SPYWARE-RU.COM

Созданные ответы форума

Просмотр 5 сообщений - с 1 по 5 (из 5 всего)

Автор

Сообщения
4 апреля, 2009 в 6:24 пп в ответ на: Удалил Rapid, а вирусы всё лезут #23011
ivar-nat
Participant
- Темы:1
- Сообщений:6
ОК! Как проверю, отчёт пришлю! Полчаса назад немного испугался. Кликаешь правой кнопкой — квадратик для выполнения команд пустой — ни удалить, ни копировать тебе файлы, начинаешь по пустому полю гонять курсор — все команды построчно появляются. Перезагрузил комп — вроде всё нормально пошло, но на всякий случай сделал обновление для malwarebytes и прогоняю сейчас под ним комп, потом касперского в онлайне подключу.
А рисунки — нет не на планшете делаю! Ручная работа. Пёрышко-сканер -ФШ! Иногда и красками по старинке. Сын подарил планшет, но чо-то как-то не пошло дело! Летом вернусь в Москву, пусть он меня поднатаскает, а пока я дедовскими методами попользуюсь.
Если что — вот здесь больше пятисот моих рисунков ( вдруг появится желание и время): http://hiero.ru/Ivar_nat
2 апреля, 2009 в 9:45 пп в ответ на: Удалил Rapid, а вирусы всё лезут #23009
ivar-nat
Participant
- Темы:1
- Сообщений:6
Спасибо Огромное за помощь! Надеюсь, что ещё повалтузю своего Писюка.
2 апреля, 2009 в 9:43 пп в ответ на: Удалил Rapid, а вирусы всё лезут #23008
ivar-nat
Participant
- Темы:1
- Сообщений:6
Комп работает! Я просто счастлив! Правда AVG, время от времени, отлавливает пачку троянов, но типа успешно их «хилит». Не Потёмкинские ли это деревни? Вроде, как работаю, лечу больного!
Но я рад, что снова могу заниматься любимым делом. Вот оно:
Рисунок сделал уже после излечения

А этот ДО
30 марта, 2009 в 1:22 пп в ответ на: Удалил Rapid, а вирусы всё лезут #23006
ivar-nat
Participant
- Темы:1
- Сообщений:6
Всё запустилось !
Протокол получился следующий
========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========

ServiceDriver ati64si deleted successfully.

ServiceDriver fips32cup deleted successfully.

ServiceDriver ksi32sk deleted successfully.

ServiceDriver netsik deleted successfully.

ServiceDriver nicsk32 deleted successfully.

ServiceDriver port135sik deleted successfully.

ServiceDriver securentm deleted successfully.

ServiceDriver tvncaikilwiw deleted successfully.
========== REGISTRY ==========
Registry value HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun\Administrator deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWindows\»AppInit_DLLS»|»» /E : value set successfully!
HKEY_LOCAL_MACHINEsystemcurrentcontrolsetcontrolsecurityproviders\»SecurityProviders»|»msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll» /E : value set successfully!
========== FILES ==========
File/Folder C:WINDOWSsystem32mmmlerye.dll not found.
File/Folder C:WINDOWSsystem32digeste.dll not found.
C:WINDOWSsystem32search_fid.txt moved successfully.
C:WINDOWSsystem32mess_add.txt moved successfully.
File/Folder C:WINDOWSsystem32mmmlerye.dll not found.
File/Folder C:WINDOWSsystem32driverseoebrue.sys not found.
File/Folder C:WINDOWSsystem32driverssecurentm.sys not found.
File/Folder C:WINDOWSsystem32driversport135sik.sys not found.
File/Folder C:WINDOWSsystem32driversnicsk32.sys not found.
File/Folder C:WINDOWSsystem32driversnetsik.sys not found.
File/Folder C:WINDOWSsystem32driversksi32sk.sys not found.
File/Folder C:WINDOWSsystem32driversfips32cup.sys not found.
File/Folder C:WINDOWSsystem32driversati64si.sys not found.
========== COMMANDS ==========
User’s Temp folder emptied.
User’s Temporary Internet Files folder emptied.
User’s Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:Documents and SettingsLocalServiceLocal SettingsTemporary Internet FilesContent.IE5index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer — Version 1.0.9.0 log created on 03302009_155453

Files moved on Reboot…
File move failed. C:Documents and SettingsLocalServiceLocal SettingsTemporary Internet FilesContent.IE5index.dat scheduled to be moved on reboot.

Поскольку я совсем далёк от всего этого, каков будет вердикт специалиста? Для полной картины
прилагаю информацию от RSIT:
(log.txt)

Logfile of random’s system information tool 1.06 (written by random/random)
Run by Administrator at 2009-03-30 16:15:44
Microsoft Windows XP Professional Service Pack 2
System drive C: has 90 GB (38%) free of 238 GB
Total RAM: 2038 MB (73% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:15:58, on 30.03.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:PROGRA~1AVGAVG8avgwdsvc.exe
C:Program FilesNeroNero8Nero BackItUpNBService.exe
C:Program FilesCyberLinkShared filesRichVideo.exe
C:WINDOWSExplorer.EXE
C:PROGRA~1AVGAVG8avgrsx.exe
C:PROGRA~1AVGAVG8avgnsx.exe
C:WINDOWSnotepad.exe
C:WINDOWSRTHDCPL.EXE
C:WINDOWSsystem32igfxtray.exe
C:WINDOWSsystem32hkcmd.exe
C:WINDOWSsystem32igfxpers.exe
C:WINDOWSsystem32igfxsrvc.exe
C:Program FilesMicrosoft OfficeOffice12GrooveMonitor.exe
C:Program FilesCyberLinkPowerDVDPDVDServ.exe
C:Program FilesWinampwinampa.exe
C:Program FilesABBYY Lingvo 12Lvagent.exe
C:WINDOWSSystem32svchost.exe
C:PROGRA~1AVGAVG8avgtray.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesCommon FilesNeroLibNMBgMonitor.exe
C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
C:Program FilesABBYY Lingvo 12Tutor.exe
C:Program FilesCommon FilesNeroLibNMIndexingService.exe
C:Program FilesCommon FilesNeroLibNMIndexStoreSvr.exe
C:Program FilesMSICommonRaUI.exe
C:Program FilesInternet ExplorerIEXPLORE.EXE
C:Program FilesInternet ExplorerIEXPLORE.EXE
C:Program FilesRSIT.exe
C:Program Filestrend microAdministrator.exe

R1 — HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,AutoConfigURL = 7961882642
R1 — HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyServer = 7961882642
O2 — BHO: AcroIEHelperStub — {18DF081C-E8AD-4283-A596-FA578C2EBDC3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelperShim.dll
O2 — BHO: WormRadar.com IESiteBlocker.NavFilter — {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} — C:Program FilesAVGAVG8avgssie.dll
O2 — BHO: Groove GFS Browser Helper — {72853161-30C5-4D22-B7F9-0BBC1D38A37E} — C:PROGRA~1MICROS~2Office12GRA8E1~1.DLL
O2 — BHO: AVG Security Toolbar — {A057A204-BACC-4D26-9990-79A187E2698E} — C:PROGRA~1AVGAVG8AVGTOO~1.DLL
O2 — BHO: Google Toolbar Helper — {AA58ED58-01DD-4d91-8333-CF10577473F7} — C:Program FilesGoogleGoogle ToolbarGoogleToolbar.dll
O2 — BHO: Google Toolbar Notifier BHO — {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} — C:Program FilesGoogleGoogleToolbarNotifier5.0.926.3450swg.dll
O2 — BHO: Google Dictionary Compression sdch — {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} — C:Program FilesGoogleGoogle ToolbarComponentfastsearch_219B3E1547538286.dll
O4 — HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 — HKLM..Run: [Alcmtr] ALCMTR.EXE
O4 — HKLM..Run: [IgfxTray] C:WINDOWSsystem32igfxtray.exe
O4 — HKLM..Run: [HotKeysCmds] C:WINDOWSsystem32hkcmd.exe
O4 — HKLM..Run: [Persistence] C:WINDOWSsystem32igfxpers.exe
O4 — HKLM..Run: [GrooveMonitor] «C:Program FilesMicrosoft OfficeOffice12GrooveMonitor.exe»
O4 — HKLM..Run: [Adobe Reader Speed Launcher] «C:Program FilesAdobeReader 9.0ReaderReader_sl.exe»
O4 — HKLM..Run: [LanzarL2007] «C:DOCUME~1ADMINI~1LOCALS~1Temp{3DAF61E8-FC3E-4215-8504-CC732E757AC1}{D1DA2BA7-2592-4036-9BB2-DCCABDE8DC1A}….L2007tmpSetup.exe» /SETUP:»/l0x0019″
O4 — HKLM..Run: [NeroFilterCheck] C:Program FilesCommon FilesNeroLibNeroCheck.exe
O4 — HKLM..Run: [NBKeyScan] «C:Program FilesNeroNero8Nero BackItUpNBKeyScan.exe»
O4 — HKLM..Run: [RemoteControl] «C:Program FilesCyberLinkPowerDVDPDVDServ.exe»
O4 — HKLM..Run: [LanguageShortcut] «C:Program FilesCyberLinkPowerDVDLanguageLanguage.exe»
O4 — HKLM..Run: [WinampAgent] «C:Program FilesWinampwinampa.exe»
O4 — HKLM..Run: [QuickTime Task] «C:Program FilesQuickTimeQTTask.exe» -atboottime
O4 — HKLM..Run: [Lingvo Launcher] «C:Program FilesABBYY Lingvo 12Lvagent.exe» /STARTUP
O4 — HKLM..Run: [AVG8_TRAY] C:PROGRA~1AVGAVG8avgtray.exe
O4 — HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] «C:Program FilesCommon FilesNeroLibNMBgMonitor.exe»
O4 — HKCU..Run: [swg] C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
O4 — HKCU..Run: [Tutor.exe] C:Program FilesABBYY Lingvo 12Tutor.exe /AS
O4 — Global Startup: Adobe Gamma Loader.lnk = C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe
O4 — Global Startup: MSI Wireless Utility.lnk = C:Program FilesMSICommonRaUI.exe
O8 — Extra context menu item: Copy to Semagic — C:Program FilesSemagiccopy.htm
O8 — Extra context menu item: E&xport to Microsoft Excel — res://C:PROGRA~1MICROS~2Office12EXCEL.EXE/3000
O8 — Extra context menu item: Semagic — C:Program FilesSemagiclink.htm
O9 — Extra button: Send to OneNote — {2670000A-7350-4f3c-8081-5663EE0C6C49} — C:PROGRA~1MICROS~2Office12ONBttnIE.dll
O9 — Extra ‘Tools’ menuitem: S&end to OneNote — {2670000A-7350-4f3c-8081-5663EE0C6C49} — C:PROGRA~1MICROS~2Office12ONBttnIE.dll
O9 — Extra button: Research — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2Office12REFIEBAR.DLL
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O16 — DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) — http://foto.mail.ru/ImageUploader4.cab
O18 — Protocol: grooveLocalGWS — {88FED34C-F0CA-4636-A375-3CB6248B04CD} — C:PROGRA~1MICROS~2Office12GR99D3~1.DLL
O18 — Protocol: linkscanner — {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} — C:Program FilesAVGAVG8avgpp.dll
O20 — Winlogon Notify: avgrsstarter — C:WINDOWSSYSTEM32avgrsstx.dll
O23 — Service: Adobe LM Service — Adobe Systems — C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe
O23 — Service: AVG Free8 WatchDog (avg8wd) — AVG Technologies CZ, s.r.o. — C:PROGRA~1AVGAVG8avgwdsvc.exe
O23 — Service: Google Updater Service (gusvc) — Google — C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
O23 — Service: Nero BackItUp Scheduler 3 — Nero AG — C:Program FilesNeroNero8Nero BackItUpNBService.exe
O23 — Service: NMIndexingService — Nero AG — C:Program FilesCommon FilesNeroLibNMIndexingService.exe
O23 — Service: Cyberlink RichVideo Service(CRVS) (RichVideo) — Unknown owner — C:Program FilesCyberLinkShared filesRichVideo.exe

—
End of file — 6774 bytes

======Scheduled tasks folder======

C:WINDOWStasksAppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelperShim.dll [2008-06-11 75128]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search — C:Program FilesAVGAVG8avgssie.dll [2009-03-27 1078552]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper — C:PROGRA~1MICROS~2Office12GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{A057A204-BACC-4D26-9990-79A187E2698E}]
AVG Security Toolbar — C:PROGRA~1AVGAVG8AVGTOO~1.DLL [2009-03-27 1968920]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper — C:Program FilesGoogleGoogle ToolbarGoogleToolbar.dll [2009-01-25 251504]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO — C:Program FilesGoogleGoogleToolbarNotifier5.0.926.3450swg.dll [2009-01-25 657904]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
Google Dictionary Compression sdch — C:Program FilesGoogleGoogle ToolbarComponentfastsearch_219B3E1547538286.dll [2009-01-25 522224]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«RTHDCPL»=C:WINDOWSRTHDCPL.EXE [2007-12-20 16860672]
«Alcmtr»=C:WINDOWSALCMTR.EXE [2005-05-03 69632]
«IgfxTray»=C:WINDOWSsystem32igfxtray.exe [2008-01-16 142104]
«HotKeysCmds»=C:WINDOWSsystem32hkcmd.exe [2008-01-16 162584]
«Persistence»=C:WINDOWSsystem32igfxpers.exe [2008-01-16 138008]
«GrooveMonitor»=C:Program FilesMicrosoft OfficeOffice12GrooveMonitor.exe [2006-10-27 31016]
«Adobe Reader Speed Launcher»=C:Program FilesAdobeReader 9.0ReaderReader_sl.exe [2008-06-12 34672]
«LanzarL2007″=C:DOCUME~1ADMINI~1LOCALS~1Temp{3DAF61E8-FC3E-4215-8504-CC732E757AC1}{D1DA2BA7-2592-4036-9BB2-DCCABDE8DC1A}….L2007tmpSetup.exe /SETUP:/l0x0019 []
«NeroFilterCheck»=C:Program FilesCommon FilesNeroLibNeroCheck.exe [2007-03-01 153136]
«NBKeyScan»=C:Program FilesNeroNero8Nero BackItUpNBKeyScan.exe [2007-09-20 1836328]
«RemoteControl»=C:Program FilesCyberLinkPowerDVDPDVDServ.exe [2007-03-14 71216]
«LanguageShortcut»=C:Program FilesCyberLinkPowerDVDLanguageLanguage.exe [2007-03-14 54832]
«WinampAgent»=C:Program FilesWinampwinampa.exe [2007-10-10 36352]
«QuickTime Task»=C:Program FilesQuickTimeQTTask.exe [2007-12-11 286720]
«»= []
«Lingvo Launcher»=C:Program FilesABBYY Lingvo 12Lvagent.exe [2006-12-14 258048]
«AVG8_TRAY»=C:PROGRA~1AVGAVG8avgtray.exe [2009-03-27 1932568]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«ctfmon.exe»=C:WINDOWSsystem32ctfmon.exe [2004-08-04 15360]
«BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=C:Program FilesCommon FilesNeroLibNMBgMonitor.exe [2007-10-23 202024]
«swg»=C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe [2008-10-08 68856]
«Tutor.exe»=C:Program FilesABBYY Lingvo 12Tutor.exe [2006-12-14 987136]

C:Documents and SettingsAll UsersStart MenuProgramsStartup
Adobe Gamma Loader.lnk — C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe
MSI Wireless Utility.lnk — C:Program FilesMSICommonRaUI.exe

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyavgrsstarter]
C:WINDOWSsystem32avgrsstx.dll [2009-03-27 10520]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyigfxcui]
C:WINDOWSsystem32igfxdev.dll [2008-01-16 204800]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks]
«{B5A7F190-DDA6-4420-B3BA-52453494E6CD}»=C:PROGRA~1MICROS~2Office12GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=145

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«HonorAutoRunSetting»=

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesMicrosoft OfficeOffice12OUTLOOK.EXE»=»C:Program FilesMicrosoft OfficeOffice12OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook»
«C:Program FilesMicrosoft OfficeOffice12GROOVE.EXE»=»C:Program FilesMicrosoft OfficeOffice12GROOVE.EXE:*:Enabled:Microsoft Office Groove»
«C:Program FilesMicrosoft OfficeOffice12ONENOTE.EXE»=»C:Program FilesMicrosoft OfficeOffice12ONENOTE.EXE:*:Enabled:Microsoft Office OneNote»
«C:Program FilesCyberLinkPowerDVDPowerDVD.exe»=»C:Program FilesCyberLinkPowerDVDPowerDVD.exe:*:Enabled:CyberLink PowerDVD»
«C:Program FilesNeroNero8Nero HomeNeroHome.exe»=»C:Program FilesNeroNero8Nero HomeNeroHome.exe:*:Enabled:Nero Home»
«C:Program FilesAVGAVG8avgupd.exe»=»C:Program FilesAVGAVG8avgupd.exe:*:Enabled:avgupd.exe»
«C:Program FilesAVGAVG8avgnsx.exe»=»C:Program FilesAVGAVG8avgnsx.exe:*:Enabled:avgnsx.exe»
«C:WINDOWSsystem32userinit.exe»=»C:WINDOWSsystem32userinit.exe:*:Enabled:ENABLE»
«C:WINDOWSExplorer.EXE»=»C:WINDOWSExplorer.EXE:*:Enabled:ENABLE»
«C:WINDOWSRTHDCPL.EXE»=»C:WINDOWSRTHDCPL.EXE:*:Enabled:ENABLE»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2E]
shellAutoRuncommand — E:WDSetup.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{2e489614-d73d-11dd-9e5a-000d05046a49}]
shellAutoRuncommand — E:WDSetup.exe

======List of files/folders created in the last 1 months======

2009-03-30 15:54:53 —-D—- C:_OTMoveIt
2009-03-30 15:51:47 —-A—- C:Program FilesOTMoveIt3.exe
2009-03-30 08:07:19 —-HDC—- C:WINDOWS$NtUninstallKB951376-v2$
2009-03-30 08:07:14 —-HDC—- C:WINDOWS$NtUninstallKB952954$
2009-03-30 08:07:10 —-HDC—- C:WINDOWS$NtUninstallKB956803$
2009-03-30 08:07:05 —-HDC—- C:WINDOWS$NtUninstallKB935448$
2009-03-30 08:07:00 —-HDC—- C:WINDOWS$NtUninstallKB955839$
2009-03-30 08:06:46 —-HDC—- C:WINDOWS$NtUninstallKB958215$
2009-03-30 08:06:35 —-HDC—- C:WINDOWS$NtUninstallKB950974$
2009-03-30 08:06:30 —-HDC—- C:WINDOWS$NtUninstallKB951698$
2009-03-30 08:06:23 —-HDC—- C:WINDOWS$NtUninstallKB960225$
2009-03-30 08:06:12 —-HDC—- C:WINDOWS$NtUninstallKB956841$
2009-03-30 08:06:04 —-HDC—- C:WINDOWS$NtUninstallKB952069_WM9$
2009-03-30 08:05:57 —-HDC—- C:WINDOWS$NtUninstallKB967715$
2009-03-30 08:05:50 —-HDC—- C:WINDOWS$NtUninstallKB958690$
2009-03-30 08:05:42 —-HDC—- C:WINDOWS$NtUninstallKB951748$
2009-03-30 08:05:36 —-HDC—- C:WINDOWS$NtUninstallKB956802$
2009-03-30 08:05:32 —-D—- C:Program FilesMSXML 4.0
2009-03-30 08:05:07 —-HDC—- C:WINDOWS$NtUninstallKB944338-v2$
2009-03-29 14:23:35 —-D—- C:WINDOWSsystem32CatRoot_bak
2009-03-29 14:18:23 —-N—- C:WINDOWSsystem32xpsp3res.dll
2009-03-29 09:48:23 —-HDC—- C:WINDOWS$NtUninstallKB946648$
2009-03-29 09:48:17 —-HDC—- C:WINDOWS$NtUninstallKB960714$
2009-03-29 09:48:14 —-HDC—- C:WINDOWS$NtUninstallKB938464-v2$
2009-03-29 09:48:11 —-HDC—- C:WINDOWS$NtUninstallKB941569$
2009-03-29 09:48:01 —-HDC—- C:WINDOWS$NtUninstallKB950762$
2009-03-29 09:47:57 —-HDC—- C:WINDOWS$NtUninstallKB957097$
2009-03-29 09:47:54 —-HDC—- C:WINDOWS$NtUninstallKB960715$
2009-03-29 09:47:51 —-HDC—- C:WINDOWS$NtUninstallKB958687$
2009-03-29 09:47:48 —-HDC—- C:WINDOWS$NtUninstallKB952287$
2009-03-29 09:47:43 —-HDC—- C:WINDOWS$NtUninstallKB929399$
2009-03-29 09:47:26 —-HDC—- C:WINDOWS$NtUninstallKB950760$
2009-03-29 09:47:22 —-HDC—- C:WINDOWS$NtUninstallKB951066$
2009-03-29 09:47:19 —-HDC—- C:WINDOWS$NtUninstallKB954600$
2009-03-29 09:47:15 —-HDC—- C:WINDOWS$NtUninstallKB958644$
2009-03-29 09:47:06 —-HDC—- C:WINDOWS$NtUninstallKB955069$
2009-03-29 09:01:55 —-D—- C:WINDOWSsystem32PreInstall
2009-03-29 09:01:53 —-HDC—- C:WINDOWS$NtUninstallKB898461$
2009-03-29 09:01:53 —-HD—- C:WINDOWS$hf_mig$
2009-03-28 10:21:20 —-D—- C:WINDOWSsystem32SoftwareDistribution
2009-03-28 02:09:09 —-D—- C:Program FilesPanda Security
2009-03-28 01:38:44 —-D—- C:rsit
2009-03-28 01:38:44 —-D—- C:Program Filestrend micro
2009-03-28 01:38:24 —-A—- C:Program FilesRSIT.exe
2009-03-27 18:55:16 —-A—- C:WINDOWSsystem32redirect_key.txt
2009-03-27 16:54:09 —-D—- C:Documents and SettingsAdministratorApplication DataMalwarebytes
2009-03-27 16:54:01 —-D—- C:Documents and SettingsAll UsersApplication DataMalwarebytes
2009-03-27 16:54:00 —-D—- C:Program FilesMalwarebytes’ Anti-Malware
2009-03-27 16:50:30 —-A—- C:Program Filesmbam-setup.exe
2009-03-27 16:41:56 —-D—- C:Documents and SettingsAdministratorApplication DataanvB8
2009-03-27 16:38:02 —-D—- C:Documents and SettingsAdministratorApplication DataanvA5
2009-03-27 16:20:52 —-D—- C:Documents and SettingsAdministratorApplication Dataanv36
2009-03-27 16:16:57 —-D—- C:Documents and SettingsAdministratorApplication Dataanv5
2009-03-27 16:12:53 —-D—- C:Documents and SettingsAdministratorApplication Dataanv84
2009-03-27 16:00:42 —-D—- C:Documents and SettingsAdministratorApplication Dataanv1A
2009-03-27 15:57:51 —-D—- C:Documents and SettingsAdministratorApplication Dataanv71
2009-03-27 15:55:17 —-A—- C:WINDOWSsystem32wincreate.exe
2009-03-27 15:52:48 —-D—- C:Documents and SettingsAdministratorApplication DataanvBA
2009-03-27 15:46:13 —-D—- C:Documents and SettingsAdministratorApplication Dataanv6
2009-03-27 15:26:03 —-D—- C:Documents and SettingsAdministratorApplication Dataanv34
2009-03-27 15:08:11 —-A—- C:Program Fileslaunch.exe
2009-03-27 14:47:00 —-D—- C:Documents and SettingsAdministratorApplication Dataanv19
2009-03-27 11:13:35 —-HD—- C:$AVG8.VAULT$
2009-03-27 11:11:00 —-A—- C:WINDOWSsystem32avgrsstx.dll
2009-03-27 11:10:53 —-D—- C:Documents and SettingsAdministratorApplication DataAVGTOOLBAR
2009-03-27 11:10:47 —-D—- C:Program FilesAVG
2009-03-27 11:10:46 —-D—- C:Documents and SettingsAll UsersApplication Dataavg8
2009-03-27 10:56:47 —-A—- C:Program Filesavg_free_stf_en_85_283a1450.exe
2009-03-27 10:45:13 —-D—- C:Documents and SettingsAdministratorApplication DataanvD3
2009-03-27 10:33:26 —-D—- C:Documents and SettingsAdministratorApplication Dataanv57
2009-03-27 10:31:39 —-D—- C:Documents and SettingsAdministratorApplication DataanvF4
2009-03-27 10:13:17 —-D—- C:Documents and SettingsAdministratorApplication Dataanv81
2009-03-27 10:09:20 —-D—- C:Documents and SettingsAdministratorApplication Dataanv7A
2009-03-27 10:05:40 —-D—- C:Documents and SettingsAdministratorApplication Dataanv2C
2009-03-27 09:56:02 —-D—- C:Documents and SettingsAdministratorApplication DataanvF0
2009-03-27 09:48:25 —-D—- C:Documents and SettingsAdministratorApplication DataanvC3
2009-03-27 09:42:52 —-D—- C:QUARANTINE
2009-03-27 09:41:43 —-A—- C:WINDOWSIE4 Error Log.txt

======List of files/folders modified in the last 1 months======

2009-03-30 16:15:43 —-D—- C:WINDOWSPrefetch
2009-03-30 16:06:25 —-D—- C:WINDOWSTemp
2009-03-30 16:06:23 —-A—- C:RTHDCPL_Dump.txt
2009-03-30 16:04:13 —-A—- C:WINDOWSSchedLgU.Txt
2009-03-30 15:54:53 —-D—- C:WINDOWSsystem32
2009-03-30 15:51:54 —-RD—- C:Program Files
2009-03-30 08:23:47 —-D—- C:WINDOWS
2009-03-30 08:23:37 —-SHD—- C:Config.Msi
2009-03-30 08:23:37 —-RSHDC—- C:WINDOWSsystem32dllcache
2009-03-30 08:07:21 —-HD—- C:WINDOWSinf
2009-03-30 08:07:20 —-D—- C:WINDOWSsystem32drivers
2009-03-30 08:07:17 —-A—- C:WINDOWSimsins.BAK
2009-03-30 08:06:52 —-D—- C:Program FilesInternet Explorer
2009-03-30 08:06:50 —-D—- C:WINDOWSsystem32CatRoot2
2009-03-30 08:05:34 —-SHD—- C:WINDOWSInstaller
2009-03-30 08:05:33 —-D—- C:WINDOWSWinSxS
2009-03-29 21:37:32 —-A—- C:WINDOWSNeroDigital.ini
2009-03-29 17:09:53 —-D—- C:WINDOWSsystem32CatRoot
2009-03-29 14:23:35 —-D—- C:WINDOWSDebug
2009-03-29 09:48:24 —-D—- C:Program FilesMessenger
2009-03-29 09:01:36 —-A—- C:WINDOWSsystem32PerfStringBackup.INI
2009-03-29 00:12:35 —-D—- C:Program FilesXvid
2009-03-28 10:21:29 —-D—- C:WINDOWSSoftwareDistribution
2009-03-28 10:21:29 —-D—- C:WINDOWSHelp
2009-03-28 02:07:54 —-SD—- C:WINDOWSDownloaded Program Files
2009-03-27 22:11:16 —-D—- C:Program FilesSemagic
2009-03-27 11:10:41 —-D—- C:Program FilesCommon FilesMicrosoft Shared
2009-03-27 11:10:15 —-SD—- C:Documents and SettingsAdministratorApplication DataMicrosoft
2009-03-27 10:20:59 —-D—- C:Program FilesCommon Files
2009-03-27 10:20:57 —-D—- C:Program FilesMcAfee
2009-03-11 18:17:48 —-D—- C:WINDOWSsystem32wbem

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:WINDOWSSystem32Driversavgldx86.sys [2009-03-27 325640]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; C:WINDOWSSystem32Driversavgmfx86.sys [2009-03-27 27656]
R1 AvgTdiX;AVG Free8 Network Redirector; C:WINDOWSSystem32Driversavgtdix.sys [2009-03-27 108552]
R1 intelppm;Intel Processor Driver; C:WINDOWSsystem32DRIVERSintelppm.sys [2004-08-04 36096]
R1 kbdhid;Keyboard HID Driver; C:WINDOWSsystem32DRIVERSkbdhid.sys [2004-08-04 14848]
R2 {95808DC4-FA4A-4C74-92FE-5B863F82066B};{95808DC4-FA4A-4C74-92FE-5B863F82066B}; ??C:Program FilesCyberLinkPowerDVD00.fcl []
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.3.0; C:WINDOWSsystem32DRIVERSAegisP.sys [2008-08-13 20747]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:WINDOWSsystem32DRIVERSHDAudBus.sys [2005-01-07 138752]
R3 hidusb;Microsoft HID Class Driver; C:WINDOWSsystem32DRIVERShidusb.sys [2004-08-04 9600]
R3 ialm;ialm; C:WINDOWSsystem32DRIVERSigxpmp32.sys [2008-01-16 5761760]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:WINDOWSsystem32driversRtkHDAud.sys [2007-12-20 4637696]
R3 mouhid;Mouse HID Driver; C:WINDOWSsystem32DRIVERSmouhid.sys [2004-08-04 12160]
R3 pcouffin;VSO Software pcouffin; C:WINDOWSSystem32Driverspcouffin.sys [2008-10-27 47360]
R3 RT61;Ralink RT61 Wireless Driver; C:WINDOWSsystem32DRIVERSRT61.sys [2006-01-19 363008]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:WINDOWSsystem32DRIVERSRtenicxp.sys [2008-01-16 90880]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:WINDOWSsystem32DRIVERSusbccgp.sys [2004-08-04 31616]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:WINDOWSsystem32DRIVERSusbehci.sys [2004-08-03 26624]
R3 usbhub;Microsoft USB Standard Hub Driver; C:WINDOWSsystem32DRIVERSusbhub.sys [2004-08-03 57600]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:WINDOWSsystem32DRIVERSusbuhci.sys [2004-08-03 20480]
S1 mferkdk;VSCore mferkdk; ??C:Program FilesMcAfeeVirusScan Enterprisemferkdk.sys []
S3 se45bus;Sony Ericsson Device 069 driver (WDM); C:WINDOWSsystem32DRIVERSse45bus.sys [2006-11-30 61536]
S3 se45mdfl;Sony Ericsson Device 069 USB WMC Modem Filter; C:WINDOWSsystem32DRIVERSse45mdfl.sys [2006-11-30 9360]
S3 se45mdm;Sony Ericsson Device 069 USB WMC Modem Driver; C:WINDOWSsystem32DRIVERSse45mdm.sys [2006-11-30 97088]
S3 se45mgmt;Sony Ericsson Device 069 USB WMC Device Management Drivers (WDM); C:WINDOWSsystem32DRIVERSse45mgmt.sys [2006-11-30 88624]
S3 se45obex;Sony Ericsson Device 069 USB WMC OBEX Interface; C:WINDOWSsystem32DRIVERSse45obex.sys [2006-11-30 86432]
S3 se45unic;Sony Ericsson Device 069 USB Ethernet Emulation SEMC45 (WDM); C:WINDOWSsystem32DRIVERSse45unic.sys [2006-11-30 90800]
S3 USBSTOR;USB Mass Storage Driver; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2004-08-03 26496]
S3 WudfPf;Windows Driver Foundation — User-mode Driver Framework Platform Driver; C:WINDOWSsystem32DRIVERSWudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avg8wd;AVG Free8 WatchDog; C:PROGRA~1AVGAVG8avgwdsvc.exe [2009-03-27 298264]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:Program FilesNeroNero8Nero BackItUpNBService.exe [2007-09-20 853288]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:Program FilesCyberLinkShared filesRichVideo.exe [2007-05-14 272024]
R3 NMIndexingService;NMIndexingService; C:Program FilesCommon FilesNeroLibNMIndexingService.exe [2007-10-23 382248]
S3 Adobe LM Service;Adobe LM Service; C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe [2008-08-14 72704]
S3 gusvc;Google Updater Service; C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe [2009-01-25 137200]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:Program FilesMicrosoft OfficeOffice12GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:Program FilesCommon FilesMicrosoft SharedOFFICE12ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2006-10-26 145184]
S3 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2004-08-04 14336]

EOF

А Info забыл — откуда берём?
30 марта, 2009 в 12:50 пп в ответ на: Удалил Rapid, а вирусы всё лезут #23005
ivar-nat
Participant
- Темы:1
- Сообщений:6
Ок! В Выходные не прочитал ваше сообщение, не было времени. Спасибо огромное за помощь! Отчёт приложу, как только всё сделаю! Рапид, больше в Программных файлах не появляется, но трояны лезут пачками.
Автор

Сообщения