53080 bytes executable
c:windowssystem32wuaueng.dll.wusetup.173250.bak 1712984 bytes executable

scan completed successfully
hidden files: 3

**************************************************************************

[HKEY_LOCAL_MACHINESystemControlSet005Servicesd348bus]
«ImagePath»=»»
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘explorer.exe'(2116)
c:windowssystem32WPDShServiceObj.dll
c:windowssystem32PortableDeviceTypes.dll
c:windowssystem32PortableDeviceApi.dll
.

---

Other Running Processes

---

.
c:windowssystem32nvsvc32.exe
c:program filesAlwil SoftwareAvast5AvastSvc.exe
c:program filesCommon FilesAutodesk SharedServiceAdskScSrv.exe
c:program filesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
c:windowssystem32PnkBstrA.exe
c:windowssystem32wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-09-19 15:06:53 — machine was rebooted
ComboFix-quarantined-files.txt 2010-09-19 11:06

Pre-Run: 36 574 306 304 байт свободно
Post-Run: 38 231 490 560 байт свободно

WindowsXP-KB310994-SP2-Pro-BootDisk-RUS.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)WINDOWS
[operating systems]
c:cmdconsBOOTSECT.DAT=»Microsoft Windows Recovery Console» /cmdcons
UnsupportedDebug=»do not select this» /debug
multi(0)disk(0)rdisk(0)partition(1)WINDOWS=»Microsoft Windows XP Professional RU» /noexecute=optin /fastdetect/3GB

Current=5 Default=5 Failed=4 LastKnownGood=6 Sets=1,2,4,5,6
— — End Of File — — 7A7989BE3AA00662D6108A35DF02CB70

[Bruce333]

Все сделала
вот логи

[Автор]

Сообщения