[byfet]

Ок , хотел скачать тот нод32 который вы написали, выясняется, что ничего не могу качать из интернета, выскакивает ошибка «Файл «C:WindowsTEMP» не может быть сохранён, так как вы не можете менять содержимое указанной папки.

Измените свойства папки и попробуйте снова или введите другой адрес для сохранения.»

ЭТО после нажатия на ссылку скачть, на любую ссылку, место скачки менял, таже ошибка. помогите плзз./*/-32

[byfet]

Да стандартный. Помимо него у меня нод32 стоит, все бы ничего да встроенный в винду брендмауэр при каждом запуске компа показывает что он отключен и его надо включить, включаю, все блокирует, может его совсем отключить и как это сделать?

[byfet]

Advanced SystemCare находит какие то проблемы, пишет чтобы человек посмотрел который разбирается:

Logfile of Advanced SystemCare 3 Security Analyzer
Scan saved at 11:15:18, on 14.11.2009
Platform: Windows Vista (WinNT 6.0)
MSIE: Internet Explorer v8.0 (8.0.6001.18828)
Boot mode: Normal

Running processes:
C:Windowssystem32taskeng.exe
C:Windowssystem32Dwm.exe
C:Windowssystem32taskeng.exe
C:Program FilesIObitAdvanced SystemCare 3AWC.exe
C:WindowsExplorer.EXE
C:WindowsWindowsMobilewmdSync.exe
C:Program FilesESETESET NOD32 Antivirusegui.exe
C:Program FilesAPCAPC PowerChute Personal Editionapcsystray.exe
C:Program FilesWindows Media Playerwmpnscfg.exe
C:Program FilesQIPqip.exe
C:Program FilesIVT CorporationBlueSoleilBlueSoleil.exe
C:Program FilesInternet ExplorerIELowutil.exe
O4 — HKLM..Run: [egui] «C:Program FilesESETESET NOD32 Antivirusegui.exe» /hide /waitservice
O4 — HKLM..Run: [Malwarebytes Anti-Malware (reboot)] «C:Program FilesMalwarebytes’ Anti-Malwarembam.exe» /runcleanupscript
O8 — Extra context menu item: &Winamp Search — C:ProgramDataWinamp ToolbarieToolbarresourcesen-USlocalsearch.html
O23 — Service: APC UPS Service — American Power Conversion Corporation — C:Program FilesAPCAPC PowerChute Personal Editionmainserv.exe
O23 — Service: Eset HTTP Server (EhttpSrv) — ESET — C:Program FilesESETESET NOD32 AntivirusEHttpSrv.exe
O23 — Service: Eset Service (ekrn) — ESET — C:Program FilesESETESET NOD32 Antivirusekrn.exe
O23 — Service: Nero BackItUp Scheduler 3 — Nero AG — C:Program FilesNeroNero8Nero BackItUpNBService.exe
O23 — Service: NMIndexingService — Nero AG — C:Program FilesCommon FilesNeroLibNMIndexingService.exe

[byfet]

В принципи все в норме, единственное-при запуске компьютера, когда только загрузился рабочий стол, открывается окно, IRBIS/мои документы, хотелось бы это исправить. Теперь вы можете мне сказать, все вирусы мы вылечели?

[byfet]

ComboFix 09-11-07.02 — Irbis 08.11.2009 15:40.1.4 — NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1251.7.1049.18.3326.2286 [GMT 3:00]
Running from: c:usersIrbisDownloadsComboFix.exe
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
SP: ESET NOD32 Antivirus 3.0 *disabled* (Updated) {E5E70D32-0101-4B98-A4D6-D1D15C3BB448}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:$recycle.binS-1-5-21-1446179839-891853363-1653453915-500
c:$recycle.binS-1-5-21-6276019-3713205604-3198127286-500
c:program filesMail.RuAgentMradllnewmrasearch.dll
c:programdataMicrosoftNetworkDownloaderqmgr0.dat
c:programdataMicrosoftNetworkDownloaderqmgr1.dat
c:usersIrbisAppDataRoamingDesktopicon
c:usersIrbisAppDataRoamingDesktopiconconfig.ini
c:usersIrbisAppDataRoamingMicrosoftInternet ExplorerqiPSearchbar.dll

---

BITS: Possible infected sites

---

hxxp://soft.export.yandex.ru
hxxp://bar.export.yandex.ru
.
((((((((((((((((((((((((( Files Created from 2009-10-08 to 2009-11-08 )))))))))))))))))))))))))))))))
.

2009-11-08 12:48 . 2009-11-08 12:48

---

d

---

w- c:usersirbis2AppDataLocaltemp
2009-11-08 12:48 . 2009-11-08 12:48

---

d

---

w- c:usersIrbisAppDataLocaltemp
2009-11-08 12:48 . 2009-11-08 12:48

---

d

---

w- c:usersDefaultAppDataLocaltemp
2009-11-06 12:21 . 2009-11-06 12:21

---

d

---

w- c:program filesIObit
2009-11-03 11:52 . 2009-11-03 11:52

---

d

---

w- c:usersIrbisAppDataRoamingMalwarebytes
2009-11-03 11:52 . 2009-09-10 11:54 38224 —-a-w- c:windowssystem32driversmbamswissarmy.sys
2009-11-03 11:52 . 2009-11-03 11:52

---

d

---

w- c:programdataMalwarebytes
2009-11-03 11:52 . 2009-09-10 11:53 19160 —-a-w- c:windowssystem32driversmbam.sys
2009-11-03 11:52 . 2009-11-03 11:52 4096 d

---

w- c:program filesMalwarebytes’ Anti-Malware
2009-10-30 17:24 . 2009-10-30 17:24

---

d

---

w- c:program filesWindows Portable Devices
2009-10-30 15:48 . 2009-09-10 02:00 92672 —-a-w- c:windowssystem32UIAnimation.dll
2009-10-30 15:48 . 2009-09-10 02:01 3023360 —-a-w- c:windowssystem32UIRibbon.dll
2009-10-30 15:48 . 2009-09-10 02:00 1164800 —-a-w- c:windowssystem32UIRibbonRes.dll
2009-10-30 15:46 . 2009-10-01 01:02 30208 —-a-w- c:windowssystem32WPDShextAutoplay.exe
2009-10-30 15:46 . 2009-10-01 01:02 31232 —-a-w- c:windowssystem32BthMtpContextHandler.dll
2009-10-30 15:46 . 2009-10-01 01:01 81920 —-a-w- c:windowssystem32wpdbusenum.dll
2009-10-30 15:46 . 2009-10-01 01:01 60928 —-a-w- c:windowssystem32PortableDeviceConnectApi.dll
2009-10-30 15:46 . 2009-10-01 01:02 2537472 —-a-w- c:windowssystem32wpdshext.dll
2009-10-30 15:46 . 2009-10-01 01:02 334848 —-a-w- c:windowssystem32PortableDeviceApi.dll
2009-10-30 15:46 . 2009-10-01 01:02 87552 —-a-w- c:windowssystem32WPDShServiceObj.dll
2009-10-30 15:46 . 2009-10-01 01:01 546816 —-a-w- c:windowssystem32wpd_ci.dll
2009-10-30 15:46 . 2009-10-01 01:01 160256 —-a-w- c:windowssystem32PortableDeviceTypes.dll
2009-10-30 15:46 . 2009-10-01 01:01 350208 —-a-w- c:windowssystem32WPDSp.dll
2009-10-30 15:46 . 2009-10-01 01:01 196608 —-a-w- c:windowssystem32PortableDeviceWMDRM.dll
2009-10-30 15:46 . 2009-10-01 01:01 100864 —-a-w- c:windowssystem32PortableDeviceClassExtension.dll
2009-10-30 15:43 . 2009-10-08 21:08 555520 —-a-w- c:windowssystem32UIAutomationCore.dll
2009-10-30 15:43 . 2009-10-08 21:08 234496 —-a-w- c:windowssystem32oleacc.dll
2009-10-30 15:43 . 2009-10-08 21:07 4096 —-a-w- c:windowssystem32oleaccrc.dll
2009-10-30 13:11 . 2009-09-10 14:58 310784 —-a-w- c:windowssystem32unregmp2.exe
2009-10-30 13:11 . 2009-09-10 14:59 8147456 —-a-w- c:windowssystem32wmploc.DLL
2009-10-27 15:25 . 2009-10-27 15:27

---

d

---

w- c:windowssystem32ca-ES
2009-10-27 15:25 . 2009-10-27 15:27

---

d

---

w- c:windowssystem32eu-ES
2009-10-27 15:25 . 2009-10-27 15:27

---

d

---

w- c:windowssystem32vi-VN
2009-10-27 14:41 . 2009-10-27 14:41

---

d

---

w- C:rsit
2009-10-27 14:28 . 2009-10-27 14:28 4096 d

---

w- c:windowssystem32EventProviders
2009-10-27 13:53 . 2009-10-27 13:53

---

d

---

w- c:program filesTrend Micro
2009-10-27 13:48 . 2009-08-27 05:22 916480 —-a-w- c:windowssystem32wininet.dll
2009-10-27 13:48 . 2009-08-27 05:17 71680 —-a-w- c:windowssystem32iesetup.dll
2009-10-27 13:47 . 2009-08-27 05:17 109056 —-a-w- c:windowssystem32iesysprep.dll
2009-10-27 13:47 . 2009-08-27 03:42 133632 —-a-w- c:windowssystem32ieUnatt.exe
2009-10-27 13:40 . 2009-08-07 02:24 44768 —-a-w- c:windowssystem32wups2.dll
2009-10-27 13:40 . 2009-08-07 02:24 53472 —-a-w- c:windowssystem32wuauclt.exe
2009-10-27 13:40 . 2009-08-07 02:23 1929952 —-a-w- c:windowssystem32wuaueng.dll
2009-10-27 13:40 . 2009-08-07 01:45 2421760 —-a-w- c:windowssystem32wucltux.dll
2009-10-27 13:40 . 2009-08-07 02:24 35552 —-a-w- c:windowssystem32wups.dll
2009-10-27 13:40 . 2009-08-07 02:23 575704 —-a-w- c:windowssystem32wuapi.dll
2009-10-27 13:40 . 2009-08-07 01:44 87552 —-a-w- c:windowssystem32wudriver.dll
2009-10-27 13:40 . 2009-08-06 16:23 171608 —-a-w- c:windowssystem32wuwebv.dll
2009-10-27 13:40 . 2009-08-06 15:44 33792 —-a-w- c:windowssystem32wuapp.exe
2009-10-21 11:25 . 2009-10-21 11:25

---

d

---

w- c:usersIrbisAppDataRoamingPeerNetworking
2009-10-19 18:25 . 2009-10-19 18:25

---

d

---

w- c:program filesAPC
2009-10-15 20:50 . 2009-10-21 08:25

---

d

---

w- c:program filesESET
2009-10-15 19:36 . 2009-10-15 19:36

---

d

---

w- c:usersIrbisAppDataLocalESET
2009-10-15 13:00 . 2009-09-10 16:48 218624 —-a-w- c:windowssystem32msv1_0.dll
2009-10-15 12:56 . 2009-08-04 12:34 3600456 —-a-w- c:windowssystem32ntkrnlpa.exe
2009-10-15 12:56 . 2009-08-04 12:34 3548216 —-a-w- c:windowssystem32ntoskrnl.exe
2009-10-15 12:34 . 2009-09-04 11:41 60928 —-a-w- c:windowssystem32msasn1.dll
2009-10-15 12:34 . 2009-09-14 09:29 144896 —-a-w- c:windowssystem32driverssrv2.sys
2009-10-15 12:34 . 2009-05-08 12:53 604672 —-a-w- c:windowssystem32WMSPDMOD.DLL
2009-10-13 07:07 . 2009-10-13 07:07

---

d

---

w- c:usersIrbisAppDataRoamingSamsung
2009-10-13 07:06 . 2006-07-24 12:05 5632 —-a-w- c:windowssystem32driversStarOpen.sys
2009-10-13 07:03 . 2009-10-13 07:06

---

d

---

w- c:windowssystem32Samsung_USB_Drivers
2009-10-13 07:03 . 2009-10-13 07:03

---

d

---

w- c:program filesSamsung
2009-10-12 16:39 . 2008-02-28 09:26 1414440 —-a-w- c:windowssystem32ShellManager310E2D762.dll
2009-10-12 15:34 . 2009-10-12 16:53

---

d

---

w- c:usersIrbisAppDataLocalAhead
2009-10-12 15:32 . 2009-10-12 15:39

---

d

---

w- c:usersIrbisAppDataRoamingAhead
2009-10-12 15:31 . 2009-10-12 15:49 4096 d

---

w- c:program filesCommon FilesAhead
2009-10-12 14:56 . 2009-10-12 14:56

---

d

---

w- c:usersIrbisAppDataRoamingNeroDigital(TM)
2009-10-09 16:34 . 2009-10-09 16:34

---

d

---

w- c:program filesIVT Corporation
2009-10-09 15:32 . 2009-10-19 15:01 319456 —-a-w- c:windowsDIFxAPI.dll
2009-10-09 15:32 . 2008-08-26 04:25 150560 —-a-w- c:windowssystem32driversRtHDMIV.sys
2009-10-09 15:32 . 2008-08-25 04:35 2296320 —-a-w- c:windowssystem32RtkHDMI.dll
2009-10-09 15:32 . 2008-08-22 10:05 799744 —-a-w- c:windowssystem32RHDMIExt.dll
2009-10-09 15:32 . 2008-08-06 08:51 1200128 —-a-w- c:windowsRtkUpd.exe
2009-10-09 15:32 . 2008-07-31 07:13 34304 —-a-w- c:windowssystem32RHCoInst.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-08 09:12 . 2008-01-21 05:59 693850 —-a-w- c:windowssystem32perfh019.dat
2009-11-08 09:12 . 2008-01-21 05:59 143974 —-a-w- c:windowssystem32perfc019.dat
2009-11-06 14:48 . 2008-12-19 09:24 4096 d—h—w- c:program filesInstallShield Installation Information
2009-11-06 14:44 . 2009-02-11 09:19

---

d

---

w- c:usersIrbisAppDataRoamingIObit
2009-11-05 07:19 . 2009-01-28 17:47 4096 d

---

w- c:usersIrbisAppDataRoamingIP-TV Player
2009-11-03 16:42 . 2008-12-16 12:16

---

d

---

w- c:usersIrbisAppDataRoamingOpenOffice.org2
2009-11-03 16:42 . 2008-12-16 12:16 1 —-a-w- c:usersIrbisAppDataRoamingOpenOffice.org2useruno_packagescachestamp.sys
2009-11-02 17:42 . 2009-10-03 10:18 195456

---

w- c:windowssystem32MpSigStub.exe
2009-10-30 17:24 . 2006-11-02 10:25 665600 —-a-w- c:windowsinfdrvindex.dat
2009-10-30 17:24 . 2009-10-30 17:24 0 —ha-w- c:windowssystem32driversMsft_User_WpdFs_01_07_00.Wdf
2009-10-27 15:27 . 2006-11-02 12:35

---

d

---

w- c:program filesWindows Calendar
2009-10-27 15:27 . 2006-11-02 11:18 4096 d

---

w- c:program filesWindows Mail
2009-10-27 15:27 . 2006-11-02 12:35 4096 d

---

w- c:program filesWindows Sidebar
2009-10-27 15:27 . 2006-11-02 12:35 4096 d

---

w- c:program filesWindows Collaboration
2009-10-27 15:27 . 2006-11-02 12:35 4096 d

---

w- c:program filesWindows Photo Gallery
2009-10-27 15:27 . 2006-11-02 12:35 4096 d

---

w- c:program filesWindows Defender
2009-10-22 12:31 . 2009-06-20 08:10 4096 d

---

w- c:program filesCommon FilesNero
2009-10-22 12:29 . 2009-01-09 11:46 4096 d

---

w- c:programdataNero
2009-10-19 16:13 . 2009-01-30 12:48 4096 d

---

w- c:program filesUnlocker
2009-10-18 19:00 . 2008-12-22 22:16 22328 —-a-w- c:windowssystem32driversPnkBstrK.sys
2009-10-18 19:00 . 2008-12-22 22:16 103736 —-a-w- c:windowssystem32PnkBstrB.exe
2009-10-15 21:30 . 2009-10-06 14:16

---

d

---

w- c:usersIrbisAppDataRoamingCMedia
2009-10-15 20:30 . 2008-12-16 12:13

---

d

---

w- c:programdataSkype
2009-10-15 12:12 . 2008-12-22 20:54

---

d

---

w- c:usersIrbisAppDataRoamingskypePM
2009-10-12 17:15 . 2009-06-20 08:10

---

d

---

w- c:program filesNero
2009-10-12 16:20 . 2009-06-20 08:35 4096 d

---

w- c:usersIrbisAppDataRoamingNero
2009-10-09 16:36 . 2009-10-03 11:32

---

d

---

w- c:programdataBluetooth
2009-10-09 16:36 . 2009-10-03 11:28 12 —-a-w- c:windowsbthservsdp.dat
2009-10-09 11:51 . 2009-10-09 11:51 54656 —-a-w- c:usersirbis2AppDataLocalGDIPFONTCACHEV1.DAT
2009-10-09 11:51 . 2009-10-09 11:51

---

d

---

w- c:usersirbis2AppDataRoamingMRA
2009-10-09 11:51 . 2009-10-09 11:51

---

d

---

w- c:usersirbis2AppDataRoamingATI
2009-10-09 11:51 . 2009-10-09 11:51

---

d

---

w- c:programdataATI
2009-10-06 14:16 . 2009-10-06 14:16 804864 —-a-w- c:usersIrbisAppDataRoamingCMediaUninstall.exe
2009-10-06 11:20 . 2009-02-24 16:09 4096 d

---

w- c:programdataInstallations
2009-10-04 00:06 . 2009-03-13 11:10 4096 dc-h—w- c:programdata{0151C9FC-719D-4459-B1E2-4685CC6E62A8}
2009-09-25 02:10 . 2009-10-30 15:47 974848 —-a-w- c:windowssystem32WindowsCodecs.dll
2009-09-25 02:07 . 2009-10-30 15:47 189440 —-a-w- c:windowssystem32WindowsCodecsExt.dll
2009-09-25 02:04 . 2009-10-30 15:47 321024 —-a-w- c:windowssystem32PhotoMetadataHandler.dll
2009-09-25 01:49 . 2009-10-30 15:47 1554432 —-a-w- c:windowssystem32xpsservices.dll
2009-09-25 01:48 . 2009-10-30 15:47 351232 —-a-w- c:windowssystem32XpsPrint.dll
2009-09-25 01:38 . 2009-10-30 15:47 847360 —-a-w- c:windowssystem32OpcServices.dll
2009-09-25 01:36 . 2009-10-30 15:47 280064 —-a-w- c:windowssystem32XpsGdiConverter.dll
2009-09-25 01:35 . 2009-10-30 15:47 135680 —-a-w- c:windowssystem32XpsRasterService.dll
2009-09-25 01:33 . 2009-10-30 15:47 195584 —-a-w- c:windowssystem32dxdiagn.dll
2009-09-25 01:33 . 2009-10-30 15:47 829440 —-a-w- c:windowssystem32d3d10warp.dll
2009-09-25 01:33 . 2009-10-30 15:47 369664 —-a-w- c:windowssystem32WMPhoto.dll
2009-09-25 01:32 . 2009-10-30 15:47 252928 —-a-w- c:windowssystem32dxdiag.exe
2009-09-25 01:31 . 2009-10-30 15:47 519680 —-a-w- c:windowssystem32d3d11.dll
2009-09-25 01:31 . 2009-10-30 15:47 486912 —-a-w- c:windowssystem32d3d10level9.dll
2009-09-25 01:31 . 2009-10-30 15:47 161280 —-a-w- c:windowssystem32d3d10_1.dll
2009-09-25 01:31 . 2009-10-30 15:47 218112 —-a-w- c:windowssystem32d3d10_1core.dll
2009-09-25 01:31 . 2009-10-30 15:47 1030144 —-a-w- c:windowssystem32d3d10.dll
2009-09-25 01:31 . 2009-10-30 15:47 828928 —-a-w- c:windowssystem32d2d1.dll
2009-09-25 01:30 . 2009-10-30 15:47 481792 —-a-w- c:windowssystem32dxgi.dll
2009-09-25 01:30 . 2009-10-30 15:47 190464 —-a-w- c:windowssystem32d3d10core.dll
2009-09-25 01:27 . 2009-10-30 15:47 634880 —-a-w- c:windowssystem32driversdxgkrnl.sys
2009-09-25 01:27 . 2009-10-30 15:47 37888 —-a-w- c:windowssystem32cdd.dll
2009-09-25 01:27 . 2009-10-30 15:47 793088 —-a-w- c:windowssystem32FntCache.dll
2009-09-25 01:27 . 2009-10-30 15:47 1064448 —-a-w- c:windowssystem32DWrite.dll
2009-09-24 22:54 . 2009-10-30 15:47 258048 —-a-w- c:windowssystem32winspool.drv
2009-09-24 22:54 . 2009-10-30 15:47 667648 —-a-w- c:windowssystem32printfilterpipelinesvc.exe
2009-09-24 22:54 . 2009-10-30 15:47 26112 —-a-w- c:windowssystem32printfilterpipelineprxy.dll
2009-09-21 09:06 . 2009-09-21 09:06

---

d

---

w- c:programdataUbisoft
2009-09-21 08:49 . 2009-09-21 08:49

---

d

---

w- c:usersIrbisAppDataRoamingInstallShield
2009-09-13 13:44 . 2009-09-13 13:44 4096 d

---

w- c:program filesDAEMON Tools Lite
2009-09-13 13:44 . 2008-12-28 14:16 4096 d

---

w- c:program filesDAEMON Tools Toolbar
2009-09-13 11:42 . 2009-09-13 11:42 93 —-a-w- c:usersIrbisAppDataLocalfusioncache.dat
2009-09-10 07:00 . 2009-01-07 09:09

---

d

---

w- c:program filesMicrosoft Games for Windows — LIVE
2009-08-29 00:27 . 2009-09-03 06:33 4240384 —-a-w- c:windowssystem32GameUXLegacyGDFs.dll
2009-08-29 00:14 . 2009-09-03 06:33 28672 —-a-w- c:windowssystem32Apphlpdm.dll
2009-08-14 16:27 . 2009-09-10 06:01 904776 —-a-w- c:windowssystem32driverstcpip.sys
2009-08-14 15:53 . 2009-09-10 06:01 17920 —-a-w- c:windowssystem32netevent.dll
2009-08-14 13:49 . 2009-09-10 06:01 9728 —-a-w- c:windowssystem32TCPSVCS.EXE
2009-08-14 13:49 . 2009-09-10 06:01 17920 —-a-w- c:windowssystem32ROUTE.EXE
2009-08-14 13:49 . 2009-09-10 06:01 11264 —-a-w- c:windowssystem32MRINFO.EXE
2009-08-14 13:49 . 2009-09-10 06:01 27136 —-a-w- c:windowssystem32NETSTAT.EXE
2009-08-14 13:49 . 2009-09-10 06:01 8704 —-a-w- c:windowssystem32HOSTNAME.EXE
2009-08-14 13:49 . 2009-09-10 06:01 19968 —-a-w- c:windowssystem32ARP.EXE
2009-08-14 13:49 . 2009-09-10 06:01 10240 —-a-w- c:windowssystem32finger.exe
2009-08-14 13:48 . 2009-09-10 06:01 30720 —-a-w- c:windowssystem32driverstcpipreg.sys
2009-08-14 13:48 . 2009-09-10 06:01 105984 —-a-w- c:windowssystem32netiohlp.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]
«{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}»= «c:program filesWinamp Toolbarwinamptb.dll» [2008-07-16 1266992]

[HKEY_CLASSES_ROOTclsid{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOTWINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOTTypeLib{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOTWINAMPTB.AOLTBSearch]

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2009-07-24 5586208]

[HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«Windows Mobile-based device management»=»c:windowsWindowsMobilewmdSync.exe» [2008-01-21 215552]
«egui»=»c:program filesESETESET NOD32 Antivirusegui.exe» [2008-07-01 1447168]
«Malwarebytes Anti-Malware (reboot)»=»c:program filesMalwarebytes’ Anti-Malwarembam.exe» [2009-09-10 1312080]

c:usersIrbisAppDataRoamingMicrosoftWindowsStart MenuProgramsStartup
explorer — џа«лЄ.lnk — c:windowsexplorer.exe [2009-9-24 2926592]

c:programdataMicrosoftWindowsStart MenuProgramsStartup
APC UPS Status.lnk — c:program filesAPCAPC PowerChute Personal EditionDisplay.exe [2009-10-19 221247]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]
«EnableUIADesktopToggle»= 0 (0x0)

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalWinDefend]
@=»Service»

[HKLM~startupfolderC:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^FlyLinkDC++.lnk]
backup=c:windowspssFlyLinkDC++.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM~startupfolderC:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^IP-TV Player Agent.lnk]
path=c:programdataMicrosoftWindowsStart MenuProgramsStartupIP-TV Player Agent.lnk
backup=c:windowspssIP-TV Player Agent.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM~startupfolderC:^Users^Irbis^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Punto Switcher.lnk]
backup=c:windowspssPunto Switcher.lnk.Startup
backupExtension=.Startup
HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregYupdate!

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerSvc]
«VistaSp2″=hex(b):a6,e0,41,85,86,59,ca,01

R0 hotcore3;hotcore3;c:windowsSystem32drivershotcore3.sys [22.12.2008 19:08 40368]
R1 epfwtdir;epfwtdir;c:windowsSystem32driversepfwtdir.sys [01.07.2008 8:04 34312]
R2 ekrn;Eset Service;c:program filesESETESET NOD32 Antivirusekrn.exe [21.12.2007 7:21 468224]
R3 dc3d;USBCCGP filter driver (dc3d);c:windowsSystem32driversdc3d.sys [15.01.2009 9:15 15360]
S3 btnetBUs;Bluetooth PAN Bus Service;c:windowsSystem32driversbtnetBus.sys [17.06.2009 13:02 29192]
S3 FontCache;Служба кэша шрифтов Windows;c:windowssystem32svchost.exe -k LocalServiceAndNoImpersonation [21.01.2008 5:33 21504]

— Other Services/Drivers In Memory —

*NewlyCreated* — MBR
*NewlyCreated* — PROCEXP113
*Deregistered* — mbr
*Deregistered* — PROCEXP113

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionsvchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the ‘Scheduled Tasks’ folder

2009-11-08 c:windowsTasksAWC AutoSweep.job
— c:program filesIObitAdvanced SystemCare 3AutoSweep.exe [2009-11-06 12:35]

2009-11-08 c:windowsTasksAWC Startup.job
— c:program filesIObitAdvanced SystemCare 3AWC.exe [2009-11-06 06:30]

2009-11-06 c:windowsTasksAWC Update.job
— c:program filesIObitAdvanced SystemCare 3IObitUpdate.exe [2009-11-06 07:15]

2009-10-04 c:windowsTasksCrysis Wars(R) Updates.job
— c:windowsInstallerCrysis Wars(R) Updates for All Users.lnk [2009-03-13 11:10]

2009-11-08 c:windowsTasksUser_Feed_Synchronization-{11B80F1F-A2FA-4650-AE3D-FF57D2DC2C9B}.job
— c:windowssystem32msfeedssync.exe [2009-10-27 03:41]
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.apeha.ru
uDefault_Search_URL = hxxp://search.qip.ru
uSearchURL,(Default) = hxxp://search.qip.ru/search?query=%s&from=IE
IE: &Winamp Search — c:programdataWinamp ToolbarieToolbarresourcesen-USlocalsearch.html
TCP: {0BE9002C-16D0-4D5C-8E24-72119F8E8B16} = 195.98.160.26,80.253.30.20
FF — ProfilePath — c:usersIrbisAppDataRoamingMozillaFirefoxProfiles9vf96daw.default
FF — prefs.js: browser.search.defaulturl — hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
FF — prefs.js: browser.search.selectedEngine — DAEMON Search
FF — prefs.js: browser.startup.homepage — hxxp://www.yandex.ru/?clid=21973
FF — prefs.js: keyword.URL — hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=
FF — component: c:usersIrbisAppDataRoamingMozillaFirefoxProfiles9vf96daw.defaultextensions{0b38152b-1b20-484d-a11f-5e04a9b0661f}componentsWinampTBPlayer.dll
FF — HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} — c:windowsMicrosoft.NETFrameworkv3.5Windows Presentation FoundationDotNetAssistantExtension

—- FIREFOX POLICIES —-
FF — user.js: browser.cache.memory.capacity — 65536
FF — user.js: browser.chrome.favicons — fales
FF — user.js: browser.display.show_image_placeholders — true
FF — user.js: browser.turbo.enabled — true
FF — user.js: browser.urlbar.autocomplete.enabled — true
FF — user.js: browser.urlbar.autofill — true
FF — user.js: browser.xul.error_pages.enabled — true
FF — user.js: content.interrupt.parsing — true
FF — user.js: content.max.tokenizing.time — 3000000
FF — user.js: content.maxtextrun — 8191
FF — user.js: content.notify.backoffcount — 5
FF — user.js: content.notify.interval — 750000
FF — user.js: content.notify.ontimer — true
FF — user.js: content.switch.threshold — 750000
FF — user.js: network.http.max-connections — 32
FF — user.js: network.http.max-connections-per-server — 8
FF — user.js: network.http.max-persistent-connections-per-proxy — 8
FF — user.js: network.http.max-persistent-connections-per-server — 4
FF — user.js: network.http.pipelining — true
FF — user.js: network.http.pipelining.firstrequest — true
FF — user.js: network.http.pipelining.maxrequests — 8
FF — user.js: network.http.proxy.pipelining — true
FF — user.js: network.http.request.max-start-delay — 0
FF — user.js: nglayout.initialpaint.delay — 0
FF — user.js: plugin.expose_full_path — true
FF — user.js: ui.submenuDelay — 0
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-08 15:49
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x857C61F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
Driveratapi -> 0x857c61f8
Warning: possible MBR rootkit infection !
user & kernel MBR OK
Use «Recovery Console» command «fixmbr» to clear infection !

**************************************************************************
.

---

LOCKED REGISTRY KEYS

---

[HKEY_USERSS-1-5-21-1446179839-891853363-1653453915-1000SoftwareSecuROM!CAUTION! NEVER A OR CHANGE ANY KEY*]
«??»=hex:1a,df,a9,24,f3,cd,c4,5e,5b,57,6a,c5,80,0b,fc,9a,c7,f9,27,5f,e7,1e,66,
e7,ae,d3,3b,99,8c,73,34,85,5b,68,ea,a4,a7,ca,c0,63,7d,57,87,2a,a2,fa,5c,d3,
«??»=hex:5d,2e,bc,00,9b,07,bc,9c,34,34,87,88,c9,ab,ca,0d

[HKEY_USERSS-1-5-21-1446179839-891853363-1653453915-1000SoftwareSecuROMLicense information*]
«datasecu»=hex:d9,c9,72,54,09,b0,4c,77,19,14,07,d6,c2,8c,19,e0,bc,25,1d,a7,74,
35,a3,4c,55,be,d0,ba,a9,ef,04,f3,74,a5,1a,ac,e7,8c,39,da,fc,59,2b,87,36,00,
«rkeysecu»=hex:0d,0d,43,2c,3f,4e,39,63,90,b8,22,6e,61,b9,09,3c

[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}000AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
«BlindDial»=dword:00000000

[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}001AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
«BlindDial»=dword:00000000

[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}002AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
«BlindDial»=dword:00000000
.
Completion time: 2009-11-08 15:52
ComboFix-quarantined-files.txt 2009-11-08 12:51

Pre-Run: 19 608 797 184 байт свободно
Post-Run: 19 547 557 888 байт свободно

— — End Of File — — 78B264087BF9969EF3D540839855CDA0

[byfet]

Лог до обновления MBAM:

Malwarebytes’ Anti-Malware 1.41
Версия базы данных: 2775
Windows 6.0.6002 Service Pack 2

03.11.2009 18:35:06
mbam-log-2009-11-03 (18-35-06).txt

Тип проверки: Полная (C:|H:|)
Проверено объектов: 268737
Прошло времени: 50 minute(s), 35 second(s)

Заражено процессов в памяти: 0
Заражено модулей в памяти: 0
Заражено ключей реестра: 1
Заражено значений реестра: 0
Заражено параметров реестра: 0
Заражено папок: 0
Заражено файлов: 0

Заражено процессов в памяти:
(Вредоносные программы не обнаружены)

Заражено модулей в памяти:
(Вредоносные программы не обнаружены)

Заражено ключей реестра:
HKEY_CLASSES_ROOTCLSID{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Заражено значений реестра:
(Вредоносные программы не обнаружены)

Заражено параметров реестра:
(Вредоносные программы не обнаружены)

Заражено папок:
(Вредоносные программы не обнаружены)

Заражено файлов:
(Вредоносные программы не обнаружены)

Лог после обновления MBAM:

Malwarebytes’ Anti-Malware 1.41
Версия базы данных: 3092
Windows 6.0.6002 Service Pack 2

03.11.2009 19:37:36
mbam-log-2009-11-03 (19-37-36).txt

Тип проверки: Полная (C:|)
Проверено объектов: 238553
Прошло времени: 40 minute(s), 56 second(s)

Заражено процессов в памяти: 0
Заражено модулей в памяти: 0
Заражено ключей реестра: 0
Заражено значений реестра: 0
Заражено параметров реестра: 0
Заражено папок: 0
Заражено файлов: 3

Заражено процессов в памяти:
(Вредоносные программы не обнаружены)

Заражено модулей в памяти:
(Вредоносные программы не обнаружены)

Заражено ключей реестра:
(Вредоносные программы не обнаружены)

Заражено значений реестра:
(Вредоносные программы не обнаружены)

Заражено параметров реестра:
(Вредоносные программы не обнаружены)

Заражено папок:
(Вредоносные программы не обнаружены)

Заражено файлов:
C:Program FilesSamsungSamsung PC Studio 3utilSMSMoveD500.exe (Worm.Koobface) -> Quarantined and deleted successfully.
C:Program FilesSamsungSamsung PC Studio 3utilSMSMoveX800.exe (Worm.Koobface) -> Quarantined and deleted successfully.
C:Program FilesSamsungSamsung PC Studio 3utilSMSMoveZ510.exe (Worm.Koobface) -> Quarantined and deleted successfully.

Лог RSIT:

Logfile of random’s system information tool 1.06 (written by random/random)
Run by Irbis at 2009-11-03 22:03:40
Microsoft® Windows Vista™ Home Basic Service Pack 2
System drive C: has 19 GB (39%) free of 47 GB
Total RAM: 3326 MB (60% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:03:47, on 03.11.2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18828)
Boot mode: Normal

Running processes:
C:Windowssystem32taskeng.exe
C:Windowssystem32Dwm.exe
C:Windowssystem32taskeng.exe
C:WindowsExplorer.EXE
C:Program FilesIObitAdvanced SystemCare 3AWC.exe
C:WindowsWindowsMobilewmdSync.exe
C:Program FilesESETESET NOD32 Antivirusegui.exe
C:Windowssystem32wbemunsecapp.exe
C:Program FilesAPCAPC PowerChute Personal Editionapcsystray.exe
C:Program FilesWindows DefenderMSASCui.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:Program FilesWindows Media Playerwmpnscfg.exe
H:Программыудаляет вредоносные прогиЧерви, вирусы вредонсн прогиRSIT.exe
C:Program FilesTrend MicroHijackThisIrbis.exe

R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://search.qip.ru
R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://search.qip.ru
R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://search.qip.ru/ie
R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://search.qip.ru
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.apeha.ru
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://search.qip.ru/ie
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =
R1 — HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://search.qip.ru/search?query=%s&from=IE
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =
R3 — URLSearchHook: QIPBHO Class — {95289393-33EA-4F8D-B952-483415B9C955} — C:UsersIrbisAppDataRoamingMicrosoftInternet Explorerqipsearchbar.dll
R3 — URLSearchHook: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — c:program filesmail.rusputnikMailRuSputnik.dll
R3 — URLSearchHook: Winamp Search Class — {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} — C:Program FilesWinamp Toolbarwinamptb.dll
O1 — Hosts: ::1 localhost
O4 — HKLM..Run: [Windows Mobile-based device management] %windir%WindowsMobilewmdSync.exe
O4 — HKLM..Run: [egui] «C:Program FilesESETESET NOD32 Antivirusegui.exe» /hide /waitservice
O4 — HKLM..Run: [Malwarebytes Anti-Malware (reboot)] «C:Program FilesMalwarebytes’ Anti-Malwarembam.exe» /runcleanupscript
O4 — HKUSS-1-5-19..Run: [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User ‘NETWORK SERVICE’)
O4 — Startup: explorer — Ярлык.lnk = C:Windowsexplorer.exe
O4 — Global Startup: APC UPS Status.lnk = ?
O8 — Extra context menu item: &Winamp Search — C:ProgramDataWinamp ToolbarieToolbarresourcesen-USlocalsearch.html
O13 — Gopher Prefix:
O17 — HKLMSystemCCSServicesTcpip..{0BE9002C-16D0-4D5C-8E24-72119F8E8B16}: NameServer = 195.98.160.26,80.253.30.20
O17 — HKLMSystemCCSServicesTcpip..{AA8B0828-9FF6-4C43-8E03-08D6FABCDA25}: NameServer = 195.98.160.26 195.98.161.26
O23 — Service: APC UPS Service — American Power Conversion Corporation — C:Program FilesAPCAPC PowerChute Personal Editionmainserv.exe
O23 — Service: Eset HTTP Server (EhttpSrv) — ESET — C:Program FilesESETESET NOD32 AntivirusEHttpSrv.exe
O23 — Service: Eset Service (ekrn) — ESET — C:Program FilesESETESET NOD32 Antivirusekrn.exe
O23 — Service: Nero BackItUp Scheduler 3 — Nero AG — C:Program FilesNeroNero8Nero BackItUpNBService.exe
O23 — Service: NMIndexingService — Nero AG — C:Program FilesCommon FilesNeroLibNMIndexingService.exe

—
End of file — 4415 bytes

======Scheduled tasks folder======

C:WindowstasksAWC Startup.job
C:WindowstasksCrysis Wars(R) Updates.job
C:WindowstasksUser_Feed_Synchronization-{11B80F1F-A2FA-4650-AE3D-FF57D2DC2C9B}.job

======Registry dump======

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«Windows Mobile-based device management»=C:WindowsWindowsMobilewmdSync.exe [2008-01-21 215552]
«egui»=C:Program FilesESETESET NOD32 Antivirusegui.exe [2008-07-01 1447168]
«Malwarebytes Anti-Malware (reboot)»=C:Program FilesMalwarebytes’ Anti-Malwarembam.exe [2009-09-10 1312080]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe Reader Speed Launcher]
C:Program FilesAdobeReader 8.0ReaderReader_sl.exe [2008-01-11 39792]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregComrade.exe]
C:Program FilesGameSpyComradeComrade.exe [2007-06-29 36864]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregEA Core]
C:Program FilesElectronic ArtsEADMCore.exe [2008-07-22 2772992]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:Program FilesCommon FilesNeroLibNMIndexStoreSvr.exe [2007-09-20 1410344]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNBKeyScan]
C:Program FilesNeroNero8Nero BackItUpNBKeyScan.exe [2007-09-20 1836328]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNeroFilterCheck]
C:Program FilesCommon FilesNeroLibNeroCheck.exe [2007-03-01 153136]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregOrb]
C:Program FilesWinamp RemotebinOrbTray.exe [2008-04-01 507904]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPC Suite Tray]
C:Program FilesNokiaNokia PC Suite 7PCSuite.exe [2009-06-25 1414144]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregRGSC]
H:GamesGTA4Rockstar Games Social ClubRGSCLauncher.exe /silent []

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregRtHDVCpl]
RtHDVCpl.exe []

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSkype]
C:Program FilesSkypePhoneSkype.exe /nosplash /minimized []

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSunJavaUpdateSched]
C:Program FilesJavajre1.6.0_04binjusched.exe [2007-12-14 144784]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregUnlockerAssistant]
C:Program FilesUnlockerUnlockerAssistant.exe [2008-05-02 15872]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregWinampAgent]
C:Program FilesWinampwinampa.exe [2008-08-04 36352]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregWindows Defender]
C:Program FilesWindows DefenderMSASCui.exe [2008-01-21 1008184]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregYandexDesktopSearch]
C:Program FilesYandexDesktopyandesk.exe [2007-12-10 7456256]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregYupdate!]
C:Program FilesCommon FilesYandexYupdateyupdate.exe []

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupfolderC:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^FlyLinkDC++.lnk]
C:PROGRA~1FLYLIN~1FLYLIN~1.EXE [2008-11-20 3002880]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupfolderC:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^IP-TV Player Agent.lnk]
C:PROGRA~1IP-TVP~1IPTVPL~1.EXE [2008-12-17 359424]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupfolderC:^Users^Irbis^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Punto Switcher.lnk]
C:PROGRA~1YandexPUNTOS~1punto.exe [2009-07-13 830248]

C:ProgramDataMicrosoftWindowsStart MenuProgramsStartup
APC UPS Status.lnk — C:Program FilesAPCAPC PowerChute Personal EditionDisplay.exe

C:UsersIrbisAppDataRoamingMicrosoftWindowsStart MenuProgramsStartup
explorer — Ярлык.lnk — C:Windowsexplorer.exe

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkWudfPf]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkWudfRd]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkWudfSvc]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkWudfUsbccidDriver]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1
«EnableUIADesktopToggle»=0

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«BindDirectlyToPropertySetStorage»=

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{40f65ff5-a063-11de-8fb5-001e90ce2363}]
shellAutoRuncommand — J:Autorun.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{876a6357-453c-11de-8ec8-001e90ce2363}]
shellAutoRuncommand — internet_free.exe -flash

======File associations======

.js — edit — C:WindowsSystem32Notepad.exe %1
.js — open — C:WindowsSystem32WScript.exe «%1» %*

======List of files/folders created in the last 1 months======

2009-11-03 14:52:36 —-D—- C:UsersIrbisAppDataRoamingMalwarebytes
2009-11-03 14:52:29 —-D—- C:ProgramDataMalwarebytes
2009-11-03 14:52:27 —-D—- C:Program FilesMalwarebytes’ Anti-Malware
2009-10-30 20:24:43 —-D—- C:Program FilesWindows Portable Devices
2009-10-30 18:48:22 —-A—- C:Windowssystem32UIAnimation.dll
2009-10-30 18:48:21 —-A—- C:Windowssystem32UIRibbonRes.dll
2009-10-30 18:48:21 —-A—- C:Windowssystem32UIRibbon.dll
2009-10-30 18:47:37 —-A—- C:Windowssystem32WMPhoto.dll
2009-10-30 18:47:35 —-A—- C:Windowssystem32cdd.dll
2009-10-30 18:47:33 —-A—- C:Windowssystem32XpsRasterService.dll
2009-10-30 18:47:33 —-A—- C:Windowssystem32printfilterpipelineprxy.dll
2009-10-30 18:47:33 —-A—- C:Windowssystem32d3d10warp.dll
2009-10-30 18:47:32 —-A—- C:Windowssystem32XpsGdiConverter.dll
2009-10-30 18:47:32 —-A—- C:Windowssystem32WindowsCodecsExt.dll
2009-10-30 18:47:32 —-A—- C:Windowssystem32WindowsCodecs.dll
2009-10-30 18:47:32 —-A—- C:Windowssystem32printfilterpipelinesvc.exe
2009-10-30 18:47:32 —-A—- C:Windowssystem32PhotoMetadataHandler.dll
2009-10-30 18:47:32 —-A—- C:Windowssystem32dxdiagn.dll
2009-10-30 18:47:32 —-A—- C:Windowssystem32dxdiag.exe
2009-10-30 18:47:32 —-A—- C:Windowssystem32d2d1.dll
2009-10-30 18:47:31 —-A—- C:Windowssystem32xpsservices.dll
2009-10-30 18:47:31 —-A—- C:Windowssystem32XpsPrint.dll
2009-10-30 18:47:31 —-A—- C:Windowssystem32OpcServices.dll
2009-10-30 18:47:31 —-A—- C:Windowssystem32FntCache.dll
2009-10-30 18:47:31 —-A—- C:Windowssystem32dxgi.dll
2009-10-30 18:47:31 —-A—- C:Windowssystem32DWrite.dll
2009-10-30 18:47:31 —-A—- C:Windowssystem32d3d11.dll
2009-10-30 18:47:31 —-A—- C:Windowssystem32d3d10level9.dll
2009-10-30 18:47:31 —-A—- C:Windowssystem32d3d10core.dll
2009-10-30 18:47:31 —-A—- C:Windowssystem32d3d10_1core.dll
2009-10-30 18:47:31 —-A—- C:Windowssystem32d3d10_1.dll
2009-10-30 18:47:30 —-A—- C:Windowssystem32d3d10.dll
2009-10-30 18:46:27 —-A—- C:Windowssystem32WPDShextAutoplay.exe
2009-10-30 18:46:26 —-A—- C:Windowssystem32wpdbusenum.dll
2009-10-30 18:46:26 —-A—- C:Windowssystem32BthMtpContextHandler.dll
2009-10-30 18:46:15 —-A—- C:Windowssystem32PortableDeviceConnectApi.dll
2009-10-30 18:46:07 —-A—- C:Windowssystem32WPDSp.dll
2009-10-30 18:46:07 —-A—- C:Windowssystem32WPDShServiceObj.dll
2009-10-30 18:46:07 —-A—- C:Windowssystem32wpdshext.dll
2009-10-30 18:46:07 —-A—- C:Windowssystem32wpd_ci.dll
2009-10-30 18:46:07 —-A—- C:Windowssystem32PortableDeviceWMDRM.dll
2009-10-30 18:46:07 —-A—- C:Windowssystem32PortableDeviceTypes.dll
2009-10-30 18:46:07 —-A—- C:Windowssystem32PortableDeviceClassExtension.dll
2009-10-30 18:46:07 —-A—- C:Windowssystem32PortableDeviceApi.dll
2009-10-30 18:43:55 —-A—- C:Windowssystem32UIAutomationCore.dll
2009-10-30 18:43:55 —-A—- C:Windowssystem32oleaccrc.dll
2009-10-30 18:43:55 —-A—- C:Windowssystem32oleacc.dll
2009-10-30 16:12:25 —-A—- C:Windowssystem32jscript.dll
2009-10-30 16:11:54 —-A—- C:Windowssystem32wmp.dll
2009-10-30 16:11:46 —-A—- C:Windowssystem32unregmp2.exe
2009-10-30 16:11:42 —-A—- C:Windowssystem32wmploc.DLL
2009-10-27 18:25:35 —-D—- C:Windowssystem32eu-ES
2009-10-27 18:25:35 —-D—- C:Windowssystem32ca-ES
2009-10-27 18:25:24 —-D—- C:Windowssystem32vi-VN
2009-10-27 17:41:05 —-D—- C:rsit
2009-10-27 17:28:01 —-D—- C:Windowssystem32EventProviders
2009-10-27 16:53:49 —-D—- C:Program FilesTrend Micro
2009-10-27 16:48:02 —-A—- C:Windowssystem32occache.dll
2009-10-27 16:48:02 —-A—- C:Windowssystem32jsproxy.dll
2009-10-27 16:48:01 —-A—- C:Windowssystem32msfeedsbs.dll
2009-10-27 16:48:01 —-A—- C:Windowssystem32msfeeds.dll
2009-10-27 16:48:01 —-A—- C:Windowssystem32ieui.dll
2009-10-27 16:48:01 —-A—- C:Windowssystem32iepeers.dll
2009-10-27 16:48:00 —-A—- C:Windowssystem32wininet.dll
2009-10-27 16:48:00 —-A—- C:Windowssystem32iesetup.dll
2009-10-27 16:48:00 —-A—- C:Windowssystem32iernonce.dll
2009-10-27 16:47:59 —-A—- C:Windowssystem32msfeedssync.exe
2009-10-27 16:47:59 —-A—- C:Windowssystem32iertutil.dll
2009-10-27 16:47:59 —-A—- C:Windowssystem32ie4uinit.exe
2009-10-27 16:47:58 —-A—- C:Windowssystem32ieUnatt.exe
2009-10-27 16:47:58 —-A—- C:Windowssystem32iesysprep.dll
2009-10-27 16:47:58 —-A—- C:Windowssystem32iedkcs32.dll
2009-10-27 16:47:57 —-A—- C:Windowssystem32urlmon.dll
2009-10-27 16:47:56 —-A—- C:Windowssystem32ieframe.dll
2009-10-27 16:47:55 —-A—- C:Windowssystem32mshtml.dll
2009-10-27 16:45:36 —-A—- C:Windowssystem32mshtmler.dll
2009-10-27 16:45:36 —-A—- C:Windowssystem32mshtmled.dll
2009-10-27 16:45:36 —-A—- C:Windowssystem32icardie.dll
2009-10-27 16:45:36 —-A—- C:Windowssystem32admparse.dll
2009-10-27 16:45:35 —-A—- C:Windowssystem32msls31.dll
2009-10-27 16:45:35 —-A—- C:Windowssystem32corpol.dll
2009-10-27 16:45:34 —-A—- C:Windowssystem32imgutil.dll
2009-10-27 16:45:34 —-A—- C:Windowssystem32ieakeng.dll
2009-10-27 16:45:34 —-A—- C:Windowssystem32dxtrans.dll
2009-10-27 16:45:34 —-A—- C:Windowssystem32dxtmsft.dll
2009-10-27 16:45:33 —-A—- C:Windowssystem32licmgr10.dll
2009-10-27 16:45:33 —-A—- C:Windowssystem32inseng.dll
2009-10-27 16:45:32 —-A—- C:Windowssystem32webcheck.dll
2009-10-27 16:45:32 —-A—- C:Windowssystem32msrating.dll
2009-10-27 16:45:32 —-A—- C:Windowssystem32ieakui.dll
2009-10-27 16:45:32 —-A—- C:Windowssystem32ieaksie.dll
2009-10-27 16:45:31 —-A—- C:Windowssystem32WinFXDocObj.exe
2009-10-27 16:45:31 —-A—- C:Windowssystem32wextract.exe
2009-10-27 16:45:31 —-A—- C:Windowssystem32mstime.dll
2009-10-27 16:45:30 —-A—- C:Windowssystem32pngfilt.dll
2009-10-27 16:45:30 —-A—- C:Windowssystem32ieapfltr.dll
2009-10-27 16:45:30 —-A—- C:Windowssystem32advpack.dll
2009-10-27 16:45:29 —-A—- C:Windowssystem32vbscript.dll
2009-10-27 16:45:29 —-A—- C:Windowssystem32url.dll
2009-10-27 16:45:27 —-A—- C:Windowssystem32SetDepNx.exe
2009-10-27 16:45:27 —-A—- C:Windowssystem32RegisterIEPKEYs.exe
2009-10-27 16:45:27 —-A—- C:Windowssystem32mshta.exe
2009-10-27 16:45:27 —-A—- C:Windowssystem32iexpress.exe
2009-10-27 16:45:26 —-A—- C:Windowssystem32SetIEInstalledDate.exe
2009-10-27 16:45:26 —-A—- C:Windowssystem32PDMSetup.exe
2009-10-27 16:40:28 —-A—- C:Windowssystem32wups2.dll
2009-10-27 16:40:28 —-A—- C:Windowssystem32wuauclt.exe
2009-10-27 16:40:27 —-A—- C:Windowssystem32wucltux.dll
2009-10-27 16:40:27 —-A—- C:Windowssystem32wuaueng.dll
2009-10-27 16:40:10 —-A—- C:Windowssystem32wups.dll
2009-10-27 16:40:10 —-A—- C:Windowssystem32wudriver.dll
2009-10-27 16:40:10 —-A—- C:Windowssystem32wuapi.dll
2009-10-27 16:40:00 —-A—- C:Windowssystem32wuwebv.dll
2009-10-27 16:40:00 —-A—- C:Windowssystem32wuapp.exe
2009-10-21 14:25:52 —-D—- C:UsersIrbisAppDataRoamingPeerNetworking
2009-10-19 21:25:37 —-D—- C:Program FilesAPC
2009-10-15 23:50:18 —-D—- C:Program FilesESET
2009-10-15 22:35:26 —-D—- C:ProgramDataESET
2009-10-15 19:27:05 —-D—- C:Program FilesIObit
2009-10-15 16:00:22 —-A—- C:Windowssystem32msv1_0.dll
2009-10-15 15:56:40 —-A—- C:Windowssystem32ntkrnlpa.exe
2009-10-15 15:56:38 —-A—- C:Windowssystem32ntoskrnl.exe
2009-10-15 15:34:59 —-A—- C:Windowssystem32msasn1.dll
2009-10-15 15:34:56 —-A—- C:Windowssystem32WMSPDMOD.DLL
2009-10-13 10:07:49 —-D—- C:UsersIrbisAppDataRoamingSamsung
2009-10-13 10:03:40 —-D—- C:Windowssystem32Samsung_USB_Drivers
2009-10-13 10:03:38 —-D—- C:Program FilesSamsung
2009-10-12 19:39:19 —-A—- C:Windowssystem32ShellManager310E2D762.dll
2009-10-12 18:32:13 —-D—- C:UsersIrbisAppDataRoamingAhead
2009-10-12 18:31:04 —-D—- C:Program FilesCommon FilesAhead
2009-10-12 17:56:37 —-D—- C:UsersIrbisAppDataRoamingNeroDigital(TM)
2009-10-09 19:34:57 —-D—- C:Program FilesIVT Corporation
2009-10-09 18:32:01 —-A—- C:WindowsDIFxAPI.dll
2009-10-09 18:32:00 —-A—- C:Windowssystem32RtkHDMI.dll
2009-10-09 18:32:00 —-A—- C:Windowssystem32RHDMIExt.dll
2009-10-09 18:32:00 —-A—- C:Windowssystem32RHCoInst.dll
2009-10-09 18:32:00 —-A—- C:WindowsRtkUpd.exe
2009-10-09 14:51:49 —-D—- C:ProgramDataATI
2009-10-09 10:51:55 —-A—- C:Windowsntbtlog.txt
2009-10-06 17:16:34 —-D—- C:UsersIrbisAppDataRoamingCMedia
2009-10-06 14:06:54 —-D—- C:Windowspss

======List of files/folders modified in the last 1 months======

2009-11-03 22:03:45 —-D—- C:WindowsTemp
2009-11-03 22:03:37 —-D—- C:WindowsPrefetch
2009-11-03 19:45:40 —-D—- C:WindowsSystem32
2009-11-03 19:45:39 —-D—- C:Windowsinf
2009-11-03 19:45:39 —-A—- C:Windowssystem32PerfStringBackup.INI
2009-11-03 19:42:40 —-D—- C:UsersIrbisAppDataRoamingOpenOffice.org2
2009-11-03 14:52:31 —-D—- C:Windowssystem32drivers
2009-11-03 14:52:29 —-HD—- C:ProgramData
2009-11-03 14:52:27 —-RD—- C:Program Files
2009-11-03 14:45:35 —-D—- C:Windowsrescache
2009-11-03 14:40:20 —-SHD—- C:System Volume Information
2009-10-30 20:28:46 —-D—- C:Windowssystem32Tasks
2009-10-30 20:24:52 —-D—- C:Windows
2009-10-30 20:24:45 —-D—- C:Windowssystem32ru-RU
2009-10-30 20:24:43 —-D—- C:Windowssystem32wbem
2009-10-30 20:24:41 —-D—- C:Windowssystem32zh-TW
2009-10-30 20:24:41 —-D—- C:Windowssystem32zh-HK
2009-10-30 20:24:41 —-D—- C:Windowssystem32zh-CN
2009-10-30 20:24:41 —-D—- C:Windowssystem32uk-UA
2009-10-30 20:24:41 —-D—- C:Windowssystem32tr-TR
2009-10-30 20:24:41 —-D—- C:Windowssystem32th-TH
2009-10-30 20:24:41 —-D—- C:Windowssystem32sv-SE
2009-10-30 20:24:41 —-D—- C:Windowssystem32sr-Latn-CS
2009-10-30 20:24:41 —-D—- C:Windowssystem32sl-SI
2009-10-30 20:24:41 —-D—- C:Windowssystem32sk-SK
2009-10-30 20:24:41 —-D—- C:Windowssystem32ro-RO
2009-10-30 20:24:41 —-D—- C:Windowssystem32pt-PT
2009-10-30 20:24:41 —-D—- C:Windowssystem32pt-BR
2009-10-30 20:24:41 —-D—- C:Windowssystem32pl-PL
2009-10-30 20:24:41 —-D—- C:Windowssystem32nl-NL
2009-10-30 20:24:41 —-D—- C:Windowssystem32nb-NO
2009-10-30 20:24:41 —-D—- C:Windowssystem32lv-LV
2009-10-30 20:24:41 —-D—- C:Windowssystem32lt-LT
2009-10-30 20:24:41 —-D—- C:Windowssystem32ko-KR
2009-10-30 20:24:41 —-D—- C:Windowssystem32ja-JP
2009-10-30 20:24:41 —-D—- C:Windowssystem32it-IT
2009-10-30 20:24:41 —-D—- C:Windowssystem32hu-HU
2009-10-30 20:24:41 —-D—- C:Windowssystem32hr-HR
2009-10-30 20:24:41 —-D—- C:Windowssystem32he-IL
2009-10-30 20:24:41 —-D—- C:Windowssystem32fr-FR
2009-10-30 20:24:41 —-D—- C:Windowssystem32fi-FI
2009-10-30 20:24:41 —-D—- C:Windowssystem32et-EE
2009-10-30 20:24:41 —-D—- C:Windowssystem32es-ES
2009-10-30 20:24:41 —-D—- C:Windowssystem32en-US
2009-10-30 20:24:41 —-D—- C:Windowssystem32el-GR
2009-10-30 20:24:41 —-D—- C:Windowssystem32de-DE
2009-10-30 20:24:41 —-D—- C:Windowssystem32da-DK
2009-10-30 20:24:41 —-D—- C:Windowssystem32cs-CZ
2009-10-30 20:24:41 —-D—- C:Windowssystem32bg-BG
2009-10-30 20:24:41 —-D—- C:Windowssystem32ar-SA
2009-10-30 19:30:34 —-D—- C:WindowsMicrosoft.NET
2009-10-30 19:29:50 —-RSD—- C:Windowsassembly
2009-10-30 18:48:39 —-D—- C:Windowswinsxs
2009-10-30 18:48:37 —-D—- C:Windowssystem32catroot
2009-10-30 18:47:04 —-D—- C:Windowssystem32catroot2
2009-10-30 18:38:21 —-D—- C:Program FilesInternet Explorer
2009-10-30 18:37:56 —-D—- C:Program FilesWindows Media Player
2009-10-27 18:51:22 —-D—- C:WindowsTasks
2009-10-27 18:35:03 —-SHD—- C:Boot
2009-10-27 18:27:56 —-D—- C:Program FilesWindows Calendar
2009-10-27 18:27:55 —-D—- C:Program FilesWindows Mail
2009-10-27 18:27:54 —-D—- C:Program FilesMovie Maker
2009-10-27 18:27:52 —-D—- C:Program FilesWindows Sidebar
2009-10-27 18:27:51 —-D—- C:Program FilesWindows Collaboration
2009-10-27 18:27:48 —-D—- C:Program FilesWindows Photo Gallery
2009-10-27 18:27:48 —-D—- C:Program FilesCommon FilesSystem
2009-10-27 18:27:39 —-D—- C:Windowsservicing
2009-10-27 18:27:39 —-D—- C:Program FilesWindows Defender
2009-10-27 18:27:21 —-D—- C:WindowsIME
2009-10-27 18:27:20 —-D—- C:Windowssystem32XPSViewer
2009-10-27 18:27:20 —-D—- C:Windowssystem32oobe
2009-10-27 18:27:19 —-D—- C:Windowssystem32migration
2009-10-27 18:27:14 —-D—- C:Windowssystem32AdvancedInstallers
2009-10-27 18:27:11 —-D—- C:Windowssystem32SLUI
2009-10-27 18:27:11 —-D—- C:Windowssystem32setup
2009-10-27 18:27:10 —-D—- C:Windowssystem32ru
2009-10-27 18:27:10 —-D—- C:Windowssystem32manifeststore
2009-10-27 18:27:02 —-D—- C:Windowssystem32migwiz
2009-10-27 18:25:43 —-RSD—- C:WindowsFonts
2009-10-27 18:25:42 —-D—- C:WindowsAppPatch
2009-10-27 18:25:23 —-D—- C:Windowssystem32Boot
2009-10-27 17:20:55 —-D—- C:WindowsPolicyDefinitions
2009-10-22 15:33:30 —-SHD—- C:WindowsInstaller
2009-10-22 15:33:15 —-A—- C:Windowssystem32MsiExec.exe.log
2009-10-22 15:31:43 —-D—- C:Program FilesCommon FilesNero
2009-10-22 15:29:48 —-D—- C:ProgramDataNero
2009-10-19 22:54:19 —-D—- C:Program FilesMozilla Firefox
2009-10-19 21:25:31 —-HD—- C:Program FilesInstallShield Installation Information
2009-10-19 19:18:09 —-D—- C:UsersIrbisAppDataRoamingDesktopicon
2009-10-19 19:13:40 —-D—- C:Program FilesUnlocker
2009-10-19 18:01:55 —-D—- C:Windowssystem32RTCOM
2009-10-18 22:00:37 —-A—- C:Windowssystem32PnkBstrB.exe
2009-10-15 23:30:08 —-D—- C:ProgramDataSkype
2009-10-15 23:30:08 —-D—- C:Program FilesCommon Files
2009-10-15 15:12:17 —-D—- C:UsersIrbisAppDataRoamingskypePM
2009-10-12 20:15:33 —-D—- C:Program FilesNero
2009-10-12 19:20:57 —-D—- C:UsersIrbisAppDataRoamingNero
2009-10-12 18:16:04 —-A—- C:WindowsIrremote.ini
2009-10-09 19:36:47 —-D—- C:ProgramDataBluetooth
2009-10-09 17:48:41 —-D—- C:WindowsDebug
2009-10-09 17:39:31 —-D—- C:Windowssystem32WDI
2009-10-09 14:51:49 —-SHD—- C:$Recycle.Bin
2009-10-09 14:49:04 —-RD—- C:Users
2009-10-06 14:20:01 —-D—- C:ProgramDataInstallations
2009-10-06 14:02:55 —-D—- C:UsersIrbisAppDataRoamingIP-TV Player
2009-10-04 03:06:51 —-HDC—- C:ProgramData{0151C9FC-719D-4459-B1E2-4685CC6E62A8}

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 easdrv;easdrv; C:Windowssystem32DRIVERSeasdrv.sys [2008-07-01 53256]
R1 epfwtdir;epfwtdir; C:Windowssystem32DRIVERSepfwtdir.sys [2008-07-01 34312]
R1 StarOpen;StarOpen; C:Windowssystem32driversStarOpen.sys [2006-07-24 5632]
R1 Uim_IM;UIM Drive Backup Image Plugin; C:WindowsSystem32DriversUim_IM.sys [2007-07-16 131192]
R1 UimBus;Universal Image Mounter Controller; C:Windowssystem32DRIVERSUimBus.sys [2007-07-16 32080]
R2 atksgt;atksgt; C:Windowssystem32DRIVERSatksgt.sys [2009-04-18 279712]
R2 eamon;EAMON; C:Windowssystem32DRIVERSeamon.sys [2008-07-01 39944]
R2 lirsgt;lirsgt; C:Windowssystem32DRIVERSlirsgt.sys [2009-04-18 25888]
R3 atikmdag;atikmdag; C:Windowssystem32DRIVERSatikmdag.sys [2008-06-21 3695616]
R3 BlueletAudio;Bluetooth Audio Service; C:Windowssystem32DRIVERSblueletaudio.sys [2007-06-24 34312]
R3 BlueletSCOAudio;Bluetooth SCO Audio Service; C:Windowssystem32DRIVERSBlueletSCOAudio.sys [2007-06-24 27656]
R3 BT;Bluetooth PAN Network Adapter; C:Windowssystem32DRIVERSbtnetdrv.sys [2007-03-05 18320]
R3 Btcsrusb;Bluetooth USB For Bluetooth Service; C:WindowsSystem32Driversbtcusb.sys [2007-06-24 38920]
R3 dc3d;USBCCGP filter driver (dc3d); C:Windowssystem32DRIVERSdc3d.sys [2009-01-15 15360]
R3 HdAudAddService;Драйвер функции UAA для службы High Definition Audio (Microsoft), версия 1.1; C:Windowssystem32driversHdAudio.sys [2009-04-11 236544]
R3 NuidFltr;NUID filter driver; C:Windowssystem32DRIVERSNuidFltr.sys [2009-05-09 14736]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:Windowssystem32DRIVERSnvmfdx32.sys [2007-11-18 1040544]
R3 Point32;Microsoft IntelliPoint Filter Driver; C:Windowssystem32DRIVERSpoint32k.sys [2007-08-21 24064]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:WindowsSystem32DriversRootMdm.sys [2008-01-21 8192]
R3 RTHDMIAzAudService;Service for HDMI; C:Windowssystem32driversRtHDMIV.sys [2008-08-26 150560]
R3 VComm;Virtual Serial port driver; C:Windowssystem32DRIVERSVComm.sys [2007-03-05 34448]
R3 VcommMgr;Bluetooth VComm Manager Service; C:WindowsSystem32DriversVcommMgr.sys [2007-03-05 44304]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:Windowssystem32DRIVERSwmiacpi.sys [2008-01-21 11264]
S3 a0w0llan;a0w0llan; C:Windowssystem32driversa0w0llan.sys []
S3 BthEnum;Служба перечислителя Bluetooth; C:Windowssystem32DRIVERSBthEnum.sys [2009-04-11 22528]
S3 BthPan;Устройства Bluetooth (личной сети); C:Windowssystem32DRIVERSbthpan.sys [2008-01-21 92160]
S3 BTHPORT;Драйвер порта Bluetooth; C:WindowsSystem32DriversBTHport.sys [2008-04-29 220160]
S3 BTHUSB;Драйвер порта USB радиомодуля Bluetooth; C:WindowsSystem32DriversBTHUSB.sys [2008-04-29 29184]
S3 btnetBUs;Bluetooth PAN Bus Service; C:WindowsSystem32DriversbtnetBus.sys [2009-06-17 29192]
S3 drmkaud;Звуковой дешифратор DRM ядра системы; C:Windowssystem32driversdrmkaud.sys [2008-01-21 5632]
S3 HidBatt;Драйвер батареи ИБП HID; C:Windowssystem32DRIVERSHidBatt.sys [2008-01-21 21504]
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:Windowssystem32driversRTKVHDA.sys []
S3 IvtBtBUs;IVT Bluetooth Bus Service; C:WindowsSystem32DriversIvtBtBus.sys []
S3 MSKSSRV;Представитель служб потоков Microsoft; C:Windowssystem32driversMSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Посредник синхронизации потоков Microsoft; C:Windowssystem32driversMSPCLOCK.sys [2008-01-21 5888]
S3 MSPQM;Представитель диспетчера качества потоков Microsoft; C:Windowssystem32driversMSPQM.sys [2008-01-21 5504]
S3 MSTEE;Преобразователь потоков Tee/Sink-to-Sink Microsoft; C:Windowssystem32driversMSTEE.sys [2008-01-21 6016]
S3 nmwcd;Nokia USB Phone Parent; C:Windowssystem32driversccdcmb.sys [2009-02-09 17664]
S3 nmwcdc;Nokia USB Generic; C:Windowssystem32driversccdcmbo.sys [2009-02-09 22016]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:Windowssystem32DRIVERSpccsmcfd.sys [2008-08-26 18816]
S3 RFCOMM;Устройство Bluetooth (протокол RFCOMM TDI); C:Windowssystem32DRIVERSrfcomm.sys [2009-04-11 148992]
S3 RTL8169;Realtek 8169 NT драйвер; C:Windowssystem32DRIVERSRtlh86.sys [2006-11-02 44544]
S3 upperdev;upperdev; C:Windowssystem32DRIVERSusbser_lowerflt.sys [2009-02-09 7808]
S3 usbser;Nokia USB Serial Port; C:Windowssystem32driversusbser.sys [2009-04-11 27648]
S3 UsbserFilt;UsbserFilt; C:Windowssystem32DRIVERSusbser_lowerfltj.sys [2009-02-09 7808]
S3 vaxscsi;vaxscsi; C:WindowsSystem32Driversvaxscsi.sys [2008-12-28 223128]
S3 winusb;WinUSB Service; C:Windowssystem32DRIVERSwinusb.sys [2009-04-11 31616]
S3 WUDFRd;WUDFRd; C:Windowssystem32DRIVERSWUDFRd.sys [2008-01-21 83328]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:Windowssystem32driverserrdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:Windowssystem32driversmegasr.sys [2008-01-21 386616]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 APC UPS Service;APC UPS Service; C:Program FilesAPCAPC PowerChute Personal Editionmainserv.exe [2005-12-12 176193]
R2 ekrn;Eset Service; C:Program FilesESETESET NOD32 Antivirusekrn.exe [2007-12-21 468224]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:Program FilesNeroNero8Nero BackItUpNBService.exe [2007-09-20 853288]
R2 RapiMgr;@%windir%WindowsMobilerapimgr.dll,-104; C:Windowssystem32svchost.exe [2008-01-21 21504]
R2 WcesComm;@%windir%WindowsMobilewcescomm.dll,-40079; C:Windowssystem32svchost.exe [2008-01-21 21504]
S3 aspnet_state;Служба состояний ASP.NET; C:WindowsMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2009-03-30 31048]
S3 EhttpSrv;Eset HTTP Server; C:Program FilesESETESET NOD32 AntivirusEHttpSrv.exe [2008-07-01 19200]
S3 FontCache;@%systemroot%system32FntCache.dll,-100; C:Windowssystem32svchost.exe [2008-01-21 21504]
S3 NMIndexingService;NMIndexingService; C:Program FilesCommon FilesNeroLibNMIndexingService.exe [2007-09-20 382248]
S3 usprserv;User Privilege Service; C:WindowsSystem32svchost.exe [2008-01-21 21504]
S4 BthServ;@%SystemRoot%System32bthserv.dll,-101; C:Windowssystem32svchost.exe [2008-01-21 21504]

---

EOF

---

[Автор]

Сообщения