Созданные ответы форума
-
Сообщения
-
ComboFix 08-12-01.03 — АК 2008-12-02 20:23:44.1 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1251.1.1049.18.295 [GMT 3:00]
Running from: c:documents and settingsАКРабочий столComboFix.exe
* Created a new restore point
* Resident AV is activeWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.c:docume~1A141~1LOCALS~1Temptmp2.tmp
c:documents and settingsАКLocal SettingsTemporary Internet Files0EB9F12C_6E6B_4c03_AEBA_8C04CFA98AA4.gif
c:documents and settingsАКLocal SettingsTemporary Internet Files15913497_F86C_4218_8817_F50940D1E1B2.gif
c:documents and settingsАКLocal SettingsTemporary Internet Files29887DDE_00B9_4011_9CF7_59511F1ECC1B.gif
c:documents and settingsАКLocal SettingsTemporary Internet Files2A665EDD_5758_480c_8366_66DFC5F23877.gif
c:documents and settingsАКLocal SettingsTemporary Internet Files35B7DFFA_884F_4fbc_8E60_DA601BDC7BF7.gif
c:documents and settingsАКLocal SettingsTemporary Internet Files362FD6E8_8CDA_4c2a_A8AA-BDA22B321711.jpg
c:documents and settingsАКLocal SettingsTemporary Internet Files3DF04940_9866_4241_A998_0CDDFAFD147A.gif
c:documents and settingsАКLocal SettingsTemporary Internet Files426500D7_0FF3_426c_828D_065DBAEA0581.gif
c:documents and settingsАКLocal SettingsTemporary Internet Files478BD4AE_2691_438d_BDCA_3485DC022700.gif
c:documents and settingsАКLocal SettingsTemporary Internet Files5C6C645F_BAA8_4149_BFEB_2031230FF0FD.gif
c:documents and settingsАКLocal SettingsTemporary Internet Files61EA7D69_19D4_421a_A899_0DF4D58CD119.jpg
c:documents and settingsАКLocal SettingsTemporary Internet Files777FDAFB_83CF_4960_AA71_4E5D7BCD8E57.gif
c:documents and settingsАКLocal SettingsTemporary Internet Files8DA878D5_E80B_4721_B75A_17EFFAF1A700.gif
c:documents and settingsАКLocal SettingsTemporary Internet Files98F6DF79_7171_452d_9C26_C0193E12DBDF.gif
c:documents and settingsАКLocal SettingsTemporary Internet FilesA2B240D6_0386_419e_91C5_3F7D90437CD0.jpg
c:documents and settingsАКLocal SettingsTemporary Internet FilesC75CEF8D_5AF4_4563_8594_C45A45E14E63.gif
c:documents and settingsАКLocal SettingsTemporary Internet FilesE21285C1_40E6_435c_A69F_3387E7BD89CB.gif
c:documents and settingsАКLocal SettingsTemporary Internet FilesE9A4D648_ED73_4ea7_88B2_18332DBA4F3E.jpg
c:program filesINSTALL.LOG
c:windowskdcoms.dll.
((((((((((((((((((((((((( Files Created from 2008-11-02 to 2008-12-02 )))))))))))))))))))))))))))))))
.2008-12-02 08:31 . 2008-12-02 08:31
d
C:rsit
2008-12-02 08:30 . 2008-12-02 08:30 305,705 —a
C:RSIT.exe
2008-12-02 08:30 . 2008-06-14 20:59 272,512
c— c:windowssystem32dllcachebthport.sys
2008-12-02 08:29 . 2008-10-24 14:10 453,632
c— c:windowssystem32dllcachemrxsmb.sys
2008-12-02 08:25 . 2008-08-14 16:47 2,182,144
c— c:windowssystem32dllcachentoskrnl.exe
2008-12-02 08:25 . 2008-08-14 16:47 2,138,112
c— c:windowssystem32dllcachentkrnlmp.exe
2008-12-02 08:25 . 2008-08-14 16:47 2,059,520
c— c:windowssystem32dllcachentkrnlpa.exe
2008-12-02 08:25 . 2008-08-14 16:47 2,017,792
c— c:windowssystem32dllcachentkrpamp.exe
2008-11-30 16:43 . 2008-11-30 16:43 54,156 —ah
c:windowsQTFont.qfn
2008-11-30 16:43 . 2008-11-30 16:43 1,409 —a
c:windowsQTFont.for
2008-11-29 22:55 . 2008-11-29 22:55d
c:program filesOpera
2008-11-29 22:14 . 2003-08-18 03:00 1,875,968 —a—c— c:windowssystem32dllcachemsir3jp.lex
2008-11-29 22:13 . 2003-08-18 03:00 13,463,552 —a—c— c:windowssystem32dllcachehwxjpn.dll
2008-11-29 22:12 . 2003-08-18 03:00 2,134,528 —a—c— c:windowssystem32dllcachesmtpsnap.dll
2008-11-29 22:11 . 2008-11-29 22:11 749 -rah
c:windowsWindowsShell.Manifest
2008-11-29 22:11 . 2008-11-29 22:11 749 -rah
c:windowssystem32wuaucpl.cpl.manifest
2008-11-29 22:11 . 2008-11-29 22:11 749 -rah
c:windowssystem32sapi.cpl.manifest
2008-11-29 22:11 . 2008-11-29 22:11 749 -rah
c:windowssystem32nwc.cpl.manifest
2008-11-29 22:11 . 2008-11-29 22:11 749 -rah
c:windowssystem32ncpa.cpl.manifest
2008-11-29 22:11 . 2008-11-29 22:11 488 -rah
c:windowssystem32logonui.exe.manifest
2008-11-29 22:06 . 2004-08-03 22:31 20,992 —a
c:windowssystem32driversRTL8139.sys.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-02 17:23
d
w c:program filesESET
2008-11-29 22:21
d
w c:program filesTrend Micro
2008-10-24 11:10 453,632 —-a-w c:windowssystem32driversmrxsmb.sys
2008-10-16 11:09 43,544 —-a-w c:windowssystem32wups2.dll
2008-09-15 15:40 1,846,144 —-a-w c:windowssystem32win32k.sys
2008-09-04 16:45 1,106,944 —-a-w c:windowssystem32msxml3.dll
2007-05-31 20:00 1,286,963 —-a-w c:documents and settingsAll Userswrar370ru.exe
2007-03-08 16:55 17,144 -c—a-w c:documents and settingsАКApplication DataGDIPFONTCACHEV1.DAT
1999-06-25 07:55 149,504 —-a-w c:program filesUNWISE.EXE
.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2003-08-18 15360]
«MSMSGS»=»c:program filesMessengermsmsgs.exe» [2004-10-13 1694208]
«swg»=»c:program filesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe» [2007-04-02 68856]
«QIP2005″=»c:program filesQIPqip8070qip.exe» [2008-07-01 3256320][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2001-07-09 155648]
«QuickTime Task»=»c:program filesQuickTimeqttask.exe» [2007-11-23 286720]
«nod32kui»=»c:program filesEsetnod32kui.exe» [2002-11-28 949376]
«SoundMan»=»SOUNDMAN.EXE» [2003-01-07 c:windowsSOUNDMAN.EXE][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2003-08-18 15360]c:documents and settingsAll Usersѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
E-Color.lnk — c:program filesE-ColorCommonIconMgr.exe [2006-12-03 57344][HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]
«VIDC.ACDV»= ACDV.dll[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«AntiVirusOverride»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«c:\WINDOWS\system32\sessmgr.exe»=
«c:\Program Files\QIP\qip8070\qip.exe»=
«%windir%\system32\sessmgr.exe»=R1 nod32drv;nod32drv;c:windowssystem32driversnod32drv.sys [2002-11-28 15424]
*Newly Created Service* — PROCEXP90
.
— — — — ORPHANS REMOVED — — — —HKLM-Run-ICQ Lite — c:program filesICQLiteICQLite.exe
Notify-WgaLogon — (no file).
Supplementary Scan
.
uStart Page = hxxp://www.yandex.ru/
uSearch Page = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearch Bar = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office10EXCEL.EXE/3000
IE: Поиск@Mail.Ru — c:program filesMail.RuSputnikMailRuSputnik.dll/SEARCH.HTM
IE: Словари@Mail.Ru — c:program filesMail.RuSputnikMailRuSputnik.dll/TRANSLATE.HTM
LSP: c:windowssystem32imon.dll
TCP: {BA15ECF6-5CE2-40F7-9BBD-B82A908FB9FD} = 172.16.24.1,172.16.25.1c:windowsDownloaded Program FilesImResCtl.dll — O16 -: {2D4C57AA-54C0-4942-BB2A-51DF0727950B}
hxxp://www.openkremlin.ru/cab/ImResCtl.cab
c:windowsDownloaded Program FilesImResCtl.inf
.**************************************************************************
catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-02 20:25:32
Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘lsass.exe'(444)
c:windowssystem32imon.dll
.
Completion time: 2008-12-02 20:26:27
ComboFix-quarantined-files.txt 2008-12-02 17:26:01Pre-Run: 3 133 599 744 байт свободно
Post-Run: 3,840,016,384 байт свободно136 — E O F — 2008-12-02 05:59:12
Logfile of random’s system information tool 1.04 (written by random/random)
Run by АК at 2008-12-02 08:31:10
Microsoft Windows XP Professional Service Pack 2
System drive C: has 4 GB (37%) free of 10 GB
Total RAM: 511 MB (41% free)Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:31:22, on 02.12.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: NormalRunning processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
C:Program FilesEsetnod32krn.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesEsetnod32kui.exe
C:WINDOWSSOUNDMAN.EXE
C:WINDOWSsystem32ctfmon.exe
C:Program FilesMessengermsmsgs.exe
C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
C:Program FilesE-ColorCommonIconMgr.exe
C:Program FilesE-ColorColorifichgcctl95.exe
C:Program FilesE-ColorE-Color IndicatorTICIcon.exe
C:WINDOWSsystem32wuauclt.exe
C:Program FilesOperaopera.exe
C:WINDOWSsystem32wuauclt.exe
C:RSIT.exe
C:WINDOWSSoftwareDistributionDownload22bf96c336da35c81bd674be409e119dupdateupdate.exe
C:Program FilesTrend MicroHijackThisАК.exeR0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.yandex.ru/
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O2 — BHO: AcroIEHlprObj Class — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dll
O2 — BHO: Спутник@Mail.Ru — {8984B388-A5BB-4DF7-B274-77B879E179DB} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O2 — BHO: Google Toolbar Helper — {AA58ED58-01DD-4d91-8333-CF10577473F7} — c:program filesgooglegoogletoolbar1.dll
O2 — BHO: Google Toolbar Notifier BHO — {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} — C:Program FilesGoogleGoogleToolbarNotifier3.1.807.1746swg.dll
O2 — BHO: MyCentria Internet Mate v2.0 — {FFFC57DB-1DE3-4303-B24D-CEE6DCDD3D86} — C:PROGRA~1MYCENT~1InfoBarMYCENT~1.DLL (file missing)
O3 — Toolbar: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O3 — Toolbar: &Google — {2318C2B1-4965-11d4-9B18-009027A5CD4F} — c:program filesgooglegoogletoolbar1.dll
O4 — HKLM..Run: [ICQ Lite] «C:Program FilesICQLiteICQLite.exe» -minimize
O4 — HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 — HKLM..Run: [QuickTime Task] «C:Program FilesQuickTimeqttask.exe» -atboottime
O4 — HKLM..Run: [nod32kui] «C:Program FilesEsetnod32kui.exe» /WAITSERVICE
O4 — HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [MSMSGS] «C:Program FilesMessengermsmsgs.exe» /background
O4 — HKCU..Run: [swg] C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
O4 — HKCU..Run: [QIP2005] C:Program FilesQIPqip8070qip.exe
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — Global Startup: E-Color.lnk = C:Program FilesE-ColorCommonIconMgr.exe
O4 — Global Startup: Google Updater.lnk = C:Program FilesGoogleGoogle UpdaterGoogleUpdater.exe
O4 — Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOffice10OSA.EXE
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2Office10EXCEL.EXE/3000
O8 — Extra context menu item: Поиск@Mail.Ru — res://C:Program FilesMail.RuSputnikMailRuSputnik.dll/SEARCH.HTM
O8 — Extra context menu item: Словари@Mail.Ru — res://C:Program FilesMail.RuSputnikMailRuSputnik.dll/TRANSLATE.HTM
O9 — Extra button: ICQ Lite — {B863453A-26C3-4e1f-A54D-A2CD196348E9} — C:Program FilesICQLiteICQLite.exe (file missing)
O9 — Extra ‘Tools’ menuitem: ICQ Lite — {B863453A-26C3-4e1f-A54D-A2CD196348E9} — C:Program FilesICQLiteICQLite.exe (file missing)
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O16 — DPF: {2D4C57AA-54C0-4942-BB2A-51DF0727950B} (ImResize Class) — http://www.openkremlin.ru/cab/ImResCtl.cab
O17 — HKLMSystemCCSServicesTcpip..{BA15ECF6-5CE2-40F7-9BBD-B82A908FB9FD}: NameServer = 172.16.24.1,172.16.25.1
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Google Updater Service (gusvc) — Google — C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: NetMeeting Remote Desktop Sharing (mnmsrvc) — Корпорация Майкрософт — C:WINDOWSsystem32mnmsrvc.exe
O23 — Service: NOD32 Kernel Service (NOD32krn) — Eset — C:Program FilesEsetnod32krn.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe
O24 — Desktop Component 0: (no name) — http://www.happych.ru/images/oblaco.gif—
End of file — 6187 bytes======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class — C:Program FilesAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dll [2003-05-15 50376][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{8984B388-A5BB-4DF7-B274-77B879E179DB}]
MailRuBHO Class — C:Program FilesMail.RuSputnikMailRuSputnik.dll [2007-11-16 366080][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper — c:program filesgooglegoogletoolbar1.dll [2007-01-19 2427968][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO — C:Program FilesGoogleGoogleToolbarNotifier3.1.807.1746swg.dll [2008-10-09 737776][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{FFFC57DB-1DE3-4303-B24D-CEE6DCDD3D86}]
MyCentria Internet Mate v2.0 — C:PROGRA~1MYCENT~1InfoBarMYCENT~1.DLL [][HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{09900DE8-1DCA-443F-9243-26FF581438AF} — Спутник@Mail.Ru — C:Program FilesMail.RuSputnikMailRuSputnik.dll [2007-11-16 366080]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} — &Google — c:program filesgooglegoogletoolbar1.dll [2007-01-19 2427968][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«ICQ Lite»=C:Program FilesICQLiteICQLite.exe -minimize []
«NeroFilterCheck»=C:WINDOWSsystem32NeroCheck.exe [2001-07-09 155648]
«QuickTime Task»=C:Program FilesQuickTimeqttask.exe [2007-11-23 286720]
«nod32kui»=C:Program FilesEsetnod32kui.exe [2002-11-28 949376]
«SoundMan»=C:WINDOWSSOUNDMAN.EXE [2003-01-07 46592][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=C:WINDOWSsystem32ctfmon.exe [2003-08-18 15360]
«MSMSGS»=C:Program FilesMessengermsmsgs.exe [2004-10-13 1694208]
«swg»=C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe [2007-04-02 68856]
«QIP2005″=C:Program FilesQIPqip8070qip.exe [2008-07-01 3256320]C:Documents and SettingsAll UsersГлавное менюПрограммыАвтозагрузка
E-Color.lnk — C:Program FilesE-ColorCommonIconMgr.exe
Google Updater.lnk — C:Program FilesGoogleGoogle UpdaterGoogleUpdater.exe
Microsoft Office.lnk — C:Program FilesMicrosoft OfficeOffice10OSA.EXE[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyWgaLogon]
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=145[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«C:WINDOWSsystem32sessmgr.exe»=»C:WINDOWSsystem32sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019»
«C:Program FilesICQLiteICQLite.exe»=»C:Program FilesICQLiteICQLite.exe:*:Enabled:ICQ Lite»
«C:Documents and SettingsAll UsersДокументыqip.exe»=»C:Documents and SettingsAll UsersДокументыqip.exe:*:Enabled:Quiet Internet Pager»
«C:Program FilesUtkonosUtkonos.exe»=»C:Program FilesUtkonosUtkonos.exe:*:Enabled:Резервирование товаров»
«C:Program FilesQIPqip.exe»=»C:Program FilesQIPqip.exe:*:Enabled:Quiet Internet Pager»
«C:Program FilesQIPqip8070qip.exe»=»C:Program FilesQIPqip8070qip.exe:*:Enabled:Quiet Internet Pager»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{a2ce3947-269f-11dd-ae1d-00804844e39c}]
shellAutoRuncommand — C:WINDOWSsystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Secret.exe======List of files/folders created in the last 1 months======
2008-12-02 08:31:10 —-D—- C:rsit
2008-12-02 08:30:10 —-A—- C:RSIT.exe
2008-12-02 08:29:05 —-D—- C:WINDOWSLastGood
2008-11-29 22:56:03 —-D—- C:Documents and SettingsАКApplication DataOpera
2008-11-29 22:55:51 —-D—- C:Program FilesOpera
2008-11-29 22:18:23 —-D—- C:WINDOWSPrefetch
2008-11-29 22:11:24 —-RAH—- C:WINDOWSsystem32logonui.exe.manifest
2008-11-29 22:03:25 —-A—- C:WINDOWSsystem32spxcoins.dll
2008-11-29 22:03:25 —-A—- C:WINDOWSsystem32irclass.dll
2008-11-29 22:03:08 —-RA—- C:WINDOWSSETD7.tmp
2008-11-29 22:03:05 —-RA—- C:WINDOWSSETCB.tmp
2008-11-29 22:03:02 —-RA—- C:WINDOWSSETC8.tmp
2008-11-29 22:02:11 —-A—- C:WINDOWSsetuplog.txt======List of files/folders modified in the last 1 months======
2008-12-02 08:31:23 —-D—- C:WINDOWSsystem32CatRoot2
2008-12-02 08:30:58 —-A—- C:WINDOWSNeroDigital.ini
2008-12-02 08:30:54 —-HD—- C:WINDOWSinf
2008-12-02 08:30:38 —-HD—- C:WINDOWS$hf_mig$
2008-12-02 08:30:38 —-D—- C:WINDOWS
2008-12-02 08:30:12 —-D—- C:WINDOWSTemp
2008-12-02 08:27:39 —-RSHDC—- C:WINDOWSsystem32dllcache
2008-12-02 08:27:23 —-D—- C:WINDOWSsystem32
2008-12-02 08:25:54 —-A—- C:WINDOWSSchedLgU.Txt
2008-12-02 08:23:39 —-D—- C:WINDOWSSoftwareDistribution
2008-12-02 08:23:39 —-D—- C:WINDOWSHelp
2008-12-01 00:11:39 —-SHD—- C:WINDOWSInstaller
2008-11-30 01:21:14 —-D—- C:Program FilesTrend Micro
2008-11-30 00:59:24 —-D—- C:WINDOWSsystem32Setup
2008-11-30 00:59:24 —-D—- C:WINDOWSsystem
2008-11-30 00:59:16 —-D—- C:WINDOWSsystem32usmt
2008-11-30 00:59:05 —-D—- C:WINDOWSAppPatch
2008-11-30 00:59:04 —-D—- C:WINDOWSime
2008-11-30 00:59:04 —-D—- C:WINDOWSehome
2008-11-30 00:59:03 —-RSD—- C:WINDOWSFonts
2008-11-30 00:59:02 —-D—- C:WINDOWSMedia
2008-11-30 00:58:52 —-D—- C:WINDOWSPeerNet
2008-11-30 00:58:39 —-D—- C:WINDOWSsystem32npp
2008-11-30 00:58:32 —-D—- C:WINDOWSmsagent
2008-11-30 00:56:49 —-D—- C:WINDOWSsystem321049
2008-11-30 00:56:42 —-D—- C:WINDOWStwain_32
2008-11-30 00:56:32 —-D—- C:WINDOWSsystem32icsxml
2008-11-30 00:56:06 —-D—- C:WINDOWSsystem321033
2008-11-30 00:55:10 —-D—- C:WINDOWSWinSxS
2008-11-30 00:55:10 —-D—- C:WINDOWSDriver Cache
2008-11-29 23:29:48 —-D—- C:WINDOWSsecurity
2008-11-29 23:28:49 —-D—- C:Program FilesESET
2008-11-29 22:55:51 —-RD—- C:Program Files
2008-11-29 22:20:34 —-D—- C:WINDOWSRegistration
2008-11-29 22:20:33 —-A—- C:WINDOWSsystem32PerfStringBackup.INI
2008-11-29 22:19:37 —-SHD—- C:System Volume Information
2008-11-29 22:19:37 —-D—- C:WINDOWSsystem32Restore
2008-11-29 22:17:54 —-D—- C:WINDOWSsystem32config
2008-11-29 22:12:17 —-AC—- C:WINDOWSOEWABLog.txt
2008-11-29 22:12:12 —-AC—- C:WINDOWSODBCINST.INI
2008-11-29 22:11:53 —-D—- C:WINDOWSsystem32ias
2008-11-29 22:11:26 —-RD—- C:WINDOWSWeb
2008-11-29 22:11:18 —-RAH—- C:WINDOWSsystem32cdplayer.exe.manifest
2008-11-29 22:11:07 —-A—- C:WINDOWSwin.ini
2008-11-29 22:11:02 —-D—- C:WINDOWSsystem32oobe
2008-11-29 22:10:59 —-D—- C:Program FilesWindows Media Player
2008-11-29 22:10:57 —-D—- C:WINDOWSsystem32drivers
2008-11-29 22:10:56 —-D—- C:Program FilesOutlook Express
2008-11-29 22:10:56 —-D—- C:Program FilesCommon FilesSystem
2008-11-29 22:10:52 —-D—- C:Program FilesInternet Explorer
2008-11-29 22:10:09 —-D—- C:WINDOWSsystem32Com
2008-11-29 22:09:40 —-D—- C:WINDOWSsystem32wbem
2008-11-29 22:09:05 —-SH—- C:boot.ini
2008-11-29 22:04:38 —-D—- C:WINDOWSsystem32CatRoot
2008-11-29 22:03:30 —-A—- C:WINDOWSsystem.ini
2008-11-29 22:03:17 —-ASH—- C:Documents and SettingsAll UsersApplication Datadesktop.ini======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2003-08-18 40448]
R1 nod32drv;nod32drv; C:WINDOWSsystem32driversnod32drv.sys [2002-11-28 15424]
R1 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:WINDOWSSystem32driversws2ifsl.sys [2003-08-18 12032]
R2 AMON;AMON; C:WINDOWSsystem32driversamon.sys [2002-11-28 512096]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:WINDOWSsystem32driversALCXWDM.SYS [2003-01-10 695852]
R3 nv;nv; C:WINDOWSsystem32DRIVERSnv4_mini.sys [2004-08-04 1897408]
R3 pfc;Padus ASPI Shell; C:WINDOWSsystem32driverspfc.sys [2006-12-03 10368]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet адаптер, драйвер для NT; C:WINDOWSsystem32DRIVERSRTL8139.SYS [2004-08-03 20992]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2003-08-18 26624]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2003-08-18 57600]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2003-08-18 20480]
S1 kbdhid;Драйвер клавиатуры HID; C:WINDOWSsystem32DRIVERSkbdhid.sys [2003-08-18 14848]
S3 GMSIPCI;GMSIPCI; ??E:ReservSystemsДрайвераMB_DriversINSTALLGMSIPCI.SYS []
S3 HidUsb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2003-08-18 9600]
S3 mouhid;Драйвер мыши HID; C:WINDOWSsystem32DRIVERSmouhid.sys [2003-08-18 12160]
S3 ssm_bus;SAMSUNG Mobile USB Device II 1.0 driver (WDM); C:WINDOWSsystem32DRIVERSssm_bus.sys [2007-05-02 83592]
S3 ssm_mdfl;SAMSUNG Mobile USB Modem II 1.0 Filter; C:WINDOWSsystem32DRIVERSssm_mdfl.sys [2007-05-02 15112]
S3 ssm_mdm;SAMSUNG Mobile USB Modem II 1.0 Drivers; C:WINDOWSsystem32DRIVERSssm_mdm.sys [2007-05-02 109704]
S3 usbccgp;Драйвер универсального родительского устройства USB (Microsoft); C:WINDOWSsystem32DRIVERSusbccgp.sys [2003-08-18 31616]
S3 usbscan;Драйвер USB-сканера; C:WINDOWSsystem32DRIVERSusbscan.sys [2004-08-03 15104]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2003-08-18 26496]======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 gusvc;Google Updater Service; C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe [2007-03-21 136952]
R2 NOD32krn;NOD32 Kernel Service; C:Program FilesEsetnod32krn.exe [2002-11-28 552064]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv1.1.4322aspnet_state.exe [2004-07-15 32768]
EOF
info.txt logfile of random’s system information tool 1.04 2008-12-02 08:31:25
======Uninstall list======
—>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:WINDOWSINFPCHealth.inf
ACDSee 5.0 PowerPack—>MsiExec.exe /I{5058B085-AA79-41E5-A726-681B4C4B846E}
Adobe Flash Player 10 Plugin—>C:WINDOWSsystem32MacromedFlashuninstall_plugin.exe
Adobe Flash Player 9 ActiveX—>C:WINDOWSsystem32MacromedFlashFlashUtil9b.exe -uninstallDelete
Adobe Photoshop 7.0 Русская версия—>C:PROGRA~1UNWISE.EXE C:PROGRA~1INSTALL.LOG
Adobe Reader 6.0—>MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-000000000001}
AirCartridge-PCP 1.2.7—>C:Program FilesAirCartridge-PCP 1.2.7uninstall.exe
Colorific—>C:WINDOWSIsUninst.exe -f»C:Program FilesE-ColorColorificcfmunins.isu» -c»C:PROGRA~1E-ColorCOLORI~1cfmunins.dll» ProdNameColorific
Dream Aquarium—>»C:Program FilesDream AquariumUnInstall.exe»
E-Color Indicator—>C:WINDOWSIsUninst.exe -f»C:Program FilesE-ColorE-Color IndicatorUninst.isu» -c»C:Program FilesE-ColorE-Color IndicatorTICUninstall.dll»
Google Toolbar for Internet Explorer—>regsvr32 /u /s «c:program filesgooglegoogletoolbar1.dll»
Google Updater—>»C:Program FilesGoogleGoogle UpdaterGoogleUpdater.exe» -uninstall
Google Планета Земля—>MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
HijackThis 2.0.2—>»C:Program FilesTrend MicroHijackThisHijackThis.exe» /uninstall
ICQ 5.1—>C:Program FilesICQLiteICQLiteUninstall.EXE
Microsoft .NET Framework 1.1 Hotfix (KB928366)—>»C:WINDOWSMicrosoft.NETFrameworkv1.1.4322Updateshotfix.exe» «C:WINDOWSMicrosoft.NETFrameworkv1.1.4322UpdatesM928366M928366Uninstall.msp»
Microsoft .NET Framework 1.1—>msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1—>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Office XP (профессиональный выпуск)—>MsiExec.exe /I{91110419-6000-11D3-8CFE-0050048383C9}
mpegable DS decoder—>C:WINDOWSAKDeInstall.exe «/C:Program Filesmpegable»
Nero 6 Demo—>C:Program FilesAheadnerouninstallUNNERO.exe /UNINSTALL
NOD32 antivirus system—>C:Program FilesEsetSetupsetup.exe /UNINSTALL
NOD32 FiX—>»C:Program FilesEsetunins000.exe»
Opera 9.62—>MsiExec.exe /X{8318FEFD-F467-44D6-82B8-129374BFE9B1}
QIP 2005 Uninstall—>»C:Program FilesQIPqip8070unqip.exe»
QIP Infium 1.0.9015 RC3—>»C:Program FilesQIPНовая папкаunins000.exe»
QuickTime—>C:WINDOWSunvise32qt.exe C:WINDOWSsystem32QuickTimeUninstall.log
Realtek AC’97 Audio—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{FB08F381-6533-4108-B7DD-039E11FBC27E}setup.exe» REMOVE
SAMSUNG Mobile Modem Driver Set—>C:WINDOWSsystem32Samsung_USB_Drivers3SSCDUninstall.exe
Samsung Mobile phone USB driver Software—>C:WINDOWSsystem32Samsung_USB_Drivers5SSSDUninstall.exe
SAMSUNG Mobile USB Modem 1.0 Software—>C:WINDOWSsystem32Samsung_USB_Drivers1SS_Uninstall.exe
SAMSUNG Mobile USB Modem Software—>C:WINDOWSsystem32Samsung_USB_Drivers2SSM_Uninstall.exe
Samsung PC Studio 3 USB Driver Installer—>»C:Program FilesInstallShield Installation Information{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}setup.exe» -runfromtemp -l0x0009 -removeonly
Samsung Samples Installer—>»C:Program FilesInstallShield Installation Information{7AC15160-A49B-4A89-B181-D4619C025FFF}setup.exe» -runfromtemp -l0x0009 -removeonly
Xteq Systems X-Setup 6.0—>»C:Program FilesX-Setupunins000.exe»
Архиватор WinRAR—>C:Program FilesWinRARuninstall.exe
Интернет помощник MyCentria—>C:Program FilesMyCentriaMyCentriaUninstall.exe
Обновление безопасности для Windows XP (KB923789)—>C:WINDOWSsystem32MacroMedFlashgenuinst.exe C:WINDOWSsystem32MacroMedFlashKB923789.inf=====HijackThis Backups=====
O2 — BHO: sfolibP — {4EB419A1-4BF3-4A38-A449-E091E2BE69D0} — C:WINDOWSsystem32sfolib.dll
F2 — REG:system.ini: UserInit=C:WINDOWSsystem32userinit.exe,C:WINDOWSuserinit.exe======Security center information======
AV: ESET NOD32 antivirus system 2.70
======Environment variables======
«ComSpec»=%SystemRoot%system32cmd.exe
«Path»=%SystemRoot%system32;%SystemRoot%;%SystemRoot%system32WBEM
«windir»=%SystemRoot%
«FP_NO_HOST_CHECK»=NO
«OS»=Windows_NT
«PROCESSOR_ARCHITECTURE»=x86
«PROCESSOR_LEVEL»=15
«PROCESSOR_IDENTIFIER»=x86 Family 15 Model 2 Stepping 7, GenuineIntel
«PROCESSOR_REVISION»=0207
«NUMBER_OF_PROCESSORS»=1
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP
EOF
