Созданные ответы форума
-
Сообщения
-
Проверила компьютер через программу GMER.
Результаты таковы:GMER 1.0.15.14939 — http://www.gmer.net
Rootkit scan 2009-03-19 22:14:48
Windows 5.1.2600 Service Pack 2—- User code sections — GMER 1.0.15 —-
.text C:Program FilesESETESET NOD32 Antivirusekrn.exe[1140] kernel32.dll!SetUnhandledExceptionFilter 7C8447ED 4 Bytes [C2, 04, 00, 00]
.text C:Program FilesInternet Exploreriexplore.exe[2032] USER32.dll!DialogBoxParamW 77D45F97 5 Bytes JMP 4360F341 C:WINDOWSsystem32IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:Program FilesInternet Exploreriexplore.exe[2032] USER32.dll!DialogBoxIndirectParamW 77D5204A 5 Bytes JMP 437A187F C:WINDOWSsystem32IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:Program FilesInternet Exploreriexplore.exe[2032] USER32.dll!MessageBoxIndirectA 77D5A062 5 Bytes JMP 437A1800 C:WINDOWSsystem32IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:Program FilesInternet Exploreriexplore.exe[2032] USER32.dll!DialogBoxParamA 77D5B124 5 Bytes JMP 437A1844 C:WINDOWSsystem32IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:Program FilesInternet Exploreriexplore.exe[2032] USER32.dll!MessageBoxExW 77D706D8 5 Bytes JMP 437A178C C:WINDOWSsystem32IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:Program FilesInternet Exploreriexplore.exe[2032] USER32.dll!MessageBoxExA 77D706FC 5 Bytes JMP 437A17C6 C:WINDOWSsystem32IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:Program FilesInternet Exploreriexplore.exe[2032] USER32.dll!DialogBoxIndirectParamA 77D76E45 5 Bytes JMP 437A18BA C:WINDOWSsystem32IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:Program FilesInternet Exploreriexplore.exe[2032] USER32.dll!MessageBoxIndirectW 77D86225 5 Bytes JMP 436316F6 C:WINDOWSsystem32IEFRAME.dll (Internet Explorer/Microsoft Corporation)—- Devices — GMER 1.0.15 —-
AttachedDevice FileSystemNtfs Ntfs eamon.sys (Amon monitor/ESET)
AttachedDevice DriverTcpip DeviceTcp epfwtdir.sys
AttachedDevice FileSystemFastfat Fat eamon.sys (Amon monitor/ESET)—- Registry — GMER 1.0.15 —-
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (L002TP) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPTP) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPPoE) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@374@4O4494 ?0404@0404;4;0454;4L4=4K494 ?4>4@4B4 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (IP) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 ?4;0404=484@4>0424I484:0404 ?0404:0454B4>0424 1?2?
Reg HKLMSYSTEMCurrentControlSetServicesSysmonLogLog Queries{c48954cf-7f4b-46a8-861f-d3f4af44daf6}@204B4@480414C4B4K4 E4@0404=0454=484O4 0040404=4=4K4E4 33
Reg HKLMSYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (L002TP) 1?
Reg HKLMSYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPTP) 1?
Reg HKLMSYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPPoE) 1?
Reg HKLMSYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@374@4O4494 ?0404@0404;4;0454;4L4=4K494 ?4>4@4B4 1?
Reg HKLMSYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (IP) 1?
Reg HKLMSYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 ?4;0404=484@4>0424I484:0404 ?0404:0454B4>0424 1?2?
Reg HKLMSYSTEMControlSet002ServicesSysmonLogLog Queries{c48954cf-7f4b-46a8-861f-d3f4af44daf6}@204B4@480414C4B4K4 E4@0404=0454=484O4 0040404=4=4K4E4 33
Reg HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.ÀOpenWithProgids@204_auto_file—- EOF — GMER 1.0.15 —-
Нет, вирус больше не появлялся (тьфу-тьфу), да и компьютер после вчерашних процедур стал работать лучше!
СПАСИБО ОГРОМНОЕ!!! (даже слов не хватит, чтобы выразить мою благодарность!)Выполнила все инструкции по лечению «больного» 🙂 (честно говоря, до последнего момента он немного подтормаживал, особенно при работе с Интернетом. Сейчас вроде бы получше стало).
Вот последние результаты из «истории болезни»:Logfile of random’s system information tool 1.05 (written by random/random)
Run by Root at 2009-01-11 19:35:15
Microsoft Windows XP Professional Service Pack 2
System drive C: has 25 GB (63%) free of 40 GB
Total RAM: 1023 MB (59% free)Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:35:17, on 11.01.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: NormalRunning processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:WINDOWSRTHDCPL.EXE
C:Program FilesCommon FilesDoctor WebScanning Enginedwengine.exe
C:Program FilesCommon FilesInstallShieldUpdateServiceissch.exe
C:Program FilesJavajre6binjqs.exe
C:Program FilesABBYY FineReader 7.0 Professional EditionAbbyyNewsReader.exe
C:Program FilesAdobeReader 8.0ReaderReader_sl.exe
C:WINDOWSsystem32nvsvc32.exe
C:Program FilesJavajre6binjusched.exe
C:Program FilesDrWebSpIDerAgent.exe
C:PROGRA~1DrWebspidernt.exe
C:Program FilesDrWebspiderml.exe
C:Program FilesDrWebspidergate.exe
C:PROGRA~1DrWebspiderui.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesCanonCALCALMAIN.exe
C:WINDOWSsystem32wbemwmiapsrv.exe
C:Program FilesInternet Exploreriexplore.exe
C:WINDOWSsystem32wuauclt.exe
C:Documents and SettingsRootРабочий столЛечение вирусовRSIT.exe
C:Program Filestrend microRoot.exeR0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.yandex.ru/
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: (no name) — {83821C2B-32A8-4DD7-B6D4-44309A78E668} — C:Program FilesMail.RuAgentMradllnewmrasearch.dll
O2 — BHO: Adobe PDF Reader Link Helper — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 — BHO: BitComet ClickCapture — {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} — E:BitComettoolsBitCometBHO_1.1.7.4.dll
O2 — BHO: Java(tm) Plug-In SSV Helper — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — C:Program FilesJavajre6binssv.dll
O2 — BHO: (no name) — {7E853D72-626A-48EC-A868-BA8D5E23E045} — (no file)
O2 — BHO: Google Toolbar Helper — {AA58ED58-01DD-4d91-8333-CF10577473F7} — c:program filesgooglegoogletoolbar2.dll
O2 — BHO: Google Toolbar Notifier BHO — {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} — C:Program FilesGoogleGoogleToolbarNotifier3.1.807.1746swg.dll
O2 — BHO: Java(tm) Plug-In 2 SSV Helper — {DBC80044-A445-435b-BC74-9C25C1C588A9} — C:Program FilesJavajre6binjp2ssv.dll
O2 — BHO: JQSIEStartDetectorImpl — {E7E6F031-17CE-4C07-BC86-EABFE594F69C} — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll
O3 — Toolbar: &Google — {2318C2B1-4965-11d4-9B18-009027A5CD4F} — c:program filesgooglegoogletoolbar2.dll
O3 — Toolbar: Rambler-Ассистент — {468CD8A9-7C25-45FA-969E-3D925C689DC4} — C:Program FilesRambler AssistantramblertoolbarU1.dll
O4 — HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 — HKLM..Run: [Alcmtr] ALCMTR.EXE
O4 — HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 — HKLM..Run: [nwiz] nwiz.exe /install
O4 — HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 — HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 — HKLM..Run: [ISUSPM Startup] «C:Program FilesCommon FilesInstallShieldUpdateServiceisuspm.exe» -startup
O4 — HKLM..Run: [ISUSScheduler] «C:Program FilesCommon FilesInstallShieldUpdateServiceissch.exe» -start
O4 — HKLM..Run: [MAgent] C:Program FilesMail.RuAgentmagent.exe -LM
O4 — HKLM..Run: [FineReader7NewsReaderPro] C:Program FilesABBYY FineReader 7.0 Professional EditionAbbyyNewsReader.exe
O4 — HKLM..Run: [Adobe Reader Speed Launcher] «C:Program FilesAdobeReader 8.0ReaderReader_sl.exe»
O4 — HKLM..Run: [SunJavaUpdateSched] «C:Program FilesJavajre6binjusched.exe»
O4 — HKLM..Run: [SpIDerAgent] «C:Program FilesDrWebSpIDerAgent.exe»
O4 — HKLM..Run: [SpIDerMail] «C:Program FilesDrWebspiderml.exe»
O4 — HKLM..Run: [SpIDerGate] «C:Program FilesDrWebspidergate.exe» -autorun
O4 — HKLM..Run: [SpIDerNT] C:PROGRA~1DrWebspiderui.exe /agent
O4 — HKCU..Run: [swg] C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
O4 — HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-20..RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — HKUS.DEFAULT..RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User ‘Default user’)
O4 — S-1-5-18 Startup: Adobe Gamma.lnk = C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe (User ‘SYSTEM’)
O4 — .DEFAULT Startup: Adobe Gamma.lnk = C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe (User ‘Default user’)
O4 — Startup: Adobe Gamma.lnk = C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe
O8 — Extra context menu item: &D&ownload &with BitComet — res://E:BitCometBitComet.exe/AddLink.htm
O8 — Extra context menu item: &D&ownload all video with BitComet — res://E:BitCometBitComet.exe/AddVideo.htm
O8 — Extra context menu item: &D&ownload all with BitComet — res://E:BitCometBitComet.exe/AddAllLink.htm
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 — Extra context menu item: Scan link by Dr.Web — http://www.drweb.com/online/drweb-online-en.html
O8 — Extra context menu item: Добавить в Rambler-Закладки — res://C:Program FilesRambler AssistantramblertoolbarU1.dll/zakladki.htm
O8 — Extra context menu item: Найти с помощью Рамблера — res://C:Program FilesRambler AssistantramblertoolbarU1.dll/search.htm
O8 — Extra context menu item: Перевести с помощью словарей Рамблера — res://C:Program FilesRambler AssistantramblertoolbarU1.dll/dic.htm
O9 — Extra button: BitComet Search — {461CC20B-FB6E-4f16-8FE8-C29359DB100E} — E:BitComettoolsBitCometBHO_1.1.7.4.dll
O9 — Extra button: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra ‘Tools’ menuitem: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra button: Skype — {77BF5300-1474-4EC7-9980-D32B190E9B07} — C:WINDOWSsystem32shdocvw.dll
O9 — Extra button: Research — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2Office12REFIEBAR.DLL
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O16 — DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) — http://www.kaspersky.com/kos/russian/partner/rus/kavwebscan_unicode.cab
O16 — DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) — http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 — DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) — http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab
O17 — HKLMSystemCCSServicesTcpip..{3B7AD64D-DA3F-4F1A-A0BB-9A1A55337C2F}: NameServer = 195.34.32.116 212.188.4.10
O18 — Protocol: skype4com — {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} — C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O23 — Service: Adobe LM Service — Adobe Systems — C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe
O23 — Service: Canon Camera Access Library 8 (CCALib8) — Canon Inc. — C:Program FilesCanonCALCALMAIN.exe
O23 — Service: Dr.Web ® Scanning Engine (DrWebEngine) (DrWebEngine) — Doctor Web, Ltd. — C:Program FilesCommon FilesDoctor WebScanning Enginedwengine.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Google Updater Service (gusvc) — Google — C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: Java Quick Starter (JavaQuickStarterService) — Sun Microsystems, Inc. — C:Program FilesJavajre6binjqs.exe
O23 — Service: NetMeeting Remote Desktop Sharing (mnmsrvc) — Корпорация Майкрософт — C:WINDOWSsystem32mnmsrvc.exe
O23 — Service: NVIDIA Display Driver Service (NVSvc) — NVIDIA Corporation — C:WINDOWSsystem32nvsvc32.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: SpIDer Guard for Windows (SPIDERNT) — Doctor Web, Ltd. — C:PROGRA~1DrWebspidernt.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe—
End of file — 10530 bytes======Scheduled tasks folder======
C:WINDOWStasksDr.Web Update.job
======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll [2006-10-22 62080][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}]
BitComet Helper — E:BitComettoolsBitCometBHO_1.1.7.4.dll [2007-07-04 513336][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper — C:Program FilesJavajre6binssv.dll [2008-12-21 320920][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{7E853D72-626A-48EC-A868-BA8D5E23E045}]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper — c:program filesgooglegoogletoolbar2.dll [2007-01-19 2403392][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO — C:Program FilesGoogleGoogleToolbarNotifier3.1.807.1746swg.dll [2008-09-13 737776][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper — C:Program FilesJavajre6binjp2ssv.dll [2008-12-21 34816][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll [2008-12-21 73728][HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} — &Google — c:program filesgooglegoogletoolbar2.dll [2007-01-19 2403392]
{468CD8A9-7C25-45FA-969E-3D925C689DC4} — Rambler-Ассистент — C:Program FilesRambler AssistantramblertoolbarU1.dll [2008-12-26 849392][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«RTHDCPL»=C:WINDOWSRTHDCPL.EXE [2007-03-21 16126464]
«Alcmtr»=C:WINDOWSALCMTR.EXE [2005-05-03 69632]
«NvCplDaemon»=C:WINDOWSsystem32NvCpl.dll [2006-03-09 7561216]
«nwiz»=nwiz.exe /install []
«NvMediaCenter»=C:WINDOWSsystem32NvMcTray.dll [2006-03-09 86016]
«NeroFilterCheck»=C:WINDOWSsystem32NeroCheck.exe [2001-07-09 155648]
«ISUSPM Startup»=C:Program FilesCommon FilesInstallShieldUpdateServiceisuspm.exe [2005-08-11 249856]
«ISUSScheduler»=C:Program FilesCommon FilesInstallShieldUpdateServiceissch.exe [2005-08-11 81920]
«MAgent»=C:Program FilesMail.RuAgentmagent.exe [2008-10-09 4417016]
«FineReader7NewsReaderPro»=C:Program FilesABBYY FineReader 7.0 Professional EditionAbbyyNewsReader.exe [2003-09-12 278528]
«Adobe Reader Speed Launcher»=C:Program FilesAdobeReader 8.0ReaderReader_sl.exe [2008-01-11 39792]
«SunJavaUpdateSched»=C:Program FilesJavajre6binjusched.exe [2008-12-21 136600]
«SpIDerAgent»=C:Program FilesDrWebSpIDerAgent.exe [2008-12-17 697584]
«SpIDerMail»=C:Program FilesDrWebspiderml.exe [2008-12-12 627952]
«SpIDerGate»=C:Program FilesDrWebspidergate.exe [2008-12-15 1402096]
«SpIDerNT»=C:PROGRA~1DrWebspiderui.exe [2008-12-09 197896][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«swg»=C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe [2007-08-03 68856]
«ctfmon.exe»=C:WINDOWSsystem32ctfmon.exe [2007-03-20 30208][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregCTFMON.EXE]
C:WINDOWSsystem32ctfmon.exe [2007-03-20 30208][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIMJPMIG8.1]
C:WINDOWSIMEimjp8_1IMJPMIG.EXE [2004-08-18 208952][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPHIME2002A]
C:WINDOWSsystem32IMETINTLGNTTINTSETP.EXE [2004-08-18 455168][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPHIME2002ASync]
C:WINDOWSsystem32IMETINTLGNTTINTSETP.EXE [2004-08-18 455168][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregProcess Killer]
C:Program FilesProcess Killerprkiller.exe [2006-11-23 38400][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupfolderC:^Documents and Settings^All Users^Главное меню^Программы^Автозагрузка^RKLauncher.lnk]
C:PROGRA~1RK_LAU~1RKLAUN~1.EXE [2006-08-14 692224]C:Documents and SettingsRootГлавное менюПрограммыАвтозагрузка
Adobe Gamma.lnk — C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32WPDShServiceObj.dll [2006-10-18 133632][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=255
«NoSMMyPictures»=1
«NoSMConfigurePrograms»=1[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«C:Program FileseMuleeMule.exe»=»C:Program FileseMuleeMule.exe:*:Enabled:eMule Plus»
«C:Program FilesMSN Messengermsnmsgr.exe»=»C:Program FilesMSN Messengermsnmsgr.exe:*:Enabled:Windows Live Messenger 8.1»
«C:Program FilesMSN Messengerlivecall.exe»=»C:Program FilesMSN Messengerlivecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)»
«C:Program FilesMail.RuAgentmagent.exe»=»C:Program FilesMail.RuAgentmagent.exe:*:Enabled:Mail.Ru Агент»
«E:АкадоStrongDC for CorbinaStrongDC.exe»=»E:АкадоStrongDC for CorbinaStrongDC.exe:*:Enabled:StrongDC++»
«E:StrongDC++StrongDC.exe»=»E:StrongDC++StrongDC.exe:*:Enabled:StrongDC++»
«E:BitCometBitComet.exe»=»E:BitCometBitComet.exe:*:Enabled:BitComet — a BitTorrent Client»
«C:Documents and SettingsRootРабочий столutorrent.exe»=»C:Documents and SettingsRootРабочий столutorrent.exe:*:Enabled:µTorrent»
«C:Program FilesQIPqip.exe»=»C:Program FilesQIPqip.exe:*:Enabled:Quiet Internet Pager»
«C:Program FilesMicrosoft OfficeOFFICE11WINWORD.EXE»=»C:Program FilesMicrosoft OfficeOFFICE11WINWORD.EXE:*:Disabled:Microsoft Office Word»
«C:Program FilesMiranda IMmiranda32.exe»=»C:Program FilesMiranda IMmiranda32.exe:*:Enabled:Miranda IM»
«E:ДашаJabberMiranda IMmiranda32.exe»=»E:ДашаJabberMiranda IMmiranda32.exe:*:Enabled:Miranda IM»
«C:Program FilesPsipsi.exe»=»C:Program FilesPsipsi.exe:*:Enabled:psi»
«C:Program FilesTrilliantrillian.exe»=»C:Program FilesTrilliantrillian.exe:*:Enabled:Trillian»
«C:Program FilesSkypePhoneSkype.exe»=»C:Program FilesSkypePhoneSkype.exe:*:Enabled:Skype»
«C:Program FilesQIPQIP Infiuminfium.exe»=»C:Program FilesQIPQIP Infiuminfium.exe:*:Enabled:QIP Infium»[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«C:Program FilesMSN Messengermsnmsgr.exe»=»C:Program FilesMSN Messengermsnmsgr.exe:*:Enabled:Windows Live Messenger 8.1»
«C:Program FilesMSN Messengerlivecall.exe»=»C:Program FilesMSN Messengerlivecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)»======List of files/folders created in the last 1 months======
2009-01-11 18:50:26 —-D—- C:Program FilesCommon FilesDoctor Web
2009-01-11 18:50:23 —-D—- C:Documents and SettingsAll UsersApplication DataDoctor Web
2009-01-11 18:31:57 —-D—- C:Program FilesDrWeb
2009-01-11 18:28:55 —-SHD—- C:Config.Msi
2009-01-11 18:28:03 —-A—- C:Program Filesdrweb-500-win-space.exe
2009-01-10 20:58:16 —-D—- C:_OTMoveIt
2009-01-10 14:01:13 —-A—- C:Program FilesDoctor.exe
2009-01-10 13:00:56 —-A—- C:avenger.txt
2009-01-09 23:09:40 —-D—- C:Program FilesMicrosoft Windows OneCare Live
2009-01-09 20:31:20 —-D—- C:Program FilesCommon FilesDownload Manager
2009-01-09 19:35:48 —-HDC—- C:WINDOWSie7
2009-01-09 19:15:09 —-D—- C:WINDOWSsystem32en-US
2009-01-09 18:50:37 —-D—- C:Program FilesWindows Live Safety Center
2009-01-09 18:22:01 —-D—- C:Program FilesИнтернет
2009-01-09 14:03:07 —-D—- C:Program FilesEsetOnlineScanner
2009-01-09 13:44:19 —-D—- C:Program Filestrend micro
2009-01-09 13:44:16 —-D—- C:rsit
2009-01-09 13:42:39 —-A—- C:Program FilesRSIT.exe
2009-01-08 21:10:58 —-D—- C:Documents and SettingsAll UsersApplication DataKaspersky Lab Setup Files
2009-01-08 21:08:20 —-A—- C:Program Fileskis8.0.0.506ru.exe
2009-01-08 20:31:10 —-D—- C:Documents and SettingsAll UsersApplication DataKaspersky Lab
2009-01-08 20:31:02 —-D—- C:WINDOWSsystem32Kaspersky Lab
2009-01-08 19:44:38 —-D—- C:Documents and SettingsRootApplication DataMalwarebytes
2009-01-08 19:44:33 —-D—- C:Documents and SettingsAll UsersApplication DataMalwarebytes
2009-01-08 19:44:32 —-D—- C:Program FilesMalwarebytes’ Anti-Malware
2008-12-21 17:49:30 —-D—- C:Documents and SettingsRootApplication DataQIP.Online
2008-12-21 17:48:41 —-D—- C:Program FilesQIP1
2008-12-21 17:47:46 —-A—- C:Program Filesqip8080.exe
2008-12-21 17:17:23 —-A—- C:WINDOWSsystem32javaws.exe
2008-12-21 17:17:23 —-A—- C:WINDOWSsystem32javaw.exe
2008-12-21 17:17:23 —-A—- C:WINDOWSsystem32java.exe
2008-12-21 17:17:23 —-A—- C:WINDOWSsystem32deploytk.dll
2008-12-20 14:55:54 —-A—- C:WINDOWSsystem32ieencode.dll
2008-12-20 11:38:51 —-D—- C:Program FilesESET_NOD32_Antivirus_3.0.621_Final_(eng)___Eset_Smart_Security_3.0.621_Final_(eng)
2008-12-20 11:07:23 —-D—- C:Documents and SettingsAll UsersApplication DataTEMP
2008-12-20 11:06:16 —-D—- C:Program FilesMyCentria
2008-12-20 10:57:12 —-A—- C:WINDOWSsystem32ztvunrar36.dll
2008-12-20 10:57:12 —-A—- C:WINDOWSsystem32ztvunace26.dll
2008-12-20 10:57:12 —-A—- C:WINDOWSsystem32ztvcabinet.dll
2008-12-20 10:57:11 —-A—- C:WINDOWSsystem32unrar3.dll
2008-12-20 10:56:52 —-D—- C:Documents and SettingsRootApplication DataSimply Super Software
2008-12-14 13:44:35 —-D—- C:Documents and SettingsRootApplication DataLGSync
2008-12-14 13:41:52 —-D—- C:Program FilesLG Electronics======List of files/folders modified in the last 1 months======
2009-01-11 19:35:16 —-D—- C:Temp
2009-01-11 19:32:38 —-D—- C:WINDOWSTemp
2009-01-11 19:32:28 —-D—- C:WINDOWSsystem32drivers
2009-01-11 19:31:19 —-A—- C:WINDOWSSchedLgU.Txt
2009-01-11 18:54:46 —-D—- C:WINDOWS
2009-01-11 18:53:35 —-D—- C:WINDOWSsystem32CatRoot2
2009-01-11 18:53:15 —-SHD—- C:WINDOWSInstaller
2009-01-11 18:50:37 —-SD—- C:WINDOWSTasks
2009-01-11 18:50:26 —-D—- C:Program FilesCommon Files
2009-01-11 18:31:57 —-RD—- C:Program Files
2009-01-11 18:29:48 —-D—- C:WINDOWSsystem32
2009-01-11 18:29:19 —-HD—- C:WINDOWSinf
2009-01-10 21:02:35 —-SHD—- C:System Volume Information
2009-01-10 21:02:35 —-D—- C:WINDOWSsystem32Restore
2009-01-10 20:26:58 —-D—- C:WINDOWSsystem32NtmsData
2009-01-09 19:40:00 —-D—- C:WINDOWSHelp
2009-01-09 19:37:10 —-D—- C:WINDOWSWBEM
2009-01-09 19:37:10 —-D—- C:WINDOWSsystem32ru-ru
2009-01-09 19:37:02 —-D—- C:WINDOWSMedia
2009-01-09 19:37:01 —-D—- C:Program FilesInternet Explorer
2009-01-09 19:37:00 —-RSHDC—- C:WINDOWSsystem32dllcache
2009-01-09 19:36:30 —-D—- C:WINDOWSsystem32CatRoot
2009-01-09 19:31:01 —-D—- C:WINDOWSPrefetch
2009-01-09 19:29:43 —-A—- C:WINDOWSimsins.BAK
2009-01-09 18:55:36 —-D—- C:Program FilesDevalVR
2009-01-09 18:54:06 —-D—- C:Program FilesMozilla Firefox
2009-01-09 18:50:37 —-SD—- C:WINDOWSDownloaded Program Files
2009-01-08 19:25:57 —-A—- C:WINDOWSsystem32PerfStringBackup.INI
2009-01-08 19:23:11 —-D—- C:Program FilesCorel
2009-01-08 18:58:08 —-D—- C:Program FilesBusiness Plan PL(Demo)
2009-01-06 15:38:56 —-A—- C:WINDOWSNeroDigital.ini
2009-01-06 09:38:46 —-D—- C:WINDOWSnetwork diagnostic
2009-01-05 13:33:00 —-D—- C:Documents and SettingsRootApplication DataSkype
2009-01-02 17:10:23 —-D—- C:Documents and SettingsRootApplication DataZoomBrowser EX
2009-01-02 17:09:35 —-D—- C:Documents and SettingsAll UsersApplication DataZoomBrowser
2008-12-29 21:45:20 —-D—- C:Program FilesДекларация 2006
2008-12-29 21:44:30 —-D—- C:Program FilesДекларация 2005
2008-12-26 19:25:56 —-D—- C:Program FilesRambler Assistant
2008-12-21 17:17:02 —-D—- C:Program FilesJava
2008-12-20 12:59:22 —-D—- C:Program FilesVirtualNetwork
2008-12-20 12:55:38 —-D—- C:Program FilesESET
2008-12-14 13:41:51 —-HD—- C:Program FilesInstallShield Installation Information======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2007-03-20 40448]
R1 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:WINDOWSSystem32driversws2ifsl.sys [2004-08-18 12032]
R2 rspndr;Ответчик обнаружения топологии уровня связи; C:WINDOWSsystem32DRIVERSrspndr.sys [2006-12-04 62336]
R2 SPIDER;SpIDer Guard File System Monitor; ??C:PROGRA~1DrWebspider.sys []
R3 b57w2k;Broadcom NetXtreme Gigabit Ethernet; C:WINDOWSsystem32DRIVERSb57xp32.sys [2004-12-06 126720]
R3 HDAudBus;Драйвер шины Microsoft UAA для High Definition Audio; C:WINDOWSsystem32DRIVERSHDAudBus.sys [2005-12-26 138752]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:WINDOWSsystem32driversRtkHDAud.sys [2007-03-28 4395008]
R3 nv;nv; C:WINDOWSsystem32DRIVERSnv4_mini.sys [2006-03-09 3650368]
R3 pfc;Padus ASPI Shell; C:WINDOWSsystem32driverspfc.sys [2007-05-31 9856]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:WINDOWSSystem32DriversRootMdm.sys [2004-08-18 5888]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2006-10-23 30208]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2006-10-23 59264]
R3 usbprint;Класс принтеров Microsoft USB; C:WINDOWSsystem32DRIVERSusbprint.sys [2004-08-03 25856]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2006-10-23 20608]
S3 usb2vcom;USB Data Cable; C:WINDOWSsystem32DRIVERSusb2vcom.sys [2005-08-06 28704]
S3 usbscan;Драйвер USB-сканера; C:WINDOWSsystem32DRIVERSusbscan.sys [2004-08-03 15104]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2004-12-28 26368]
S3 WudfPf;Windows Driver Foundation — User-mode Driver Framework Platform Driver; C:WINDOWSsystem32DRIVERSWudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 CCALib8;Canon Camera Access Library 8; C:Program FilesCanonCALCALMAIN.exe [2006-03-30 96341]
R2 DrWebEngine;Dr.Web ® Scanning Engine (DrWebEngine); C:Program FilesCommon FilesDoctor WebScanning Enginedwengine.exe [2008-10-17 869688]
R2 JavaQuickStarterService;Java Quick Starter; C:Program FilesJavajre6binjqs.exe [2008-12-21 152984]
R2 NVSvc;NVIDIA Display Driver Service; C:WINDOWSsystem32nvsvc32.exe [2006-03-09 143436]
R2 SPIDERNT;SpIDer Guard for Windows; C:PROGRA~1DrWebspidernt.exe [2008-12-09 197896]
S3 Adobe LM Service;Adobe LM Service; C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe [2007-12-16 72704]
S3 gusvc;Google Updater Service; C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe [2007-06-02 138168]
S3 odserv;Microsoft Office Diagnostics Service; C:Program FilesCommon FilesMicrosoft SharedOFFICE12ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2006-10-26 145184]
S3 usnjsvc;Служба Messenger Sharing Folders USN Journal Reader; C:Program FilesMSN Messengerusnsvc.exe [2007-01-19 97136]
S3 WMPNetworkSvc;Служба общих сетевых ресурсов проигрывателя Windows Media; C:Program FilesWindows Media PlayerWMPNetwk.exe [2006-11-02 914944]
S3 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2004-08-18 14336]
EOF
Валерий, спасибо огромное за помощь!
Сделала все, как Вы сказали, и вот, что у меня получилось:========== PROCESSES ==========
Process explorer.exe killed successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{0B014B81-4E12-46F9-806F-55867AF8FD3C}\ not found.
Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{FFFC57DB-1DE3-4303-B24D-CEE6DCDD3D86}\ deleted successfully.
========== FILES ==========
File/Folder C:WINDOWSsystem32winsystems.dll not found.
========== COMMANDS ==========
File delete failed. C:Temp~DF7DF5.tmp scheduled to be deleted on reboot.
File delete failed. C:Temp~DF7F90.tmp scheduled to be deleted on reboot.
File delete failed. C:Temp~DF8420.tmp scheduled to be deleted on reboot.
User’s Temp folder emptied.
User’s Temporary Internet Files folder emptied.
User’s Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:Documents and SettingsLocalServiceLocal SettingsTemporary Internet FilesContent.IE5index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:WINDOWStempPerflib_Perfdata_604.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfullyOTMoveIt3 by OldTimer — Version 1.0.8.0 log created on 01102009_205816
Files moved on Reboot…
File C:Temp~DF7DF5.tmp not found!
File C:Temp~DF7F90.tmp not found!
File C:Temp~DF8420.tmp not found!
File move failed. C:Documents and SettingsLocalServiceLocal SettingsTemporary Internet FilesContent.IE5index.dat scheduled to be moved on reboot.
File C:WINDOWStempPerflib_Perfdata_604.dat not found!Logfile of random’s system information tool 1.05 (written by random/random)
Run by Root at 2009-01-10 21:13:45
Microsoft Windows XP Professional Service Pack 2
System drive C: has 26 GB (64%) free of 40 GB
Total RAM: 1023 MB (63% free)Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:13:48, on 10.01.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: NormalRunning processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:WINDOWSRTHDCPL.EXE
C:Program FilesCommon FilesInstallShieldUpdateServiceissch.exe
C:Program FilesJavajre6binjusched.exe
C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesJavajre6binjqs.exe
C:WINDOWSsystem32nvsvc32.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesCanonCALCALMAIN.exe
C:WINDOWSsystem32wbemwmiapsrv.exe
C:Program FilesInternet Exploreriexplore.exe
C:Documents and SettingsRootРабочий столЛечение вирусовRSIT.exe
C:Program Filestrend microRoot.exeR0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.yandex.ru/
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: (no name) — {0A94B116-4504-4e26-AB05-E61E474AA38B} — (no file)
R3 — URLSearchHook: (no name) — {83821C2B-32A8-4DD7-B6D4-44309A78E668} — C:Program FilesMail.RuAgentMradllnewmrasearch.dll
O2 — BHO: Adobe PDF Reader Link Helper — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 — BHO: Ask Search Assistant BHO — {0A94B111-4504-4e26-AB05-E61E474AA38B} — (no file)
O2 — BHO: BitComet ClickCapture — {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} — E:BitComettoolsBitCometBHO_1.1.7.4.dll
O2 — BHO: IEVkbdBHO — {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} — C:Program FilesKaspersky LabKaspersky Internet Security 2009ievkbd.dll
O2 — BHO: VirtualNetwork module — {6C517674-DE1C-4493-977C-34A1BFAB35BA} — (no file)
O2 — BHO: Java(tm) Plug-In SSV Helper — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — C:Program FilesJavajre6binssv.dll
O2 — BHO: (no name) — {7E853D72-626A-48EC-A868-BA8D5E23E045} — (no file)
O2 — BHO: Google Toolbar Helper — {AA58ED58-01DD-4d91-8333-CF10577473F7} — c:program filesgooglegoogletoolbar2.dll
O2 — BHO: Google Toolbar Notifier BHO — {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} — C:Program FilesGoogleGoogleToolbarNotifier3.1.807.1746swg.dll
O2 — BHO: Java(tm) Plug-In 2 SSV Helper — {DBC80044-A445-435b-BC74-9C25C1C588A9} — C:Program FilesJavajre6binjp2ssv.dll
O2 — BHO: JQSIEStartDetectorImpl — {E7E6F031-17CE-4C07-BC86-EABFE594F69C} — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll
O2 — BHO: Ask Toolbar BHO — {F4D76F01-7896-458a-890F-E1F05C46069F} — (no file)
O3 — Toolbar: &Google — {2318C2B1-4965-11d4-9B18-009027A5CD4F} — c:program filesgooglegoogletoolbar2.dll
O3 — Toolbar: Rambler-Ассистент — {468CD8A9-7C25-45FA-969E-3D925C689DC4} — C:Program FilesRambler AssistantramblertoolbarU1.dll
O3 — Toolbar: (no name) — {F4D76F09-7896-458a-890F-E1F05C46069F} — (no file)
O4 — HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 — HKLM..Run: [Alcmtr] ALCMTR.EXE
O4 — HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 — HKLM..Run: [nwiz] nwiz.exe /install
O4 — HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 — HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 — HKLM..Run: [ISUSPM Startup] «C:Program FilesCommon FilesInstallShieldUpdateServiceisuspm.exe» -startup
O4 — HKLM..Run: [ISUSScheduler] «C:Program FilesCommon FilesInstallShieldUpdateServiceissch.exe» -start
O4 — HKLM..Run: [MAgent] C:Program FilesMail.RuAgentmagent.exe -LM
O4 — HKLM..Run: [FineReader7NewsReaderPro] C:Program FilesABBYY FineReader 7.0 Professional EditionAbbyyNewsReader.exe
O4 — HKLM..Run: [Adobe Reader Speed Launcher] «C:Program FilesAdobeReader 8.0ReaderReader_sl.exe»
O4 — HKLM..Run: [SunJavaUpdateSched] «C:Program FilesJavajre6binjusched.exe»
O4 — HKLM..Run: [AVP] «C:Program FilesKaspersky LabKaspersky Internet Security 2009avp.exe»
O4 — HKCU..Run: [swg] C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
O4 — HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-20..RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — HKUS.DEFAULT..RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User ‘Default user’)
O4 — Startup: Adobe Gamma.lnk = C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe
O8 — Extra context menu item: &D&ownload &with BitComet — res://E:BitCometBitComet.exe/AddLink.htm
O8 — Extra context menu item: &D&ownload all video with BitComet — res://E:BitCometBitComet.exe/AddVideo.htm
O8 — Extra context menu item: &D&ownload all with BitComet — res://E:BitCometBitComet.exe/AddAllLink.htm
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 — Extra context menu item: Добавить в Rambler-Закладки — res://C:Program FilesRambler AssistantramblertoolbarU1.dll/zakladki.htm
O8 — Extra context menu item: Добавить в Анти-Баннер — C:Program FilesKaspersky LabKaspersky Internet Security 2009ie_banner_deny.htm
O8 — Extra context menu item: Найти с помощью Рамблера — res://C:Program FilesRambler AssistantramblertoolbarU1.dll/search.htm
O8 — Extra context menu item: Перевести с помощью словарей Рамблера — res://C:Program FilesRambler AssistantramblertoolbarU1.dll/dic.htm
O9 — Extra button: Статистика защиты веб-трафика — {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} — C:Program FilesKaspersky LabKaspersky Internet Security 2009SCIEPlgn.dll
O9 — Extra button: BitComet Search — {461CC20B-FB6E-4f16-8FE8-C29359DB100E} — E:BitComettoolsBitCometBHO_1.1.7.4.dll
O9 — Extra button: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra ‘Tools’ menuitem: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra button: Skype — {77BF5300-1474-4EC7-9980-D32B190E9B07} — C:WINDOWSsystem32shdocvw.dll
O9 — Extra button: Research — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2Office12REFIEBAR.DLL
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O16 — DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) — http://www.kaspersky.com/kos/russian/partner/rus/kavwebscan_unicode.cab
O16 — DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) — http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 — DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) — http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab
O17 — HKLMSystemCCSServicesTcpip..{3B7AD64D-DA3F-4F1A-A0BB-9A1A55337C2F}: NameServer = 195.34.32.116 212.188.4.10
O18 — Protocol: skype4com — {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} — C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O20 — AppInit_DLLs: C:PROGRA~1KASPER~1KASPER~1mzvkbd.dll,C:PROGRA~1KASPER~1KASPER~1mzvkbd3.dll,C:PROGRA~1KASPER~1KASPER~1adialhk.dll,C:PROGRA~1KASPER~1KASPER~1kloehk.dll
O23 — Service: Adobe LM Service — Adobe Systems — C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe
O23 — Service: Application Driver Auto Removal Service (01) (appdrvrem01) — Protection Technology — C:WINDOWSSystem32appdrvrem01.exe
O23 — Service: Kaspersky Internet Security (AVP) — Kaspersky Lab — C:Program FilesKaspersky LabKaspersky Internet Security 2009avp.exe
O23 — Service: Canon Camera Access Library 8 (CCALib8) — Canon Inc. — C:Program FilesCanonCALCALMAIN.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Google Updater Service (gusvc) — Google — C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: Java Quick Starter (JavaQuickStarterService) — Sun Microsystems, Inc. — C:Program FilesJavajre6binjqs.exe
O23 — Service: NetMeeting Remote Desktop Sharing (mnmsrvc) — Корпорация Майкрософт — C:WINDOWSsystem32mnmsrvc.exe
O23 — Service: NVIDIA Display Driver Service (NVSvc) — NVIDIA Corporation — C:WINDOWSsystem32nvsvc32.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe—
End of file — 10615 bytes======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll [2006-10-22 62080][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{0A94B111-4504-4e26-AB05-E61E474AA38B}]
Ask Search Assistant BHO[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}]
BitComet Helper — E:BitComettoolsBitCometBHO_1.1.7.4.dll [2007-07-04 513336][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class — C:Program FilesKaspersky LabKaspersky Internet Security 2009ievkbd.dll [2008-11-11 62728][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{6C517674-DE1C-4493-977C-34A1BFAB35BA}]
VirtualNetwork Class[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper — C:Program FilesJavajre6binssv.dll [2008-12-21 320920][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{7E853D72-626A-48EC-A868-BA8D5E23E045}]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper — c:program filesgooglegoogletoolbar2.dll [2007-01-19 2403392][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO — C:Program FilesGoogleGoogleToolbarNotifier3.1.807.1746swg.dll [2008-09-13 737776][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper — C:Program FilesJavajre6binjp2ssv.dll [2008-12-21 34816][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll [2008-12-21 73728][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{F4D76F01-7896-458a-890F-E1F05C46069F}]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} — &Google — c:program filesgooglegoogletoolbar2.dll [2007-01-19 2403392]
{468CD8A9-7C25-45FA-969E-3D925C689DC4} — Rambler-Ассистент — C:Program FilesRambler AssistantramblertoolbarU1.dll [2008-12-26 849392]
{F4D76F09-7896-458a-890F-E1F05C46069F}[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«RTHDCPL»=C:WINDOWSRTHDCPL.EXE [2007-03-21 16126464]
«Alcmtr»=C:WINDOWSALCMTR.EXE [2005-05-03 69632]
«NvCplDaemon»=C:WINDOWSsystem32NvCpl.dll [2006-03-09 7561216]
«nwiz»=nwiz.exe /install []
«NvMediaCenter»=C:WINDOWSsystem32NvMcTray.dll [2006-03-09 86016]
«NeroFilterCheck»=C:WINDOWSsystem32NeroCheck.exe [2001-07-09 155648]
«ISUSPM Startup»=C:Program FilesCommon FilesInstallShieldUpdateServiceisuspm.exe [2005-08-11 249856]
«ISUSScheduler»=C:Program FilesCommon FilesInstallShieldUpdateServiceissch.exe [2005-08-11 81920]
«MAgent»=C:Program FilesMail.RuAgentmagent.exe [2008-10-09 4417016]
«FineReader7NewsReaderPro»=C:Program FilesABBYY FineReader 7.0 Professional EditionAbbyyNewsReader.exe [2003-09-12 278528]
«Adobe Reader Speed Launcher»=C:Program FilesAdobeReader 8.0ReaderReader_sl.exe [2008-01-11 39792]
«SunJavaUpdateSched»=C:Program FilesJavajre6binjusched.exe [2008-12-21 136600]
«AVP»=C:Program FilesKaspersky LabKaspersky Internet Security 2009avp.exe [2008-11-11 206088][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«swg»=C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe [2007-08-03 68856]
«ctfmon.exe»=C:WINDOWSsystem32ctfmon.exe [2007-03-20 30208][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregCTFMON.EXE]
C:WINDOWSsystem32ctfmon.exe [2007-03-20 30208][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIMJPMIG8.1]
C:WINDOWSIMEimjp8_1IMJPMIG.EXE [2004-08-18 208952][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPHIME2002A]
C:WINDOWSsystem32IMETINTLGNTTINTSETP.EXE [2004-08-18 455168][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPHIME2002ASync]
C:WINDOWSsystem32IMETINTLGNTTINTSETP.EXE [2004-08-18 455168][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregProcess Killer]
C:Program FilesProcess Killerprkiller.exe [2006-11-23 38400][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupfolderC:^Documents and Settings^All Users^Главное меню^Программы^Автозагрузка^RKLauncher.lnk]
C:PROGRA~1RK_LAU~1RKLAUN~1.EXE [2006-08-14 692224]C:Documents and SettingsRootГлавное менюПрограммыАвтозагрузка
Adobe Gamma.lnk — C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWindows]
«AppInit_DLLS»=»C:PROGRA~1KASPER~1KASPER~1mzvkbd.dll,C:PROGRA~1KASPER~1KASPER~1mzvkbd3.dll,C:PROGRA~1KASPER~1KASPER~1adialhk.dll,C:PROGRA~1KASPER~1KASPER~1kloehk.dll»[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyklogon]
C:WINDOWSsystem32klogon.dll [2008-11-11 218376][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32WPDShServiceObj.dll [2006-10-18 133632][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=255
«NoSMMyPictures»=1
«NoSMConfigurePrograms»=1[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«C:Program FileseMuleeMule.exe»=»C:Program FileseMuleeMule.exe:*:Enabled:eMule Plus»
«C:Program FilesMSN Messengermsnmsgr.exe»=»C:Program FilesMSN Messengermsnmsgr.exe:*:Enabled:Windows Live Messenger 8.1»
«C:Program FilesMSN Messengerlivecall.exe»=»C:Program FilesMSN Messengerlivecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)»
«C:Program FilesMail.RuAgentmagent.exe»=»C:Program FilesMail.RuAgentmagent.exe:*:Enabled:Mail.Ru Агент»
«E:АкадоStrongDC for CorbinaStrongDC.exe»=»E:АкадоStrongDC for CorbinaStrongDC.exe:*:Enabled:StrongDC++»
«E:StrongDC++StrongDC.exe»=»E:StrongDC++StrongDC.exe:*:Enabled:StrongDC++»
«E:BitCometBitComet.exe»=»E:BitCometBitComet.exe:*:Enabled:BitComet — a BitTorrent Client»
«C:Documents and SettingsRootРабочий столutorrent.exe»=»C:Documents and SettingsRootРабочий столutorrent.exe:*:Enabled:µTorrent»
«C:Program FilesQIPqip.exe»=»C:Program FilesQIPqip.exe:*:Enabled:Quiet Internet Pager»
«C:Program FilesMicrosoft OfficeOFFICE11WINWORD.EXE»=»C:Program FilesMicrosoft OfficeOFFICE11WINWORD.EXE:*:Disabled:Microsoft Office Word»
«C:Program FilesMiranda IMmiranda32.exe»=»C:Program FilesMiranda IMmiranda32.exe:*:Enabled:Miranda IM»
«E:ДашаJabberMiranda IMmiranda32.exe»=»E:ДашаJabberMiranda IMmiranda32.exe:*:Enabled:Miranda IM»
«C:Program FilesPsipsi.exe»=»C:Program FilesPsipsi.exe:*:Enabled:psi»
«C:Program FilesTrilliantrillian.exe»=»C:Program FilesTrilliantrillian.exe:*:Enabled:Trillian»
«C:Program FilesSkypePhoneSkype.exe»=»C:Program FilesSkypePhoneSkype.exe:*:Enabled:Skype»
«C:Program FilesQIPQIP Infiuminfium.exe»=»C:Program FilesQIPQIP Infiuminfium.exe:*:Enabled:QIP Infium»[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«C:Program FilesMSN Messengermsnmsgr.exe»=»C:Program FilesMSN Messengermsnmsgr.exe:*:Enabled:Windows Live Messenger 8.1»
«C:Program FilesMSN Messengerlivecall.exe»=»C:Program FilesMSN Messengerlivecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)»======List of files/folders created in the last 1 months======
2009-01-10 20:58:16 —-D—- C:_OTMoveIt
2009-01-10 14:01:13 —-A—- C:Program FilesDoctor.exe
2009-01-10 13:00:56 —-A—- C:avenger.txt
2009-01-09 23:09:40 —-D—- C:Program FilesMicrosoft Windows OneCare Live
2009-01-09 20:31:20 —-D—- C:Program FilesCommon FilesDownload Manager
2009-01-09 19:35:48 —-HDC—- C:WINDOWSie7
2009-01-09 19:15:09 —-D—- C:WINDOWSsystem32en-US
2009-01-09 18:50:37 —-D—- C:Program FilesWindows Live Safety Center
2009-01-09 18:22:01 —-D—- C:Program FilesИнтернет
2009-01-09 14:03:07 —-D—- C:Program FilesEsetOnlineScanner
2009-01-09 13:44:19 —-D—- C:Program Filestrend micro
2009-01-09 13:44:16 —-D—- C:rsit
2009-01-09 13:42:39 —-A—- C:Program FilesRSIT.exe
2009-01-08 21:18:21 —-D—- C:Program FilesKaspersky Lab
2009-01-08 21:10:58 —-D—- C:Documents and SettingsAll UsersApplication DataKaspersky Lab Setup Files
2009-01-08 21:08:20 —-A—- C:Program Fileskis8.0.0.506ru.exe
2009-01-08 20:31:10 —-D—- C:Documents and SettingsAll UsersApplication DataKaspersky Lab
2009-01-08 20:31:02 —-D—- C:WINDOWSsystem32Kaspersky Lab
2009-01-08 19:44:38 —-D—- C:Documents and SettingsRootApplication DataMalwarebytes
2009-01-08 19:44:33 —-D—- C:Documents and SettingsAll UsersApplication DataMalwarebytes
2009-01-08 19:44:32 —-D—- C:Program FilesMalwarebytes’ Anti-Malware
2008-12-21 17:49:30 —-D—- C:Documents and SettingsRootApplication DataQIP.Online
2008-12-21 17:48:41 —-D—- C:Program FilesQIP1
2008-12-21 17:47:46 —-A—- C:Program Filesqip8080.exe
2008-12-21 17:17:23 —-A—- C:WINDOWSsystem32javaws.exe
2008-12-21 17:17:23 —-A—- C:WINDOWSsystem32javaw.exe
2008-12-21 17:17:23 —-A—- C:WINDOWSsystem32java.exe
2008-12-21 17:17:23 —-A—- C:WINDOWSsystem32deploytk.dll
2008-12-20 14:55:54 —-A—- C:WINDOWSsystem32ieencode.dll
2008-12-20 11:38:51 —-D—- C:Program FilesESET_NOD32_Antivirus_3.0.621_Final_(eng)___Eset_Smart_Security_3.0.621_Final_(eng)
2008-12-20 11:07:23 —-D—- C:Documents and SettingsAll UsersApplication DataTEMP
2008-12-20 11:06:16 —-D—- C:Program FilesMyCentria
2008-12-20 10:57:12 —-A—- C:WINDOWSsystem32ztvunrar36.dll
2008-12-20 10:57:12 —-A—- C:WINDOWSsystem32ztvunace26.dll
2008-12-20 10:57:12 —-A—- C:WINDOWSsystem32ztvcabinet.dll
2008-12-20 10:57:11 —-A—- C:WINDOWSsystem32unrar3.dll
2008-12-20 10:56:52 —-D—- C:Documents and SettingsRootApplication DataSimply Super Software
2008-12-14 13:44:35 —-D—- C:Documents and SettingsRootApplication DataLGSync
2008-12-14 13:41:52 —-D—- C:Program FilesLG Electronics======List of files/folders modified in the last 1 months======
2009-01-10 21:13:47 —-D—- C:Temp
2009-01-10 21:11:00 —-D—- C:WINDOWSTemp
2009-01-10 21:05:23 —-A—- C:WINDOWSSchedLgU.Txt
2009-01-10 21:02:35 —-SHD—- C:System Volume Information
2009-01-10 21:02:35 —-D—- C:WINDOWSsystem32Restore
2009-01-10 20:26:57 —-D—- C:WINDOWSsystem32NtmsData
2009-01-10 20:02:49 —-D—- C:WINDOWSsystem32CatRoot2
2009-01-10 14:30:48 —-D—- C:WINDOWS
2009-01-10 14:01:13 —-RD—- C:Program Files
2009-01-10 10:02:42 —-HD—- C:WINDOWSinf
2009-01-10 09:52:16 —-D—- C:WINDOWSsystem32
2009-01-09 20:31:20 —-D—- C:Program FilesCommon Files
2009-01-09 19:40:00 —-D—- C:WINDOWSHelp
2009-01-09 19:37:10 —-D—- C:WINDOWSWBEM
2009-01-09 19:37:10 —-D—- C:WINDOWSsystem32ru-ru
2009-01-09 19:37:02 —-D—- C:WINDOWSMedia
2009-01-09 19:37:01 —-D—- C:Program FilesInternet Explorer
2009-01-09 19:37:00 —-RSHDC—- C:WINDOWSsystem32dllcache
2009-01-09 19:36:30 —-D—- C:WINDOWSsystem32CatRoot
2009-01-09 19:31:01 —-D—- C:WINDOWSPrefetch
2009-01-09 19:29:43 —-A—- C:WINDOWSimsins.BAK
2009-01-09 18:55:36 —-D—- C:Program FilesDevalVR
2009-01-09 18:54:06 —-D—- C:Program FilesMozilla Firefox
2009-01-09 18:50:37 —-SD—- C:WINDOWSDownloaded Program Files
2009-01-08 21:19:15 —-SHD—- C:WINDOWSInstaller
2009-01-08 21:19:08 —-D—- C:WINDOWSsystem32drivers
2009-01-08 19:25:57 —-A—- C:WINDOWSsystem32PerfStringBackup.INI
2009-01-08 19:23:11 —-D—- C:Program FilesCorel
2009-01-08 18:58:08 —-D—- C:Program FilesBusiness Plan PL(Demo)
2009-01-06 15:38:56 —-A—- C:WINDOWSNeroDigital.ini
2009-01-06 09:38:46 —-D—- C:WINDOWSnetwork diagnostic
2009-01-05 13:33:00 —-D—- C:Documents and SettingsRootApplication DataSkype
2009-01-02 17:10:23 —-D—- C:Documents and SettingsRootApplication DataZoomBrowser EX
2009-01-02 17:09:35 —-D—- C:Documents and SettingsAll UsersApplication DataZoomBrowser
2008-12-29 21:45:20 —-D—- C:Program FilesДекларация 2006
2008-12-29 21:44:30 —-D—- C:Program FilesДекларация 2005
2008-12-26 19:25:56 —-D—- C:Program FilesRambler Assistant
2008-12-21 17:17:02 —-D—- C:Program FilesJava
2008-12-20 21:25:21 —-SD—- C:WINDOWSTasks
2008-12-20 12:59:22 —-D—- C:Program FilesVirtualNetwork
2008-12-20 12:55:38 —-D—- C:Program FilesESET
2008-12-14 13:41:51 —-HD—- C:Program FilesInstallShield Installation Information
2008-12-11 16:20:30 —-D—- C:Program FileseMule======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 appdrv01;Application Driver (01); C:WINDOWSSystem32Driversappdrv01.sys [2008-11-30 2915944]
R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2007-03-20 40448]
R1 KLIF;Kaspersky Lab Driver; C:WINDOWSsystem32DRIVERSklif.sys [2009-01-08 227344]
R2 rspndr;Ответчик обнаружения топологии уровня связи; C:WINDOWSsystem32DRIVERSrspndr.sys [2006-12-04 62336]
R3 b57w2k;Broadcom NetXtreme Gigabit Ethernet; C:WINDOWSsystem32DRIVERSb57xp32.sys [2004-12-06 126720]
R3 HDAudBus;Драйвер шины Microsoft UAA для High Definition Audio; C:WINDOWSsystem32DRIVERSHDAudBus.sys [2005-12-26 138752]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:WINDOWSsystem32driversRtkHDAud.sys [2007-03-28 4395008]
R3 KLFLTDEV;Kaspersky Lab KLFltDev; C:WINDOWSsystem32DRIVERSklfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:WINDOWSsystem32DRIVERSklim5.sys [2008-04-30 24592]
R3 nv;nv; C:WINDOWSsystem32DRIVERSnv4_mini.sys [2006-03-09 3650368]
R3 pfc;Padus ASPI Shell; C:WINDOWSsystem32driverspfc.sys [2007-05-31 9856]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:WINDOWSSystem32DriversRootMdm.sys [2004-08-18 5888]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2006-10-23 30208]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2006-10-23 59264]
R3 usbprint;Класс принтеров Microsoft USB; C:WINDOWSsystem32DRIVERSusbprint.sys [2004-08-03 25856]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2006-10-23 20608]
S3 usb2vcom;USB Data Cable; C:WINDOWSsystem32DRIVERSusb2vcom.sys [2005-08-06 28704]
S3 usbscan;Драйвер USB-сканера; C:WINDOWSsystem32DRIVERSusbscan.sys [2004-08-03 15104]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2004-12-28 26368]
S3 WudfPf;Windows Driver Foundation — User-mode Driver Framework Platform Driver; C:WINDOWSsystem32DRIVERSWudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []
S4 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:WINDOWSSystem32driversws2ifsl.sys [2004-08-18 12032]======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 AVP;Kaspersky Internet Security; C:Program FilesKaspersky LabKaspersky Internet Security 2009avp.exe [2008-11-11 206088]
R2 CCALib8;Canon Camera Access Library 8; C:Program FilesCanonCALCALMAIN.exe [2006-03-30 96341]
R2 JavaQuickStarterService;Java Quick Starter; C:Program FilesJavajre6binjqs.exe [2008-12-21 152984]
R2 NVSvc;NVIDIA Display Driver Service; C:WINDOWSsystem32nvsvc32.exe [2006-03-09 143436]
S2 appdrvrem01;Application Driver Auto Removal Service (01); C:WINDOWSSystem32appdrvrem01.exe [2008-11-30 304528]
S3 Adobe LM Service;Adobe LM Service; C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe [2007-12-16 72704]
S3 gusvc;Google Updater Service; C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe [2007-06-02 138168]
S3 odserv;Microsoft Office Diagnostics Service; C:Program FilesCommon FilesMicrosoft SharedOFFICE12ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2006-10-26 145184]
S3 usnjsvc;Служба Messenger Sharing Folders USN Journal Reader; C:Program FilesMSN Messengerusnsvc.exe [2007-01-19 97136]
S3 WMPNetworkSvc;Служба общих сетевых ресурсов проигрывателя Windows Media; C:Program FilesWindows Media PlayerWMPNetwk.exe [2006-11-02 914944]
S3 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2004-08-18 14336]
EOF
Жду дальнейших инструкций :))
