Созданные ответы форума
-
Сообщения
-
вот сейчас в нете и все пока хорошо, никаких инсинуаций со стороны компа.
Ну,, я так предполагаю, что Вам Валерий спасибо, потому что ничего другого не делалось. Если будут проблемы, уж точно сюда обращусь. Посмотрю, что будет завтра и отчитаюсь.Спасиб большой
15.01.2009
Все в норме. спасибо за квалифицированную помощь.вставляю все что получено после Combofixa
ComboFix 09-01-13.04 — Admin 2009-01-14 19:51:39.4 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1251.1.1049.18.2046.1538 [GMT 8:00]
Running from: c:documents and settingsAdminРабочий столвременная интернетComboFix.exe
AV: avast! antivirus 4.8.1296 [VPS 081231-0] *On-access scanning disabled* (Outdated)
* Created a new restore pointWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.c:documents and settingsAdminLocal SettingsTemporary Internet Files0EB9F12C_6E6B_4c03_AEBA_8C04CFA98AA4.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet Files15913497_F86C_4218_8817_F50940D1E1B2.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet Files29887DDE_00B9_4011_9CF7_59511F1ECC1B.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet Files35B7DFFA_884F_4fbc_8E60_DA601BDC7BF7.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files362FD6E8_8CDA_4c2a_A8AA-BDA22B321711.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files3DF04940_9866_4241_A998_0CDDFAFD147A.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet Files426500D7_0FF3_426c_828D_065DBAEA0581.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files478BD4AE_2691_438d_BDCA_3485DC022700.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files5C6C645F_BAA8_4149_BFEB_2031230FF0FD.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet Files61EA7D69_19D4_421a_A899_0DF4D58CD119.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files777FDAFB_83CF_4960_AA71_4E5D7BCD8E57.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files8DA878D5_E80B_4721_B75A_17EFFAF1A700.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files98F6DF79_7171_452d_9C26_C0193E12DBDF.gif
c:documents and settingsAdminLocal SettingsTemporary Internet FilesA2B240D6_0386_419e_91C5_3F7D90437CD0.gif
c:documents and settingsAdminLocal SettingsTemporary Internet FilesC75CEF8D_5AF4_4563_8594_C45A45E14E63.gif
c:documents and settingsAdminLocal SettingsTemporary Internet FilesE21285C1_40E6_435c_A69F_3387E7BD89CB.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet FilesE9A4D648_ED73_4ea7_88B2_18332DBA4F3E.gif.
((((((((((((((((((((((((( Files Created from 2008-12-14 to 2009-01-14 )))))))))))))))))))))))))))))))
.2009-01-12 22:08 . 2009-01-12 22:11 146,880 —a
c:windowssystem32x
2009-01-11 20:41 . 2009-01-11 20:41d
C:_OTMoveIt
2009-01-11 19:06 . 2009-01-12 18:07d
C:rsit
2009-01-11 17:37 . 2009-01-11 17:37d
c:program filesTrend Micro
2009-01-11 17:30 . 2009-01-11 17:30d
c:windowsERUNT
2009-01-11 17:30 . 2009-01-11 17:30d
C:ERDNT
2009-01-11 17:30 . 2009-01-11 17:30d
C:!FixIEDef
2009-01-11 12:40 . 2009-01-11 12:40d
c:program filesYandex
2009-01-10 12:35 . 2009-01-11 10:15d
c:program filesDreamRender
2009-01-10 12:35 . 2006-12-07 15:01 20,480 —a
c:windowssystem32DreamSaver.scr
2009-01-08 21:21 . 2009-01-12 09:28 38 —a
c:windowsavisplitter.INI
2009-01-08 19:21 . 2009-01-08 19:21d
c:program filesCreative Zone
2009-01-08 19:21 . 2009-01-08 20:39 490 —a
c:windowsSStylerPro.ini
2009-01-08 16:48 . 2009-01-08 16:48d
c:program filessollab
2009-01-08 16:48 . 1999-03-23 09:12 299,520 —a
c:windowsuninst.exe
2009-01-08 16:48 . 2002-08-14 00:08 264,704 —a
c:windowssystem32MaggiUninstall60.exe
2009-01-08 16:28 . 2009-01-08 16:28d
c:program filesMedia Art
2009-01-08 16:19 . 2009-01-08 16:21 491 —a
c:windowsSStylerProDemo.ini
2009-01-04 11:53 . 2009-01-11 10:14d
c:program filesCommon FilesYandex
2009-01-04 11:53 . 2009-01-11 12:40d
c:documents and settingsAdminApplication DataYandex
2009-01-02 22:12 . 2009-01-02 22:20d
c:program filesЮристАссистент 5.1
2009-01-02 22:12 . 2004-07-29 06:47 142,336 —a
c:windowssystem32unirsrv.dll
2009-01-01 09:06 . 2009-01-01 09:06d
c:documents and settingsAll UsersApplication DataActivision
2008-12-25 11:47 . 2008-05-08 09:03 453,632 —a
c:windowssystem32SetACL.ocx
2008-12-14 17:16 . 2008-12-14 17:25d
c:program filesBitComet
2008-12-14 17:02 . 2008-12-14 17:06d
c:program filesuTorrent
2008-12-14 17:02 . 2008-12-20 11:49d
c:documents and settingsAdminApplication DatauTorrent.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-04 03:53
d
w c:program filesDownload Master
2009-01-01 01:06
d
w c:documents and settingsAdminApplication DataActivision
2009-01-01 01:05 107,888 —-a-w c:windowssystem32CmdLineExt.dll
2009-01-01 01:04
d—h—w c:program filesInstallShield Installation Information
2009-01-01 00:59
d
w c:program filesActivision
2008-12-13 11:42
d
w c:program filesNeoDownloader
2008-12-13 11:42
d
w c:documents and settingsAdminApplication DataNeoDownloader
2008-12-10 13:02
d
w c:documents and settingsAdminApplication DataDownload Master
2008-11-14 09:20
d
w c:program filesБольшая детская энциклопедия
2008-10-11 09:10 18,656 —-a-w c:documents and settingsAdminApplication DataGDIPFONTCACHEV1.DAT
.
Sigcheck
2007-11-27 20:16 578560 5231f1983829611637e9493105e84751 c:windowssystem32user32.dll2007-11-27 20:37 360576 6ebeae64113900f24318b02d3a87c112 c:windowssystem32driverstcpip.sys
2007-11-27 23:16 2158592 159e42007b9030b3dfe525251d4f5585 c:windowssystem32ntkrnlpa.exe
2007-11-25 22:15 2278912 61a3571d0a6550623405bb4103f4cca5 c:windowssystem32ntoskrnl.exe
2007-11-27 20:15 1608704 16577d75e24b75c7d34fd955f8f9b732 c:windowsexplorer.exe
2007-11-27 20:15 30208 ba72689de7721cc6a4414c5c92b43302 c:windowssystem32ctfmon.exe
2007-11-27 20:16 80216 796678ab414abd87b2d5c4baeb236859 c:windowssystem32wuauclt.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2008-12-16 3111712][HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar][HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2008-12-16 3111712][HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar][HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2007-01-26 201728]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2007-07-02 132608]
«LClock»=»c:program filesLClockLClock.exe» [2004-09-20 65536]
«EPSON Stylus Photo R270 Series»=»c:windowsSystem32spoolDRIVERSW32X863E_FATIBNP.EXE» [2006-05-19 139264]
«Download Master»=»c:program filesDownload Masterdmaster.exe» [2007-09-18 3253248]
«BitComet»=»c:program filesBitCometBitComet.exe» [2006-06-24 3394048][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2006-01-12 155648]
«VolumeControl»=»c:program filesVolumeControlvolume.exe» [2003-09-16 36864]
«avast!»=»c:progra~1ALWILS~1Avast4ashDisp.exe» [2008-11-27 81000]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2007-10-25 8527872]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2007-10-25 81920]
«RemoteControl»=»c:program filesCyberLinkPowerDVDPDVDServ.exe» [2003-12-08 32768]
«Share-to-Web Namespace Daemon»=»c:program filesHewlett-PackardHP Share-to-Webhpgs2wnd.exe» [2002-04-17 69632]
«RTHDCPL»=»RTHDCPL.EXE» [2007-09-19 c:windowsRTHDCPL.exe]
«nwiz»=»nwiz.exe» [2007-10-25 c:windowssystem32nwiz.exe]
«BluetoothAuthenticationAgent»=»bthprops.cpl» [2004-08-18 c:windowssystem32bthprops.cpl][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2007-01-26 201728]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2007-07-02 132608][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» [2007-11-27 c:windowssystem32advpack.dll]
«IE7_012″=»advpack.dll» [2007-11-27 c:windowssystem32advpack.dll]c:documents and settingsAll Usersѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
Microsoft Office.lnk — c:program filesMicrosoft OfficeOffice10OSA.EXE [2001-02-13 83360][HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoThumbnailCache»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoThumbnailCache»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesDisableNotify»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusDisableNotify»=dword:00000001
«AntiVirusOverride»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«11144:TCP»= 11144:TCP:BitComet 11144 TCP
«11144:UDP»= 11144:UDP:BitComet 11144 UDPR1 aswSP;avast! Self Protection;c:windowssystem32driversaswSP.sys [2008-12-10 111184]
R4 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [2008-12-10 20560]
.
.
Supplementary Scan
.
uStart Page = hxxp://www.yandex.ru/
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office10EXCEL.EXE/3000
IE: Закачать ВСЕ при помощи Download Master — c:program filesDownload Masterdmieall.htm
IE: Закачать при помощи Download Master — c:program filesDownload Masterdmie.htm
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe
TCP: {CB00EAF5-1A29-447D-88A9-D9284558B523} = 192.168.1.1
FF — ProfilePath — c:documents and settingsAdminApplication DataMozillaFirefoxProfilesorny4kcv.default
FF — prefs.js: browser.startup.homepage — hxxp://www.yandex.ru/
FF — prefs.js: keyword.URL — hxxp://yandex.ru/yandsearch?stype=first&clid=22030&yasoft=barff&text=
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnppl3260.dll
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnprpjplug.dll
.**************************************************************************
catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-14 19:53:11
Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(796)
c:windowssystem32SETUPAPI.dll
c:windowssystem32cscui.dll— — — — — — — > ‘lsass.exe'(852)
c:windowssystem32setupapi.dll
.
Completion time: 2009-01-14 19:54:12
ComboFix-quarantined-files.txt 2009-01-14 11:54:03
ComboFix2.txt 2009-01-11 10:47:14Pre-Run: 93 841 682 432 байт свободно
Post-Run: 93,843,951,616 байт свободно182
Спасибо, что работаете и не бросаете в беде.
Спасибо. Отправляю лог. Все открывает без всплывающих окон, мозилу и эксплорер и вместе и порознь, но работают минут 5, потом просит снова подключиться, хотя судя по состоянию — не отключается от нета. Подключишься и все, сайты открывать перестает, пишет чтобы снова попробовали. Сообщение и то не успеваю отправить, приходится перезагрузжаться.
Logfile of random’s system information tool 1.05 (written by random/random)
Run by Admin at 2009-01-12 18:06:30
Microsoft Windows XP Professional Service Pack 2
System drive C: has 90 GB (38%) free of 238 GB
Total RAM: 2046 MB (77% free)Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:06:34, on 12.01.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20661)
Boot mode: NormalRunning processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
C:Program FilesAlwil SoftwareAvast4ashServ.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSnotepad.exe
C:program filesVolumeControlvolume.exe
C:PROGRA~1ALWILS~1Avast4ashDisp.exe
C:WINDOWSRTHDCPL.EXE
C:WINDOWSsystem32RUNDLL32.EXE
C:Program FilesCyberLinkPowerDVDPDVDServ.exe
C:Program FilesHewlett-PackardHP Share-to-Webhpgs2wnd.exe
C:WINDOWSsystem32rundll32.exe
C:Program FilesPunto Switcherps.exe
C:Program FilesLClockLClock.exe
C:Program FilesDownload Masterdmaster.exe
C:Program FilesBitCometBitComet.exe
C:Program FilesHewlett-PackardHP Share-to-Webhpgs2wnf.exe
C:WINDOWSsystem32nvsvc32.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:WINDOWSSystem32svchost.exe
C:Documents and SettingsAdminРабочий столвременная интернетRSIT.exe
C:Program FilesTrend MicroHijackThisAdmin.exeR0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.yandex.ru/
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
O2 — BHO: AcroIEHlprObj Class — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dll
O2 — BHO: SSVHelper Class — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — C:Program FilesJavajre1.6.0_03binssv.dll
O2 — BHO: IE 4.x-6.x BHO for Download Master — {9961627E-4059-41B4-8E0E-A7D6B3854ADF} — C:PROGRA~1DOWNLO~1dmiehlp.dll
O2 — BHO: EpsonToolBandKicker Class — {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} — C:Program FilesEPSONEPSON Web-To-PageEPSON Web-To-Page.dll
O3 — Toolbar: EPSON Web-To-Page — {EE5D279F-081B-4404-994D-C6B60AAEBA6D} — C:Program FilesEPSONEPSON Web-To-PageEPSON Web-To-Page.dll
O3 — Toolbar: Яндекс.Бар — {91397D20-1446-11D4-8AF4-0040CA1127B6} — C:Program FilesYandexYandexBarIEyndbar.dll
O4 — HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 — HKLM..Run: [VolumeControl] C:program filesVolumeControlvolume.exe
O4 — HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 — HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 — HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 — HKLM..Run: [nwiz] nwiz.exe /install
O4 — HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 — HKLM..Run: [RemoteControl] «C:Program FilesCyberLinkPowerDVDPDVDServ.exe»
O4 — HKLM..Run: [Share-to-Web Namespace Daemon] C:Program FilesHewlett-PackardHP Share-to-Webhpgs2wnd.exe
O4 — HKLM..Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 — HKCU..Run: [Punto Switcher] C:Program FilesPunto Switcherps.exe
O4 — HKCU..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe
O4 — HKCU..Run: [LClock] C:Program FilesLClockLClock.exe
O4 — HKCU..Run: [EPSON Stylus Photo R270 Series] C:WINDOWSSystem32spoolDRIVERSW32X863E_FATIBNP.EXE /FU «C:WINDOWSTEMPE_S80.tmp» /EF «HKCU»
O4 — HKCU..Run: [Download Master] C:Program FilesDownload Masterdmaster.exe -autorun
O4 — HKCU..Run: [BitComet] «C:Program FilesBitCometBitComet.exe»
O4 — HKUSS-1-5-18..Run: [Punto Switcher] C:Program FilesPunto Switcherps.exe (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,NewUserFirstLogonInstall,0 (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [Punto Switcher] C:Program FilesPunto Switcherps.exe (User ‘Default user’)
O4 — HKUS.DEFAULT..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,NewUserFirstLogonInstall,0 (User ‘Default user’)
O4 — Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOffice10OSA.EXE
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2Office10EXCEL.EXE/3000
O8 — Extra context menu item: Закачать ВСЕ при помощи Download Master — C:Program FilesDownload Masterdmieall.htm
O8 — Extra context menu item: Закачать при помощи Download Master — C:Program FilesDownload Masterdmie.htm
O9 — Extra button: (no name) — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_03binssv.dll
O9 — Extra ‘Tools’ menuitem: Sun Java Console — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_03binssv.dll
O9 — Extra button: Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
O9 — Extra ‘Tools’ menuitem: &Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O17 — HKLMSystemCCSServicesTcpip..{CB00EAF5-1A29-447D-88A9-D9284558B523}: NameServer = 192.168.1.1
O17 — HKLMSystemCCSServicesTcpip..{E39AD5CE-84EE-4477-A974-C5727D5B666A}: NameServer = 195.46.116.1 195.46.96.1
O23 — Service: avast! iAVS4 Control Service (aswUpdSv) — ALWIL Software — C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 — Service: avast! Antivirus — ALWIL Software — C:Program FilesAlwil SoftwareAvast4ashServ.exe
O23 — Service: avast! Mail Scanner — ALWIL Software — C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
O23 — Service: avast! Web Scanner — ALWIL Software — C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: NVIDIA Display Driver Service (NVSvc) — NVIDIA Corporation — C:WINDOWSsystem32nvsvc32.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe—
End of file — 7802 bytes======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class — C:Program FilesAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dll [2003-05-14 50376][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class — C:Program FilesJavajre1.6.0_03binssv.dll [2007-09-25 501136][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9961627E-4059-41B4-8E0E-A7D6B3854ADF}]
IE 4.x-6.x BHO for Download Master — C:PROGRA~1DOWNLO~1dmiehlp.dll [2008-10-24 157696][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}]
EpsonToolBandKicker Class — C:Program FilesEPSONEPSON Web-To-PageEPSON Web-To-Page.dll [2005-02-21 368640][HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{EE5D279F-081B-4404-994D-C6B60AAEBA6D} — EPSON Web-To-Page — C:Program FilesEPSONEPSON Web-To-PageEPSON Web-To-Page.dll [2005-02-21 368640]
{91397D20-1446-11D4-8AF4-0040CA1127B6} — Яндекс.Бар — C:Program FilesYandexYandexBarIEyndbar.dll [2008-12-16 3111712][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«NeroFilterCheck»=C:WINDOWSsystem32NeroCheck.exe [2006-01-12 155648]
«VolumeControl»=C:program filesVolumeControlvolume.exe [2003-09-16 36864]
«avast!»=C:PROGRA~1ALWILS~1Avast4ashDisp.exe [2008-11-27 81000]
«RTHDCPL»=C:WINDOWSRTHDCPL.EXE [2007-09-19 16844800]
«NvCplDaemon»=C:WINDOWSsystem32NvCpl.dll [2007-10-25 8527872]
«nwiz»=nwiz.exe /install []
«NvMediaCenter»=C:WINDOWSsystem32NvMcTray.dll [2007-10-25 81920]
«RemoteControl»=C:Program FilesCyberLinkPowerDVDPDVDServ.exe [2003-12-08 32768]
«Share-to-Web Namespace Daemon»=C:Program FilesHewlett-PackardHP Share-to-Webhpgs2wnd.exe [2002-04-17 69632]
«BluetoothAuthenticationAgent»=C:WINDOWSsystem32bthprops.cpl [2004-08-18 110592][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«Punto Switcher»=C:Program FilesPunto Switcherps.exe [2007-01-26 201728]
«VistaIcon»=C:Program FilesVistaDriveIconVistaDrv.exe [2007-07-02 132608]
«LClock»=C:Program FilesLClockLClock.exe [2004-09-20 65536]
«EPSON Stylus Photo R270 Series»=C:WINDOWSSystem32spoolDRIVERSW32X863E_FATIBNP.EXE [2006-05-19 139264]
«Download Master»=C:Program FilesDownload Masterdmaster.exe [2007-09-18 3253248]
«BitComet»=C:Program FilesBitCometBitComet.exe [2006-06-24 3394048]C:Documents and SettingsAll UsersГлавное менюПрограммыАвтозагрузка
Microsoft Office.lnk — C:Program FilesMicrosoft OfficeOffice10OSA.EXE[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32WPDShServiceObj.dll [2006-10-19 133632][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=36
«NoSharedDocuments»=1
«NoThumbnailCache»=1
«NoSMConfigurePrograms»=1
«NoDriveAutoRun»=FFFFFFFF
«NoDrives»=0[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveAutoRun»=
«NoDriveTypeAutoRun»=
«NoDrives»=[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»======List of files/folders created in the last 1 months======
2009-01-11 20:41:21 —-D—- C:_OTMoveIt
2009-01-11 20:37:49 —-RASHD—- C:autorun.inf
2009-01-11 20:05:37 —-SHD—- C:RECYCLER
2009-01-11 19:41:03 —-D—- C:WINDOWSpss
2009-01-11 19:06:14 —-D—- C:rsit
2009-01-11 18:47:14 —-A—- C:ComboFix.txt
2009-01-11 18:38:22 —-A—- C:logit.txt
2009-01-11 17:37:45 —-D—- C:Program FilesTrend Micro
2009-01-11 17:30:25 —-D—- C:ERDNT
2009-01-11 17:30:24 —-D—- C:WINDOWSERUNT
2009-01-11 17:30:19 —-D—- C:!FixIEDef
2009-01-11 12:46:08 —-A—- C:WINDOWSzip.exe
2009-01-11 12:46:08 —-A—- C:WINDOWSVFIND.exe
2009-01-11 12:46:08 —-A—- C:WINDOWSSWXCACLS.exe
2009-01-11 12:46:08 —-A—- C:WINDOWSSWSC.exe
2009-01-11 12:46:08 —-A—- C:WINDOWSSWREG.exe
2009-01-11 12:46:08 —-A—- C:WINDOWSsed.exe
2009-01-11 12:46:08 —-A—- C:WINDOWSNIRCMD.exe
2009-01-11 12:46:08 —-A—- C:WINDOWSgrep.exe
2009-01-11 12:46:08 —-A—- C:WINDOWSfdsv.exe
2009-01-11 12:46:02 —-D—- C:WINDOWSERDNT
2009-01-11 12:40:33 —-D—- C:Program FilesYandex
2009-01-10 12:35:34 —-D—- C:Program FilesDreamRender
2009-01-08 21:21:52 —-A—- C:WINDOWSavisplitter.INI
2009-01-08 19:21:52 —-A—- C:WINDOWSSStylerPro.ini
2009-01-08 19:21:44 —-D—- C:Program FilesCreative Zone
2009-01-08 16:48:27 —-A—- C:WINDOWSsystem32MaggiUninstall60.exe
2009-01-08 16:48:26 —-D—- C:Program Filessollab
2009-01-08 16:48:19 —-A—- C:WINDOWSuninst.exe
2009-01-08 16:28:43 —-D—- C:Program FilesMedia Art
2009-01-08 16:19:03 —-A—- C:WINDOWSSStylerProDemo.ini
2009-01-04 11:53:21 —-D—- C:Program FilesCommon FilesYandex
2009-01-04 11:53:21 —-D—- C:Documents and SettingsAdminApplication DataYandex
2009-01-02 22:12:47 —-D—- C:Program FilesЮристАссистент 5.1
2009-01-02 22:12:47 —-A—- C:WINDOWSsystem32unirsrv.dll
2009-01-01 09:06:05 —-D—- C:Documents and SettingsAll UsersApplication DataActivision
2008-12-25 11:47:33 —-A—- C:WINDOWSsystem32SetACL_GPL.txt
2008-12-14 17:16:59 —-D—- C:Program FilesBitComet
2008-12-14 17:02:44 —-D—- C:Documents and SettingsAdminApplication DatauTorrent
2008-12-14 17:02:43 —-D—- C:Program FilesuTorrent
2008-12-13 20:39:45 —-A—- C:WINDOWSsystem32wshirda.dll
2008-12-13 20:39:44 —-A—- C:WINDOWSsystem32irmon.dll
2008-12-13 20:39:44 —-A—- C:WINDOWSsystem32irftp.exe
2008-12-13 19:42:24 —-D—- C:Documents and SettingsAdminApplication DataNeoDownloader
2008-12-13 19:42:23 —-D—- C:Program FilesNeoDownloader======List of files/folders modified in the last 1 months======
2009-01-12 18:06:11 —-A—- C:WINDOWSSchedLgU.Txt
2009-01-12 18:06:07 —-D—- C:Program FilesMozilla Firefox
2009-01-12 18:05:25 —-D—- C:WINDOWSTemp
2009-01-12 18:04:29 —-D—- C:WINDOWSPrefetch
2009-01-11 20:41:41 —-D—- C:WINDOWSsystem32CatRoot2
2009-01-11 19:41:03 —-D—- C:WINDOWS
2009-01-11 18:47:15 —-D—- C:WINDOWSsystem32
2009-01-11 18:46:28 —-A—- C:WINDOWSsystem.ini
2009-01-11 18:46:00 —-D—- C:WINDOWSsystem32drivers
2009-01-11 18:45:59 —-D—- C:WINDOWSAppPatch
2009-01-11 18:45:59 —-D—- C:Program FilesCommon Files
2009-01-11 17:37:45 —-RD—- C:Program Files
2009-01-11 13:46:34 —-D—- C:Documents and SettingsAdminApplication DataMozilla
2009-01-11 13:10:48 —-D—- C:WINDOWSnetwork diagnostic
2009-01-11 12:52:42 —-A—- C:WINDOWSsystem32PerfStringBackup.INI
2009-01-11 12:46:08 —-SHD—- C:System Volume Information
2009-01-11 12:46:08 —-D—- C:WINDOWSsystem32Restore
2009-01-11 01:00:30 —-SHD—- C:WINDOWSInstaller
2009-01-08 18:37:26 —-D—- C:фотографии, картинки
2009-01-08 18:36:56 —-D—- C:WINDOWSOPTIONS
2009-01-08 16:52:49 —-D—- C:WINDOWSHelp
2009-01-07 12:27:09 —-A—- C:WINDOWSNeroDigital.ini
2009-01-05 14:13:58 —-D—- C:Games
2009-01-04 11:54:26 —-D—- C:Downloads
2009-01-04 11:53:00 —-D—- C:Program FilesDownload Master
2009-01-01 09:06:05 —-D—- C:Documents and SettingsAdminApplication DataActivision
2009-01-01 09:05:54 —-A—- C:WINDOWSsystem32CmdLineExt.dll
2009-01-01 09:05:34 —-HD—- C:WINDOWSinf
2009-01-01 09:05:34 —-D—- C:WINDOWSsystem32DirectX
2009-01-01 09:04:54 —-HD—- C:Program FilesInstallShield Installation Information
2009-01-01 08:59:50 —-D—- C:Program FilesActivision
2008-12-28 13:31:57 —-D—- C:WINDOWSSoftwareDistribution
2008-12-27 15:56:34 —-SD—- C:Documents and SettingsAdminApplication DataMicrosoft
2008-12-17 20:11:59 —-D—- C:WINDOWSsecurity
2008-12-14 18:15:48 —-D—- C:кино
2008-12-13 20:47:02 —-RSHDC—- C:WINDOWSsystem32dllcache======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:WINDOWSsystem32driversAavmker4.sys [2008-11-27 26944]
R1 AFS2K;AFS2k; C:WINDOWSsystem32driversAFS2K.sys [2008-09-23 82380]
R1 aswSP;avast! Self Protection; C:WINDOWSsystem32driversaswSP.sys [2008-11-27 111184]
R1 aswTdi;avast! Network Shield Support; C:WINDOWSsystem32driversaswTdi.sys [2008-11-27 50864]
R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2007-11-27 40448]
R2 aswFsBlk;aswFsBlk; C:WINDOWSsystem32DRIVERSaswFsBlk.sys [2008-11-27 20560]
R2 aswMon2;avast! Standard Shield Support; C:WINDOWSsystem32driversaswMon2.sys [2008-11-27 94032]
R2 rspndr;Ответчик обнаружения топологии уровня связи; C:WINDOWSsystem32DRIVERSrspndr.sys [2006-12-04 62336]
R3 aswRdr;aswRdr; C:WINDOWSsystem32driversaswRdr.sys [2008-11-27 23152]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:WINDOWSsystem32DRIVERSHDAudBus.sys [2005-12-26 138752]
R3 HidUsb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2001-08-18 9600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:WINDOWSsystem32driversRtkHDAud.sys [2007-09-19 4617728]
R3 mouhid;Драйвер мыши HID; C:WINDOWSsystem32DRIVERSmouhid.sys [2001-10-20 12160]
R3 nv;nv; C:WINDOWSsystem32DRIVERSnv4_mini.sys [2007-10-25 7426112]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:WINDOWSsystem32DRIVERSRtenicxp.sys [2007-09-19 101504]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2006-10-23 30208]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2007-04-09 59392]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2006-10-23 20608]
S3 BthEnum;Драйвер блока запроса Bluetooth; C:WINDOWSsystem32DRIVERSBthEnum.sys [2004-08-03 17024]
S3 BTHMODEM;Драйвер связи для модема Bluetooth; C:WINDOWSsystem32DRIVERSbthmodem.sys [2004-08-03 38016]
S3 BthPan;Bluetooth Device (Personal Area Network); C:WINDOWSsystem32DRIVERSbthpan.sys [2004-08-03 100992]
S3 BTHPORT;Драйвер порта Bluetooth; C:WINDOWSSystem32DriversBTHport.sys [2004-08-17 274688]
S3 BTHUSB;Драйвер порта USB радиомодуля Bluetooth; C:WINDOWSSystem32DriversBTHUSB.sys [2004-08-03 18944]
S3 ENTECH;ENTECH; ??C:WINDOWSsystem32DRIVERSENTECH.sys []
S3 gdrv;gdrv; ??C:WINDOWSgdrv.sys []
S3 RFCOMM;Устройство Bluetooth (протокол RFCOMM TDI); C:WINDOWSsystem32DRIVERSrfcomm.sys [2004-08-03 59648]
S3 usbohci;Драйвер минипорта Microsoft USB открытого хост-контроллера; C:WINDOWSsystem32DRIVERSusbohci.sys [2007-11-27 17152]
S3 usbprint;Класс принтеров Microsoft USB; C:WINDOWSsystem32DRIVERSusbprint.sys [2004-08-03 25856]
S3 usbscan;Драйвер USB-сканера; C:WINDOWSsystem32DRIVERSusbscan.sys [2004-08-03 15104]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2004-08-04 26496]
S3 WudfPf;Windows Driver Foundation — User-mode Driver Framework Platform Driver; C:WINDOWSsystem32DRIVERSWudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2006-09-29 82944]
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 aswUpdSv;avast! iAVS4 Control Service; C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe [2008-11-27 18752]
R2 avast! Antivirus;avast! Antivirus; C:Program FilesAlwil SoftwareAvast4ashServ.exe [2008-11-27 155160]
R2 BthServ;Bluetooth Support Service; C:WINDOWSsystem32svchost.exe [2004-08-18 14336]
R2 NVSvc;NVIDIA Display Driver Service; C:WINDOWSsystem32nvsvc32.exe [2007-10-25 155716]
R3 avast! Mail Scanner;avast! Mail Scanner; C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe [2008-11-27 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:Program FilesAlwil SoftwareAvast4ashWebSv.exe [2008-11-27 352920]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv1.1.4322aspnet_state.exe [2004-07-15 32768]
S3 WMPNetworkSvc;Служба общих сетевых ресурсов проигрывателя Windows Media; C:Program FilesWindows Media PlayerWMPNetwk.exe [2006-11-03 914944]
S3 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2004-08-18 14336]
EOF
