[Katy]

Скачала и запустила эту программу. Вот, что она показала в конце:

ComboFix 09-07-12.03 — User 02.09.2009 3:12.1.2 — NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1251.7.1049.18.2047.1125 [GMT 4:00]
Running from: c:usersUserDownloadsComboFix.exe
SP: Защитник Windows *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:$recycle.binS-1-5-21-1557293541-630233733-3230284385-500
c:$recycle.binS-1-5-21-2152478756-3922319563-605102323-500
c:programdataMicrosoftNetworkDownloaderqmgr0.dat
c:programdataMicrosoftNetworkDownloaderqmgr1.dat
c:usersUserAppDataRoamingwsnpoem
c:usersUserAppDataRoamingwsnpoem0B5F982.uf
c:usersUserAppDataRoamingwsnpoemaudio.dll
c:usersUserAppDataRoamingwsnpoemvideo.dll
c:windowsInstaller98cd6.msi

---

BITS: Possible infected sites

---

hxxp://soft.export.yandex.ru
hxxp://download.yandex.ru
.
((((((((((((((((((((((((( Files Created from 2009-08-01 to 2009-09-01 )))))))))))))))))))))))))))))))
.

2009-09-02 22:04 . 2009-09-02 22:04

---

d

---

w- c:program filesToros Software
2009-09-02 17:09 . 2009-09-02 17:09

---

d

---

w- C:_OTM
2009-09-01 23:16 . 2009-09-01 23:16

---

d

---

w- c:usersUserAppDataLocaltemp
2009-09-01 15:53 . 2009-09-01 20:45

---

d

---

w- c:usersUserTracing
2009-09-01 15:24 . 2009-09-01 15:24

---

dc—-w- c:windowssystem32DRVSTORE
2009-09-01 15:24 . 2009-02-06 14:08 55280 —-a-w- c:windowssystem32driversfssfltr.sys
2009-09-01 15:23 . 2009-09-01 15:23

---

d

---

w- c:program filesMicrosoft Sync Framework
2009-09-01 15:22 . 2009-09-01 15:22

---

d

---

w- c:program filesMicrosoft SQL Server Compact Edition
2009-09-01 15:20 . 2009-09-01 15:20

---

d

---

w- c:program filesMicrosoft
2009-09-01 15:20 . 2009-09-01 15:20

---

d

---

w- c:program filesWindows Live SkyDrive
2009-09-01 15:20 . 2009-09-01 15:24

---

d

---

w- c:program filesWindows Live
2009-09-01 15:19 . 2009-09-01 15:19

---

d

---

w- c:windowsPCHEALTH
2009-09-01 14:59 . 2009-09-01 14:59

---

d

---

w- c:program filesCommon FilesWindows Live
2009-09-01 11:59 . 2009-09-01 11:59

---

d

---

w- c:program filesRealtek
2009-09-01 11:59 . 2009-06-29 08:16 160256 —-a-w- c:windowssystem32FMAPO.dll
2009-09-01 11:59 . 2009-04-16 06:14 142848 —-a-w- c:windowssystem32AERTACap.dll
2009-09-01 11:59 . 2009-03-31 10:07 125952 —-a-w- c:windowssystem32AERTARen.dll
2009-09-01 11:59 . 2009-03-09 01:30 290304 —-a-w- c:windowssystem32RP3DAA32.dll
2009-09-01 11:59 . 2008-11-09 07:52 159744 —-a-w- c:windowssystem32MaxxAudioAPO20.dll
2009-09-01 11:59 . 2008-05-19 14:25 1933312 —-a-w- c:windowssystem32MaxxAudioEQ.dll
2009-09-01 11:59 . 2007-07-30 14:26 126976 —-a-w- c:windowssystem32MaxxAudioAPO.dll
2009-09-01 11:57 . 2009-09-01 12:01

---

d—h—w- c:program filesTemp
2009-09-01 11:57 . 2009-06-24 06:43 831488 —-a-w- c:windowsRtlExUpd.dll
2009-08-31 22:52 . 2009-08-31 22:52

---

d

---

w- c:usersUserAppDataLocalApps

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-02 17:23 . 2009-07-05 18:47

---

d

---

w- c:program filestrend micro
2009-09-01 23:16 . 2009-05-24 12:03 289069088 —sha-w- c:windowssystem32driversfidbox.dat
2009-09-01 23:11 . 2009-03-22 13:08

---

d

---

w- c:usersUserAppDataRoamingBitTorrent
2009-09-01 20:44 . 2009-05-24 12:03 3328292 —sha-w- c:windowssystem32driversfidbox.idx
2009-09-01 12:00 . 2009-09-01 12:00 319456 —-a-w- c:windowsDIFxAPI.dll
2009-09-01 11:59 . 2009-03-22 18:02

---

d—h—w- c:program filesInstallShield Installation Information
2009-07-09 17:39 . 2009-07-09 17:39

---

d

---

w- c:program filesPerfect World Entertainment
2009-07-09 17:25 . 2009-07-09 11:05

---

d

---

w- c:usersUserAppDataRoamingGetRightToGo
2009-07-09 17:14 . 2009-07-09 17:14

---

d

---

w- c:program filesUbisoft
2009-07-09 15:32 . 2009-07-09 15:32

---

d

---

w- c:program filesMidway Home Entertainment
2009-07-09 15:13 . 2009-03-22 18:02

---

d

---

w- c:program filesRockstar Games
2009-07-06 13:47 . 2009-09-01 12:00 51744 —-a-w- c:windowssystem32RtkCoInst.dll
2009-07-06 13:47 . 2009-09-01 12:00 1169440 —-a-w- c:windowssystem32RtkPgExt.dll
2009-07-06 13:47 . 2009-09-01 12:00 326176 —-a-w- c:windowssystem32RtkApoApi.dll
2009-07-06 13:47 . 2009-09-01 12:00 2898464 —-a-w- c:windowssystem32RtkAPO.dll
2009-07-06 13:12 . 2009-09-01 12:00 2657120 —-a-w- c:windowssystem32driversRTKVHDA.sys
2009-07-05 18:10 . 2009-06-17 10:41

---

d

---

w- c:program filesThe Adventure Company
2009-07-05 08:25 . 2009-07-05 08:25 12800 —-a-w- c:usersUserAppDataRoamingmsmedia.dll
2009-07-05 08:25 . 2009-07-05 08:25 12800 —-a-w- c:usersUserAppDataRoamingmsmedia.dll
2009-07-05 02:31 . 2009-03-18 17:10

---

d

---

w- c:programdataNVIDIA
2009-07-04 12:03 . 2009-07-04 12:03 245 —-a-w- c:windowssystem32PSUNCpl.dat
2009-07-04 12:03 . 2009-07-04 12:03

---

d

---

w- c:programdataPanda Security
2009-07-04 11:55 . 2009-07-04 11:43

---

d

---

w- c:program filesFIFA 2009 — Russian Premier League
2009-06-28 18:04 . 2006-11-09 07:21 653074 —-a-w- c:windowssystem32perfh019.dat
2009-06-28 18:04 . 2006-11-09 07:21 125594 —-a-w- c:windowssystem32perfc019.dat
2009-06-27 15:40 . 2009-06-27 14:41 281504 —-a-w- c:windowssystem32driversatksgt.sys
2009-06-27 15:40 . 2009-06-27 14:41 25888 —-a-w- c:windowssystem32driverslirsgt.sys
2009-06-27 14:19 . 2009-03-22 13:16 721904 —-a-w- c:windowssystem32driverssptd.sys
2009-06-27 13:05 . 2009-03-18 16:49 49920 —-a-w- c:usersUserAppDataLocalGDIPFONTCACHEV1.DAT
2009-03-22 13:47 . 2009-03-22 13:47 2599 —-a-w- c:program filesCommon Filesunins000.dat
2009-03-22 13:46 . 2009-03-22 13:47 729520 —-a-w- c:program filesCommon Filesunins000.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2009-01-21 3117856]

[HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar]

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2009-01-21 3117856]

[HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar]

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«Sidebar»=»c:program filesWindows Sidebarsidebar.exe» [2008-01-18 1233920]
«ehTray.exe»=»c:windowsehomeehTray.exe» [2008-01-18 125952]
«RGSC»=»c:program filesRockstar GamesRockstar Games Social ClubRGSCLauncher.exe» [2008-12-01 306088]
«DAEMON Tools Lite»=»c:program filesDAEMON Tools Litedaemon.exe» [2009-04-23 691656]
«msnmsgr»=»c:program filesWindows LiveMessengermsnmsgr.exe» [2009-02-06 3885408]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«Windows Defender»=»c:program filesWindows DefenderMSASCui.exe» [2008-01-18 1008184]
«SunJavaUpdateSched»=»c:program filesJavajre6binjusched.exe» [2009-05-24 148888]
«Sony Ericsson PC Suite»=»c:program filesSony EricssonMobile2Application LauncherApplication Launcher.exe» [2007-05-28 528384]
«WheelMouse»=»c:program filesA4TechMouseAmoumain.exe» [2007-02-10 241664]
«PSUNMain»=»c:program filesPanda SecurityPanda Cloud AntivirusPSUNMain.exe» [2009-04-23 353536]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2009-03-27 13687328]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2009-03-27 92704]
«RtHDVCpl»=»c:program filesRealtekAudioHDARtHDVCpl.exe» [2009-07-06 7600672]
«Skytel»=»c:program filesRealtekAudioHDASkytel.exe» [2009-07-06 1833504]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]
«EnableUIADesktopToggle»= 0 (0x0)

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalWinDefend]
@=»Service»

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerSvc]
«AntiVirusOverride»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicyFirewallRules]
«{3CE2CE2B-9196-402D-A8E2-471709DD8F31}»= UDP:c:program filesBitTorrentBitTorrent.exe:BitTorrent (TCP-In)
«{9DD7E610-5320-4B5D-8D50-F89D93CC69F1}»= TCP:c:program filesBitTorrentBitTorrent.exe:BitTorrent (UDP-In)
«{F52A7D62-BD7D-4773-9E5E-239983ED2A99}»= UDP:c:program filesRockstar GamesRockstar Games Social ClubRGSCLauncher.exe:Rockstar Games Social Club
«{D389AA9E-62BE-434B-A0A4-B0D6C986CEE4}»= TCP:c:program filesRockstar GamesRockstar Games Social ClubRGSCLauncher.exe:Rockstar Games Social Club
«{EB9A164A-B748-4A7A-9DCB-27118E8AEBA4}»= c:program filesWindows LiveSyncWindowsLiveSync.exe:Windows Live Sync

[HKLM~servicessharedaccessparametersfirewallpolicyStandardProfileAuthorizedApplicationsList]
«c:\Program Files\Sims 3\Game\Bin\TS3.exe»= c:program filesSims 3GameBinTS3.exe:*:Disabled:Sims3

R1 is-LU48Ldrv;is-LU48Ldrv;c:windowsSystem32drivers5268050.sys [24.05.2009 16:03 148496]
R1 PSINKNC;PSINKNC;c:windowsSystem32driversPSINKNC.sys [23.04.2009 20:14 114184]
R2 NanoServiceMain;NanoServiceMain;c:program filesPanda SecurityPanda Cloud AntivirusPSANHost.exe [23.04.2009 20:14 95488]
R2 PSINAflt;PSINAflt;c:windowsSystem32driversPSINAflt.sys [23.04.2009 20:14 137224]
R2 PSINFile;PSINFile;c:windowsSystem32driversPSINFile.sys [23.04.2009 20:14 94216]
R2 PSINProc;PSINProc;c:windowsSystem32driversPSINProc.sys [23.04.2009 20:14 98312]
S1 is-7M2THdrv;is-7M2THdrv;c:windowsSystem32drivers42613427.sys [28.05.2009 18:37 148496]
S3 Amps2prt;A4Tech PS/2 Port Mouse Driver;c:windowsSystem32driversAmps2prt.sys [10.02.2007 6:04 14336]
S3 fssfltr;FssFltr;c:windowsSystem32driversfssfltr.sys [01.09.2009 19:24 55280]
S3 fsssvc;Семейная безопасность Windows Live;c:program filesWindows LiveFamily Safetyfsssvc.exe [06.02.2009 18:08 533360]
.
— — — — ORPHANS REMOVED — — — —

BHO-{88888888-8888-8888-8888-888888888888} — (no file)
HKCU-Run-adstopper — c:program filesAdStoperAdStopperTrayApp.exe
HKCU-Run-YandexOnline — c:program filesYandexOnlineonline.exe

.

---

Supplementary Scan

---

.
uStart Page = http://www.apeha.ru
uInternet Settings,ProxyOverride = *.local
IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} — c:program filesPokerStars.NETPokerStarsUpdate.exe
FF — ProfilePath — c:usersUserAppDataRoamingMozillaFirefoxProfilesrmeoxo4z.default
FF — prefs.js: browser.search.defaulturl — hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF — prefs.js: browser.search.selectedEngine — Live Search
FF — prefs.js: browser.startup.homepage — hxxp://www.yandex.ru/?clid=41140&yasoft=barff
FF — prefs.js: keyword.URL — hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF — component: c:usersUserAppDataRoamingMozillaFirefoxProfilesrmeoxo4z.defaultextensionsDTToolbar@toolbarnet.comcomponentsDTToolbarFF.dll
FF — plugin: c:program filesMozilla FirefoxpluginsnpWebLaunch.dll
FF — plugin: c:program filesWindows LivePhoto GalleryNPWLPG.dll
FF — HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} — c:windowsMicrosoft.NETFrameworkv3.5Windows Presentation FoundationDotNetAssistantExtension
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-02 03:16
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

c:windowsTEMPTMP000000666E0D484B240C8158 524288 bytes executable

scan completed successfully
hidden files: 1

**************************************************************************
.

---

LOCKED REGISTRY KEYS

---

[HKEY_USERSS-1-5-21-1660588483-3707213830-2510818919-1001SoftwareSecuROMLicense information*]
«datasecu»=hex:f2,4c,7b,0d,43,b5,90,5c,a7,3c,d6,55,61,4d,8a,3f,a4,19,44,ae,bf,
ee,db,da,59,9f,18,6f,5f,af,b0,cc,aa,3c,22,ad,9d,d7,52,0d,83,b3,39,be,c6,f4,
«rkeysecu»=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98

[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}000AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
«BlindDial»=dword:00000000

[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}001AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
«BlindDial»=dword:00000000
.
Completion time: 2009-09-01 3:18
ComboFix-quarantined-files.txt 2009-09-01 23:18

Pre-Run: 27 578 454 016 байт свободно
Post-Run: 37 512 531 968 байт свободно

191 — E O F — 2009-09-01 23:01

[Katy]

Пробовала перевести дату в календаре на два месяца вперед, на мозилле информер исчез, а на опере и экспорере остался. Хотя и на мозилле уже вылетал, приходилось еще раз переводить дату.

[Katy]

Сделала, как вы сказали. Вот, что получилось:

========== PROCESSES ==========
Process explorer.exe killed successfully!
========== SERVICES/DRIVERS ==========
ServiceDriver is-LU48Ldrv not found.
Unable to delete servicedriver keyis-LU48Ldrv.
ServiceDriver is-7M2THdrv not found.
Unable to delete servicedriver keyis-7M2THdrv.
ServiceDriver is-7M2THdrv not found.
Unable to delete servicedriver keyusprserv.
========== REGISTRY ==========
Registry delete failed. HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{88888888-8888-8888-8888-888888888888} scheduled to be deleted on reboot.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{88888888-8888-8888-8888-888888888888} not found.
Registry delete failed. HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9D64F819-9380-8473-DAB2-702FCB3D7A3E} scheduled to be deleted on reboot.
Unable to delete registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{9D64F819-9380-8473-DAB2-702FCB3D7A3E} .
Registry value HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun\userinit deleted successfully.
Registry key HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{ab66e7d6-6325-11de-ac84-0019665315d7} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{ab66e7d6-6325-11de-ac84-0019665315d7} not found.
========== FILES ==========
C:UsersUserAppDataRoamingMicrosoftWindowsStart MenuProgramsStartupis-7M2TH.lnk moved successfully.
C:UsersUserAppDataRoamingMicrosoftWindowsStart MenuProgramsStartupis-LU48L.lnk moved successfully.
========== COMMANDS ==========

OTM by OldTimer — Version 3.0.0.4 log created on 09022009_210936

Logfile of random’s system information tool 1.06 (written by random/random)
Run by User at 2009-09-02 21:23:50
Microsoft® Windows Vista™ Home Premium Service Pack 1
System drive C: has 31 GB (13%) free of 238 GB
Total RAM: 2047 MB (66% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:23:52, on 02.09.2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:Windowssystem32taskeng.exe
C:Windowssystem32Dwm.exe
C:WindowsExplorer.EXE
C:Program FilesWindows DefenderMSASCui.exe
C:Program FilesJavajre6binjusched.exe
C:Program FilesSony EricssonMobile2Application LauncherApplication Launcher.exe
C:Program FilesA4TechMouseAmoumain.exe
C:Program FilesPanda SecurityPanda Cloud AntivirusPSUNMain.exe
C:WindowsSystem32rundll32.exe
C:Program FilesWindows Sidebarsidebar.exe
C:Windowsehomeehtray.exe
C:Program FilesDAEMON Tools Litedaemon.exe
C:Program FilesWindows LiveMessengermsnmsgr.exe
C:Windowsehomeehmsas.exe
C:Program FilesWindows Sidebarsidebar.exe
C:Program FilesCommon FilesTeleca SharedGeneric.exe
C:Program FilesSony EricssonMobile2Mobile Phone Monitorepmworker.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:Windowssystem32wuauclt.exe
C:Windowsexplorer.exe
C:Windowssystem32NOTEPAD.EXE
C:UsersUserDesktopRSIT.exe
C:Program Filestrend microUser.exe

R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.apeha.ru
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://www.key.ru
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =
R1 — HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *.local
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =
O1 — Hosts: ::1 localhost
O2 — BHO: Search Helper — {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} — C:Program FilesMicrosoftSearch Enhancement PackSearch HelperSEPsearchhelperie.dll
O2 — BHO: (no name) — {88888888-8888-8888-8888-888888888888} — (no file)
O2 — BHO: Помощник по входу в Windows Live — {9030D464-4C02-4ABF-8ECC-5164760863C6} — C:Program FilesCommon FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll
O2 — BHO: MS Media Module — {9D64F819-9380-8473-DAB2-702FCB3D7A3E} — %USERPROFILE%Application Datamsmedia.dll (file missing)
O2 — BHO: Java(tm) Plug-In 2 SSV Helper — {DBC80044-A445-435b-BC74-9C25C1C588A9} — C:Program FilesJavajre6binjp2ssv.dll
O2 — BHO: Windows Live Toolbar Helper — {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} — C:Program FilesWindows LiveToolbarwltcore.dll
O3 — Toolbar: Яндекс.Бар — {91397D20-1446-11D4-8AF4-0040CA1127B6} — C:Program FilesYandexYandexBarIEyndbar.dll
O3 — Toolbar: DAEMON Tools Toolbar — {32099AAC-C132-4136-9E9A-4E364A424E17} — C:Program FilesDAEMON Tools ToolbarDTToolbar.dll
O3 — Toolbar: &Windows Live Toolbar — {21FA44EF-376D-4D53-9B0F-8A89D3229068} — C:Program FilesWindows LiveToolbarwltcore.dll
O4 — HKLM..Run: [Windows Defender] %ProgramFiles%Windows DefenderMSASCui.exe -hide
O4 — HKLM..Run: [SunJavaUpdateSched] «C:Program FilesJavajre6binjusched.exe»
O4 — HKLM..Run: [Sony Ericsson PC Suite] «C:Program FilesSony EricssonMobile2Application LauncherApplication Launcher.exe» /startoptions
O4 — HKLM..Run: [WheelMouse] C:Program FilesA4TechMouseAmoumain.exe
O4 — HKLM..Run: [PSUNMain] «C:Program FilesPanda SecurityPanda Cloud AntivirusPSUNMain.exe» /Traybar
O4 — HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:Windowssystem32NvCpl.dll,NvStartup
O4 — HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:Windowssystem32NvMcTray.dll,NvTaskbarInit
O4 — HKCU..Run: [Sidebar] C:Program FilesWindows Sidebarsidebar.exe /autoRun
O4 — HKCU..Run: [ehTray.exe] C:WindowsehomeehTray.exe
O4 — HKCU..Run: [RGSC] C:Program FilesRockstar GamesRockstar Games Social ClubRGSCLauncher.exe /silent
O4 — HKCU..Run: [adstopper] C:Program FilesAdStoperAdStopperTrayApp.exe
O4 — HKCU..Run: [YandexOnline] «C:Program FilesYandexOnlineonline.exe» -AutoStart
O4 — HKCU..Run: [DAEMON Tools Lite] «C:Program FilesDAEMON Tools Litedaemon.exe» -autorun
O4 — HKCU..Run: [msnmsgr] «C:Program FilesWindows LiveMessengermsnmsgr.exe» /background
O4 — HKUSS-1-5-19..Run: [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User ‘NETWORK SERVICE’)
O4 — Startup: Registration .LNK = C:Program FilesUbisoftCyan WorldsMyst V End Of AgesregisterRegistrationReminder.exe
O9 — Extra button: Отправка в блог — {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} — C:Program FilesWindows LiveWriterWriterBrowserExtension.dll
O9 — Extra ‘Tools’ menuitem: &Отправка в блог Windows Live Writer — {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} — C:Program FilesWindows LiveWriterWriterBrowserExtension.dll
O9 — Extra button: PokerStars.net — {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} — C:Program FilesPokerStars.NETPokerStarsUpdate.exe
O13 — Gopher Prefix:
O16 — DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) — http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 — Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) — Apple Computer, Inc. — C:Program FilesBonjourmDNSResponder.exe
O23 — Service: @dfsrres.dll,-101 (DFSR) — Корпорация Майкрософт — C:Windowssystem32DFSR.exe
O23 — Service: InstallDriver Table Manager (IDriverT) — Macrovision Corporation — C:Program FilesCommon FilesInstallShieldDriver1150Intel 32IDriverT.exe
O23 — Service: MSCSPTISRV — Sony Corporation — C:Program FilesCommon FilesSony SharedAVLibMSCSPTISRV.exe
O23 — Service: NanoServiceMain — Panda Security, S.L. — C:Program FilesPanda SecurityPanda Cloud AntivirusPSANHost.exe
O23 — Service: NVIDIA Display Driver Service (nvsvc) — NVIDIA Corporation — C:Windowssystem32nvvsvc.exe
O23 — Service: PACSPTISVR — Unknown owner — C:Program FilesCommon FilesSony SharedAVLibPACSPTISVR.exe
O23 — Service: SonicStage Back-End Service — Sony Corporation — C:Program FilesCommon FilesSony SharedAVLibSsBeSvc.exe
O23 — Service: Sony SPTI Service (SPTISRV) — Sony Corporation — C:Program FilesCommon FilesSony SharedAVLibSPTISRV.exe
O23 — Service: SonicStage SCSI Service (SSScsiSV) — Sony Corporation — C:Program FilesCommon FilesSony SharedAVLibSSScsiSV.exe

—
End of file — 7012 bytes

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper — C:Program FilesMicrosoftSearch Enhancement PackSearch HelperSEPsearchhelperie.dll [2009-05-19 137600]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{88888888-8888-8888-8888-888888888888}]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Помощник по входу в Windows Live — C:Program FilesCommon FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9D64F819-9380-8473-DAB2-702FCB3D7A3E}]
MS Media Module — C:UsersUserApplication Datamsmedia.dll []

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper — C:Program FilesJavajre6binjp2ssv.dll [2009-05-24 35840]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
Windows Live Toolbar Helper — C:Program FilesWindows LiveToolbarwltcore.dll [2009-02-06 1068904]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{91397D20-1446-11D4-8AF4-0040CA1127B6} — Яндекс.Бар — C:Program FilesYandexYandexBarIEyndbar.dll [2009-01-21 3117856]
{32099AAC-C132-4136-9E9A-4E364A424E17} — DAEMON Tools Toolbar — C:Program FilesDAEMON Tools ToolbarDTToolbar.dll [2009-04-23 937416]
{21FA44EF-376D-4D53-9B0F-8A89D3229068} — &Windows Live Toolbar — C:Program FilesWindows LiveToolbarwltcore.dll [2009-02-06 1068904]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«Windows Defender»=C:Program FilesWindows DefenderMSASCui.exe [2008-01-19 1008184]
«SunJavaUpdateSched»=C:Program FilesJavajre6binjusched.exe [2009-05-24 148888]
«Sony Ericsson PC Suite»=C:Program FilesSony EricssonMobile2Application LauncherApplication Launcher.exe [2007-05-28 528384]
«WheelMouse»=C:Program FilesA4TechMouseAmoumain.exe [2007-02-11 241664]
«PSUNMain»=C:Program FilesPanda SecurityPanda Cloud AntivirusPSUNMain.exe [2009-04-23 353536]
«NvCplDaemon»=C:Windowssystem32NvCpl.dll [2009-03-28 13687328]
«NvMediaCenter»=C:Windowssystem32NvMcTray.dll [2009-03-28 92704]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«Sidebar»=C:Program FilesWindows Sidebarsidebar.exe [2008-01-19 1233920]
«ehTray.exe»=C:WindowsehomeehTray.exe [2008-01-19 125952]
«RGSC»=C:Program FilesRockstar GamesRockstar Games Social ClubRGSCLauncher.exe [2008-12-01 306088]
«adstopper»=C:Program FilesAdStoperAdStopperTrayApp.exe []
«YandexOnline»=C:Program FilesYandexOnlineonline.exe -AutoStart []
«DAEMON Tools Lite»=C:Program FilesDAEMON Tools Litedaemon.exe [2009-04-23 691656]
«msnmsgr»=C:Program FilesWindows LiveMessengermsnmsgr.exe [2009-02-06 3885408]

C:UsersUserAppDataRoamingMicrosoftWindowsStart MenuProgramsStartup
Registration .LNK — C:Program FilesUbisoftCyan WorldsMyst V End Of AgesregisterRegistrationReminder.exe

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1
«EnableUIADesktopToggle»=0

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«C:Program FilesSims 3GameBinTS3.exe»=»C:Program FilesSims 3GameBinTS3.exe:*:Disabled:Sims3»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]

======List of files/folders created in the last 3 months======

2009-09-02 21:09:36 —-D—- C:_OTM
2009-09-01 19:24:26 —-DC—- C:Windowssystem32DRVSTORE
2009-09-01 19:23:38 —-D—- C:Program FilesMicrosoft Sync Framework
2009-09-01 19:22:33 —-D—- C:Program FilesMicrosoft SQL Server Compact Edition
2009-09-01 19:20:28 —-D—- C:Program FilesMicrosoft
2009-09-01 19:20:11 —-D—- C:Program FilesWindows Live SkyDrive
2009-09-01 19:20:04 —-D—- C:Program FilesWindows Live
2009-09-01 19:19:52 —-D—- C:WindowsPCHEALTH
2009-09-01 18:59:56 —-D—- C:Program FilesCommon FilesWindows Live
2009-07-05 22:47:51 —-D—- C:rsit
2009-07-05 22:47:51 —-D—- C:Program Filestrend micro
2009-07-05 12:25:55 —-A—- C:UsersUserAppDataRoamingmsmedia.dll
2009-07-04 16:03:17 —-D—- C:ProgramDataPanda Security
2009-07-04 15:43:09 —-D—- C:Program FilesFIFA 2009 — Russian Premier League
2009-07-04 15:01:26 —-SHD—- C:UsersUserAppDataRoamingwsnpoem
2009-06-28 22:33:41 —-D—- C:ProgramDataSonicStage
2009-06-28 22:29:13 —-A—- C:Windowssystem32CDDBUISony.dll
2009-06-28 22:29:13 —-A—- C:Windowssystem32CddbPlaylist2Sony.dll
2009-06-28 22:29:13 —-A—- C:Windowssystem32CddbMusicIDSony.dll
2009-06-28 22:29:13 —-A—- C:Windowssystem32CddbLinkSony.dll
2009-06-28 22:29:13 —-A—- C:Windowssystem32CDDBControlSony.dll
2009-06-28 22:29:12 —-A—- C:Windowssystem32pxsfs.dll
2009-06-28 22:29:12 —-A—- C:Windowssystem32pxinsi64.exe
2009-06-28 22:29:12 —-A—- C:Windowssystem32pxinsa64.exe
2009-06-28 22:29:12 —-A—- C:Windowssystem32pxhpinst.exe
2009-06-28 22:29:12 —-A—- C:Windowssystem32pxdrv.dll
2009-06-28 22:29:12 —-A—- C:Windowssystem32pxcpyi64.exe
2009-06-28 22:29:12 —-A—- C:Windowssystem32pxcpya64.exe
2009-06-28 22:29:12 —-A—- C:Windowssystem32pxafs.dll
2009-06-28 22:29:11 —-A—- C:Windowssystem32vxblock.dll
2009-06-28 22:29:11 —-A—- C:Windowssystem32pxwave.dll
2009-06-28 22:29:11 —-A—- C:Windowssystem32pxmas.dll
2009-06-28 22:29:11 —-A—- C:Windowssystem32px.dll
2009-06-28 22:28:23 —-D—- C:ProgramDataSony Corporation
2009-06-28 22:27:41 —-D—- C:Program FilesSony
2009-06-28 22:27:39 —-D—- C:Windowssystem32Iosubsys
2009-06-28 22:25:27 —-D—- C:UsersUserAppDataRoamingSony Corporation
2009-06-28 22:25:26 —-D—- C:Program FilesCommon FilesSony Shared
2009-06-27 19:43:26 —-D—- C:UsersUserAppDataRoamingGames
2009-06-27 19:39:39 —-D—- C:Windows8AAB4176A747493AA42CB63CFADFD8E3.TMP
2009-06-27 18:49:20 —-D—- C:ProgramDataTages
2009-06-27 18:21:55 —-D—- C:Program FilesDAEMON Tools Toolbar
2009-06-27 16:31:56 —-D—- C:UsersUserAppDataRoamingBlackBean
2009-06-24 01:36:49 —-D—- C:GAMES
2009-06-23 22:22:39 —-D—- C:Program FilesA4Tech
2009-06-21 02:48:02 —-A—- C:WindowsGame.INI
2009-06-17 22:51:24 —-SHD—- C:found.001
2009-06-17 14:41:07 —-D—- C:Program FilesThe Adventure Company
2009-06-13 14:10:44 —-D—- C:Program FilesPrototype
2009-06-05 06:16:58 —-D—- C:UsersUserAppDataRoamingPeerNetworking
2009-06-03 02:11:19 —-D—- C:UsersUserAppDataRoamingUP
2009-06-03 01:07:54 —-D—- C:UsersUserAppDataRoamingAce

======List of files/folders modified in the last 3 months======

2009-09-02 21:23:34 —-D—- C:WindowsTemp
2009-09-02 15:27:47 —-SHD—- C:System Volume Information
2009-09-02 12:09:58 —-D—- C:Windowssystem32drivers
2009-09-02 03:02:51 —-SHD—- C:WindowsInstaller
2009-09-01 20:07:32 —-D—- C:WindowsMicrosoft.NET
2009-09-01 20:06:36 —-RSD—- C:Windowsassembly
2009-09-01 19:53:12 —-SD—- C:UsersUserAppDataRoamingMicrosoft
2009-09-01 19:24:26 —-D—- C:WindowsSystem32
2009-09-01 19:23:44 —-D—- C:Windowswinsxs
2009-09-01 19:23:38 —-RD—- C:Program Files
2009-09-01 19:23:29 —-SD—- C:ProgramDataMicrosoft
2009-09-01 19:23:15 —-D—- C:Windows
2009-09-01 19:22:15 —-D—- C:WindowsSoftwareDistribution
2009-09-01 19:20:16 —-D—- C:Program FilesCommon Filesmicrosoft shared
2009-09-01 18:59:56 —-D—- C:Program FilesCommon Files
2009-07-05 06:31:07 —-D—- C:ProgramDataNVIDIA
2009-07-05 06:30:16 —-D—- C:Windowsnvtmpinst
2009-07-05 06:24:53 —-D—- C:Windowssystem32catroot
2009-07-05 06:24:53 —-D—- C:Windowsinf
2009-07-05 06:21:57 —-D—- C:Windowssystem32catroot2
2009-07-05 05:43:12 —-D—- C:Program FilesMozilla Firefox
2009-07-04 21:09:36 —-HD—- C:Program FilesInstallShield Installation Information
2009-07-04 20:25:55 —-D—- C:WindowsPrefetch
2009-07-04 16:03:17 —-HD—- C:ProgramData
2009-06-28 22:26:22 —-D—- C:Program FilesCommon FilesInstallShield
2009-06-28 22:04:32 —-A—- C:Windowssystem32PerfStringBackup.INI
2009-06-27 19:39:35 —-D—- C:Program FilesCommon FilesWise Installation Wizard
2009-06-27 18:24:07 —-D—- C:UsersUserAppDataRoamingDAEMON Tools Lite
2009-06-27 18:23:10 —-D—- C:Program FilesDAEMON Tools Lite
2009-06-24 20:46:58 —-D—- C:Program FilesRockstar Games
2009-06-22 02:49:27 —-D—- C:WindowsMinidump
2009-06-21 15:53:16 —-D—- C:Program FilesYandex
2009-06-21 15:51:30 —-D—- C:UsersUserAppDataRoamingYaChatData
2009-06-05 15:38:03 —-D—- C:WindowsDebug
2009-06-04 04:42:17 —-D—- C:UsersUserAppDataRoamingBitTorrent
2009-06-04 03:31:49 —-D—- C:Program FilesCommon FilesAdobe
2009-06-04 00:58:49 —-D—- C:UsersUserAppDataRoamingAdobe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 is-LU48Ldrv;is-LU48Ldrv; C:Windowssystem32DRIVERS5268050.sys [2008-07-08 148496]
R1 PSINKNC;PSINKNC; C:Windowssystem32DRIVERSpsinknc.sys [2009-04-23 114184]
R2 atksgt;atksgt; C:Windowssystem32DRIVERSatksgt.sys [2009-06-27 281504]
R2 lirsgt;lirsgt; C:Windowssystem32DRIVERSlirsgt.sys [2009-06-27 25888]
R2 PSINAflt;PSINAflt; C:Windowssystem32DRIVERSPSINAflt.sys [2009-04-23 137224]
R2 PSINFile;PSINFile; C:Windowssystem32DRIVERSPSINFile.sys [2009-04-23 94216]
R2 PSINProc;PSINProc; C:Windowssystem32DRIVERSPSINProc.sys [2009-04-23 98312]
R3 HdAudAddService;Драйвер функции UAA для службы High Definition Audio (Microsoft), версия 1.1; C:Windowssystem32driversHdAudio.sys [2006-11-02 235520]
R3 nvlddmkm;nvlddmkm; C:Windowssystem32DRIVERSnvlddmkm.sys [2009-03-28 7738816]
R3 RTL8169;Realtek 8169 NT драйвер; C:Windowssystem32DRIVERSRtlh86.sys [2006-11-02 44544]
S1 is-7M2THdrv;is-7M2THdrv; C:Windowssystem32DRIVERS42613427.sys [2008-07-08 148496]
S3 Amps2prt;A4Tech PS/2 Port Mouse Driver; C:Windowssystem32DRIVERSAmps2prt.sys [2007-02-10 14336]
S3 ayp8dcjt;ayp8dcjt; C:Windowssystem32driversayp8dcjt.sys []
S3 drmkaud;Звуковой дешифратор DRM ядра системы; C:Windowssystem32driversdrmkaud.sys [2008-01-18 5632]
S3 fssfltr;FssFltr; C:Windowssystem32DRIVERSfssfltr.sys [2009-02-06 55280]
S3 ialm;ialm; C:Windowssystem32DRIVERSialmnt5.sys [2006-11-02 1302492]
S3 MSKSSRV;Представитель служб потоков Microsoft; C:Windowssystem32driversMSKSSRV.sys [2008-01-18 8192]
S3 MSPCLOCK;Посредник синхронизации потоков Microsoft; C:Windowssystem32driversMSPCLOCK.sys [2008-01-18 5888]
S3 MSPQM;Представитель диспетчера качества потоков Microsoft; C:Windowssystem32driversMSPQM.sys [2008-01-18 5504]
S3 MSTEE;Преобразователь потоков Tee/Sink-to-Sink Microsoft; C:Windowssystem32driversMSTEE.sys [2008-01-18 6016]
S3 NPPTNT2;NPPTNT2; ??C:Windowssystem32npptNT2.sys [2005-01-03 4682]
S3 R300;R300; C:Windowssystem32DRIVERSatikmdag.sys [2006-11-02 2028032]
S3 RTL8023xp;Realtek 10/100 NIC Family NDIS x86 драйвер; C:Windowssystem32DRIVERSRtnicxp.sys [2006-11-02 47104]
S3 s125bus;Sony Ericsson Device 125 driver (WDM); C:Windowssystem32DRIVERSs125bus.sys [2007-04-24 83336]
S3 s125mdfl;Sony Ericsson Device 125 USB WMC Modem Filter; C:Windowssystem32DRIVERSs125mdfl.sys [2007-04-24 15112]
S3 s125mdm;Sony Ericsson Device 125 USB WMC Modem Driver; C:Windowssystem32DRIVERSs125mdm.sys [2007-04-24 108680]
S3 s125mgmt;Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM); C:Windowssystem32DRIVERSs125mgmt.sys [2007-04-24 100488]
S3 s125obex;Sony Ericsson Device 125 USB WMC OBEX Interface; C:Windowssystem32DRIVERSs125obex.sys [2007-04-24 98696]
S3 WUDFRd;WUDFRd; C:Windowssystem32DRIVERSWUDFRd.sys [2008-01-18 83328]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:Windowssystem32driverswmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:Program FilesBonjourmDNSResponder.exe [2006-02-28 229376]
R2 NanoServiceMain;NanoServiceMain; C:Program FilesPanda SecurityPanda Cloud AntivirusPSANHost.exe [2009-04-23 95488]
R2 nvsvc;NVIDIA Display Driver Service; C:Windowssystem32nvvsvc.exe [2009-03-28 207392]
R2 SeaPort;SeaPort; C:Program FilesMicrosoftSearch Enhancement PackSeaPortSeaPort.exe [2009-05-19 240512]
S3 fsssvc;Семейная безопасность Windows Live; C:Program FilesWindows LiveFamily Safetyfsssvc.exe [2009-02-06 533360]
S3 IDriverT;InstallDriver Table Manager; C:Program FilesCommon FilesInstallShieldDriver1150Intel 32IDriverT.exe [2005-11-14 69632]
S3 MSCSPTISRV;MSCSPTISRV; C:Program FilesCommon FilesSony SharedAVLibMSCSPTISRV.exe [2006-12-14 45056]
S3 PACSPTISVR;PACSPTISVR; C:Program FilesCommon FilesSony SharedAVLibPACSPTISVR.exe [2006-12-14 57344]
S3 SonicStage Back-End Service;SonicStage Back-End Service; C:Program FilesCommon FilesSony SharedAVLibSsBeSvc.exe [2007-02-05 112184]
S3 SPTISRV;Sony SPTI Service; C:Program FilesCommon FilesSony SharedAVLibSPTISRV.exe [2006-12-14 69632]
S3 SSScsiSV;SonicStage SCSI Service; C:Program FilesCommon FilesSony SharedAVLibSSScsiSV.exe [2007-02-05 75320]
S3 usprserv;User Privilege Service; C:WindowsSystem32svchost.exe [2008-01-19 21504]

---

EOF

---

[Автор]

Сообщения