[mamin yozik]

ComboFix 10-07-24.03 — Admin 26.07.2010 0:08.1.1 — x86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.255.68 [GMT 4:00]
Running from: d:программыComboFix.exe
Command switches used :: c:documents and settingsAdminРабочий столWindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Created a new restore point
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:documents and settingsAdminГлавное менюПрограммыАвтозагрузкаwwwznv32.exe
c:documents and settingsAdminApplication Dataavdrn.dat
c:program filesCommon Fileskeylog.txt
c:windowsDelete.bat
c:windowssystem32Пузыри.scr
c:windowssystem321319540099.dat
c:windowssystem32acctresq.exe
c:windowssystem32ssField Lines.scr
c:windowssystem32ssRibbons.scr
c:windowssystem32SYSINTERNALS_BLUESCREEN.SCR

Infected copy of c:windowssystem32driversaec.sys was found and disinfected
Restored copy from — c:windowssystem32dllcacheaec.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

---

Legacy_NAPAGENTNAPAGENT

---

Service_napagentnapagent

((((((((((((((((((((((((( Files Created from 2010-06-25 to 2010-07-25 )))))))))))))))))))))))))))))))
.

2010-07-24 16:09 . 2010-07-24 16:09

---

d

---

w- c:program filestrend micro
2010-07-24 16:08 . 2010-07-24 16:10

---

d

---

w- C:rsit
2010-07-23 12:35 . 2008-04-13 20:10 34688 -c—a-w- c:windowssystem32dllcachelbrtfdc.sys
2010-07-23 12:35 . 2008-04-13 20:10 34688 —-a-w- c:windowssystem32driverslbrtfdc.sys
2010-07-23 12:35 . 2008-04-13 20:11 8576 -c—a-w- c:windowssystem32dllcachei2omgmt.sys
2010-07-23 12:35 . 2008-04-13 20:11 8576 —-a-w- c:windowssystem32driversi2omgmt.sys
2010-07-23 12:35 . 2008-04-13 20:11 8192 -c—a-w- c:windowssystem32dllcachechanger.sys
2010-07-23 12:35 . 2008-04-13 20:11 8192 —-a-w- c:windowssystem32driverschanger.sys
2010-07-22 08:00 . 2010-07-22 08:00

---

d

---

w- c:documents and settingsAdminApplication DataSunODFPluginforMicrosoftOffice
2010-07-22 07:54 . 2010-07-22 07:54

---

d

---

w- c:program filesSun
2010-07-19 19:20 . 2010-07-23 18:49 13312 —-a-w- c:windowssystem32driversvdi1mtqw.sys
2010-07-18 19:03 . 2010-07-18 19:04

---

d

---

w- c:windowssystem32NtmsData
2010-07-18 18:50 . 2010-07-18 18:50

---

d—h—w- c:windowsPIF
2010-07-12 19:34 . 2010-07-12 19:38

---

d

---

w- C:Np2009w
2010-06-27 18:39 . 2010-06-27 18:39

---

d

---

w- c:documents and settingsAdminApplication DataSony Corporation
2010-06-27 17:58 . 2010-06-27 17:58

---

d

---

w- c:documents and settingsAll UsersApplication DataSony Corporation
2010-06-27 17:57 . 2010-06-27 17:58

---

d

---

w- c:program filesSony

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-25 18:39 . 2010-05-07 16:29

---

d

---

w- c:documents and settingsAdminApplication Dataicq
2010-07-23 19:24 . 2010-04-14 14:04

---

d

---

w- c:documents and settingsAdminApplication DatauTorrent
2010-07-23 19:00 . 2010-07-17 14:21 16 —-a-w- c:windowssystem32configsystemprofileApplication Dataswqatk.dat
2010-07-23 12:33 . 2010-07-23 12:33 20 —-a-w- c:documents and settingsNetworkServiceApplication Dataswqatk.dat
2010-07-19 12:23 . 2010-04-14 13:31

---

d—a-w- c:documents and settingsAdminApplication DataYandex
2010-07-19 12:18 . 2010-06-14 08:03

---

d

---

w- c:documents and settingsAdminApplication DataFOG Downloader
2010-07-17 09:27 . 2010-04-16 05:55 23576 —-a-w- c:documents and settingsAdminLocal SettingsApplication DataGDIPFONTCACHEV1.DAT
2010-06-22 18:30 . 2010-06-22 18:29

---

d

---

w- c:program filesK-Lite Codec Pack
2010-06-22 14:40 . 2010-06-22 14:17

---

d

---

w- c:documents and settingsAdminApplication DataSkype
2010-06-22 14:18 . 2010-06-22 14:18 56 —ha-w- c:windowssystem32ezsidmv.dat
2010-06-22 14:18 . 2010-06-22 14:18

---

d

---

w- c:documents and settingsAdminApplication DataskypePM
2010-06-22 14:16 . 2010-06-22 14:16

---

d

---

w- c:program filesCommon FilesSkype
2010-06-22 14:16 . 2010-06-22 14:15

---

d

---

w- c:documents and settingsAll UsersApplication DataSkype
2010-06-12 05:47 . 2010-05-07 17:03

---

d

---

w- c:program filesICQ7.1
2010-05-27 05:43 . 2010-05-27 05:08

---

d

---

w- c:documents and settingsAdminApplication DataNokia
2010-05-27 05:13 . 2008-04-15 13:00 76678 —-a-w- c:windowssystem32perfc019.dat
2010-05-27 05:13 . 2008-04-15 13:00 448388 —-a-w- c:windowssystem32perfh019.dat
2010-05-27 05:12 . 2010-05-27 05:12 0 —ha-w- c:windowssystem32driversMsft_User_PCCSWpdDriver_01_07_00.Wdf
2010-05-27 05:12 . 2010-05-27 05:12 0 —ha-w- c:windowssystem32driversMsftWdf_user_01_07_00.Wdf
2010-05-27 05:12 . 2010-05-27 05:08

---

d

---

w- c:documents and settingsAdminApplication DataPC Suite
2010-05-27 05:11 . 2010-05-27 05:08

---

d

---

w- c:documents and settingsAll UsersApplication DataPC Suite
2010-05-27 05:11 . 2010-05-27 05:11 0 —ha-w- c:windowssystem32driversMsft_Kernel_ccdcmb_01007.Wdf
2010-05-27 05:11 . 2010-05-27 05:11 0 —ha-w- c:windowssystem32driversMsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2010-05-27 05:03 . 2010-05-27 05:01

---

d

---

w- c:program filesDIFX
2010-05-27 05:02 . 2010-05-27 05:02

---

d

---

w- c:program filesCommon FilesPCSuite
2010-05-27 05:02 . 2010-05-27 05:02

---

d

---

w- c:program filesCommon FilesNokia
2010-05-27 05:02 . 2010-05-27 05:00

---

d

---

w- c:program filesNokia
2010-05-27 05:01 . 2010-05-27 05:01

---

d

---

w- c:program filesPC Connectivity Solution
2010-04-30 03:49 . 2010-04-30 03:49 95232 —-a-w- c:documents and settingsAll UsersApplication DataInstallations{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}InstallerCommonCustomActionspcswpcsi.exe
2010-04-30 03:49 . 2010-04-30 03:49 61440 —-a-w- c:documents and settingsAll UsersApplication DataInstallations{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}InstallerCommonCustomActionsUninstPCSFEMsi.exe
2010-04-30 03:49 . 2010-04-30 03:49 10240 —-a-w- c:documents and settingsAll UsersApplication DataInstallations{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}InstallerCommonCustomActionsUninstPCS.exe
2010-04-30 03:49 . 2010-04-30 03:49 8192 —-a-w- c:documents and settingsAll UsersApplication DataInstallations{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}InstallerCommonCustomActionsUninstCCD.exe
2010-04-30 03:48 . 2010-04-30 03:50 34001264 —-a-w- c:documents and settingsAll UsersApplication DataInstallations{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}Nokia_PC_Suite_7_1_40_1_rus_web.exe
.

---

Sigcheck

---

[-] 2009-04-24 . 6A104BA98D99D53AB0C91825CE659FC6 . 361600 . . [5.1.2600.5625] . . c:windowssystem32driverstcpip.sys

[-] 2009-04-24 . 2F29C751D1E9F6A9E4D3DB3A472DFF02 . 78360 . . [7.2.6001.788] . . c:windowssystem32wuauclt.exe

[-] 2009-04-24 . 23B7D3F3F5EC8FEEA75EC381C71CBD5E . 579072 . . [5.1.2600.5512] . . c:windowssystem32user32.dll

[-] 2009-04-24 . 7921B0E73103546CF65890FB9EA5BAC0 . 1039872 . . [8.00.6001.18702] . . c:windowssystem32wininet.dll

[-] 2009-04-24 . A7830A9F166C9CE4F18CA22076F1077C . 1721344 . . [6.00.2900.5512] . . c:windowsexplorer.exe

[-] 2009-04-24 . 8F51D3D08E9FFF9113EFDFA7A7511F2C . 1571840 . . [5.1.2600.5512] . . c:windowssystem32sfcfiles.dll

[-] 2009-04-24 . EFCC265C7C50677C7C9E0260981182C6 . 30208 . . [5.1.2600.5512] . . c:windowssystem32ctfmon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
«ICQ»=»c:program filesICQ7.1ICQ.exe» [2010-06-08 133368]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«SoundMan»=»SOUNDMAN.EXE» [2007-04-16 577536]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2006-01-12 155648]
«egui»=»c:program filesESETESET NOD32 Antivirusegui.exe» [2009-11-16 2054360]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2009-04-24 30208]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE8_01″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» [2009-04-24 128512]
«IE8_02″=»advpack.dll» [2009-04-24 128512]

[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalWdf01000.sys]
@=»Driver»

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPC Suite Tray]
2009-11-11 06:57 1451520 —-a-w- c:program filesNokiaNokia PC Suite 7PCSuite.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupreguTorrent]
2010-04-14 14:05 319792 —-a-w- c:program filesuTorrentuTorrent.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionrun-]
«PMBVolumeWatcher»=c:program filesSonyPMBPMBVolumeWatcher.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusOverride»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\ICQ7.1\ICQ.exe»=
«c:\Program Files\ICQ7.1\aolload.exe»=

R1 ehdrv;ehdrv;c:windowssystem32driversehdrv.sys [16.11.2009 9:03 108792]
R1 epfwtdir;epfwtdir;c:windowssystem32driversepfwtdir.sys [16.11.2009 9:06 96408]
R2 2GIS UpdateClientService;2GIS UpdateClientService;c:program files2gisUpdateClientWin32UpdateClientService.exe [17.09.2008 12:03 1134592]
R2 ekrn;ESET Service;c:program filesESETESET NOD32 Antivirusekrn.exe [16.11.2009 9:04 735960]
R2 ICQ Service;ICQ Service;c:program filesICQ6ToolbarICQ Service.exe [07.05.2010 20:30 246520]
R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:program filesSonyPMBPMBDeviceInfoProvider.exe [24.10.2009 3:18 360224]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:program filesTuneUp Utilities 2010TuneUpUtilitiesDriver32.sys [25.02.2010 10:18 10064]
S4 sptd;sptd;c:windowssystem32driverssptd.sys [14.04.2010 17:19 721904]

— Other Services/Drivers In Memory —

*NewlyCreated* — WUAUSERV

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSvchost — NetSvcs
UxTuneUp
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://start.icq.com/
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~1Office12EXCEL.EXE/3000
IE: {{71BFC818-0CED-42D6-9C87-5142918957EE} — c:program filesICQ7.1ICQ.exe
.
— — — — ORPHANS REMOVED — — — —

Toolbar-ITBar7Position — (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-26 00:16
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

LOCKED REGISTRY KEYS

---

[HKEY_USERSS-1-5-21-1229272821-299502267-1606980848-500SoftwareMicrosoftInternet ExplorerUser Preferences]
@Denied: (2) (Administrator)
«88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977″=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,44,ad,5e,9b,90,cc,bf,41,aa,a7,1d,
«2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81″=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,44,ad,5e,9b,90,cc,bf,41,aa,a7,1d,
«6256FFB019F8FDFBD36745B06F4540E9AEAF222A25″=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,44,ad,5e,9b,90,cc,bf,41,aa,a7,1d,
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘winlogon.exe'(664)
c:windowssystem32cscui.dll

— — — — — — — > ‘explorer.exe'(3772)
c:windowssystem32SHDOCVW.dll
c:windowssystem32COMRes.dll
c:windowsSystem32cscui.dll
c:windowssystem32msi.dll
c:windowssystem32ieframe.dll
c:windowssystem32NETSHELL.dll
c:windowssystem32wpdshserviceobj.dll
c:windowssystem32webcheck.dll
c:program filesNokiaNokia PC Suite 7PhoneBrowser.dll
c:program filesNokiaNokia PC Suite 7NGSCM.DLL
c:program filesNokiaNokia PC Suite 7LangPhoneBrowser_rus.nlr
c:program filesNokiaNokia PC Suite 7ResourcePhoneBrowser_Nokia.ngr
c:windowssystem32portabledevicetypes.dll
c:windowssystem32portabledeviceapi.dll
.

---

Other Running Processes

---

.
c:windowsSOUNDMAN.EXE
c:program filesJavajre6binjqs.exe
c:program filesTuneUp Utilities 2010TuneUpUtilitiesService32.exe
c:windowssystem32wscntfy.exe
c:program filesTuneUp Utilities 2010TuneUpUtilitiesApp32.exe
.
**************************************************************************
.
Completion time: 2010-07-26 00:20:38 — machine was rebooted
ComboFix-quarantined-files.txt 2010-07-25 20:20

Pre-Run: 3 971 235 840 байт свободно
Post-Run: 4 071 718 912 байт свободно

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)WINDOWS
[operating systems]
c:cmdconsBOOTSECT.DAT=»Microsoft Windows Recovery Console» /cmdcons
multi(0)disk(0)rdisk(0)partition(1)WINDOWS=»Microsoft Windows XP Professional RU» /execute /fastdetect

— — End Of File — — CC3CC28F9DF8D90073120DDBEDC12DFD

[mamin yozik]

После того как написал вам письмо, полез по форумам, нашел пример скрипта в АВЗ выполнил его, и после этого мой НОД обновил базы и смог его удалить!!! но через какое то время он опять появился, видимо я что то не до конца сделал или вообще что то не так выполнил.НОД его не находит теперь. скажите логи в хайджек и авз надо делать новые или эти пойдут?

[mamin yozik]

info.txt logfile of random’s system information tool 1.08 2010-07-24 20:10:14

======Uninstall list======

—>msiexec /package {90120000-0016-0000-0000-0000000FF1CE} /uninstall {C5060182-C90D-4314-9AE9-5C0DCF8FD1EF}
—>msiexec /package {90120000-001B-0000-0000-0000000FF1CE} /uninstall {3520B304-0EF8-475D-8C52-47ABCCC75FC6}
—>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:WINDOWSINFPCHealth.inf
µTorrent—>»C:Program FilesuTorrentuTorrent.exe» /UNINSTALL
1C:Предприятие 8.1 (учебная версия)—>MsiExec.exe /I{BF2F0D7C-C4A6-46B4-B977-99FD0C769219}
1С:Предприятие 8.0 (учебная версия)—>C:PROGRA~1COMMON~1INSTAL~1Driver7INTEL3~1IDriver.exe /M{369342E5-06FD-4798-8E3C-649259BE8775} /l1049
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-0016-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-0016-0419-0000-0000000FF1CE} /uninstall {1AD50F4A-04F7-4944-BD47-4421532548F5}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-001B-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-001B-0419-0000-0000000FF1CE} /uninstall {1AD50F4A-04F7-4944-BD47-4421532548F5}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-001F-0419-0000-0000000FF1CE} /uninstall {D7CE14BC-96D9-41C5-822D-F5B1C2C35AA2}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-001F-0419-0000-0000000FF1CE} /uninstall {D7CE14BC-96D9-41C5-822D-F5B1C2C35AA2}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-001F-0422-0000-0000000FF1CE} /uninstall {DC154E48-5278-423A-80A1-B93247E38A1A}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-001F-0422-0000-0000000FF1CE} /uninstall {DC154E48-5278-423A-80A1-B93247E38A1A}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-006E-0419-0000-0000000FF1CE} /uninstall {23653CA5-BFB5-4B52-B2DA-045D7ABEB874}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-006E-0419-0000-0000000FF1CE} /uninstall {23653CA5-BFB5-4B52-B2DA-045D7ABEB874}
Adobe Flash Player 10 Plugin—>C:WINDOWSsystem32MacromedFlashFlashUtil10h_Plugin.exe -maintain plugin
CCleaner (remove only)—>»C:Program FilesCCleaneruninst.exe»
Daemon Tools Lite—>rundll32.exe advpack.dll,LaunchINFSection dtools.inf,Uninstall
Foxit Reader 3.0 Build 1122—>C:Program FilesFoxit ReaderUninstall.exe
ICQ Toolbar—>C:Program FilesICQ6ToolbarICQUnToolbar.exe
ICQ7.1—>»C:Program FilesInstallShield Installation Information{71BFC818-0CED-42D6-9C87-5142918957EE}ICQ7.exe» -runfromtemp -l0x0009 -removeonly
Java(TM) 6 Update 13—>MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216013FF}
K-Lite Mega Codec Pack 5.8.3—>»C:Program FilesK-Lite Codec Packunins000.exe»
Microsoft .NET Framework 1.1 Russian Language Pack—>MsiExec.exe /X{2BB372D9-52B4-410A-BC1A-FEAB63181EEF}
Microsoft .NET Framework 1.1—>msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1—>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 1—>MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7—>»C:WINDOWS$NtUninstallWdf01007$spuninstspuninst.exe»
Microsoft Office Excel 2007—>»C:Program FilesCommon FilesMicrosoft SharedOFFICE12Office Setup Controllersetup.exe» /uninstall EXCEL /dll OSETUP.DLL
Microsoft Office Excel 2007—>MsiExec.exe /X{90120000-0016-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (Russian) 2007—>MsiExec.exe /X{90120000-0016-0419-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007—>MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007—>MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Russian) 2007—>MsiExec.exe /X{90120000-001F-0419-0000-0000000FF1CE}
Microsoft Office Proof (Ukrainian) 2007—>MsiExec.exe /X{90120000-001F-0422-0000-0000000FF1CE}
Microsoft Office Proofing (Russian) 2007—>MsiExec.exe /X{90120000-002C-0419-0000-0000000FF1CE}
Microsoft Office Shared MUI (Russian) 2007—>MsiExec.exe /X{90120000-006E-0419-0000-0000000FF1CE}
Microsoft Office Word 2007—>»C:Program FilesCommon FilesMicrosoft SharedOFFICE12Office Setup Controllersetup.exe» /uninstall WORD /dll OSETUP.DLL
Microsoft Office Word 2007—>MsiExec.exe /X{90120000-001B-0000-0000-0000000FF1CE}
Microsoft Office Word MUI (Russian) 2007—>MsiExec.exe /X{90120000-001B-0419-0000-0000000FF1CE}
Microsoft User-Mode Driver Framework Feature Pack 1.7—>»C:WINDOWS$NtUninstallWudf01007$spuninstspuninst.exe»
MSVC80_x86_v2—>MsiExec.exe /I{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}
MSXML 4.0 SP3 Parser—>MsiExec.exe /I{196467F1-C11F-4F76-858B-5812ADC83B94}
Nero 6—>C:Program FilesAheadnerouninstallUNNERO.exe /UNINSTALL
Nokia Connectivity Cable Driver—>MsiExec.exe /I{6869591A-7DD8-46D2-837F-57CBF7358955}
Nokia PC Suite—>C:Documents and SettingsAll UsersApplication DataInstallations{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}Nokia_PC_Suite_7_1_40_1_rus_web.exe
Nokia PC Suite—>MsiExec.exe /I{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}
Np2009w—>»C:Np2009wuninstall.exe»
NVIDIA Drivers—>C:WINDOWSsystem32nvugart.exe UninstallGUI
Paint.NET v 3.36—>rundll32.exe advpack.dll,LaunchINFSection PaintDN.inf,Uninstall
PC Connectivity Solution—>MsiExec.exe /I{6E0352EE-6F0D-4FBC-B1B8-4FF032C78BE0}
PMB—>MsiExec.exe /X{B6A98E5F-D6A7-46FB-9E9D-1F7BF443491C}
Realtek AC’97 Audio—>Alcrmv.exe -r -m
Skype™ 4.2—>MsiExec.exe /X{D103C4BA-F905-437A-8049-DB24763BBE36}
Sun ODF Plugin for Microsoft Office 3.0—>MsiExec.exe /X{03B1BBDC-7FAA-4A03-9988-A85428BAD382}
The KMPlayer 2.9.4.1434—>C:Program FilesThe KMPlayerUninstall.exe
TuneUp Utilities—>C:Program FilesTuneUp Utilities 2010TUInstallHelper.exe —Trigger-Uninstall
VIA Rhine-Family Fast-Ethernet Adapter—>Rundll32.exe vuins32.dll,vuins32Ex $Rhine $VIA
Vista Drive Icon—>rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFVistaDrv.inf,Uninstall
Архиватор WinRAR—>C:Program FilesWinRARuninstall.exe
Данные ДубльГИС г.Н.Новгород 01.06.2010—>MsiExec.exe /X{217EC25F-8F89-47AF-9E29-DC4EF102AD25}
Декларация 2009—>»C:Program FilesДекларация 2009unins000.exe»
ДубльГИС 3.0.6.4—>MsiExec.exe /X{751DAFAF-980F-4745-AF49-547623DD1CB7}
Пакет драйверов Windows — Nokia Modem (06/01/2009 7.01.0.4)—>C:PROGRA~1DIFX270581355A767BF1dpinst.exe /u C:WINDOWSsystem32DRVSTOREnokbtmdm_0777326F40B753DD4E385F058ADB286B70A301FEnokbtmdm.inf
Пакет драйверов Windows — Nokia Modem (10/05/2009 4.2)—>C:PROGRA~1DIFX270581355A767BF1dpinst.exe /u C:WINDOWSsystem32DRVSTOREnokia_blue_AAB746D5658CCF4CAE7A35CED5F0ADA3C447A973nokia_bluetooth.inf
Пакет драйверов Windows — Nokia pccsmcfd (08/22/2008 7.0.0.0)—>C:PROGRA~1DIFXB4723E9A0713E5B1dpinst.exe /u C:WINDOWSsystem32DRVSTOREpccsmcfd_A3B3916E5D8138F59EE218321B27B044D3B18294pccsmcfd.inf
Печать НД с PDF417 3.0.9 (пакет)—>MsiExec.exe /I{476219D4-168B-4634-9A38-A5286BB3AFB5}
Центр обновлений ДубльГИС—>MsiExec.exe /X{2FB165EB-69C0-416D-9B4E-E805ABC8CB1F}

======Security center information======

AV: ESET NOD32 Antivirus 4.0

======System event log======

Computer Name: MICROSOF-3900E5
Event Code: 6009
Message: Microsoft (R) Windows 2000 (R) 5.01. 2600 Service Pack 3 Uniprocessor Free.

Record Number: 6070
Source Name: EventLog
Time Written: 20100708091121.000000+240
Event Type: информация
User:

Computer Name: MICROSOF-3900E5
Event Code: 6006
Message: Служба журнала событий остановлена.

Record Number: 6069
Source Name: EventLog
Time Written: 20100708022646.000000+240
Event Type: информация
User:

Computer Name: MICROSOF-3900E5
Event Code: 20159
Message: Подключение пользователя «0894329740» к «Beeline», выполненное с помощью устройства «VPN5-1», было прервано.

Record Number: 6068
Source Name: RemoteAccess
Time Written: 20100708022635.000000+240
Event Type: информация
User:

Computer Name: MICROSOF-3900E5
Event Code: 20158
Message: Успешно выполнено подключение пользователя «0894329740»к «Beeline», с помощью устройства «VPN5-1».

Record Number: 6067
Source Name: RemoteAccess
Time Written: 20100707225401.000000+240
Event Type: информация
User:

Computer Name: MICROSOF-3900E5
Event Code: 20159
Message: Подключение пользователя «0894329740» к «Beeline», выполненное с помощью устройства «VPN5-1», было прервано.

Record Number: 6066
Source Name: RemoteAccess
Time Written: 20100707225302.000000+240
Event Type: информация
User:

=====Application event log=====

Computer Name: MICROSOF-3900E5
Event Code: 11707
Message: Продукт: ДубльГИС 3.0.6.4 — Установка завершена успешно.

Record Number: 279
Source Name: MsiInstaller
Time Written: 20100421104355.000000+240
Event Type: информация
User: MICROSOF-3900E5Admin

Computer Name: MICROSOF-3900E5
Event Code: 1042
Message: Завершение транзакции установщика Windows: C:DOCUME~1AdminLOCALS~1Temp2gi1.tmp. ИД клиентского процесса: 2500.

Record Number: 278
Source Name: MsiInstaller
Time Written: 20100421104348.000000+240
Event Type: информация
User: NT AUTHORITYSYSTEM

Computer Name: MICROSOF-3900E5
Event Code: 1040
Message: Начата транзакция установщика Windows: C:DOCUME~1AdminLOCALS~1Temp2gi1.tmp. ИД клиентского процесса: 2500.

Record Number: 277
Source Name: MsiInstaller
Time Written: 20100421104322.000000+240
Event Type: информация
User: MICROSOF-3900E5Admin

Computer Name: MICROSOF-3900E5
Event Code: 1517
Message: Реестр пользователя MICROSOF-3900E5Admin был сохранен в то время, как приложение или служба продолжали использовать его во время выхода из системы. Используемая реестром пользователя память не была освобождена. Реестр будет выгружен, когда он не будет использоваться.

Возможная причина — службы, выполняемые от имени пользователя. Попробуйте изменить настройку служб и задать их выполнение с учетными записями LocalService или NetworkService.

Record Number: 276
Source Name: Userenv
Time Written: 20100418003107.000000+240
Event Type: предупреждение
User: NT AUTHORITYSYSTEM

Computer Name: MICROSOF-3900E5
Event Code: 4097
Message: Приложение C:Program FilesInternet Exploreriexplore.exe вызвало ошибку
Ошибка в 17/04/2010 @ 16:40:16.421
Вызвано исключение c0000005 по адресу 64697658 ()

Record Number: 275
Source Name: DrWatson
Time Written: 20100417164016.000000+240
Event Type: информация
User:

======Environment variables======

«ComSpec»=%SystemRoot%system32cmd.exe
«Path»=C:Program FilesPC Connectivity Solution;%SystemRoot%system32;%SystemRoot%;%SystemRoot%System32Wbem
«windir»=%SystemRoot%
«FP_NO_HOST_CHECK»=NO
«OS»=Windows_NT
«PROCESSOR_ARCHITECTURE»=x86
«PROCESSOR_LEVEL»=6
«PROCESSOR_IDENTIFIER»=x86 Family 6 Model 8 Stepping 1, AuthenticAMD
«PROCESSOR_REVISION»=0801
«NUMBER_OF_PROCESSORS»=1
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP

---

EOF

---

[mamin yozik]

Logfile of random’s system information tool 1.08 (written by random/random)
Run by Admin at 2010-07-24 20:08:50
Microsoft Windows XP Professional Service Pack 3
System drive C: has 4 GB (37%) free of 11 GB
Total RAM: 255 MB (18% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:09:47, on 24.07.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32csrss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSSOUNDMAN.EXE
C:Program FilesESETESET NOD32 Antivirusegui.exe
C:Program FilesVistaDriveIconVistaDrv.exe
C:WINDOWSsystem32ctfmon.exe
C:Program Files2gisUpdateClientWin32UpdateClientService.exe
C:Program FilesESETESET NOD32 Antivirusekrn.exe
C:Program FilesICQ6ToolbarICQ Service.exe
C:Program FilesJavajre6binjqs.exe
C:Program FilesSonyPMBPMBDeviceInfoProvider.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesTuneUp Utilities 2010TuneUpUtilitiesService32.exe
C:Program FilesTuneUp Utilities 2010TuneUpUtilitiesApp32.exe
C:Documents and SettingsAdminLocal SettingsApplication DataGoogleChromeApplicationchrome.exe
C:Documents and SettingsAdminLocal SettingsApplication DataGoogleChromeApplicationchrome.exe
C:Documents and SettingsAdminLocal SettingsApplication DataGoogleChromeApplicationchrome.exe
C:Documents and SettingsAdminРабочий столRSIT.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:Program Filestrend microAdmin.exe

R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://start.icq.com/
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: ICQToolBar — {855F3B16-6D32-4fe6-8A56-BBB695989046} — C:Program FilesICQ6ToolbarICQToolBar.dll
O2 — BHO: Java(tm) Plug-In 2 SSV Helper — {DBC80044-A445-435b-BC74-9C25C1C588A9} — C:Program FilesJavajre6binjp2ssv.dll
O2 — BHO: JQSIEStartDetectorImpl — {E7E6F031-17CE-4C07-BC86-EABFE594F69C} — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll
O3 — Toolbar: ICQToolBar — {855F3B16-6D32-4FE6-8A56-BBB695989046} — C:Program FilesICQ6ToolbarICQToolBar.dll
O4 — HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 — HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 — HKLM..Run: [egui] «C:Program FilesESETESET NOD32 Antivirusegui.exe» /hide /waitservice
O4 — HKCU..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [ICQ] «C:Program FilesICQ7.1ICQ.exe» silent loginmode=4
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..RunOnce: [ZZZZ1_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,OnceFirstLogonInstall,0 (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..RunOnce: [IE8_02] rundll32 advpack.dll,LaunchINFSectionEx IE8int.inf,AfterUserStart,,4,N (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-20..RunOnce: [ZZZZ1_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,OnceFirstLogonInstall,0 (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,NewUserFirstLogonInstall,0 (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe (User ‘Default user’)
O4 — HKUS.DEFAULT..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,NewUserFirstLogonInstall,0 (User ‘Default user’)
O4 — Startup: wwwznv32.exe
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~1Office12EXCEL.EXE/3000
O9 — Extra button: ICQ7.1 — {71BFC818-0CED-42D6-9C87-5142918957EE} — C:Program FilesICQ7.1ICQ.exe
O9 — Extra ‘Tools’ menuitem: ICQ7.1 — {71BFC818-0CED-42D6-9C87-5142918957EE} — C:Program FilesICQ7.1ICQ.exe
O9 — Extra button: Research — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~1Office12REFIEBAR.DLL
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O17 — HKLMSystemCCSServicesTcpip..{D72A5FFD-B901-41F1-9396-FC7659772CBC}: NameServer = 195.98.51.42 195.98.51.43
O18 — Protocol: skype4com — {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} — C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O22 — SharedTaskScheduler: Предзагрузчик Browseui — {438755C2-A8BA-11D1-B96B-00A0C90312E1} — C:WINDOWSsystem32browseui.dll
O22 — SharedTaskScheduler: Демон кэша категорий компонентов — {8C7461EF-2B13-11d2-BE35-3078302C2030} — C:WINDOWSsystem32browseui.dll
O23 — Service: 2GIS UpdateClientService — ДубльГИС — C:Program Files2gisUpdateClientWin32UpdateClientService.exe
O23 — Service: ESET HTTP Server (EhttpSrv) — ESET — C:Program FilesESETESET NOD32 AntivirusEHttpSrv.exe
O23 — Service: ESET Service (ekrn) — ESET — C:Program FilesESETESET NOD32 Antivirusekrn.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: ICQ Service — Unknown owner — C:Program FilesICQ6ToolbarICQ Service.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: Java Quick Starter (JavaQuickStarterService) — Sun Microsystems, Inc. — C:Program FilesJavajre6binjqs.exe
O23 — Service: Агент защиты доступа к сети napagentnapagent (napagentnapagent) — Unknown owner — C:WINDOWSsystem32acctresq.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: PMBDeviceInfoProvider — Sony Corporation — C:Program FilesSonyPMBPMBDeviceInfoProvider.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: ServiceLayer — Nokia — C:Program FilesPC Connectivity SolutionServiceLayer.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: TuneUp Drive Defrag Service (TuneUp.Defrag) — TuneUp Software — C:Program FilesTuneUp Utilities 2010TuneUpDefragService.exe
O23 — Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) — TuneUp Software — C:Program FilesTuneUp Utilities 2010TuneUpUtilitiesService32.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe

—
End of file — 8264 bytes

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper — C:Program FilesJavajre6binjp2ssv.dll [2010-04-14 35840]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll [2010-04-14 73728]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{855F3B16-6D32-4FE6-8A56-BBB695989046} — ICQToolBar — C:Program FilesICQ6ToolbarICQToolBar.dll [2010-03-28 1017592]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«SoundMan»=C:WINDOWSSOUNDMAN.EXE [2007-04-16 577536]
«NeroFilterCheck»=C:WINDOWSsystem32NeroCheck.exe [2006-01-12 155648]
«egui»=C:Program FilesESETESET NOD32 Antivirusegui.exe [2009-11-16 2054360]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«VistaIcon»=C:Program FilesVistaDriveIconVistaDrv.exe [2008-01-02 132096]
«CTFMON.EXE»=C:WINDOWSsystem32ctfmon.exe [2009-04-24 30208]
«ICQ»=C:Program FilesICQ7.1ICQ.exe [2010-06-08 133368]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPC Suite Tray]
C:Program FilesNokiaNokia PC Suite 7PCSuite.exe [2009-11-11 1451520]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupreguTorrent]
C:Program FilesuTorrentuTorrent.exe [2010-04-14 319792]

C:Documents and SettingsAdminГлавное менюПрограммыАвтозагрузка
wwwznv32.exe

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32wpdshserviceobj.dll [2008-05-18 133632]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalWdf01000.sys]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkWdf01000.sys]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesICQ7.1ICQ.exe»=»C:Program FilesICQ7.1ICQ.exe:*:Enabled:ICQ7.1»
«C:Program FilesICQ7.1aolload.exe»=»C:Program FilesICQ7.1aolload.exe:*:Enabled:aolload.exe»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesICQ7.1ICQ.exe»=»C:Program FilesICQ7.1ICQ.exe:*:Enabled:ICQ7.1»
«C:Program FilesICQ7.1aolload.exe»=»C:Program FilesICQ7.1aolload.exe:*:Enabled:aolload.exe»

======List of files/folders created in the last 1 months======

2010-07-24 20:09:00 —-D—- C:Program Filestrend micro
2010-07-24 20:08:50 —-D—- C:rsit
2010-07-23 16:35:18 —-A—- C:WINDOWSsystem32driverslbrtfdc.sys
2010-07-23 16:35:17 —-A—- C:WINDOWSsystem32driversi2omgmt.sys
2010-07-23 16:35:12 —-A—- C:WINDOWSsystem32driverschanger.sys
2010-07-22 12:00:33 —-D—- C:Documents and SettingsAdminApplication DataSunODFPluginforMicrosoftOffice
2010-07-22 11:54:52 —-D—- C:Program FilesSun
2010-07-19 23:20:36 —-A—- C:WINDOWSsystem32driversvdi1mtqw.sys
2010-07-18 23:03:29 —-D—- C:WINDOWSsystem32NtmsData
2010-07-18 22:50:00 —-HD—- C:WINDOWSPIF
2010-07-18 00:09:20 —-D—- C:WINDOWSpss
2010-07-12 23:34:51 —-D—- C:Np2009w
2010-06-27 22:39:50 —-D—- C:Documents and SettingsAdminApplication DataSony Corporation
2010-06-27 21:58:45 —-D—- C:Documents and SettingsAll UsersApplication DataSony Corporation
2010-06-27 21:57:16 —-D—- C:Program FilesSony

======List of files/folders modified in the last 1 months======

2010-07-24 20:09:13 —-D—- C:WINDOWSTemp
2010-07-24 20:09:00 —-RD—- C:Program Files
2010-07-24 20:08:53 —-D—- C:WINDOWSPrefetch
2010-07-24 19:20:21 —-D—- C:WINDOWS
2010-07-24 19:18:42 —-AD—- C:WINDOWSsystem32
2010-07-24 19:16:53 —-D—- C:WINDOWSsystem32drivers
2010-07-24 18:35:30 —-D—- C:Documents and SettingsAdminApplication Dataicq
2010-07-24 17:44:58 —-D—- C:WINDOWSsystem32CatRoot2
2010-07-24 11:40:34 —-N—- C:WINDOWSSchedLgU.Txt
2010-07-23 23:24:51 —-D—- C:Documents and SettingsAdminApplication DatauTorrent
2010-07-23 16:36:04 —-SD—- C:Documents and SettingsAdminApplication DataMicrosoft
2010-07-23 16:35:25 —-RSHDC—- C:WINDOWSsystem32dllcache
2010-07-22 12:14:10 —-A—- C:WINDOWSNeroDigital.ini
2010-07-22 11:57:41 —-SHD—- C:WINDOWSInstaller
2010-07-22 11:57:40 —-RSD—- C:WINDOWSassembly
2010-07-22 11:57:30 —-D—- C:WINDOWSWinSxS
2010-07-19 23:07:45 —-A—- C:Program FilesCommon Fileskeylog.txt
2010-07-19 18:15:14 —-D—- C:WINDOWSsystem32Restore
2010-07-19 18:15:13 —-SHD—- C:System Volume Information
2010-07-19 16:23:02 —-AD—- C:Documents and SettingsAdminApplication DataYandex
2010-07-19 16:18:16 —-D—- C:Documents and SettingsAdminApplication DataFOG Downloader
2010-07-18 22:50:14 —-A—- C:WINDOWSsystem.ini
2010-07-18 20:42:58 —-HD—- C:WINDOWSinf
2010-07-12 23:35:11 —-RSD—- C:WINDOWSFonts
2010-07-04 11:09:57 —-D—- C:WINDOWSNetwork Diagnostic

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 nv_agp;NVIDIA nForce AGP Bus Filter; C:WINDOWSsystem32DRIVERSnv_agp.sys [2006-02-26 21760]
R0 nvrd32;NVIDIA nForce RAID Driver; C:WINDOWSsystem32DRIVERSnvrd32.sys [2008-08-18 133152]
R0 sptd;sptd; C:WINDOWSSystem32Driverssptd.sys [2010-04-14 721904]
R0 WudfPf;Windows Driver Foundation — User-mode Driver Framework Platform Driver; C:WINDOWSsystem32DRIVERSWudfPf.sys [2008-01-18 77696]
R1 AmdK7;Драйвер AMD K7 процессора; C:WINDOWSsystem32DRIVERSamdk7.sys [2009-04-24 41984]
R1 ehdrv;ehdrv; C:WINDOWSsystem32DRIVERSehdrv.sys [2009-11-16 108792]
R1 epfwtdir;epfwtdir; C:WINDOWSsystem32DRIVERSepfwtdir.sys [2009-11-16 96408]
R2 eamon;eamon; C:WINDOWSsystem32DRIVERSeamon.sys [2009-11-16 116520]
R2 exFat;exFat; C:WINDOWSsystem32driversexFat.sys [2009-01-28 133632]
R2 rspndr;Ответчик обнаружения топологии уровня связи; C:WINDOWSsystem32DRIVERSrspndr.sys [2008-10-11 62848]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:WINDOWSsystem32driversALCXWDM.SYS [2008-09-24 4122368]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service; C:WINDOWSsystem32DRIVERSfetnd5bv.sys [2008-09-22 43520]
R3 nv;nv; C:WINDOWSsystem32DRIVERSnv4_mini.sys [2008-04-14 1897408]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv; ??C:Program FilesTuneUp Utilities 2010TuneUpUtilitiesDriver32.sys []
S3 nmwcd;Nokia USB Phone Parent; C:WINDOWSsystem32driversccdcmb.sys [2009-10-06 17664]
S3 nmwcdc;Nokia USB Generic; C:WINDOWSsystem32driversccdcmbo.sys [2009-10-06 22016]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:WINDOWSsystem32DRIVERSpccsmcfd.sys [2008-08-26 18816]
S3 upperdev;upperdev; C:WINDOWSsystem32DRIVERSusbser_lowerflt.sys [2009-10-06 7936]
S3 usbser;USB Modem Driver; C:WINDOWSsystem32driversusbser.sys [2008-04-14 26112]
S3 UsbserFilt;UsbserFilt; C:WINDOWSsystem32DRIVERSusbser_lowerfltj.sys [2009-10-06 7936]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2008-04-14 26368]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:WINDOWSSystem32Driverswdf01000.sys [2008-03-27 503008]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2008-01-18 83328]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 2GIS UpdateClientService;2GIS UpdateClientService; C:Program Files2gisUpdateClientWin32UpdateClientService.exe [2008-09-17 1134592]
R2 ekrn;ESET Service; C:Program FilesESETESET NOD32 Antivirusekrn.exe [2009-11-16 735960]
R2 ICQ Service;ICQ Service; C:Program FilesICQ6ToolbarICQ Service.exe [2010-03-28 246520]
R2 JavaQuickStarterService;Java Quick Starter; C:Program FilesJavajre6binjqs.exe [2010-04-14 152984]
R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider; C:Program FilesSonyPMBPMBDeviceInfoProvider.exe [2009-10-24 360224]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service; C:Program FilesTuneUp Utilities 2010TuneUpUtilitiesService32.exe [2010-02-25 1047880]
R2 UxTuneUp;TuneUp Theme Extension; C:WINDOWSSystem32svchost.exe [2008-04-15 14336]
R2 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2008-04-15 14336]
S2 napagentnapagent;Агент защиты доступа к сети napagentnapagent; C:WINDOWSsystem32acctresq.exe [2008-04-15 62464]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2007-10-24 70144]
S3 EhttpSrv;ESET HTTP Server; C:Program FilesESETESET NOD32 AntivirusEHttpSrv.exe [2009-11-16 20680]
S3 odserv;Microsoft Office Diagnostics Service; C:Program FilesCommon FilesMicrosoft SharedOFFICE12ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2006-10-26 145184]
S3 ServiceLayer;ServiceLayer; C:Program FilesPC Connectivity SolutionServiceLayer.exe [2009-10-27 657408]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service; C:Program FilesTuneUp Utilities 2010TuneUpDefragService.exe [2010-04-14 435016]
S3 WMPNetworkSvc;Служба общих сетевых ресурсов проигрывателя Windows Media; C:Program FilesWindows Media Playerwmpnetwk.exe [2006-11-02 914944]

---

EOF

---

[Автор]

Сообщения