Созданные ответы форума
-
Сообщения
-
только в браузере Mozilla Firefox
з.ы. пробовал удалять браузер, чистка реестра и новая установка. проблема не решилась
помогите пожалуйста! другими браузерами не часто пользуюсь (на этом привык)а вот и скрипт Сомбофикса
ComboFix 09-10-25.02 — Admin 26.10.2009 13:01.2.2 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.2046.1238 [GMT 5:00]
Running from: e:_внешкасофтComboFix.exe
AV: Doctor Web Anti-Virus *On-access scanning enabled* (Updated) {3454C8F1-ECBC-4180-A6F4-04632FBA762B}
* Created a new restore point
* Resident AV is activeWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.c:tempWLZC4CB.tmpburnlib.lng
c:tempWLZC4CB.tmpdsp_sps.lng
c:tempWLZC4CB.tmpenc_aacplus.lng
c:tempWLZC4CB.tmpenc_flac.lng
c:tempWLZC4CB.tmpenc_lame.lng
c:tempWLZC4CB.tmpenc_vorbis.lng
c:tempWLZC4CB.tmpenc_wav.lng
c:tempWLZC4CB.tmpenc_wma.lng
c:tempWLZC4CB.tmpgen_crasher.lng
c:tempWLZC4CB.tmpgen_ff.lng
c:tempWLZC4CB.tmpgen_hotkeys.lng
c:tempWLZC4CB.tmpgen_ml.lng
c:tempWLZC4CB.tmpgen_tray.lng
c:tempWLZC4CB.tmpin_cdda.lng
c:tempWLZC4CB.tmpin_dshow.lng
c:tempWLZC4CB.tmpin_flac.lng
c:tempWLZC4CB.tmpin_linein.lng
c:tempWLZC4CB.tmpin_midi.lng
c:tempWLZC4CB.tmpin_mod.lng
c:tempWLZC4CB.tmpin_mp3.lng
c:tempWLZC4CB.tmpin_mp4.lng
c:tempWLZC4CB.tmpin_nsv.lng
c:tempWLZC4CB.tmpin_vorbis.lng
c:tempWLZC4CB.tmpin_wave.lng
c:tempWLZC4CB.tmpin_wm.lng
c:tempWLZC4CB.tmpml_autotag.lng
c:tempWLZC4CB.tmpml_bookmarks.lng
c:tempWLZC4CB.tmpml_dash.lng
c:tempWLZC4CB.tmpml_disc.lng
c:tempWLZC4CB.tmpml_history.lng
c:tempWLZC4CB.tmpml_local.lng
c:tempWLZC4CB.tmpml_nowplaying.lng
c:tempWLZC4CB.tmpml_online.lng
c:tempWLZC4CB.tmpml_orb.lng
c:tempWLZC4CB.tmpml_playlists.lng
c:tempWLZC4CB.tmpml_plg.lng
c:tempWLZC4CB.tmpml_pmp.lng
c:tempWLZC4CB.tmpml_rg.lng
c:tempWLZC4CB.tmpml_transcode.lng
c:tempWLZC4CB.tmpml_wire.lng
c:tempWLZC4CB.tmpout_disk.lng
c:tempWLZC4CB.tmpout_ds.lng
c:tempWLZC4CB.tmpout_wave.lng
c:tempWLZC4CB.tmpplaylist.lng
c:tempWLZC4CB.tmppmp_activesync.lng
c:tempWLZC4CB.tmppmp_ipod.lng
c:tempWLZC4CB.tmppmp_njb.lng
c:tempWLZC4CB.tmppmp_p4s.lng
c:tempWLZC4CB.tmppmp_usb.lng
c:tempWLZC4CB.tmptagz.lng
c:tempWLZC4CB.tmpvis_avs.lng
c:tempWLZC4CB.tmpvis_avs_282.lng
c:tempWLZC4CB.tmpvis_milk.lng
c:tempWLZC4CB.tmpvis_milk2.lng
c:tempWLZC4CB.tmpvis_nsfs.lng
c:tempWLZC4CB.tmpwinamp.lng
d:њ®ё ¤®єг¬ґвлcc_20080708_2211.reg.
((((((((((((((((((((((((( Files Created from 2009-09-26 to 2009-10-26 )))))))))))))))))))))))))))))))
.2009-10-26 07:58 . 2009-10-26 08:05
d
w- c:tempWLZC4CB.tmp
2009-10-24 16:32 . 2009-10-24 16:32
d
w- c:program filesCommon FilesBioWare
2009-10-24 15:42 . 2004-03-02 11:37 125184
w- c:windowssystem32driversimagesrv.sys
2009-10-24 15:42 . 2004-03-02 11:37 5504
w- c:windowssystem32driversimagedrv.sys
2009-10-24 15:41 . 2000-06-26 05:45 106496 —-a-w- c:windowssystem32TwnLib20.dll
2009-10-24 15:41 . 2004-07-26 11:16 476320
w- c:windowssystem32ImagXpr7.dll
2009-10-24 15:41 . 2004-07-26 11:16 471040
w- c:windowssystem32ImagXRA7.dll
2009-10-24 15:41 . 2004-07-26 11:16 262144
w- c:windowssystem32ImagXR7.dll
2009-10-24 15:41 . 2004-07-26 11:16 1568768
w- c:windowssystem32ImagX7.dll
2009-10-24 15:41 . 2001-07-09 05:50 155648 —-a-w- c:windowssystem32NeroCheck.exe
2009-10-24 15:41 . 2009-10-24 15:41
d
w- c:program filesCommon FilesAhead
2009-10-24 15:41 . 2009-10-24 15:41
d
w- c:program filesAhead
2009-10-24 15:39 . 2009-10-24 15:39
d
w- c:tempapp_7EDA7873_temp
2009-10-24 15:33 . 2009-10-24 15:33
d
w- c:tempapp_20CC6F70_temp
2009-10-24 10:19 . 2009-10-24 10:26
d
w- c:program filesTotal Commander
2009-10-24 07:56 . 2009-10-26 08:04
d—h—w- c:tempNGLATempNokia
2009-10-23 15:37 . 2009-10-23 15:38
d
w- c:program filestotalcmd6
2009-10-23 15:08 . 2009-10-25 09:29
d
w- C:Downloads
2009-10-23 15:04 . 2009-10-24 11:26
d
w- C:USDownloader135
2009-10-23 07:45 . 2009-10-26 07:55
d
w- c:program filestrend micro
2009-10-23 07:45 . 2009-10-23 07:45
d
w- C:rsit
2009-10-21 08:14 . 2009-10-21 08:14
d
w- c:program filesISTool
2009-10-21 08:14 . 2009-10-21 08:14
d
w- c:documents and settingsAdminApplication DataISTool
2009-10-21 08:01 . 2009-10-21 08:01
d
w- c:program filesInno Setup 5
2009-10-14 16:33 . 2009-10-26 07:28
d
w- c:documents and settingsAdminApplication DataThe Bat!
2009-10-11 07:57 . 2009-10-11 07:57
d—h—w- c:windowsPIF
2009-10-06 12:53 . 2009-10-11 07:59
d
w- c:program filesmp3Tag 5
2009-10-06 05:41 . 2009-10-06 05:41
d
w- c:program filesTeleport.Backup
2009-10-06 05:36 . 2009-10-06 05:55
d
w- c:program filesTeleport Pro
2009-09-30 20:00 . 2009-09-30 20:00 55808 —-a-w- c:windowssystem32DevCon.exe
2009-09-30 20:00 . 2009-09-30 20:00 545 —-a-w- c:windowsUC.PIF
2009-09-30 20:00 . 2009-09-30 20:00 545 —-a-w- c:windowsRAR.PIF
2009-09-30 20:00 . 2009-09-30 20:00 545 —-a-w- c:windowsPKZIP.PIF
2009-09-30 20:00 . 2009-09-30 20:00 545 —-a-w- c:windowsPKUNZIP.PIF
2009-09-30 20:00 . 2009-09-30 20:00 545 —-a-w- c:windowsLHA.PIF
2009-09-30 20:00 . 2009-09-30 20:00 545 —-a-w- c:windowsARJ.PIF
2009-09-30 20:00 . 2009-09-30 20:00 24576 —-a-w- c:windowsNOCLOSE.PIF
2009-09-27 09:11 . 2009-09-27 09:11
d
w- c:documents and settingsAdminLocal SettingsApplication DataYandex
2009-09-27 09:09 . 2009-09-27 09:10
d
w- c:program filesCheMaxRus
2009-09-27 04:39 . 2009-09-27 04:39
d-sh—w- c:documents and settingsAll UsersApplication Data{55A29068-F2CE-456C-9148-C869879E2357}.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-26 08:05 . 2008-07-09 06:18
d
w- c:documents and settingsAdminApplication DatauTorrent
2009-10-26 08:01 . 2008-07-08 19:52
d
w- c:program filesDrWeb
2009-10-25 08:58 . 2008-04-15 12:00 84284 —-a-w- c:windowssystem32perfc019.dat
2009-10-25 08:58 . 2008-04-15 12:00 484670 —-a-w- c:windowssystem32perfh019.dat
2009-10-23 15:52 . 2008-07-08 16:35
d
w- c:program filesQIP
2009-10-23 14:20 . 2008-12-07 09:06
d
w- c:documents and settingsAdminApplication DataThinstall
2009-10-18 14:53 . 2008-07-09 06:15
d
w- c:program filesDownload Master
2009-10-14 09:58 . 2008-07-08 16:34
d—h—w- c:program filesInstallShield Installation Information
2009-10-13 13:33 . 2008-07-08 16:35
d
w- c:program filesThe Bat!
2009-10-11 16:39 . 2009-01-08 18:45
d
w- c:documents and settingsAdminApplication DataYandex
2009-10-11 08:01 . 2009-02-27 05:48
d
w- c:program filesuTorrentLP
2009-10-06 20:51 . 2008-07-09 06:15
d
w- c:documents and settingsAdminApplication DataDownload Master
2009-09-26 04:02 . 2008-12-07 09:09
d
w- c:documents and settingsAdminApplication DataAshampoo
2009-09-26 04:01 . 2009-09-26 04:01
d
w- c:documents and settingsAll UsersApplication Dataashampoo
2009-09-26 04:01 . 2009-09-26 04:01
d
w- c:program filesAshampoo
2009-09-22 16:21 . 2008-07-08 16:31
d
w- c:documents and settingsAll UsersApplication DataMicrosoft Help
2009-09-22 15:57 . 2008-07-12 06:23
d
w- c:documents and settingsAll UsersApplication DataNero
2009-09-17 12:47 . 2008-07-08 16:35
d
w- c:program filesCommon FilesWise Installation Wizard
2009-09-17 12:47 . 2008-07-11 09:42
d
w- c:program filesAGEIA Technologies
2009-09-17 02:12 . 2009-09-16 12:01
d
w- c:program filesUnlocker
2009-09-08 13:25 . 2008-07-08 16:38
d
w- c:program filesuTorrent
2009-09-08 13:25 . 2008-07-09 11:13
d
w- c:program filesMPEG Audio Collection
2009-09-08 13:25 . 2008-07-08 16:35
d
w- c:program filesSMSDV
2009-09-08 13:25 . 2009-03-11 17:23
d
w- c:program filesDreamSpell v1.2
2009-09-08 13:25 . 2009-02-10 13:42
d
w- c:program filesDCPRO
2009-09-08 13:25 . 2009-01-11 08:57
d
w- c:program filesfoobar2000
2009-08-30 13:10 . 2009-06-20 11:43
d
w- c:documents and settingsAdminApplication DataImgBurn
2009-08-20 16:50 . 2009-03-14 10:08 139152 —-a-w- c:documents and settingsAdminApplication DataPnkBstrK.sys
2009-08-20 16:50 . 2008-07-17 15:25 139152 —-a-w- c:windowssystem32driversPnkBstrK.sys
2009-08-20 16:49 . 2008-07-17 15:17 111928 —-a-w- c:windowssystem32PnkBstrB.exe
2009-08-20 16:49 . 2009-03-14 10:06 794408 —-a-w- c:windowssystem32pbsvc.exe
2009-08-20 16:49 . 2008-07-17 15:26 75064 —-a-w- c:windowssystem32PnkBstrA.exe
2009-08-10 13:30 . 2008-07-08 17:00 16608 —-a-w- c:windowsgdrv.sys
2009-04-07 06:43 . 2009-02-16 13:35 3260924 —-a-w- c:program filesuTorrent.rar
2009-03-24 18:54 . 2009-04-24 10:59 7977536 —-a-w- c:program filesFlylinkDC++378.rar
2009-03-24 18:43 . 2009-04-24 10:59 4656586 —-a-w- c:program filesFlylinkDC++.rar
2009-02-28 09:48 . 2009-02-28 09:48 216418 —-a-w- c:program filesD-Tools v3.40.rar
2009-02-17 09:54 . 2008-07-31 13:01 9220395 —-a-w- c:program filesTotal Commander.rar
2009-02-16 13:35 . 2009-02-16 13:35 584413 —-a-w- c:program filesuTorrent(Local).rar
2008-12-12 12:56 . 2008-12-12 12:56 1728549 —-a-w- c:program filesQIP.rar
2008-07-31 13:00 . 2008-07-31 13:00 4250229 —-a-w- c:program filesDownload Master.rar
2008-07-11 15:02 . 2008-07-11 15:02 23075353 —-a-w- c:program filestotalcmd6.rar
.
Sigcheck
[-] 2009-02-14 . 456E0F5B9BEB184521B0EE8FA7CC92C7 . 361600 . . [5.1.2600.5625] . . c:windowssystem32driverstcpip.sys
[-] 2008-06-21 . 030DC4D48CC2B894FEE2F390D8E66AD5 . 361344 . . [5.1.2600.5512] . . c:windows$NtUninstallKB951748$tcpip.sys
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:windows$hf_mig$KB951748SP3QFEtcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:windowssystem32dllcachetcpip.sys[-] 2008-06-21 . D1E6FF38AD08A56D55A422D3D08DF22D . 80728 . . [7.1.6001.65] . . c:windowssystem32wuauclt.exe
[-] 2008-06-21 . 23B7D3F3F5EC8FEEA75EC381C71CBD5E . 579072 . . [5.1.2600.5512] . . c:windowssystem32user32.dll
[-] 2008-06-21 . DBE9BB4018832ED71BC288B2A38F225B . 1721344 . . [6.00.2900.5512] . . c:windowsexplorer.exe
[-] 2008-06-21 . 8A76B647BF35E4C8230F69FAADABD977 . 1571840 . . [5.1.2600.5512] . . c:windowssystem32sfcfiles.dll
[-] 2008-06-21 . 53DB04AA692F9E906E46127AB7E83252 . 30208 . . [5.1.2600.5512] . . c:windowssystem32ctfmon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
«CDSlow»=»c:program filesCD Slow 2.4cdslow.exe» [2004-02-26 73728]
«DAEMON Tools Lite»=»c:program filesDAEMON Tools Litedaemon.exe» [2008-12-29 687560]
«PC Suite Tray»=»c:program filesNokiaNokia PC Suite 7PCSuite.exe» [2009-06-12 1414144][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«StartCCC»=»c:program filesATI TechnologiesATI.ACECore-StaticCLIStart.exe» [2006-11-10 90112]
«HydraVisionDesktopManager»=»c:program filesATI TechnologiesATI HYDRAVISIONHydraDM.exe» [2003-09-15 270336]
«SpIDerAgent»=»c:program filesDrWebSpIDerAgent.exe» [2008-12-17 697584]
«SpIDerMail»=»c:program filesDrWebspiderml.exe» [2008-12-12 627952]
«SpIDerGate»=»c:program filesDrWebspidergate.exe» [2008-12-15 1402096]
«SpIDerNT»=»c:progra~1DrWebspiderui.exe» [2008-12-09 197896]
«Acronis Scheduler2 Service»=»c:program filesCommon FilesAcronisSchedule2schedhlp.exe» [2008-11-04 165144]
«TrueImageMonitor.exe»=»c:program filesAcronisTrueImageHomeTrueImageMonitor.exe» [2008-11-04 4382376]
«AcronisTimounterMonitor»=»c:program filesAcronisTrueImageHomeTimounterMonitor.exe» [2008-11-04 962136]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2001-07-09 155648]
«RTHDCPL»=»RTHDCPL.EXE» — c:windowsRTHDCPL.EXE [2008-04-10 16861184][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-06-21 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» — c:windowssystem32advpack.dll [2008-12-20 124928]
«IE7_012″=»advpack.dll» — c:windowssystem32advpack.dll [2008-12-20 124928]c:documents and settingsAdminѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
зTorrent.lnk — c:program filesuTorrentutorrent.exe [2008-1-27 270128]c:documents and settingsAdminѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
зTorrent.lnk — c:program filesuTorrentutorrent.exe [2008-1-27 270128]c:documents and settingsAdminѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
зTorrent.lnk — c:program filesuTorrentutorrent.exe [2008-1-27 270128]c:documents and settingsAll Usersѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
Total Commander.lnk — c:program filesTotal CommanderTotalcmd.exe [2009-10-1 3520256]c:documents and settingsAdminѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
зTorrent.lnk — c:program filesuTorrentutorrent.exe [2008-1-27 270128][HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)
«NoAddPrinter»= 1 (0x1)
«NoSMHelp»= 1 (0x1)[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetcontrolsession manager]
BootExecute REG_MULTI_SZ autocheck autochk *OODBS[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalWdf01000.sys]
@=»Driver»[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionrun-]
«KillCopy»=c:program filesKillSoftKillCopykcresume.exe /startup[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusOverride»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\uTorrent\utorrent.exe»=
«e:\_Local\soft\utorrent 1.8.2.14458.exe»=
«c:\Program Files\uTorrentLP\utorrent_original.exe»=
«c:\Program Files\uTorrentLP\utorrent_noreport.exe»=
«c:\Program Files\uTorrent\utorrent_noreport.exe»=
«c:\Program Files\uTorrentLP\utorrent_mult100_leecher.exe»=
«c:\Program Files\uTorrent\utorrent_original.exe»=
«c:\Program Files\uTorrent\utorrent_mult10_seeder.exe»=
«c:\Program Files\uTorrent\utorrent_report.exe»=
«c:\Program Files\uTorrentLP\utorrent_fake2x_seeder.exe»=
«c:\WINDOWS\system32\PnkBstrA.exe»=
«c:\WINDOWS\system32\PnkBstrB.exe»=
«e:\Program Files\Activision\Wolfenstein\MP\Wolf2MP.exe»=
«e:\Program Files\Activision\Wolfenstein\MP\Wolf2MPLite.exe»=
«c:\Program Files\uTorrentLP\utorrent_stealth.exe»=
«e:\games\Dragon Age Origins Character Creator\bin_ship\DAOCharacterCreator.exe»=
«e:\games\Dragon Age Origins Character Creator\DAOriginsLauncher.exe»=[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«26060:TCP»= 26060:TCP:BitComet 26060 TCP
«26060:UDP»= 26060:UDP:BitComet 26060 UDPR0 DwProt;DrWeb Protection;c:windowssystem32driversdwprot.sys [10.01.2009 19:15 98168]
R0 prohlp01;StarForce Protection Helper Driver v1;c:windowssystem32driversprohlp01.sys [26.12.2002 19:20 61728]
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:windowssystem32driverssfsync03.sys [06.12.2005 20:11 35328]
R0 snapman380;Acronis Snapshots Manager (Build 380);c:windowssystem32driverssnman380.sys [21.02.2009 2:09 134272]
R0 tdrpman147;Acronis Try&Decide and Restore Points filter (build 147);c:windowssystem32driverstdrpm147.sys [21.02.2009 2:09 971232]
R1 appdrv01;Application Driver (01);c:windowssystem32driversappdrv01.sys [27.04.2009 19:49 3110512]
R1 prodrv05;StarForce Protection Environment Driver v5;c:windowssystem32driversprodrv05.sys [26.12.2002 19:14 53568]
R1 VBoxDrv;VirtualBox Service;c:windowssystem32driversVBoxDrv.sys [14.03.2009 13:53 100560]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:windowssystem32driversVBoxUSBMon.sys [14.03.2009 13:53 41744]
R2 DrWebEngine;Dr.Web ® Scanning Engine (DrWebEngine);c:program filesCommon FilesDoctor WebScanning Enginedwengine.exe [17.10.2008 13:26 869688]
R2 SPIDER;SpIDer Guard File System Monitor;c:progra~1DrWebspider.sys [09.12.2008 13:28 268328]
R2 SPIDERNT;SpIDer Guard for Windows;c:progra~1DrWebspidernt.exe [09.12.2008 13:28 197896]
R2 TTFixerService;NST ToolTipFixer;c:program filesNeoSmart TechnologiesToolTipFixerToolTipFixer.exe [27.06.2007 10:20 10240]
R3 FStarForce;FStarForce;c:windowssystem32driversFStarForce.sys [28.02.2009 14:37 8704]
R3 VBoxNetFlt;VBoxNetFlt Service;c:windowssystem32driversVBoxNetFlt.sys [14.03.2009 13:53 87568]
S2 appdrvrem01;Application Driver Auto Removal Service (01);c:windowsSystem32appdrvrem01.exe svc —> c:windowsSystem32appdrvrem01.exe svc [?]
S2 sfrem02;FrontLine Drivers Auto Removal (v2);c:windowssystem32sfrem02.exe svc —> c:windowssystem32sfrem02.exe svc [?]
S3 GEST Service;GEST Service for program management.;c:program filesGIGABYTEGESTGSvr.exe [08.07.2008 22:02 47624]— Other Services/Drivers In Memory —
*Deregistered* — mbr
[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled components{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
«c:program filesCommon FilesLightScribeLSRunOnce.exe»
.
Contents of the ‘Scheduled Tasks’ folder2009-10-23 c:windowsTasks1-Click Maintenance.job
— c:program filesTuneUp Utilities 2006SystemOptimizer.exe [2005-09-21 08:38]
.
.
Supplementary Scan
.
uStart Page = hxxp://www.ya.ru/
uInternet Settings,ProxyOverride = *.local
IE: &ICQ Toolbar Search — c:program filesICQToolbartoolbaru.dll/SEARCH.HTML
IE: &Перевести — c:program filesArsenal CompanySOCRAT InternetHTMLWSocrat.js
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~1Office12EXCEL.EXE/3000
IE: Download with Rapget — c:rapget140rapget.htm
IE: Добавить страницу в URL-Album — c:program filesURL-Albumua.htm
IE: Закачать ВСЕ при помощи Download Master — c:program filesDownload Masterdmieall.htm
IE: Закачать при помощи Download Master — c:program filesDownload Masterdmie.htm
IE: Передать на удаленную закачку DM — c:program filesDownload Masterremdown.htm
IE: Скачать при помощи USDownloader’а — c:usdownloader135Extdownloadie.html
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe
IE: {{17FA5CD6-5737-45c2-B194-74C8A4A7F7E7} — {7E1F0737-53A5-4EDC-8734-DD94B50AAF83} — c:program filesArsenal CompanySOCRAT InternetSocratInternet.dll
IE: {{DFDC8970-FD66-4385-B8C0-835A4AA1DA00} — {A3400175-12F9-4220-83BF-A7210CA4003E} — c:program filesArsenal CompanySOCRAT InternetSocratInternet.dll
LSP: c:program filesDrWebdrwebsp.dll
TCP: {600F14BB-6B06-4DE6-86C2-011E5A68679A} = 89.189.129.66
FF — ProfilePath — c:documents and settingsAdminApplication DataMozillaFirefoxProfiles2s288ejl.default
FF — prefs.js: browser.search.defaulturl — hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1210541&SearchSource=3&q=
FF — prefs.js: browser.search.selectedEngine — Web Search
FF — prefs.js: browser.startup.homepage — hxxp://ya.ru/
FF — prefs.js: keyword.URL — hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=
FF — component: c:program filesNokiaNokia PC Suite 7bkmrksynccomponentsBkMrkExt.dll
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnppl3260.dll
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnprpjplug.dll
FF — plugin: c:program filesMozilla Firefoxpluginsnpdm.dll
FF — plugin: c:program filesOpera8programpluginsnpdm.dll
FF — plugin: c:program filesOpera8programpluginsnpdsplay.dll
FF — plugin: c:program filesOpera8programpluginsNPOFF12.DLL
FF — plugin: c:program filesOpera8programpluginsnppl3260.dll
FF — plugin: c:program filesOpera8programpluginsnprpjplug.dll
FF — plugin: c:program filesOpera8programpluginsNPSWF32.dll
FF — plugin: c:program filesOpera8programpluginsnpwmsdrm.dll—- FIREFOX POLICIES —-
FF — user.js: network.http.max-persistent-connections-per-server — 4
FF — user.js: content.max.tokenizing.time — 200000
FF — user.js: content.notify.interval — 100000
FF — user.js: content.switch.threshold — 650000
FF — user.js: nglayout.initialpaint.delay — 300
.**************************************************************************
catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-26 13:07
Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(976)
c:windowssystem32SETUPAPI.dll
c:windowssystem32Ati2evxx.dll
c:windowssystem32cscui.dll
c:windowssystem32COMRes.dll— — — — — — — > ‘lsass.exe'(1032)
c:windowssystem32setupapi.dll
c:program filesDrWebdrwebsp.dll— — — — — — — > ‘explorer.exe'(3028)
c:program filesATI TechnologiesATI HYDRAVISIONHydraDMH.dll
c:windowssystem32COMRes.dll
c:windowsSystem32cscui.dll
c:windowssystem32NETSHELL.dll
c:windowssystem32msi.dll
c:program filesCommon FilesMicrosoft SharedOFFICE12MSOXEV.DLL
c:windowssystem32wpdshserviceobj.dll
c:windowssystem32SETUPAPI.dll
c:program filesNokiaNokia PC Suite 7PhoneBrowser.dll
c:program filesNokiaNokia PC Suite 7NGSCM.DLL
c:program filesNokiaNokia PC Suite 7LangPhoneBrowser_rus.nlr
c:program filesNokiaNokia PC Suite 7ResourcePhoneBrowser_Nokia.ngr
c:windowssystem32portabledevicetypes.dll
c:windowssystem32portabledeviceapi.dll
.
Other Running Processes
.
c:windowssystem32Ati2evxx.exe
c:windowssystem32Ati2evxx.exe
c:program filesCommon FilesAcronisSchedule2schedul2.exe
c:program filesCommon FilesLightScribeLSSrvc.exe
c:windowssystem32oodag.exe
c:windowssystem32PnkBstrA.exe
c:combofixCF10026.exe
c:combofixhidec.exe
c:program filesATI TechnologiesATI.ACECore-StaticMOM.EXE
c:program filesATI TechnologiesATI.ACECore-Staticccc.exe
c:program filesPC Connectivity SolutionServiceLayer.exe
c:program filesPC Connectivity SolutionTransportsNclUSBSrv.exe
c:program filesPC Connectivity SolutionTransportsNclRSSrv.exe
c:combofixmbr.cfxxe
c:combofixPEV.cfxxe
.
**************************************************************************
.
Completion time: 2009-10-26 13:13 — machine was rebooted
ComboFix-quarantined-files.txt 2009-10-26 08:12
ComboFix2.txt 2009-10-14 10:28Pre-Run: 2 153 705 472 байт свободно
Post-Run: 2 147 438 592 байт свободно— — End Of File — — 5EC11018F182B6C3010D116D37584868
логи делал не Комбофиксом, а «rsit»
лог через RSIT:
Logfile of random’s system information tool 1.06 (written by random/random)
Run by Admin at 2009-10-26 12:55:30
Microsoft Windows XP Professional Service Pack 3
System drive C: has 2 GB (21%) free of 10 GB
Total RAM: 2046 MB (64% free)Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:55:33, on 26.10.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20978)
Boot mode: NormalRunning processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:Program FilesCommon FilesAcronisSchedule2schedul2.exe
C:Program FilesCommon FilesDoctor WebScanning Enginedwengine.exe
C:Program FilesCommon FilesLightScribeLSSrvc.exe
C:WINDOWSsystem32oodag.exe
C:WINDOWSsystem32PnkBstrA.exe
C:PROGRA~1DrWebspidernt.exe
C:Program FilesATI TechnologiesATI HYDRAVISIONHydraDM.exe
C:Program FilesATI TechnologiesATI.ACECore-StaticMOM.EXE
C:WINDOWSsystem32svchost.exe
C:WINDOWSRTHDCPL.EXE
C:Program FilesNeoSmart TechnologiesToolTipFixerToolTipFixer.exe
C:Program FilesDrWebSpIDerAgent.exe
C:Program FilesDrWebspiderml.exe
C:Program FilesATI TechnologiesATI.ACECore-Staticccc.exe
C:Program FilesDrWebspidergate.exe
C:PROGRA~1DrWebspiderui.exe
C:Program FilesCommon FilesAcronisSchedule2schedhlp.exe
C:Program FilesAcronisTrueImageHomeTrueImageMonitor.exe
C:Program FilesAcronisTrueImageHomeTimounterMonitor.exe
C:Program FilesVistaDriveIconVistaDrv.exe
C:Program FilesCD Slow 2.4cdslow.exe
C:Program FilesDAEMON Tools Litedaemon.exe
C:Program FilesNokiaNokia PC Suite 7PCSuite.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesTotal CommanderTotalcmd.exe
C:Program FilesuTorrentutorrent.exe
C:Program FilesPC Connectivity SolutionServiceLayer.exe
C:Program FilesPC Connectivity SolutionTransportsNclUSBSrv.exe
C:Program FilesPC Connectivity SolutionTransportsNclRSSrv.exe
C:Program FilesMozilla Firefoxfirefox.exe
E:_ВнешкасофтRSIT.exe
C:Program Filestrend microAdmin.exeR0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.ya.ru/
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *.local
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: (no name) — — (no file)
O1 — Hosts: 127.255.255.255 serial.alcohol-soft.com
O2 — BHO: SnagIt Toolbar Loader — {00C6482D-C502-44C8-8409-FCE54AD9C208} — C:Program FilesTechSmithSnagIt 8SnagItBHO.dll
O2 — BHO: SSVHelper Class — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — C:Program FilesJavajre1.6.0_06binssv.dll
O2 — BHO: IE 4.x-6.x BHO for Download Master — {9961627E-4059-41B4-8E0E-A7D6B3854ADF} — C:PROGRA~1DOWNLO~1dmiehlp.dll
O3 — Toolbar: SnagIt — {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} — C:Program FilesTechSmithSnagIt 8SnagItIEAddin.dll
O3 — Toolbar: DM Bar — {0E1230F8-EA50-42A9-983C-D22ABC2EED3C} — C:Program FilesDownload Masterdmbar.dll
O4 — HKLM..Run: [StartCCC] «C:Program FilesATI TechnologiesATI.ACECore-StaticCLIStart.exe»
O4 — HKLM..Run: [HydraVisionDesktopManager] C:Program FilesATI TechnologiesATI HYDRAVISIONHydraDM.exe
O4 — HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 — HKLM..Run: [SpIDerAgent] «C:Program FilesDrWebSpIDerAgent.exe»
O4 — HKLM..Run: [SpIDerMail] «C:Program FilesDrWebspiderml.exe»
O4 — HKLM..Run: [SpIDerGate] «C:Program FilesDrWebspidergate.exe» -autorun
O4 — HKLM..Run: [SpIDerNT] C:PROGRA~1DrWebspiderui.exe /agent
O4 — HKLM..Run: [Acronis Scheduler2 Service] «C:Program FilesCommon FilesAcronisSchedule2schedhlp.exe»
O4 — HKLM..Run: [TrueImageMonitor.exe] C:Program FilesAcronisTrueImageHomeTrueImageMonitor.exe
O4 — HKLM..Run: [AcronisTimounterMonitor] C:Program FilesAcronisTrueImageHomeTimounterMonitor.exe
O4 — HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 — HKCU..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe
O4 — HKCU..Run: [CDSlow] c:Program FilesCD Slow 2.4cdslow.exe
O4 — HKCU..Run: [DAEMON Tools Lite] «C:Program FilesDAEMON Tools Litedaemon.exe» -autorun
O4 — HKCU..Run: [PC Suite Tray] «C:Program FilesNokiaNokia PC Suite 7PCSuite.exe» -onlytray
O4 — HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,NewUserFirstLogonInstall,0 (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — HKUS.DEFAULT..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,NewUserFirstLogonInstall,0 (User ‘Default user’)
O4 — S-1-5-18 Startup: µTorrent.lnk = C:Program FilesuTorrentutorrent.exe (User ‘SYSTEM’)
O4 — .DEFAULT Startup: µTorrent.lnk = C:Program FilesuTorrentutorrent.exe (User ‘Default user’)
O4 — Startup: µTorrent.lnk = C:Program FilesuTorrentutorrent.exe
O4 — Global Startup: Total Commander.lnk = C:Program FilesTotal CommanderTotalcmd.exe
O8 — Extra context menu item: &ICQ Toolbar Search — res://C:Program FilesICQToolbartoolbaru.dll/SEARCH.HTML
O8 — Extra context menu item: &Перевести — C:Program FilesArsenal CompanySOCRAT InternetHTMLWSocrat.js
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~1Office12EXCEL.EXE/3000
O8 — Extra context menu item: Download with Rapget — C:rapget140rapget.htm
O8 — Extra context menu item: Добавить страницу в URL-Album — C:Program FilesURL-Albumua.htm
O8 — Extra context menu item: Закачать ВСЕ при помощи Download Master — C:Program FilesDownload Masterdmieall.htm
O8 — Extra context menu item: Закачать при помощи Download Master — C:Program FilesDownload Masterdmie.htm
O8 — Extra context menu item: Передать на удаленную закачку DM — C:Program FilesDownload Masterremdown.htm
O8 — Extra context menu item: Скачать при помощи USDownloader’а — c:USDownloader135Extdownloadie.html
O9 — Extra button: (no name) — DctMapping — (no file)
O9 — Extra button: (no name) — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_06binssv.dll
O9 — Extra ‘Tools’ menuitem: Sun Java Console — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_06binssv.dll
O9 — Extra button: СОКРАТ Интернет 3.0 — {17FA5CD6-5737-45c2-B194-74C8A4A7F7E7} — C:Program FilesArsenal CompanySOCRAT InternetSocratInternet.dll
O9 — Extra button: Настройки СОКРАТ Интернет 3.0 — {71F65890-5ED6-11d4-9665-00E02962D81A} — C:Program FilesArsenal CompanySOCRAT InternetSocratInternetT.dll
O9 — Extra button: Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
O9 — Extra ‘Tools’ menuitem: &Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
O9 — Extra button: Research — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~1Office12REFIEBAR.DLL
O9 — Extra button: ICQ Lite — {B863453A-26C3-4e1f-A54D-A2CD196348E9} — C:Program FilesICQLiteICQLite.exe (file missing)
O9 — Extra ‘Tools’ menuitem: ICQ Lite — {B863453A-26C3-4e1f-A54D-A2CD196348E9} — C:Program FilesICQLiteICQLite.exe (file missing)
O9 — Extra button: Перевести страницу — {DFDC8970-FD66-4385-B8C0-835A4AA1DA00} — C:Program FilesArsenal CompanySOCRAT InternetSocratInternet.dll
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra button: Добавить страницу в URL-Album — {4D9BEE60-F894-11D4-9B21-AD4030B75053} — C:Program FilesURL-Albumua.htm (HKCU)
O9 — Extra button: (no name) — {4D9BEE60-F894-11D4-9B21-AD4030B75054} — C:Program FilesURL-Albumurlalbum.exe (HKCU)
O9 — Extra ‘Tools’ menuitem: Открыть URL-Album — {4D9BEE60-F894-11D4-9B21-AD4030B75054} — C:Program FilesURL-Albumurlalbum.exe (HKCU)
O17 — HKLMSystemCCSServicesTcpip..{600F14BB-6B06-4DE6-86C2-011E5A68679A}: NameServer = 89.189.129.66
O17 — HKLMSystemCCSServicesTcpip..{9A403CC4-D556-4C9A-BEB0-886B954517A3}: NameServer = 89.189.129.66 81.30.199.5
O17 — HKLMSystemCCSServicesTcpip..{9C943852-211E-49E0-9D16-39D1C9737A46}: NameServer = 89.189.129.66 81.30.199.5
O23 — Service: Acronis Scheduler2 Service (AcrSch2Svc) — Acronis — C:Program FilesCommon FilesAcronisSchedule2schedul2.exe
O23 — Service: Adobe LM Service — Unknown owner — C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe
O23 — Service: Application Driver Auto Removal Service (01) (appdrvrem01) — Protection Technology — C:WINDOWSSystem32appdrvrem01.exe
O23 — Service: Ati HotKey Poller — ATI Technologies Inc. — C:WINDOWSsystem32Ati2evxx.exe
O23 — Service: ATI Smart — Unknown owner — C:WINDOWSsystem32ati2sgag.exe
O23 — Service: Dr.Web ® Scanning Engine (DrWebEngine) (DrWebEngine) — Doctor Web, Ltd. — C:Program FilesCommon FilesDoctor WebScanning Enginedwengine.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: GEST Service for program management. (GEST Service) — Unknown owner — C:Program FilesGIGABYTEGESTGSvr.exe
O23 — Service: InstallDriver Table Manager (IDriverT) — Macrovision Corporation — C:Program FilesCommon FilesInstallShieldDriver1150Intel 32IDriverT.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: LightScribeService Direct Disc Labeling Service (LightScribeService) — Hewlett-Packard Company — C:Program FilesCommon FilesLightScribeLSSrvc.exe
O23 — Service: MSCSPTISRV — Sony Corporation — C:Program FilesCommon FilesSony SharedAVLibMSCSPTISRV.exe
O23 — Service: O&O Defrag — O&O Software GmbH — C:WINDOWSsystem32oodag.exe
O23 — Service: PACSPTISVR — Unknown owner — C:Program FilesCommon FilesSony SharedAVLibPACSPTISVR.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: PnkBstrA — Unknown owner — C:WINDOWSsystem32PnkBstrA.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: ServiceLayer — Nokia. — C:Program FilesPC Connectivity SolutionServiceLayer.exe
O23 — Service: FrontLine Drivers Auto Removal (v2) (sfrem02) — Protection Technology (StarForce) — C:WINDOWSsystem32sfrem02.exe
O23 — Service: SonicStage Back-End Service — Sony Corporation — C:Program FilesCommon FilesSony SharedAVLibSsBeSvc.exe
O23 — Service: SpIDer Guard for Windows (SPIDERNT) — Doctor Web, Ltd. — C:PROGRA~1DrWebspidernt.exe
O23 — Service: Sony SPTI Service (SPTISRV) — Sony Corporation — C:Program FilesCommon FilesSony SharedAVLibSPTISRV.exe
O23 — Service: SonicStage SCSI Service (SSScsiSV) — Sony Corporation — C:Program FilesCommon FilesSony SharedAVLibSSScsiSV.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: NST ToolTipFixer (TTFixerService) — NeoSmart Technologies — C:Program FilesNeoSmart TechnologiesToolTipFixerToolTipFixer.exe
O23 — Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) — TuneUp Software GmbH — C:Program FilesTuneUp Utilities 2006WinStylerThemeSvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe—
End of file — 12750 bytes======Scheduled tasks folder======
C:WINDOWStasks1-Click Maintenance.job
======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{00C6482D-C502-44C8-8409-FCE54AD9C208}]
SnagIt Toolbar Loader — C:Program FilesTechSmithSnagIt 8SnagItBHO.dll [2007-05-01 63048][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class — C:Program FilesJavajre1.6.0_06binssv.dll [2008-03-25 509328][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9961627E-4059-41B4-8E0E-A7D6B3854ADF}]
IE 4.x-6.x BHO for Download Master — C:PROGRA~1DOWNLO~1dmiehlp.dll [2009-04-16 158208][HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} — SnagIt — C:Program FilesTechSmithSnagIt 8SnagItIEAddin.dll [2007-05-01 161352]
{0E1230F8-EA50-42A9-983C-D22ABC2EED3C} — DM Bar — C:Program FilesDownload Masterdmbar.dll [2007-11-26 180224][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«StartCCC»=C:Program FilesATI TechnologiesATI.ACECore-StaticCLIStart.exe [2006-11-10 90112]
«HydraVisionDesktopManager»=C:Program FilesATI TechnologiesATI HYDRAVISIONHydraDM.exe [2003-09-15 270336]
«RTHDCPL»=C:WINDOWSRTHDCPL.EXE [2008-04-10 16861184]
«SpIDerAgent»=C:Program FilesDrWebSpIDerAgent.exe [2008-12-17 697584]
«SpIDerMail»=C:Program FilesDrWebspiderml.exe [2008-12-12 627952]
«SpIDerGate»=C:Program FilesDrWebspidergate.exe [2008-12-15 1402096]
«SpIDerNT»=C:PROGRA~1DrWebspiderui.exe [2008-12-09 197896]
«Acronis Scheduler2 Service»=C:Program FilesCommon FilesAcronisSchedule2schedhlp.exe [2008-11-04 165144]
«TrueImageMonitor.exe»=C:Program FilesAcronisTrueImageHomeTrueImageMonitor.exe [2008-11-04 4382376]
«AcronisTimounterMonitor»=C:Program FilesAcronisTrueImageHomeTimounterMonitor.exe [2008-11-04 962136]
«NeroFilterCheck»=C:WINDOWSsystem32NeroCheck.exe [2001-07-09 155648][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«VistaIcon»=C:Program FilesVistaDriveIconVistaDrv.exe [2008-01-02 132096]
«CDSlow»=c:Program FilesCD Slow 2.4cdslow.exe [2004-02-27 73728]
«DAEMON Tools Lite»=C:Program FilesDAEMON Tools Litedaemon.exe [2008-12-29 687560]
«PC Suite Tray»=C:Program FilesNokiaNokia PC Suite 7PCSuite.exe [2009-06-12 1414144]
«ctfmon.exe»=C:WINDOWSsystem32ctfmon.exe [2008-06-21 30208][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAcronis Scheduler2 Service]
C:Program FilesCommon FilesAcronisSchedule2schedhlp.exe [2008-11-04 165144][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAcronis True Image Monitor]
C:Program FilesAcronisTrueImageTrueImageMonitor.exe [][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregBluetoothAuthenticationAgent]
bthprops.cpl,,BluetoothAuthenticationAgent []C:Documents and SettingsAll UsersГлавное менюПрограммыАвтозагрузка
Total Commander.lnk — C:Program FilesTotal CommanderTotalcmd.exeC:Documents and SettingsAdminГлавное менюПрограммыАвтозагрузка
µTorrent.lnk — C:Program FilesuTorrentutorrent.exe[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyAtiExtEvent]
C:WINDOWSsystem32Ati2evxx.dll [2007-11-02 122880][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32wpdshserviceobj.dll [2008-03-02 133632][HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalWdf01000.sys]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkWdf01000.sys]
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1
«EnableLUA»=0[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=323
«NoSharedDocuments»=1
«NoSMConfigurePrograms»=1
«NoInstrumentation»=0
«NoAddPrinter»=1
«NoSMHelp»=1
«NoDriveAutoRun»=67108863
«NoDrives»=0[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=
«NoDriveAutoRun»=
«NoDrives»=[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesuTorrentutorrent.exe»=»C:Program FilesuTorrentutorrent.exe:*:Enabled:µTorrent»
«E:_Localsoftutorrent 1.8.2.14458.exe»=»E:_Localsoftutorrent 1.8.2.14458.exe:*:Enabled:µTorrent»
«C:Program FilesuTorrentLPutorrent_original.exe»=»C:Program FilesuTorrentLPutorrent_original.exe:*:Enabled:µTorrent»
«C:Program FilesuTorrentLPutorrent_noreport.exe»=»C:Program FilesuTorrentLPutorrent_noreport.exe:*:Enabled:µTorrent»
«C:Program FilesuTorrentutorrent_noreport.exe»=»C:Program FilesuTorrentutorrent_noreport.exe:*:Enabled:µTorrent»
«C:Program FilesuTorrentLPutorrent_mult100_leecher.exe»=»C:Program FilesuTorrentLPutorrent_mult100_leecher.exe:*:Enabled:µTorrent»
«C:Program FilesuTorrentutorrent_original.exe»=»C:Program FilesuTorrentutorrent_original.exe:*:Enabled:µTorrent»
«C:Program FilesuTorrentutorrent_mult10_seeder.exe»=»C:Program FilesuTorrentutorrent_mult10_seeder.exe:*:Enabled:µTorrent»
«C:Program FilesuTorrentutorrent_report.exe»=»C:Program FilesuTorrentutorrent_report.exe:*:Enabled:µTorrent»
«C:Program FilesuTorrentLPutorrent_fake2x_seeder.exe»=»C:Program FilesuTorrentLPutorrent_fake2x_seeder.exe:*:Enabled:µTorrent»
«C:WINDOWSsystem32PnkBstrA.exe»=»C:WINDOWSsystem32PnkBstrA.exe:*:Enabled:PnkBstrA»
«C:WINDOWSsystem32PnkBstrB.exe»=»C:WINDOWSsystem32PnkBstrB.exe:*:Enabled:PnkBstrB»
«E:Program FilesActivisionWolfensteinMPWolf2MP.exe»=»E:Program FilesActivisionWolfensteinMPWolf2MP.exe:*:Enabled:Wolfenstein(TM)»
«E:Program FilesActivisionWolfensteinMPWolf2MPLite.exe»=»E:Program FilesActivisionWolfensteinMPWolf2MPLite.exe:*:Enabled:Wolfenstein(TM)»
«C:Program FilesuTorrentLPutorrent_stealth.exe»=»C:Program FilesuTorrentLPutorrent_stealth.exe:*:Enabled:µTorrent»
«E:gamesDragon Age Origins Character Creatorbin_shipDAOCharacterCreator.exe»=»E:gamesDragon Age Origins Character Creatorbin_shipDAOCharacterCreator.exe:*:Enabled:Конструктор персонажей Dragon Age Начало»
«E:gamesDragon Age Origins Character CreatorDAOriginsLauncher.exe»=»E:gamesDragon Age Origins Character CreatorDAOriginsLauncher.exe:*:Enabled:Конструктор персонажей Dragon Age Начало Запуск»[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»======List of files/folders created in the last 1 months======
2009-10-24 21:32:18 —-D—- C:Program FilesCommon FilesBioWare
2009-10-24 20:41:51 —-A—- C:WINDOWSsystem32TwnLib20.dll
2009-10-24 20:41:50 —-N—- C:WINDOWSsystem32ImagXRA7.dll
2009-10-24 20:41:50 —-N—- C:WINDOWSsystem32ImagXR7.dll
2009-10-24 20:41:50 —-N—- C:WINDOWSsystem32ImagXpr7.dll
2009-10-24 20:41:50 —-N—- C:WINDOWSsystem32ImagX7.dll
2009-10-24 20:41:48 —-A—- C:WINDOWSsystem32NeroCheck.exe
2009-10-24 20:41:43 —-D—- C:Program FilesCommon FilesAhead
2009-10-24 20:41:42 —-D—- C:Program FilesAhead
2009-10-24 15:19:06 —-D—- C:Program FilesTotal Commander
2009-10-23 20:37:46 —-D—- C:Program Filestotalcmd6
2009-10-23 20:08:40 —-D—- C:Downloads
2009-10-23 20:04:44 —-D—- C:USDownloader135
2009-10-23 12:45:39 —-D—- C:Program Filestrend micro
2009-10-23 12:45:38 —-D—- C:rsit
2009-10-21 13:14:09 —-D—- C:Program FilesISTool
2009-10-21 13:14:09 —-D—- C:Documents and SettingsAdminApplication DataISTool
2009-10-21 13:01:25 —-D—- C:Program FilesInno Setup 5
2009-10-19 16:22:50 —-SHD—- C:RECYCLER
2009-10-14 21:33:08 —-D—- C:Documents and SettingsAdminApplication DataThe Bat!
2009-10-14 15:28:50 —-D—- C:WINDOWStemp
2009-10-14 15:28:49 —-A—- C:ComboFix.txt
2009-10-14 15:15:00 —-D—- C:WINDOWSERDNT
2009-10-14 15:00:14 —-A—- C:logit.txt
2009-10-11 12:57:15 —-HD—- C:WINDOWSPIF
2009-10-06 17:53:17 —-D—- C:Program Filesmp3Tag 5
2009-10-06 10:54:50 —-A—- C:WINDOWSpro.INI
2009-10-06 10:41:11 —-D—- C:Program FilesTeleport.Backup
2009-10-06 10:36:44 —-D—- C:Program FilesTeleport Pro
2009-10-04 00:04:59 —-A—- C:WINDOWSboxworld.ini
2009-10-01 01:00:00 —-A—- C:WINDOWSsystem32DevCon.exe
2009-09-27 14:09:58 —-D—- C:Program FilesCheMaxRus
2009-09-27 09:39:29 —-SHD—- C:Documents and SettingsAll UsersApplication Data{55A29068-F2CE-456C-9148-C869879E2357}======List of files/folders modified in the last 1 months======
2009-10-26 12:55:30 —-D—- C:Temp
2009-10-26 12:55:05 —-D—- C:Documents and SettingsAdminApplication DatauTorrent
2009-10-26 12:51:48 —-D—- C:Program FilesMozilla Firefox
2009-10-26 12:49:27 —-D—- C:WINDOWSsystem32CatRoot2
2009-10-26 05:07:14 —-A—- C:WINDOWSSchedLgU.Txt
2009-10-25 13:58:21 —-D—- C:WINDOWSsystem32
2009-10-25 13:58:21 —-A—- C:WINDOWSsystem32PerfStringBackup.INI
2009-10-25 13:54:32 —-D—- C:WINDOWS
2009-10-25 08:15:17 —-D—- C:WINDOWSsystem32config
2009-10-24 21:32:18 —-D—- C:Program FilesCommon Files
2009-10-24 21:32:16 —-HD—- C:WINDOWSinf
2009-10-24 21:31:53 —-RSD—- C:WINDOWSassembly
2009-10-24 21:31:30 —-D—- C:WINDOWSsystem32DirectX
2009-10-24 21:31:26 —-SHD—- C:WINDOWSInstaller
2009-10-24 21:31:25 —-D—- C:WINDOWSWinSxS
2009-10-24 20:42:08 —-D—- C:WINDOWSsystem32drivers
2009-10-24 20:41:42 —-RD—- C:Program Files
2009-10-23 20:52:21 —-D—- C:Program FilesQIP
2009-10-23 20:37:50 —-D—- C:Program FilesDrWeb
2009-10-21 13:55:59 —-RSHDC—- C:WINDOWSsystem32dllcache
2009-10-19 16:22:53 —-D—- C:WINDOWSsystem32Restore
2009-10-18 19:53:23 —-D—- C:Program FilesDownload Master
2009-10-14 21:31:47 —-SHD—- C:System Volume Information
2009-10-14 15:26:07 —-A—- C:WINDOWSsystem.ini
2009-10-14 15:22:20 —-D—- C:WINDOWSAppPatch
2009-10-14 14:58:53 —-HD—- C:Program FilesInstallShield Installation Information
2009-10-13 18:33:00 —-D—- C:Program FilesThe Bat!
2009-10-11 21:39:04 —-D—- C:Documents and SettingsAdminApplication DataYandex
2009-10-11 14:35:09 —-D—- C:Documents and SettingsAll UsersApplication DataAdobe
2009-10-11 14:33:28 —-D—- C:Documents and SettingsAdminApplication DataAdobe
2009-10-11 13:01:17 —-D—- C:Program FilesuTorrentLP
2009-10-07 01:51:52 —-D—- C:Documents and SettingsAdminApplication DataDownload Master
2009-10-02 12:46:38 —-A—- C:Documents and SettingsAdminApplication Dataex_log.txt======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 appdrv01;Application Driver (01); C:WINDOWSSystem32Driversappdrv01.sys [2009-04-27 3110512]
R1 ASPI32;ASPI32; C:WINDOWSsystem32driversASPI32.sys [1999-09-10 25244]
R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2008-04-15 40704]
R1 prodrv05;StarForce Protection Environment Driver v5; C:WINDOWSSystem32driversprodrv05.sys [2002-12-26 53568]
R1 prodrv06;StarForce Protection Environment Driver v6; C:WINDOWSSystem32driversprodrv06.sys [2003-09-06 51744]
R1 VBoxDrv;VirtualBox Service; C:WINDOWSsystem32DRIVERSVBoxDrv.sys [2009-02-16 100560]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver; C:WINDOWSsystem32DRIVERSVBoxUSBMon.sys [2009-02-16 41744]
R1 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:WINDOWSSystem32driversws2ifsl.sys [2008-04-15 12032]
R2 atksgt;atksgt; C:WINDOWSsystem32DRIVERSatksgt.sys [2009-06-07 279712]
R2 ElbyCDIO;ElbyCDIO Driver; C:WINDOWSSystem32DriversElbyCDIO.sys [2005-04-21 10624]
R2 lirsgt;lirsgt; C:WINDOWSsystem32DRIVERSlirsgt.sys [2009-06-07 25888]
R2 rspndr;Ответчик обнаружения топологии уровня связи; C:WINDOWSsystem32DRIVERSrspndr.sys [2008-06-05 62336]
R2 SPIDER;SpIDer Guard File System Monitor; ??C:PROGRA~1DrWebspider.sys []
R2 tifsfilter;Acronis True Image FS Filter; C:WINDOWSsystem32DRIVERStifsfilt.sys [2009-02-21 44704]
R3 ati2mtag;ati2mtag; C:WINDOWSsystem32DRIVERSati2mtag.sys [2007-11-02 2644480]
R3 ElbyCDFL;ElbyCDFL; C:WINDOWSSystem32DriversElbyCDFL.sys [2005-05-03 27392]
R3 FStarForce;FStarForce; C:WINDOWSsystem32DRIVERSFStarForce.sys [2009-04-08 8704]
R3 HDAudBus;Драйвер шины Microsoft UAA для High Definition Audio; C:WINDOWSsystem32DRIVERSHDAudBus.sys [2008-04-15 144384]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:WINDOWSsystem32driversRtkHDAud.sys [2008-04-17 4707328]
R3 RTHDMIAzAudService;Service for HDMI; C:WINDOWSsystem32driversRtHDMI.sys [2007-05-14 3526464]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:WINDOWSsystem32DRIVERSRtenicxp.sys [2008-01-04 105856]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2008-06-21 30336]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2008-06-21 59520]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2008-04-15 20608]
R3 VBoxNetFlt;VBoxNetFlt Service; C:WINDOWSsystem32DRIVERSVBoxNetFlt.sys [2009-02-16 87568]
S3 Arp1394;Протокол клиента 1394 ARP; C:WINDOWSsystem32DRIVERSarp1394.sys [2008-06-21 60800]
S3 atqfrxm3;atqfrxm3; C:WINDOWSsystem32driversatqfrxm3.sys []
S3 aybxmy9k;aybxmy9k; C:WINDOWSsystem32driversaybxmy9k.sys []
S3 BlueletAudio;Bluetooth Audio Service; C:WINDOWSsystem32DRIVERSblueletaudio.sys [2004-10-19 20096]
S3 BT;Bluetooth PAN Network Adapter; C:WINDOWSsystem32DRIVERSbtnetdrv.sys [2004-09-21 10804]
S3 Btcsrusb;Bluetooth USB For Bluetooth Service; C:WINDOWSSystem32Driversbtcusb.sys [2005-01-17 23000]
S3 BthEnum;Драйвер блока запроса Bluetooth; C:WINDOWSsystem32DRIVERSBthEnum.sys [2008-06-21 17024]
S3 BTHidEnum;Bluetooth HID Enumerator; C:WINDOWSsystem32DRIVERSvbtenum.sys [2005-01-13 12500]
S3 BthPan;Bluetooth Device (Personal Area Network); C:WINDOWSsystem32DRIVERSbthpan.sys [2008-06-21 101120]
S3 BTHPORT;Драйвер порта Bluetooth; C:WINDOWSSystem32DriversBTHport.sys [2008-06-14 272512]
S3 BTHUSB;Драйвер порта USB радиомодуля Bluetooth; C:WINDOWSSystem32DriversBTHUSB.sys [2008-06-21 18944]
S3 BTNetFilter;Bluetooth Network Filter; ??C:WINDOWSsystem32driversBTNetFilter.sys []
S3 catchme;catchme; ??C:ComboFixcatchme.sys []
S3 CCDECODE;Closed Caption декодер; C:WINDOWSsystem32DRIVERSCCDECODE.sys [2004-07-09 16384]
S3 ET5Drv;ET5Drv; ??C:WINDOWSsystem32DriversET5Drv.sys []
S3 gdrv;gdrv; ??C:WINDOWSgdrv.sys []
S3 HdAudAddService;ATI Function Driver for High Definition Audio Service; C:WINDOWSsystem32driversAtiHdAud.sys [2006-12-28 84992]
S3 ltmodem5;Agere Modem Driver; C:WINDOWSsystem32DRIVERSltmdmnt.sys [2003-07-01 652497]
S3 MODEMCSA;Устройство фильтрации потока Unimodem; C:WINDOWSsystem32driversMODEMCSA.sys [2008-06-21 16128]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:WINDOWSsystem32driversMSTEE.sys [2002-12-12 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:WINDOWSsystem32DRIVERSNABTSFEC.sys [2004-07-09 83968]
S3 NdisIP;Microsoft TV/Video Connection; C:WINDOWSsystem32DRIVERSNdisIP.sys [2004-07-09 10112]
S3 NIC1394;Сетевой драйвер 1394; C:WINDOWSsystem32DRIVERSnic1394.sys [2008-06-21 61824]
S3 nmwcd;Nokia USB Phone Parent; C:WINDOWSsystem32driversccdcmb.sys [2009-02-09 17664]
S3 nmwcdc;Nokia USB Generic; C:WINDOWSsystem32driversccdcmbo.sys [2009-02-09 22016]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:WINDOWSsystem32DRIVERSpccsmcfd.sys [2008-08-26 18816]
S3 RFCOMM;Устройство Bluetooth (протокол RFCOMM TDI); C:WINDOWSsystem32DRIVERSrfcomm.sys [2008-06-21 59136]
S3 ROOTMODEM;Microsoft Legacy Modem Driver; C:WINDOWSSystem32DriversRootMdm.sys [2008-04-15 5888]
S3 SLIP;BDA Slip De-Framer; C:WINDOWSsystem32DRIVERSSLIP.sys [2004-07-09 10880]
S3 streamip;BDA IPSink; C:WINDOWSsystem32DRIVERSStreamIP.sys [2004-07-09 14976]
S3 upperdev;upperdev; C:WINDOWSsystem32DRIVERSusbser_lowerflt.sys [2009-02-09 7808]
S3 usbccgp;Драйвер универсального родительского устройства USB (Microsoft); C:WINDOWSsystem32DRIVERSusbccgp.sys [2008-06-21 32384]
S3 usbscan;Драйвер USB-сканера; C:WINDOWSsystem32DRIVERSusbscan.sys [2008-06-21 15104]
S3 usbser;USB Modem Driver; C:WINDOWSsystem32driversusbser.sys [2008-06-21 26112]
S3 UsbserFilt;UsbserFilt; C:WINDOWSsystem32DRIVERSusbser_lowerfltj.sys [2009-02-09 7808]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2008-06-21 26368]
S3 usbvideo;USB-видеоустройство (WDM); C:WINDOWSSystem32Driversusbvideo.sys [2008-06-21 121984]
S3 VComm;Virtual Serial port driver; C:WINDOWSsystem32DRIVERSVComm.sys [2004-10-19 61312]
S3 VcommMgr;Bluetooth VComm Manager Service; C:WINDOWSSystem32DriversVcommMgr.sys [2004-11-05 82148]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:WINDOWSSystem32Driverswdf01000.sys [2008-03-27 503008]
S3 WSTCODEC;World Standard Teletext Codec; C:WINDOWSsystem32DRIVERSWSTCODEC.SYS [2004-07-09 18688]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2008-01-18 83328]
S4 dwshd;dwshd; C:WINDOWSSystem32driversdwshd.sys []
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 AcrSch2Svc;Acronis Scheduler2 Service; C:Program FilesCommon FilesAcronisSchedule2schedul2.exe [2008-11-04 554264]
R2 Ati HotKey Poller;Ati HotKey Poller; C:WINDOWSsystem32Ati2evxx.exe [2007-11-02 495616]
R2 BthServ;Bluetooth Support Service; C:WINDOWSsystem32svchost.exe [2008-04-15 14336]
R2 DrWebEngine;Dr.Web ® Scanning Engine (DrWebEngine); C:Program FilesCommon FilesDoctor WebScanning Enginedwengine.exe [2008-10-17 869688]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:Program FilesCommon FilesLightScribeLSSrvc.exe [2007-08-23 79136]
R2 O&O Defrag;O&O Defrag; C:WINDOWSsystem32oodag.exe [2007-05-11 1050120]
R2 PnkBstrA;PnkBstrA; C:WINDOWSsystem32PnkBstrA.exe [2009-08-20 75064]
R2 SPIDERNT;SpIDer Guard for Windows; C:PROGRA~1DrWebspidernt.exe [2008-12-09 197896]
R2 TTFixerService;NST ToolTipFixer; C:Program FilesNeoSmart TechnologiesToolTipFixerToolTipFixer.exe [2007-06-27 10240]
R2 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2008-04-15 14336]
R3 ServiceLayer;ServiceLayer; C:Program FilesPC Connectivity SolutionServiceLayer.exe [2009-06-02 637952]
S2 appdrvrem01;Application Driver Auto Removal Service (01); C:WINDOWSSystem32appdrvrem01.exe [2009-04-27 316816]
S2 ATI Smart;ATI Smart; C:WINDOWSsystem32ati2sgag.exe [2007-11-01 593920]
S2 sfrem02;FrontLine Drivers Auto Removal (v2); C:WINDOWSsystem32sfrem02.exe [2006-05-11 358008]
S3 Adobe LM Service;Adobe LM Service; C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe [2009-06-08 68096]
S3 aspnet_state;Служба состояний ASP.NET; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:WINDOWSMicrosoft.NETFrameworkv3.0WPFPresentationFontCache.exe [2008-07-29 46104]
S3 GEST Service;GEST Service for program management.; C:Program FilesGIGABYTEGESTGSvr.exe [2007-12-14 47624]
S3 IDriverT;InstallDriver Table Manager; C:Program FilesCommon FilesInstallShieldDriver1150Intel 32IDriverT.exe [2005-11-14 69632]
S3 idsvc;Windows CardSpace; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication Foundationinfocard.exe [2008-07-29 881664]
S3 MSCSPTISRV;MSCSPTISRV; C:Program FilesCommon FilesSony SharedAVLibMSCSPTISRV.exe [2006-12-14 45056]
S3 odserv;Microsoft Office Diagnostics Service; C:Program FilesCommon FilesMicrosoft SharedOFFICE12ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2006-10-26 145184]
S3 PACSPTISVR;PACSPTISVR; C:Program FilesCommon FilesSony SharedAVLibPACSPTISVR.exe [2006-12-14 57344]
S3 SonicStage Back-End Service;SonicStage Back-End Service; C:Program FilesCommon FilesSony SharedAVLibSsBeSvc.exe [2007-02-05 112184]
S3 SPTISRV;Sony SPTI Service; C:Program FilesCommon FilesSony SharedAVLibSPTISRV.exe [2006-12-14 69632]
S3 SSScsiSV;SonicStage SCSI Service; C:Program FilesCommon FilesSony SharedAVLibSSScsiSV.exe [2007-02-05 75320]
S3 TUWinStylerThemeSvc;TuneUp WinStyler Theme Service; C:Program FilesTuneUp Utilities 2006WinStylerThemeSvc.exe [2005-08-10 118272]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:Program FilesWindows Media Playerwmpnetwk.exe [2006-10-18 913408]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication FoundationSMSvcHost.exe [2008-07-29 132096]
EOF
или комбофиксом сделать?
