[morphey]

На самом деле есть еще одна машина, с которой я иногда захожу на сайт ВКонтакте. Ноутбук домашний..

[morphey]

Logfile of random’s system information tool 1.06 (written by random/random)
Run by morozova at 2009-06-18 20:22:49
Microsoft Windows XP Professional Service Pack 3
System drive C: has 16 GB (39%) free of 42 GB
Total RAM: 1015 MB (55% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:22:56, on 18.06.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesBonjourmDNSResponder.exe
C:Program FilesMcAfeeCommon FrameworkFrameworkService.exe
C:Program FilesMcAfeeVirusScan EnterpriseMcshield.exe
C:Program FilesMcAfeeVirusScan EnterpriseVsTskMgr.exe
C:WINDOWSExplorer.EXE
C:Program FilesMcAfeeVirusScan EnterpriseSHSTAT.EXE
C:Program FilesMcAfeeCommon FrameworkUdaterUI.exe
C:Program FilesWebMoney Agentwmagent.exe
C:Program FilesMcAfeeCommon FrameworkMcTray.exe
C:WINDOWSsystem32wuauclt.exe
C:Program FilesAvant Browseravant.exe
C:Documents and SettingsmorozovaРабочий столRSIT.exe
C:Program Filestrend micromorozova.exe

R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = about:blank
R1 — HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *.local
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: (no name) — {83821C2B-32A8-4DD7-B6D4-44309A78E668} — C:Program FilesMail.RuAgentMradllnewmrasearch.dll
R3 — URLSearchHook: SweetIM ToolbarURLSearchHook Class — {EEE6C35D-6118-11DC-9C72-001320C79847} — C:Program FilesSweetIMToolbarsInternet ExplorermgHelper.dll
O2 — BHO: Adobe PDF Reader Link Helper — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 — BHO: scriptproxy — {7DB2D5A0-7241-4E79-B68D-6309F01C5231} — C:Program FilesMcAfeeVirusScan EnterpriseScriptcl.dll
O2 — BHO: Adobe PDF Conversion Toolbar Helper — {AE7CD045-E861-484f-8273-0445EE161910} — C:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll
O2 — BHO: TBSB03223 — {B4806C1A-FE8A-4008-9DA3-8CEDB6E82C10} — C:Program FilesWebMoney Advisorwmadvisor.dll
O2 — BHO: SWEETIE — {EEE6C35C-6118-11DC-9C72-001320C79847} — C:Program FilesSweetIMToolbarsInternet ExplorermgToolbarIE.dll
O3 — Toolbar: Adobe PDF — {47833539-D0C5-4125-9FA8-0819E2EAAC93} — C:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll
O3 — Toolbar: SweetIM Toolbar for Internet Explorer — {EEE6C35B-6118-11DC-9C72-001320C79847} — C:Program FilesSweetIMToolbarsInternet ExplorermgToolbarIE.dll
O3 — Toolbar: WebMoney Advisor — {3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — C:Program FilesWebMoney Advisorwmadvisor.dll
O4 — HKLM..Run: [MAgent] C:Program FilesMail.RuAgentmagent.exe -LM
O4 — HKLM..Run: [ShStatEXE] «C:Program FilesMcAfeeVirusScan EnterpriseSHSTAT.EXE» /STANDALONE
O4 — HKLM..Run: [McAfeeUpdaterUI] «C:Program FilesMcAfeeCommon FrameworkUdaterUI.exe» /StartedFromRunKey
O4 — HKLM..Run: [wmagent.exe] «C:Program FilesWebMoney Agentwmagent.exe»
O4 — HKLM..Run: [QuickTime Task] «C:Program FilesQuickTimeqttask.exe» -atboottime
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O8 — Extra context menu item: &Перевести с помощью ABBYY Lingvo… — res://C:Program FilesABBYY Lingvo 12Lingvo.exe/3000
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 — Extra context menu item: Append to existing PDF — res://C:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
O8 — Extra context menu item: Convert link target to Adobe PDF — res://C:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
O8 — Extra context menu item: Convert link target to existing PDF — res://C:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
O8 — Extra context menu item: Convert selected links to Adobe PDF — res://C:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 — Extra context menu item: Convert selected links to existing PDF — res://C:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 — Extra context menu item: Convert selection to Adobe PDF — res://C:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
O8 — Extra context menu item: Convert selection to existing PDF — res://C:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
O8 — Extra context menu item: Convert to Adobe PDF — res://C:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
O9 — Extra button: WebMoney Advisor — {3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — C:Program FilesWebMoney Advisorwmadvisor.dll
O9 — Extra ‘Tools’ menuitem: WebMoney Advisor — {3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — C:Program FilesWebMoney Advisorwmadvisor.dll
O9 — Extra button: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra ‘Tools’ menuitem: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra button: Справочные материалы — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O17 — HKLMSystemCCSServicesTcpipParameters: Domain = usu.corp
O17 — HKLMSoftware..Telephony: DomainName = usu.corp
O17 — HKLMSystemCCSServicesTcpip..{734CCEDC-3731-4FBB-9E16-6737788DBF4A}: NameServer = 194.226.237.16,194.226.235.22,10.20.3.200
O17 — HKLMSystemCS1ServicesTcpipParameters: Domain = usu.corp
O23 — Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) — Apple Computer, Inc. — C:Program FilesBonjourmDNSResponder.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: FLEXnet Licensing Service — Macrovision Europe Ltd. — C:Program FilesCommon FilesMacrovision SharedFLEXnet PublisherFNPLicensingService.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: McAfee Framework Service (McAfeeFramework) — McAfee, Inc. — C:Program FilesMcAfeeCommon FrameworkFrameworkService.exe
O23 — Service: McAfee McShield (McShield) — McAfee, Inc. — C:Program FilesMcAfeeVirusScan EnterpriseMcshield.exe
O23 — Service: McAfee Task Manager (McTaskManager) — McAfee, Inc. — C:Program FilesMcAfeeVirusScan EnterpriseVsTskMgr.exe
O23 — Service: NetMeeting Remote Desktop Sharing (mnmsrvc) — Корпорация Майкрософт — C:WINDOWSsystem32mnmsrvc.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe

—
End of file — 8248 bytes

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll [2006-10-23 62080]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
scriptproxy — C:Program FilesMcAfeeVirusScan EnterpriseScriptcl.dll [2007-10-16 66880]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe PDF Conversion Toolbar Helper — C:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll [2007-05-10 321120]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{B4806C1A-FE8A-4008-9DA3-8CEDB6E82C10}]
TBSB03223 Class — C:Program FilesWebMoney Advisorwmadvisor.dll [2008-09-05 2409472]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{EEE6C35C-6118-11DC-9C72-001320C79847}]
SweetIM Toolbar Helper — C:Program FilesSweetIMToolbarsInternet ExplorermgToolbarIE.dll [2008-10-08 1172792]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} — Adobe PDF — C:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll [2007-05-10 321120]
{EEE6C35B-6118-11DC-9C72-001320C79847} — SweetIM Toolbar for Internet Explorer — C:Program FilesSweetIMToolbarsInternet ExplorermgToolbarIE.dll [2008-10-08 1172792]
{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — WebMoney Advisor — C:Program FilesWebMoney Advisorwmadvisor.dll [2008-09-05 2409472]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«»= []
«MAgent»=C:Program FilesMail.RuAgentmagent.exe [2009-04-03 6210744]
«ShStatEXE»=C:Program FilesMcAfeeVirusScan EnterpriseSHSTAT.EXE [2007-10-16 111952]
«McAfeeUpdaterUI»=C:Program FilesMcAfeeCommon FrameworkUdaterUI.exe [2007-10-25 136512]
«wmagent.exe»=C:Program FilesWebMoney Agentwmagent.exe [2008-10-01 209376]
«QuickTime Task»=C:Program FilesQuickTimeqttask.exe [2008-09-06 413696]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyigfxcui]
C:WINDOWSsystem32igfxdev.dll [2005-11-28 135168]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalati3xmxx.sys]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkati3xmxx.sys]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoWindowsUpdate»=0
«ForceStartMenuLogOff»=2
«NoTrayContextMenu»=0
«NoToolbarCustomize»=0
«NoBandCustomize»=0
«LockTaskbar»=0
«NoDeletePrinter»=0
«NoDriveTypeAutoRun»=36
«NoDriveAutoRun»=FFFFFFFF

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»

======List of files/folders created in the last 3 months======

2009-06-18 20:11:36 —-D—- C:Avenger
2009-06-18 20:11:36 —-A—- C:avenger.txt
2009-06-14 19:37:25 —-RASHD—- C:autorun.inf
2009-06-08 15:41:54 —-D—- C:Program Filestrend micro
2009-06-08 15:41:53 —-D—- C:rsit
2009-04-14 16:59:54 —-D—- C:Documents and SettingsmorozovaApplication DataWebMoney
2009-04-14 16:58:20 —-D—- C:Program FilesWebMoney Advisor
2009-04-14 16:57:54 —-D—- C:Program FilesWebMoney Agent
2009-04-14 16:57:50 —-AD—- C:Documents and SettingsAll UsersApplication DataTEMP
2009-04-14 16:57:29 —-D—- C:Program FilesWebMoney
2009-03-27 15:42:54 —-A—- C:WINDOWSsystem32epoPGPsdk.dll.sig
2009-03-27 15:42:54 —-A—- C:WINDOWSsystem32epoPGPsdk.dll
2009-03-27 15:42:53 —-D—- C:Documents and SettingsAll UsersApplication DataMcAfee
2009-03-27 15:42:25 —-D—- C:Program FilesMcAfee
2009-03-27 15:42:25 —-D—- C:Program FilesCommon FilesMcAfee

======List of files/folders modified in the last 3 months======

2009-06-18 20:22:44 —-D—- C:WINDOWSPrefetch
2009-06-18 20:18:15 —-D—- C:WINDOWSTemp
2009-06-18 20:17:47 —-A—- C:WINDOWSSchedLgU.Txt
2009-06-18 20:11:43 —-D—- C:WINDOWSsecurity
2009-06-18 20:11:36 —-D—- C:WINDOWSsystem32drivers
2009-06-17 17:13:14 —-SHD—- C:WINDOWSInstaller
2009-06-17 17:12:34 —-D—- C:WINDOWSsystem32
2009-06-17 09:52:54 —-D—- C:QUARANTINE
2009-06-16 13:43:33 —-SHD—- C:RECYCLER
2009-06-16 13:33:32 —-D—- C:Documents and Settings
2009-06-14 15:30:49 —-A—- C:WINDOWSwin.ini
2009-06-08 15:41:54 —-RD—- C:Program Files
2009-06-08 12:17:24 —-D—- C:WINDOWSsystem32CatRoot2
2009-05-15 16:48:07 —-D—- C:Documents and SettingsmorozovaApplication DataMra
2009-04-29 12:08:44 —-D—- C:Documents and SettingsAll UsersApplication DataAdobe
2009-04-08 19:28:02 —-SD—- C:WINDOWSTasks
2009-03-30 13:34:23 —-A—- C:WINDOWSsystem32PerfStringBackup.INI
2009-03-27 15:43:21 —-D—- C:WINDOWS
2009-03-27 15:42:25 —-D—- C:Program FilesCommon Files
2009-03-26 20:08:23 —-D—- C:Documents and SettingsAll UsersApplication DataFLEXnet

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2008-04-14 40704]
R1 kbdhid;Драйвер клавиатуры HID; C:WINDOWSsystem32DRIVERSkbdhid.sys [2008-04-14 14720]
R1 mferkdk;VSCore mferkdk; ??C:Program FilesMcAfeeVirusScan Enterprisemferkdk.sys []
R1 mfetdik;McAfee Inc.; C:WINDOWSsystem32driversmfetdik.sys [2007-10-16 51944]
R3 HDAudBus;Драйвер шины Microsoft UAA для High Definition Audio; C:WINDOWSsystem32DRIVERSHDAudBus.sys [2008-04-13 144384]
R3 hidusb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2008-04-14 10368]
R3 ialm;ialm; C:WINDOWSsystem32DRIVERSialmnt5.sys [2005-11-28 1353820]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:WINDOWSsystem32driversRtkHDAud.sys [2008-02-14 4676096]
R3 mfeapfk;McAfee Inc.; C:WINDOWSsystem32driversmfeapfk.sys [2007-10-16 64168]
R3 mfeavfk;McAfee Inc.; C:WINDOWSsystem32driversmfeavfk.sys [2007-10-16 72680]
R3 mfebopk;McAfee Inc.; C:WINDOWSsystem32driversmfebopk.sys [2007-10-16 33960]
R3 mfehidk;McAfee Inc.; C:WINDOWSsystem32driversmfehidk.sys [2007-10-16 171272]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:WINDOWSsystem32DRIVERSRtenicxp.sys [2008-01-03 105856]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2008-04-14 30208]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2008-04-14 59520]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2008-04-14 20608]
S2 DS1410D;DS1410D; C:WINDOWSSYSTEM32driversDS1410D.SYS []
S3 gdrv;gdrv; ??C:WINDOWSgdrv.sys []
S3 tcpsr;tcpsr; ??C:WINDOWSSystem32driverstcpsr.sys []
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2008-04-14 26368]
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:Program FilesBonjourmDNSResponder.exe [2006-02-28 229376]
R2 McAfeeFramework;McAfee Framework Service; C:Program FilesMcAfeeCommon FrameworkFrameworkService.exe [2007-10-25 103744]
R2 McShield;McAfee McShield; C:Program FilesMcAfeeVirusScan EnterpriseMcshield.exe [2007-10-16 144704]
R2 McTaskManager;McAfee Task Manager; C:Program FilesMcAfeeVirusScan EnterpriseVsTskMgr.exe [2007-10-16 54608]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:Program FilesCommon FilesMacrovision SharedFLEXnet PublisherFNPLicensingService.exe [2008-11-17 654848]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2003-07-28 89136]

---

EOF

---

[morphey]

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Driver «tcpsr» deleted successfully.
Registry key «HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalati3xmxx.sys» deleted successfully.
Registry key «HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkati3xmxx.sys» deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

[morphey]

Скачайте OTMoveIt3 by OldTimer кликнув по этой ссылке.

Эта ссылка не работает..

[morphey]

info.txt logfile of random’s system information tool 1.06 2009-06-08 15:42:07

======Uninstall list======

—>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:WINDOWSINFPCHealth.inf
ABBYY Lingvo 12 English Edition—>MsiExec.exe /I{A1200000-0001-0000-0000-074957833700}
Adobe Acrobat 8.1.5 Professional—>msiexec /I {AC76BA86-1033-F400-7760-000000000003}
Adobe Anchor Service CS3—>MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}
Adobe Asset Services CS3—>MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}
Adobe Bridge CS3—>MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}
Adobe Bridge Start Meeting—>MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}
Adobe Camera Raw 4.0—>MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}
Adobe CMaps—>MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}
Adobe Color — Photoshop Specific—>MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E}
Adobe Color Common Settings—>C:Program FilesCommon FilesAdobeInstallers6c8e2cb4fd241c55406016127a6ab2eSetup.exe
Adobe Color Common Settings—>MsiExec.exe /I{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}
Adobe Color EU Recommended Settings—>MsiExec.exe /I{BD087F50-46B2-43E4-BD73-5DB3DC20B47C}
Adobe Color JA Extra Settings—>MsiExec.exe /I{D92B72E2-C854-4738-8ED6-4C3661CC17AE}
Adobe Color NA Extra Settings—>MsiExec.exe /I{6179A7D2-A668-4F1D-BC9A-DCC6A10C7871}
Adobe Default Language CS3—>MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}
Adobe Device Central CS3—>MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}
Adobe ExtendScript Toolkit 2—>C:Program FilesCommon FilesAdobeInstallers3e054d2218e7aa282c2369d939e58ffSetup.exe
Adobe ExtendScript Toolkit 2—>MsiExec.exe /I{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}
Adobe Flash Player 10 ActiveX—>C:WINDOWSsystem32MacromedFlashuninstall_activeX.exe
Adobe Fonts All—>MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B}
Adobe Help Viewer CS3—>MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245}
Adobe Linguistics CS3—>MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078}
Adobe PDF Library Files—>MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}
Adobe Photoshop CS3—>C:Program FilesCommon FilesAdobeInstallers8c1493d5f7a42ca50dc0bfa020c595aSetup.exe
Adobe Photoshop CS3—>MsiExec.exe /I{D7C6EE24-3B88-472B-A26A-2B15565D7B3B}
Adobe Setup—>MsiExec.exe /I{3AF8C5EB-70CD-4E3E-9ED4-48B24D40AD7A}
Adobe Setup—>MsiExec.exe /I{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}
Adobe Setup—>MsiExec.exe /I{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}
Adobe Stock Photos CS3—>MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183}
Adobe Type Support—>MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}
Adobe Update Manager CS3—>MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}
Adobe Version Cue CS3 Client—>MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}
Adobe WinSoft Linguistics Plugin—>MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}
Adobe XMP Panels CS3—>MsiExec.exe /I{802771A9-A856-4A41-ACF7-1450E523C923}
Apple Software Update—>MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Avant Browser (remove only)—>»C:Program FilesAvant Browseruninst.exe»
DAEMON Tools—>MsiExec.exe /I{3DED3A72-61A8-4B87-98A5-EF0BC8038AA0}
High Definition Audio Driver Package — KB888111—>»C:WINDOWS$NtUninstallKB888111WXPSP2$spuninstspuninst.exe»
HijackThis 2.0.2—>»C:Program Filestrend microHijackThis.exe» /uninstall
Intel(R) Graphics Media Accelerator Driver—>RUNDLL32.EXE C:WINDOWSsystem32ialmrem.dll,UninstallW2KIGfx2ID PCIVEN_8086&DEV_2776 PCIVEN_8086&DEV_2772
jv16 PowerTools 2007—>»C:Program Filesjv16 PowerTools 2007unins000.exe»
Mail.Ru Агент 5.4 (сборка 2647, для всех пользователей)—>C:Program FilesMail.RuAgentmagentsetup.exe -uninstalllm
Maple 11—>»C:Program FilesMaple 11Uninstall_Maple 11Uninstall Maple 11.exe»
McAfee VirusScan Enterprise—>MsiExec.exe /I{35C03C04-3F1F-42C2-A989-A757EE691F65}
Microsoft Office — профессиональный выпуск версии 2003—>MsiExec.exe /I{90110419-6000-11D3-8CFE-0150048383C9}
OriginPro 8—>C:Program FilesInstallShield Installation Information{A912021A-FEDD-4DA3-8DB4-245EBDA84778}setup.exe -runfromtemp -l0x0009 -removeonly
PDF Settings—>MsiExec.exe /I{293D5729-7C01-4FA4-A4DE-BB6A1587BBB9}
QIP Infium 2.0.9020 RC3—>»C:Program FilesQIP Infiumunins000.exe»
QuickTime—>MsiExec.exe /I{8DC42D05-680B-41B0-8878-6C14D24602DB}
REALTEK GbE & FE Ethernet PCI-E NIC Driver—>C:Program FilesInstallShield Installation Information{C9BED750-1211-4480-B1A5-718A3BE15525}SETUP.EXE -runfromtemp -l0x0019 -removeonly
Realtek High Definition Audio Driver—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime1150Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}SETUP.EXE» -l0x19 -removeonly
SweetIM for Messenger 2.6—>MsiExec.exe /X{21D74CEE-EEFC-4D72-9691-2F2BE1DF9FB2}
SweetIM Toolbar for Internet Explorer 3.3—>MsiExec.exe /X{266C7330-C0F4-49E5-8F20-A56F9F822875}
WebMoney Advisor—>regsvr32 /u /s «C:Program FilesWebMoney Advisorwmadvisor.dll»
WebMoney Agent—>C:Program FilesWebMoney Agentuninst_wmagent.exe
WebMoney Keeper Classic 3.7.0.1—>»C:Program FilesWebMoneyUninstall.exe» «C:Program FilesWebMoneyinstall.log» -u
Windows XP Service Pack 3—>»C:WINDOWS$NtServicePackUninstall$spuninstspuninst.exe»
WinRAR archiver—>C:Program FilesWinRARuninstall.exe
Данные ДубльГИС г.Екатеринбург 01.03.2009—>MsiExec.exe /X{903F8DAC-631A-4EA1-B7AC-D0D0BD1B4979}
ДубльГИС 3.0.4.2—>MsiExec.exe /X{EBF56A8E-3483-4704-98B8-7685891F8EA7}

======Security center information======

AV: McAfee VirusScan Enterprise

======System event log======

Computer Name: ANALIT309-3
Event Code: 7036
Message: Служба «Рабочая станция» перешла в состояние Работает.

Record Number: 5221
Source Name: Service Control Manager
Time Written: 20090411125235.000000+360
Event Type: информация
User:

Computer Name: ANALIT309-3
Event Code: 7035
Message: Служба «Рабочая станция» успешно отправила управляющий элемент «запустить».

Record Number: 5220
Source Name: Service Control Manager
Time Written: 20090411125235.000000+360
Event Type: информация
User: USUmorozova

Computer Name: ANALIT309-3
Event Code: 7036
Message: Служба «Сервер» перешла в состояние Работает.

Record Number: 5219
Source Name: Service Control Manager
Time Written: 20090411125230.000000+360
Event Type: информация
User:

Computer Name: ANALIT309-3
Event Code: 7035
Message: Служба «Сервер» успешно отправила управляющий элемент «запустить».

Record Number: 5218
Source Name: Service Control Manager
Time Written: 20090411125230.000000+360
Event Type: информация
User: USUmorozova

Computer Name: ANALIT309-3
Event Code: 59
Message: Generate Activation Context завершилась не удачно для C:WINDOWSWinSxSx86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_39049d00MFC80U.DLL.
Соответствующее сообщение об ошибке: Операция успешно завершена.
.

Record Number: 5217
Source Name: SideBySide
Time Written: 20090411125156.000000+360
Event Type: ошибка
User:

=====Application event log=====

Computer Name: ANALIT309-3
Event Code: 257
Message: The Scan was unable to scan password protected file C:Documents and SettingsmorozovaLocal SettingsTemporary Internet FilesContent.IE54P23KPEByandsearch[1]yandsearch[1]. Scan engine version used is 5301.4018 DAT version 5632.0000.

Record Number: 5585
Source Name: McLogEvent
Time Written: 20090601145127.000000+360
Event Type: информация
User: NT AUTHORITYSYSTEM

Computer Name: ANALIT309-3
Event Code: 257
Message: The Scan was unable to scan password protected file C:Documents and SettingsmorozovaLocal SettingsTemporary Internet FilesContent.IE5NEWVJLKHyandsearch[1]yandsearch[1]. Scan engine version used is 5301.4018 DAT version 5632.0000.

Record Number: 5584
Source Name: McLogEvent
Time Written: 20090601145121.000000+360
Event Type: информация
User: NT AUTHORITYSYSTEM

Computer Name: ANALIT309-3
Event Code: 257
Message: The Scan was unable to scan password protected file C:Documents and SettingsmorozovaLocal SettingsTemporary Internet FilesContent.IE564ZT7EMN27600[1].htm27600[1]. Scan engine version used is 5301.4018 DAT version 5632.0000.

Record Number: 5583
Source Name: McLogEvent
Time Written: 20090601144552.000000+360
Event Type: информация
User: NT AUTHORITYSYSTEM

Computer Name: ANALIT309-3
Event Code: 257
Message: The Scan was unable to scan password protected file C:Documents and SettingsmorozovaLocal SettingsTemporary Internet FilesContent.IE5JGGEHC3N3_19[1].htm3_19[1]. Scan engine version used is 5301.4018 DAT version 5632.0000.

Record Number: 5582
Source Name: McLogEvent
Time Written: 20090601144425.000000+360
Event Type: информация
User: NT AUTHORITYSYSTEM

Computer Name: ANALIT309-3
Event Code: 257
Message: The Scan was unable to scan password protected file C:Documents and SettingsmorozovaLocal SettingsTemporary Internet FilesContent.IE5UPHG4O3J2626618[1]2626618[1]. Scan engine version used is 5301.4018 DAT version 5632.0000.

Record Number: 5581
Source Name: McLogEvent
Time Written: 20090601143652.000000+360
Event Type: информация
User: NT AUTHORITYSYSTEM

======Environment variables======

«ComSpec»=%SystemRoot%system32cmd.exe
«Path»=C:watcom-1.3binnt;C:watcom-1.3binw;%SystemRoot%system32;%SystemRoot%;%SystemRoot%System32Wbem;C:Program FilesQuickTimeQTSystem
«windir»=%SystemRoot%
«FP_NO_HOST_CHECK»=NO
«OS»=Windows_NT
«PROCESSOR_ARCHITECTURE»=x86
«PROCESSOR_LEVEL»=6
«PROCESSOR_IDENTIFIER»=x86 Family 6 Model 15 Stepping 13, GenuineIntel
«PROCESSOR_REVISION»=0f0d
«NUMBER_OF_PROCESSORS»=2
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP
«KMP_DUPLICATE_LIB_OK»=TRUE
«WATCOM»=C:watcom-1.3
«CLASSPATH»=.;C:Program FilesQuickTimeQTSystemQTJava.zip
«QTJAVA»=C:Program FilesQuickTimeQTSystemQTJava.zip
«VSEDEFLOGDIR»=C:Documents and SettingsAll UsersApplication DataMcAfeeDesktopProtection
«DEFLOGDIR»=C:Documents and SettingsAll UsersApplication DataMcAfeeDesktopProtection

---

EOF

---

[morphey]

Logfile of random’s system information tool 1.06 (written by random/random)
Run by morozova at 2009-06-08 15:41:53
Microsoft Windows XP Professional Service Pack 3
System drive C: has 16 GB (39%) free of 42 GB
Total RAM: 1015 MB (44% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:42:06, on 08.06.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesBonjourmDNSResponder.exe
C:Program FilesMcAfeeCommon FrameworkFrameworkService.exe
C:Program FilesMcAfeeVirusScan EnterpriseMcshield.exe
C:Program FilesMcAfeeVirusScan EnterpriseVsTskMgr.exe
C:WINDOWSExplorer.EXE
C:Program FilesMcAfeeCommon FrameworkUdaterUI.exe
C:Program FilesWebMoney Agentwmagent.exe
C:Program FilesMcAfeeCommon FrameworkMcTray.exe
C:Program FilesMail.RuAgentmagent.exe
C:WINDOWSSystem32svchost.exe
C:Documents and SettingsmorozovaРабочий столZViewZView2.exe
C:WINDOWSsystem32svchost.exe
C:PROGRA~1ORIGIN~1Origin8Origin8.exe
C:WINDOWSsystem32taskmgr.exe
C:Program FilesAvant Browseravant.exe
C:Documents and SettingsmorozovaРабочий столRSIT.exe
C:Program Filestrend micromorozova.exe

R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = about:blank
R1 — HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *.local
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: (no name) — {83821C2B-32A8-4DD7-B6D4-44309A78E668} — C:Program FilesMail.RuAgentMradllnewmrasearch.dll
R3 — URLSearchHook: SweetIM ToolbarURLSearchHook Class — {EEE6C35D-6118-11DC-9C72-001320C79847} — C:Program FilesSweetIMToolbarsInternet ExplorermgHelper.dll
O2 — BHO: Adobe PDF Reader Link Helper — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 — BHO: scriptproxy — {7DB2D5A0-7241-4E79-B68D-6309F01C5231} — C:Program FilesMcAfeeVirusScan EnterpriseScriptcl.dll
O2 — BHO: Adobe PDF Conversion Toolbar Helper — {AE7CD045-E861-484f-8273-0445EE161910} — C:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll
O2 — BHO: TBSB03223 — {B4806C1A-FE8A-4008-9DA3-8CEDB6E82C10} — C:Program FilesWebMoney Advisorwmadvisor.dll
O2 — BHO: SWEETIE — {EEE6C35C-6118-11DC-9C72-001320C79847} — C:Program FilesSweetIMToolbarsInternet ExplorermgToolbarIE.dll
O3 — Toolbar: Adobe PDF — {47833539-D0C5-4125-9FA8-0819E2EAAC93} — C:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll
O3 — Toolbar: SweetIM Toolbar for Internet Explorer — {EEE6C35B-6118-11DC-9C72-001320C79847} — C:Program FilesSweetIMToolbarsInternet ExplorermgToolbarIE.dll
O3 — Toolbar: WebMoney Advisor — {3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — C:Program FilesWebMoney Advisorwmadvisor.dll
O4 — HKLM..Run: [MAgent] C:Program FilesMail.RuAgentmagent.exe -LM
O4 — HKLM..Run: [ShStatEXE] «C:Program FilesMcAfeeVirusScan EnterpriseSHSTAT.EXE» /STANDALONE
O4 — HKLM..Run: [McAfeeUpdaterUI] «C:Program FilesMcAfeeCommon FrameworkUdaterUI.exe» /StartedFromRunKey
O4 — HKLM..Run: [wmagent.exe] «C:Program FilesWebMoney Agentwmagent.exe»
O4 — HKLM..Run: [QuickTime Task] «C:Program FilesQuickTimeqttask.exe» -atboottime
O4 — HKCU..Run: [rs32net] C:WINDOWSSystem32rs32net.exe
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O8 — Extra context menu item: &Перевести с помощью ABBYY Lingvo… — res://C:Program FilesABBYY Lingvo 12Lingvo.exe/3000
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 — Extra context menu item: Append to existing PDF — res://C:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
O8 — Extra context menu item: Convert link target to Adobe PDF — res://C:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
O8 — Extra context menu item: Convert link target to existing PDF — res://C:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
O8 — Extra context menu item: Convert selected links to Adobe PDF — res://C:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 — Extra context menu item: Convert selected links to existing PDF — res://C:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 — Extra context menu item: Convert selection to Adobe PDF — res://C:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
O8 — Extra context menu item: Convert selection to existing PDF — res://C:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
O8 — Extra context menu item: Convert to Adobe PDF — res://C:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
O9 — Extra button: WebMoney Advisor — {3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — C:Program FilesWebMoney Advisorwmadvisor.dll
O9 — Extra ‘Tools’ menuitem: WebMoney Advisor — {3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — C:Program FilesWebMoney Advisorwmadvisor.dll
O9 — Extra button: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra ‘Tools’ menuitem: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra button: Справочные материалы — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O17 — HKLMSystemCCSServicesTcpipParameters: Domain = usu.corp
O17 — HKLMSoftware..Telephony: DomainName = usu.corp
O17 — HKLMSystemCCSServicesTcpip..{734CCEDC-3731-4FBB-9E16-6737788DBF4A}: NameServer = 194.226.237.16,194.226.235.22,10.20.3.200
O17 — HKLMSystemCS1ServicesTcpipParameters: Domain = usu.corp
O23 — Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) — Apple Computer, Inc. — C:Program FilesBonjourmDNSResponder.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: FLEXnet Licensing Service — Macrovision Europe Ltd. — C:Program FilesCommon FilesMacrovision SharedFLEXnet PublisherFNPLicensingService.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: McAfee Framework Service (McAfeeFramework) — McAfee, Inc. — C:Program FilesMcAfeeCommon FrameworkFrameworkService.exe
O23 — Service: McAfee McShield (McShield) — McAfee, Inc. — C:Program FilesMcAfeeVirusScan EnterpriseMcshield.exe
O23 — Service: McAfee Task Manager (McTaskManager) — McAfee, Inc. — C:Program FilesMcAfeeVirusScan EnterpriseVsTskMgr.exe
O23 — Service: NetMeeting Remote Desktop Sharing (mnmsrvc) — Корпорация Майкрософт — C:WINDOWSsystem32mnmsrvc.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe

—
End of file — 8436 bytes

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll [2006-10-23 62080]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
scriptproxy — C:Program FilesMcAfeeVirusScan EnterpriseScriptcl.dll [2007-10-16 66880]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe PDF Conversion Toolbar Helper — C:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll [2007-05-10 321120]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{B4806C1A-FE8A-4008-9DA3-8CEDB6E82C10}]
TBSB03223 Class — C:Program FilesWebMoney Advisorwmadvisor.dll [2008-09-05 2409472]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{EEE6C35C-6118-11DC-9C72-001320C79847}]
SweetIM Toolbar Helper — C:Program FilesSweetIMToolbarsInternet ExplorermgToolbarIE.dll [2008-10-08 1172792]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} — Adobe PDF — C:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll [2007-05-10 321120]
{EEE6C35B-6118-11DC-9C72-001320C79847} — SweetIM Toolbar for Internet Explorer — C:Program FilesSweetIMToolbarsInternet ExplorermgToolbarIE.dll [2008-10-08 1172792]
{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — WebMoney Advisor — C:Program FilesWebMoney Advisorwmadvisor.dll [2008-09-05 2409472]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«»= []
«MAgent»=C:Program FilesMail.RuAgentmagent.exe [2009-04-03 6210744]
«ShStatEXE»=C:Program FilesMcAfeeVirusScan EnterpriseSHSTAT.EXE [2007-10-16 111952]
«McAfeeUpdaterUI»=C:Program FilesMcAfeeCommon FrameworkUdaterUI.exe [2007-10-25 136512]
«wmagent.exe»=C:Program FilesWebMoney Agentwmagent.exe [2008-10-01 209376]
«QuickTime Task»=C:Program FilesQuickTimeqttask.exe [2008-09-06 413696]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«rs32net»=C:WINDOWSSystem32rs32net.exe []

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyigfxcui]
C:WINDOWSsystem32igfxdev.dll [2005-11-28 135168]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalati3xmxx.sys]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkati3xmxx.sys]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoWindowsUpdate»=0
«ForceStartMenuLogOff»=2
«NoTrayContextMenu»=0
«NoToolbarCustomize»=0
«NoBandCustomize»=0
«LockTaskbar»=0
«NoDeletePrinter»=0
«NoDriveTypeAutoRun»=145

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{a4dd034b-bb85-11dd-a290-001fd00766ec}]
shellAUToplaYcommand — F:qjogg.cmd
shellAutoRuncommand — F:qjogg.cmd
shellexplorEcommand — F:qjogg.cmd
shellopEncommand — F:qjogg.cmd

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{c3cd59b1-1901-11de-b469-001fd00766ec}]
shellAutoRuncommand — E:
shellopencommand — rundll32.exe .\versgon.dll,InstallM

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{efc904ae-3162-11de-b484-001fd00766ec}]
shellAutoRuncommand — C:WINDOWSsystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL strongkey-rc1.3-build-208.exe
shelldefaultcommand — strongkey-rc1.3-build-208.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{fd700ec2-fc05-11dd-b448-001fd00766ec}]
shellAutoRuncommand — brzycg.exe
shellexplorecommand — brzycg.exe
shellopencommand — brzycg.exe

======List of files/folders created in the last 1 months======

2009-06-08 15:41:54 —-D—- C:Program Filestrend micro
2009-06-08 15:41:53 —-D—- C:rsit

======List of files/folders modified in the last 1 months======

2009-06-08 15:41:57 —-D—- C:WINDOWSPrefetch
2009-06-08 15:41:54 —-RD—- C:Program Files
2009-06-08 12:28:19 —-D—- C:WINDOWSTemp
2009-06-08 12:17:24 —-D—- C:WINDOWSsystem32CatRoot2
2009-06-08 10:16:47 —-A—- C:WINDOWSSchedLgU.Txt
2009-06-08 09:41:26 —-D—- C:WINDOWSsecurity
2009-06-05 13:57:22 —-D—- C:QUARANTINE
2009-06-01 15:42:00 —-SHD—- C:WINDOWSInstaller
2009-05-19 12:57:19 —-D—- C:WINDOWSsystem32
2009-05-15 16:48:07 —-D—- C:Documents and SettingsmorozovaApplication DataMra

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2008-04-14 40704]
R1 kbdhid;Драйвер клавиатуры HID; C:WINDOWSsystem32DRIVERSkbdhid.sys [2008-04-14 14720]
R1 mferkdk;VSCore mferkdk; ??C:Program FilesMcAfeeVirusScan Enterprisemferkdk.sys []
R1 mfetdik;McAfee Inc.; C:WINDOWSsystem32driversmfetdik.sys [2007-10-16 51944]
R3 HDAudBus;Драйвер шины Microsoft UAA для High Definition Audio; C:WINDOWSsystem32DRIVERSHDAudBus.sys [2008-04-13 144384]
R3 hidusb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2008-04-14 10368]
R3 ialm;ialm; C:WINDOWSsystem32DRIVERSialmnt5.sys [2005-11-28 1353820]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:WINDOWSsystem32driversRtkHDAud.sys [2008-02-14 4676096]
R3 mfeapfk;McAfee Inc.; C:WINDOWSsystem32driversmfeapfk.sys [2007-10-16 64168]
R3 mfeavfk;McAfee Inc.; C:WINDOWSsystem32driversmfeavfk.sys [2007-10-16 72680]
R3 mfebopk;McAfee Inc.; C:WINDOWSsystem32driversmfebopk.sys [2007-10-16 33960]
R3 mfehidk;McAfee Inc.; C:WINDOWSsystem32driversmfehidk.sys [2007-10-16 171272]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:WINDOWSsystem32DRIVERSRtenicxp.sys [2008-01-03 105856]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2008-04-14 30208]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2008-04-14 59520]
R3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2008-04-14 26368]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2008-04-14 20608]
S3 gdrv;gdrv; ??C:WINDOWSgdrv.sys []
S3 tcpsr;tcpsr; ??C:WINDOWSSystem32driverstcpsr.sys []
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:Program FilesBonjourmDNSResponder.exe [2006-02-28 229376]
R2 McAfeeFramework;McAfee Framework Service; C:Program FilesMcAfeeCommon FrameworkFrameworkService.exe [2007-10-25 103744]
R2 McShield;McAfee McShield; C:Program FilesMcAfeeVirusScan EnterpriseMcshield.exe [2007-10-16 144704]
R2 McTaskManager;McAfee Task Manager; C:Program FilesMcAfeeVirusScan EnterpriseVsTskMgr.exe [2007-10-16 54608]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:Program FilesCommon FilesMacrovision SharedFLEXnet PublisherFNPLicensingService.exe [2008-11-17 654848]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2003-07-28 89136]

---

EOF

---

[Автор]

Сообщения