Созданные ответы форума
-
Сообщения
-
всё уже нашёл в гугле решение проблемы, браузер Opera , нужно было удалить браузер и папку C:Documents and SettingsРоманApplication DataOpera
свежий RSIT лог
Logfile of random’s system information tool 1.05 (written by random/random)
Run by Роман at 2009-03-18 12:29:39
Microsoft Windows XP Professional Service Pack 2
System drive C: has 8 GB (38%) free of 20 GB
Total RAM: 1023 MB (64% free)Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:29:45, on 18.03.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: NormalRunning processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
D:AppServApache2.2binhttpd.exe
C:Program FilesBonjourmDNSResponder.exe
C:Program FilesESETESET NOD32 Antivirusekrn.exe
C:Program FilesJavajre6binjqs.exe
C:WINDOWSsystem32nvsvc32.exe
C:WINDOWSsystem32svchost.exe
D:AppServApache2.2binhttpd.exe
C:WINDOWSSOUNDMAN.EXE
C:Program FilesESETESET NOD32 Antivirusegui.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:Program FilesWebMoney Agentwmagent.exe
C:WINDOWSsystem32rundll32.exe
C:Program FilesJavajre6binjusched.exe
C:WINDOWSsystem32ctfmon.exe
C:WINDOWSsystem32wuauclt.exe
C:DownloadsПрограммыRSIT.exe
C:Program Filestrend microРоман.exeR0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.mail.ru/
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://www.besttoolbars.net/
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
O1 — Hosts: 92.50.229.10 nprotect.lineage2.com
O1 — Hosts: 92.50.229.10 nprotect.ncsoft.co.kr
O1 — Hosts: 92.50.229.10 update.nprotect.com
O1 — Hosts: 92.50.229.10 update.nprotect.net
O2 — BHO: Adobe PDF Reader Link Helper — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 — BHO: TBSB00196 — {1236D836-E9BA-4175-894F-2072A14D5A26} — C:Program FilesWebMoney Advisorwmadvisor.dll
O2 — BHO: TBSB00901 — {6E228C92-9153-44A8-BECA-50B14D276B0F} — C:Program FilesCommon FilesMicrosoft SharedIEKB472817 System Support Fileszasta.dll
O2 — BHO: Java(tm) Plug-In SSV Helper — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — C:Program FilesJavajre6binssv.dll
O2 — BHO: IE 4.x-6.x BHO for Download Master — {9961627E-4059-41B4-8E0E-A7D6B3854ADF} — C:PROGRA~1DOWNLO~1dmiehlp.dll
O2 — BHO: Java(tm) Plug-In 2 SSV Helper — {DBC80044-A445-435b-BC74-9C25C1C588A9} — C:Program FilesJavajre6binjp2ssv.dll
O2 — BHO: JQSIEStartDetectorImpl — {E7E6F031-17CE-4C07-BC86-EABFE594F69C} — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll
O3 — Toolbar: WebMoney Advisor — {3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — C:Program FilesWebMoney Advisorwmadvisor.dll
O4 — HKLM..Run: [NeroFilterCheck] C:Program FilesCommon FilesAheadLibNeroCheck.exe
O4 — HKLM..Run: [ISUSPM Startup] «C:Program FilesCommon FilesInstallShieldUpdateServiceisuspm.exe» -startup
O4 — HKLM..Run: [ISUSScheduler] «C:Program FilesCommon FilesInstallShieldUpdateServiceissch.exe» -start
O4 — HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 — HKLM..Run: [egui] «C:Program FilesESETESET NOD32 Antivirusegui.exe» /hide /waitservice
O4 — HKLM..Run: [QuickTime Task] «C:Program FilesQuickTimeqttask.exe» -atboottime
O4 — HKLM..Run: [MAgent] C:Program FilesMail.RuAgentmagent.exe -LM
O4 — HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 — HKLM..Run: [nwiz] nwiz.exe /install
O4 — HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 — HKLM..Run: [wmagent.exe] «C:Program FilesWebMoney Agentwmagent.exe»
O4 — HKLM..Run: [Adobe Reader Speed Launcher] «C:Program FilesAdobeReader 8.0ReaderReader_sl.exe»
O4 — HKLM..Run: [SunJavaUpdateSched] «C:Program FilesJavajre6binjusched.exe»
O4 — HKLM..RunOnce: [Malwarebytes’ Anti-Malware] C:Program FilesMalwarebytes’ Anti-Malwarembamgui.exe /install /silent
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [DAEMON Tools] «C:Program FilesDAEMON Toolsdaemon.exe» -lang 1033
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — Startup: Proxomitron-RE.lnk = C:Program FilesProxomitronProxomitron.exe
O4 — Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOfficeOSA9.EXE
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 — Extra context menu item: Закачать ВСЕ при помощи Download Master — C:Program FilesDownload Masterdmieall.htm
O8 — Extra context menu item: Закачать при помощи Download Master — C:Program FilesDownload Masterdmie.htm
O9 — Extra button: WebMoney Advisor — {3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — C:Program FilesWebMoney Advisorwmadvisor.dll
O9 — Extra ‘Tools’ menuitem: WebMoney Advisor — {3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — C:Program FilesWebMoney Advisorwmadvisor.dll
O9 — Extra button: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra ‘Tools’ menuitem: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra button: Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
O9 — Extra ‘Tools’ menuitem: &Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
O9 — Extra button: Справочные материалы — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O16 — DPF: {463ED66E-431B-11D2-ADB0-0080C83DA4EB} (AcceptWM Class) — https://w3s.webmoney.ru/WMAcceptor.dll
O16 — DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) — http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 — DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) — http://www.acclaim.com/cabs/acclaim_v5.cab
O16 — DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) — http://my.foto.mail.ru/ImageUploader4.cab
O16 — DPF: {7C6E92FA-4429-4FB6-909B-798E2EFFAEF0} (NCWeb.Launcher) — http://lineage2.plaync.co.kr/common/ocx/ncweb.cab
O17 — HKLMSystemCCSServicesTcpip..{89A22DCC-BC13-4E52-A6E2-3F0E51BB6B4D}: NameServer = 195.34.32.116 212.188.4.10
O18 — Protocol: skype4com — {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} — C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O23 — Service: Apache2.2 — Apache Software Foundation — D:AppServApache2.2binhttpd.exe
O23 — Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) — Apple Computer, Inc. — C:Program FilesBonjourmDNSResponder.exe
O23 — Service: Eset HTTP Server (EhttpSrv) — ESET — C:Program FilesESETESET NOD32 AntivirusEHttpSrv.exe
O23 — Service: Eset Service (ekrn) — ESET — C:Program FilesESETESET NOD32 Antivirusekrn.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: FLEXnet Licensing Service — Macrovision Europe Ltd. — C:Program FilesCommon FilesMacrovision SharedFLEXnet PublisherFNPLicensingService.exe
O23 — Service: InstallDriver Table Manager (IDriverT) — Macrovision Corporation — C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: Java Quick Starter (JavaQuickStarterService) — Sun Microsystems, Inc. — C:Program FilesJavajre6binjqs.exe
O23 — Service: NetMeeting Remote Desktop Sharing (mnmsrvc) — Корпорация Майкрософт — C:WINDOWSsystem32mnmsrvc.exe
O23 — Service: NBService — Nero AG — C:Program FilesNeroNero 7Nero BackItUpNBService.exe
O23 — Service: NMIndexingService — Nero AG — C:Program FilesCommon FilesAheadLibNMIndexingService.exe
O23 — Service: nnCron — nnSoft — C:Program FilesnnCronnncron.exe
O23 — Service: NVIDIA Display Driver Service (NVSvc) — NVIDIA Corporation — C:WINDOWSsystem32nvsvc32.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) — CACE Technologies — C:Program FilesWinPcaprpcapd.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: ServiceLayer — Nokia. — C:Program FilesPC Connectivity SolutionServiceLayer.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe—
End of file — 9862 bytes======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll [2006-10-22 62080][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{1236D836-E9BA-4175-894F-2072A14D5A26}]
TBSB00196 Class — C:Program FilesWebMoney Advisorwmadvisor.dll [2008-03-05 2465792][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{6E228C92-9153-44A8-BECA-50B14D276B0F}]
TBSB00901 Class — C:Program FilesCommon FilesMicrosoft SharedIEKB472817 System Support Fileszasta.dll [2008-03-13 2371584][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper — C:Program FilesJavajre6binssv.dll [2008-11-10 320920][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9961627E-4059-41B4-8E0E-A7D6B3854ADF}]
IE 4.x-6.x BHO for Download Master — C:PROGRA~1DOWNLO~1dmiehlp.dll [2008-10-24 157696][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper — C:Program FilesJavajre6binjp2ssv.dll [2008-11-10 34816][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll [2008-11-10 73728][HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — WebMoney Advisor — C:Program FilesWebMoney Advisorwmadvisor.dll [2008-03-05 2465792][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«NeroFilterCheck»=C:Program FilesCommon FilesAheadLibNeroCheck.exe [2007-03-09 153136]
«ISUSPM Startup»=C:Program FilesCommon FilesInstallShieldUpdateServiceisuspm.exe [2005-08-11 249856]
«ISUSScheduler»=C:Program FilesCommon FilesInstallShieldUpdateServiceissch.exe [2005-08-11 81920]
«SoundMan»=C:WINDOWSSOUNDMAN.EXE [2006-11-17 577536]
«egui»=C:Program FilesESETESET NOD32 Antivirusegui.exe [2008-02-06 1443072]
«QuickTime Task»=C:Program FilesQuickTimeqttask.exe [2008-04-02 385024]
«MAgent»=C:Program FilesMail.RuAgentmagent.exe [2008-12-17 4428472]
«NvCplDaemon»=C:WINDOWSsystem32NvCpl.dll [2008-05-03 13529088]
«nwiz»=nwiz.exe /install []
«NvMediaCenter»=C:WINDOWSsystem32NvMcTray.dll [2008-05-03 86016]
«wmagent.exe»=C:Program FilesWebMoney Agentwmagent.exe [2008-10-01 209376]
«Adobe Reader Speed Launcher»=C:Program FilesAdobeReader 8.0ReaderReader_sl.exe [2008-10-15 39792]
«SunJavaUpdateSched»=C:Program FilesJavajre6binjusched.exe [2008-11-10 136600][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnce]
«Malwarebytes’ Anti-Malware»=C:Program FilesMalwarebytes’ Anti-Malwarembamgui.exe [2009-02-11 399504][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=C:WINDOWSsystem32ctfmon.exe [2004-08-17 15360]
«DAEMON Tools»=C:Program FilesDAEMON Toolsdaemon.exe [2006-11-12 157592]C:Documents and SettingsAll UsersГлавное менюПрограммыАвтозагрузка
Microsoft Office.lnk — C:Program FilesMicrosoft OfficeOfficeOSA9.EXEC:Documents and SettingsРоманГлавное менюПрограммыАвтозагрузка
Proxomitron-RE.lnk — C:Program FilesProxomitronProxomitron.exe[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyWgaLogon]
C:WINDOWSsystem32WgaLogon.dll [2007-03-15 236928][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
UPnPMonitor — {e57ce738-33e8-4c51-8354-bb4de9d215d1} — C:WINDOWSsystem32upnpui.dll [2004-08-17 239616][HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworknm]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworknm.sys]
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=323
«NoDriveAutoRun»=67108863
«NoDrives»=0[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«HonorAutoRunSetting»=
«NoDriveAutoRun»=
«NoDriveTypeAutoRun»=
«NoDrives»=[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«D:GamesCounter-Strike_1.6_v19hl.exe»=»D:GamesCounter-Strike_1.6_v19hl.exe:*:Enabled:Half-Life Launcher»
«C:Program FilesuTorrent [tfile.ru]utorrent.exe»=»C:Program FilesuTorrent [tfile.ru]utorrent.exe:*:Enabled:µTorrent»
«D:GamesCounter-Strike_1.6_v19hlds.exe»=»D:GamesCounter-Strike_1.6_v19hlds.exe:*:Enabled:HLDS Launcher»
«C:WINDOWSsystem32dplaysvr.exe»=»C:WINDOWSsystem32dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper»
«C:Program FilesQIPqip.exe»=»C:Program FilesQIPqip.exe:*:Enabled:Quiet Internet Pager»
«C:Program FilesNamoWebEditor 2006binWebEditor.exe»=»C:Program FilesNamoWebEditor 2006binWebEditor.exe:*:Enabled:Namo WebEditor 2006»
«C:Program FilesMail.RuAgentmagent.exe»=»C:Program FilesMail.RuAgentmagent.exe:*:Enabled:Mail.Ru Агент»
«C:Program FilesMessengermsmsgs.exe»=»C:Program FilesMessengermsmsgs.exe:*:Enabled:Windows Messenger»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«C:Program FilesOperaOpera.exe»=»C:Program FilesOperaOpera.exe:*:Enabled:Opera Internet Browser»
«C:WINDOWSsystem32java.exe»=»C:WINDOWSsystem32java.exe:*:Enabled:Java(TM) Platform SE binary»
«C:WINDOWSsystem32dpnsvr.exe»=»C:WINDOWSsystem32dpnsvr.exe:*:Enabled:Сервер Microsoft DirectPlay8»
«C:Program FilesBonjourmDNSResponder.exe»=»C:Program FilesBonjourmDNSResponder.exe:*:Enabled:Bonjour»
«C:Program FilesWebMoneyWebMoney.exe»=»C:Program FilesWebMoneyWebMoney.exe:*:Enabled:WebMoney Keeper Classic Runner Module»
«C:Program FilesHamachihamachi.exe»=»C:Program FilesHamachihamachi.exe:*:Enabled:Hamachi Client»
«C:Program FilesSkypePhoneSkype.exe»=»C:Program FilesSkypePhoneSkype.exe:*:Enabled:Skype. Take a deep breath «
«C:Program FilesQIP Infiuminfium.exe»=»C:Program FilesQIP Infiuminfium.exe:*:Enabled:QIP Infium»
«D:Gameslineage2systeml2.exe»=»D:Gameslineage2systeml2.exe:*:Enabled:l2»
«D:GamesWarzone2100WarRuss.exe»=»D:GamesWarzone2100WarRuss.exe:*:Enabled:Warzone 2100»
«D:GamesRCCarsRCCars.exe»=»D:GamesRCCarsRCCars.exe:*:Enabled:RCCars executable»
«C:Program FilesSHOUTcastsc_serv.exe»=»C:Program FilesSHOUTcastsc_serv.exe:*:Enabled:sc_serv»
«D:AppServApache2.2binhttpd.exe»=»D:AppServApache2.2binhttpd.exe:*:Enabled:Apache HTTP Server»[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{c77f0f14-fe82-11dc-9805-92c609fb3fa2}]
shellAutoRuncommand — G:MafiaLauncher.EXE======List of files/folders created in the last 1 months======
2009-03-18 12:20:58 —-D—- C:Documents and SettingsРоманApplication DataMalwarebytes
2009-03-18 12:20:50 —-D—- C:Documents and SettingsAll UsersApplication DataMalwarebytes
2009-03-18 12:20:49 —-D—- C:Program FilesMalwarebytes’ Anti-Malware
2009-03-18 12:09:54 —-D—- C:_OTMoveIt
2009-03-17 01:17:37 —-SHD—- C:RECYCLER
2009-03-17 01:15:21 —-D—- C:Program FilesMySQL
2009-03-17 01:08:33 —-A—- C:ComboFix.txt
2009-03-16 11:03:16 —-A—- C:WINDOWSzip.exe
2009-03-16 11:03:16 —-A—- C:WINDOWSVFIND.exe
2009-03-16 11:03:16 —-A—- C:WINDOWSSWXCACLS.exe
2009-03-16 11:03:16 —-A—- C:WINDOWSSWSC.exe
2009-03-16 11:03:16 —-A—- C:WINDOWSSWREG.exe
2009-03-16 11:03:16 —-A—- C:WINDOWSsed.exe
2009-03-16 11:03:16 —-A—- C:WINDOWSNIRCMD.exe
2009-03-16 11:03:16 —-A—- C:WINDOWSgrep.exe
2009-03-16 11:03:16 —-A—- C:WINDOWSfdsv.exe
2009-03-16 11:03:12 —-D—- C:WINDOWSERDNT
2009-03-16 11:03:09 —-D—- C:Qoobox
2009-03-16 10:02:28 —-D—- C:Program Filestrend micro
2009-03-16 10:02:27 —-D—- C:rsit
2009-03-15 19:35:28 —-D—- C:acd7741803235b471a079008df
2009-03-15 11:04:26 —-HDC—- C:WINDOWS$NtUninstallKB960225$
2009-03-15 11:04:10 —-HDC—- C:WINDOWS$NtUninstallKB958690$
2009-03-14 16:02:59 —-D—- C:Documents and SettingsРоманApplication DataRadmin
2009-03-14 13:52:39 —-D—- C:Documents and SettingsAll UsersApplication DataMySQL
2009-03-12 02:57:03 —-D—- C:Documents and SettingsРоманApplication DataInstallShield
2009-03-10 23:22:45 —-D—- C:Program FilesSHOUTcast
2009-03-09 13:44:31 —-D—- C:Documents and SettingsAll UsersApplication DataFugazo
2009-03-09 13:42:19 —-D—- C:Program FilesFishCo
2009-03-09 13:42:08 —-D—- C:Program FilesReflexiveArcade
2009-03-01 23:06:59 —-D—- C:Documents and SettingsРоманApplication DataDivX
2009-03-01 11:08:54 —-HDC—- C:WINDOWS$NtUninstallKB967715$
2009-02-27 18:10:01 —-D—- C:Documents and SettingsРоманApplication DataWNR
2009-02-27 17:41:13 —-D—- C:Program FilesHamachi
2009-02-24 20:00:09 —-D—- C:Program FilesAutoClick
2009-02-23 18:06:13 —-D—- C:Program FilesnnCron======List of files/folders modified in the last 1 months======
2009-03-18 12:29:05 —-D—- C:WINDOWSTemp
2009-03-18 12:28:02 —-RD—- C:Program Files
2009-03-18 12:20:55 —-D—- C:WINDOWSsystem32drivers
2009-03-18 12:20:45 —-D—- C:WINDOWSPrefetch
2009-03-18 12:13:01 —-A—- C:WINDOWSSchedLgU.Txt
2009-03-18 11:59:33 —-D—- C:Documents and SettingsРоманApplication DataFileZilla
2009-03-17 01:16:04 —-SHD—- C:WINDOWSInstaller
2009-03-17 01:08:39 —-D—- C:WINDOWSsystem32
2009-03-17 01:08:37 —-D—- C:WINDOWS
2009-03-17 01:05:38 —-A—- C:WINDOWSsystem.ini
2009-03-17 01:04:51 —-D—- C:WINDOWSAppPatch
2009-03-17 01:04:40 —-D—- C:Program FilesCommon Files
2009-03-17 01:01:38 —-D—- C:WINDOWSsystem32CatRoot2
2009-03-17 00:41:49 —-A—- C:WINDOWSphp.ini
2009-03-17 00:26:42 —-D—- C:Documents and SettingsРоманApplication DatauTorrent
2009-03-15 11:04:32 —-HD—- C:WINDOWSinf
2009-03-15 11:04:29 —-RSHDC—- C:WINDOWSsystem32dllcache
2009-03-15 11:04:20 —-A—- C:WINDOWSimsins.BAK
2009-03-14 01:45:14 —-A—- C:WINDOWSNeroDigital.ini
2009-03-12 02:57:33 —-HD—- C:Program FilesInstallShield Installation Information
2009-03-11 22:40:03 —-D—- C:Program FilesElcomSoft
2009-03-11 21:48:58 —-D—- C:Downloads
2009-03-11 18:43:40 —-HD—- C:WINDOWS$hf_mig$
2009-03-10 23:35:09 —-D—- C:Documents and SettingsРоманApplication DataWinamp
2009-03-10 23:21:33 —-D—- C:Program FilesWinamp
2009-03-08 12:27:24 —-D—- C:Program FilesQIP Infium
2009-03-08 11:33:19 —-D—- C:Program FilesDownload Master
2009-03-07 23:36:36 —-D—- C:Program FilesOpera
2009-03-01 22:01:37 —-AD—- C:Program Filesakm_chat
2009-03-01 11:55:16 —-D—- C:Program FilesDivX
2009-03-01 11:17:10 —-D—- C:Documents and SettingsРоманApplication DataHamachi
2009-02-28 18:40:31 —-D—- C:Program FilesMozilla Firefox
2009-02-26 10:30:51 —-AD—- C:Documents and SettingsAll UsersApplication DataTEMP
2009-02-25 23:54:59 —-A—- C:WINDOWSsystem32MRT.exe
2009-02-25 00:18:04 —-D—- C:Documents and SettingsРоманApplication DataWebMoney
2009-02-24 22:41:11 —-D—- C:Program FilesFileZilla FTP Client======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 easdrv;easdrv; C:WINDOWSsystem32DRIVERSeasdrv.sys [2008-02-06 29704]
R1 epfwtdir;epfwtdir; C:WINDOWSsystem32DRIVERSepfwtdir.sys [2008-02-06 34312]
R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2004-08-17 40448]
R2 eamon;EAMON; C:WINDOWSsystem32DRIVERSeamon.sys [2008-02-06 39944]
R2 irda;ИК-протокол IrDA; C:WINDOWSsystem32DRIVERSirda.sys [2004-08-03 87424]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:WINDOWSsystem32driversALCXWDM.SYS [2006-11-23 4025088]
R3 hamachi;Hamachi Network Interface; C:WINDOWSsystem32DRIVERShamachi.sys [2009-02-27 25280]
R3 ms_mpu401;Драйвер UART Microsoft MPU-401 MIDI; C:WINDOWSsystem32driversmsmpu401.sys [2001-08-18 2944]
R3 nv;nv; C:WINDOWSsystem32DRIVERSnv4_mini.sys [2008-05-03 6554496]
R3 Rasirda;Минипорт WAN (IrDA); C:WINDOWSsystem32DRIVERSrasirda.sys [2001-08-17 19584]
R3 Stmatm;ATM/ADSL miniport; C:WINDOWSsystem32DRIVERSstmatm.sys [2003-08-12 60255]
R3 TaurusUsb;ADSL Modem USB Service; C:WINDOWSsystem32DRIVERStorususb.sys [2004-05-12 542893]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2004-08-03 26624]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2004-08-03 57600]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2004-08-03 20480]
S3 a9co70qz;a9co70qz; C:WINDOWSsystem32driversa9co70qz.sys []
S3 nm;Драйвер сетевого монитора; C:WINDOWSsystem32DRIVERSNMnt.sys [2004-08-03 40320]
S3 NPF;NetGroup Packet Filter Driver; C:WINDOWSsystem32driversnpf.sys [2007-11-06 34064]
S3 NPFWFLT;NPFWFLT; ??C:WINDOWSsystem32NPFWFLT.SYS []
S3 npkcrypt;npkcrypt; ??D:Gameslineage2systemnpkcrypt.sys []
S3 npkycryp;npkycryp; ??D:Gameslineage2systemnpkycryp.sys []
S3 STIrUsb;SigmaTel USB-IrDA Dongle; C:WINDOWSsystem32DRIVERSirstusb.sys [2001-08-17 26624]
S3 usbscan;Драйвер USB-сканера; C:WINDOWSsystem32DRIVERSusbscan.sys [2004-08-03 15104]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2004-08-03 26496]
S4 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:WINDOWSSystem32driversws2ifsl.sys [2001-10-20 12032]======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 Apache2.2;Apache2.2; D:AppServApache2.2binhttpd.exe [2008-01-17 24635]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:Program FilesBonjourmDNSResponder.exe [2006-02-28 229376]
R2 ekrn;Eset Service; C:Program FilesESETESET NOD32 Antivirusekrn.exe [2008-02-06 472320]
R2 Irmon;Монитор инфракрасной связи; C:WINDOWSsystem32svchost.exe [2004-08-17 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:Program FilesJavajre6binjqs.exe [2008-11-10 152984]
R2 NVSvc;NVIDIA Display Driver Service; C:WINDOWSsystem32nvsvc32.exe [2008-05-03 159812]
R2 UMWdf;Windows User Mode Driver Framework; C:WINDOWSsystem32wdfmgr.exe [2004-08-11 38912]
S2 nnCron;nnCron; C:Program FilesnnCronnncron.exe [2006-03-21 408576]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2007-10-24 70144]
S3 EhttpSrv;Eset HTTP Server; C:Program FilesESETESET NOD32 AntivirusEHttpSrv.exe [2008-02-06 19200]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:Program FilesCommon FilesMacrovision SharedFLEXnet PublisherFNPLicensingService.exe [2008-11-12 654848]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:WINDOWSMicrosoft.NetFrameworkv3.0WPFPresentationFontCache.exe [2006-10-20 36864]
S3 IDriverT;InstallDriver Table Manager; C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe [2005-04-03 69632]
S3 idsvc;Windows CardSpace; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication Foundationinfocard.exe [2006-10-30 741376]
S3 NBService;NBService; C:Program FilesNeroNero 7Nero BackItUpNBService.exe [2007-01-15 774144]
S3 NMIndexingService;NMIndexingService; C:Program FilesCommon FilesAheadLibNMIndexingService.exe [2007-03-12 271920]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2003-07-28 89136]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:Program FilesWinPcaprpcapd.exe [2007-11-06 92792]
S3 ServiceLayer;ServiceLayer; C:Program FilesPC Connectivity SolutionServiceLayer.exe [2007-11-06 352768]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication FoundationSMSvcHost.exe [2006-10-30 122880]
EOF
MBAM лог
Malwarebytes’ Anti-Malware 1.34
Версия базы данных: 1861
Windows 5.1.2600 Service Pack 218.03.2009 12:28:02
mbam-log-2009-03-18 (12-28-02).txtТип проверки: Быстрая
Проверено объектов: 64636
Прошло времени: 4 minute(s), 37 second(s)Заражено процессов в памяти: 0
Заражено модулей в памяти: 0
Заражено ключей реестра: 4
Заражено значений реестра: 1
Заражено параметров реестра: 0
Заражено папок: 1
Заражено файлов: 1Заражено процессов в памяти:
(Вредоносные программы не обнаружены)Заражено модулей в памяти:
(Вредоносные программы не обнаружены)Заражено ключей реестра:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall{6d7b211a-88ea-490c-bab9-3600d8d7c503} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USERSOFTWAREWakeNet (Trojan.Adware) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstalltbsb00196.tbsb00196toolbar (Adware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstalltbsb00901.tbsb00901toolbar (Adware.Trace) -> Quarantined and deleted successfully.Заражено значений реестра:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunadsltaskbar (Trojan.Agent) -> Quarantined and deleted successfully.Заражено параметров реестра:
(Вредоносные программы не обнаружены)Заражено папок:
C:Program FilesConnectionServices (Adware.BHO) -> Quarantined and deleted successfully.Заражено файлов:
C:Program FilesConnectionServicesUninstall.exe (Adware.BHO) -> Quarantined and deleted successfully.OTMoveIt лог
========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========ServiceDriver usprserv deleted successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{6C517674-DE1C-4493-977C-34A1BFAB35BA}\ not found.
Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{6D7B211A-88EA-490c-BAB9-3600D8D7C503}\ not found.
Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9D64F819-9380-8473-DAB2-702FCB3D7A3E}\ not found.
Registry value HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar\{A8C6F37D-75CB-42D0-9950-5549891B448A} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{A8C6F37D-75CB-42D0-9950-5549891B448A} deleted successfully.
Registry value HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun\CS Update deleted successfully.
========== FILES ==========
LoadLibrary failed for C:Documents and SettingsРоманApplication Databpfeed.dll
C:Documents and SettingsРоманApplication Databpfeed.dll NOT unregistered.
C:Documents and SettingsРоманApplication Databpfeed.dll moved successfully.
========== COMMANDS ==========
User’s Temp folder emptied.
User’s Temporary Internet Files folder emptied.
User’s Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:Documents and SettingsLocalServiceLocal SettingsTemporary Internet FilesContent.IE5index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:WINDOWStempPerflib_Perfdata_380.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps006adoc.bx scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps006md.dat scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps006url.ax scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps006w.ax scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps006wb.vx scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps005adoc.bx scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps005md.dat scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps005url.ax scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps005w.ax scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps005wb.vx scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps004adoc.bx scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps004md.dat scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps004url.ax scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps004w.ax scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps004wb.vx scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps003adoc.bx scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps003md.dat scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps003url.ax scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps003w.ax scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps003wb.vx scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps002adoc.bx scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps002md.dat scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps002url.ax scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps002w.ax scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps002wb.vx scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps001adoc.bx scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps001md.dat scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps001url.ax scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps001w.ax scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps001wb.vx scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps000adoc.bx scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps000md.dat scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps000url.ax scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps000w.ax scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps000wb.vx scheduled to be deleted on reboot.
Opera cache emptied.
Temp folders emptied.
Explorer started successfullyOTMoveIt3 by OldTimer — Version 1.0.9.0 log created on 03182009_120954
Files moved on Reboot…
C:Documents and SettingsLocalServiceLocal SettingsTemporary Internet FilesContent.IE5index.dat moved successfully.
File C:WINDOWStempPerflib_Perfdata_380.dat not found!
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps006adoc.bx moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps006md.dat moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps006url.ax moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps006w.ax moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps006wb.vx moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps005adoc.bx moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps005md.dat moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps005url.ax moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps005w.ax moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps005wb.vx moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps004adoc.bx moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps004md.dat moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps004url.ax moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps004w.ax moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps004wb.vx moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps003adoc.bx moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps003md.dat moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps003url.ax moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps003w.ax moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps003wb.vx moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps002adoc.bx moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps002md.dat moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps002url.ax moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps002w.ax moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps002wb.vx moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps001adoc.bx moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps001md.dat moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps001url.ax moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps001w.ax moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps001wb.vx moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps000adoc.bx moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps000md.dat moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps000url.ax moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps000w.ax moved successfully.
C:Documents and SettingsРоманLocal SettingsApplication DataOperaOperaProfilevps000wb.vx moved successfully.Log.txt
Logfile of random’s system information tool 1.05 (written by random/random)
Run by Роман at 2009-03-16 10:02:27
Microsoft Windows XP Professional Service Pack 2
System drive C: has 8 GB (39%) free of 20 GB
Total RAM: 1023 MB (56% free)Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:02:48, on 16.03.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: NormalRunning processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSSOUNDMAN.EXE
C:Program FilesESETESET NOD32 Antivirusegui.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:Program FilesWebMoney Agentwmagent.exe
C:WINDOWSsystem32rundll32.exe
C:Program FilesJavajre6binjusched.exe
C:WINDOWSsystem32ctfmon.exe
C:AppServApache2.2binhttpd.exe
C:Program FilesBonjourmDNSResponder.exe
C:Program FilesESETESET NOD32 Antivirusekrn.exe
C:Program FilesJavajre6binjqs.exe
C:Program FilesMySQLMySQL Server 6.0binmysqld.exe
C:AppServApache2.2binhttpd.exe
C:WINDOWSsystem32nvsvc32.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32wuauclt.exe
C:DownloadsПрограммыRSIT.exe
C:Program Filestrend microРоман.exeR0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.mail.ru/
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://www.besttoolbars.net/
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: (no name) — {83821C2B-32A8-4DD7-B6D4-44309A78E668} — C:Program FilesMail.RuAgentMradllnewmrasearch.dll
R3 — URLSearchHook: (no name) — {3FC0460E-A9D3-40C2-878B-CFA16C6E1262} — (no file)
O1 — Hosts: 92.50.229.10 nprotect.lineage2.com
O1 — Hosts: 92.50.229.10 nprotect.ncsoft.co.kr
O1 — Hosts: 92.50.229.10 update.nprotect.com
O1 — Hosts: 92.50.229.10 update.nprotect.net
O2 — BHO: Adobe PDF Reader Link Helper — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 — BHO: TBSB00196 — {1236D836-E9BA-4175-894F-2072A14D5A26} — C:Program FilesWebMoney Advisorwmadvisor.dll
O2 — BHO: VirtualNetwork module — {6C517674-DE1C-4493-977C-34A1BFAB35BA} — (no file)
O2 — BHO: ConnectionServices module — {6D7B211A-88EA-490c-BAB9-3600D8D7C503} — C:Program FilesConnectionServicesConnectionServices.dll (file missing)
O2 — BHO: TBSB00901 — {6E228C92-9153-44A8-BECA-50B14D276B0F} — C:Program FilesCommon FilesMicrosoft SharedIEKB472817 System Support Fileszasta.dll
O2 — BHO: Java(tm) Plug-In SSV Helper — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — C:Program FilesJavajre6binssv.dll
O2 — BHO: IE 4.x-6.x BHO for Download Master — {9961627E-4059-41B4-8E0E-A7D6B3854ADF} — C:PROGRA~1DOWNLO~1dmiehlp.dll
O2 — BHO: BP Data Feeder — {9D64F819-9380-8473-DAB2-702FCB3D7A3E} — %USERPROFILE%Application Databpfeed.dll (file missing)
O2 — BHO: Java(tm) Plug-In 2 SSV Helper — {DBC80044-A445-435b-BC74-9C25C1C588A9} — C:Program FilesJavajre6binjp2ssv.dll
O2 — BHO: JQSIEStartDetectorImpl — {E7E6F031-17CE-4C07-BC86-EABFE594F69C} — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll
O3 — Toolbar: WebMoney Advisor — {3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — C:Program FilesWebMoney Advisorwmadvisor.dll
O3 — Toolbar: KB472817 System Support Files — {A8C6F37D-75CB-42D0-9950-5549891B448A} — C:Program FilesCommon FilesMicrosoft SharedIEKB472817 System Support Fileszasta.dll
O4 — HKLM..Run: [NeroFilterCheck] C:Program FilesCommon FilesAheadLibNeroCheck.exe
O4 — HKLM..Run: [Adobe Photo Downloader] «C:Program FilesAdobePhotoshop Album Starter Edition3.2Appsapdproxy.exe»
O4 — HKLM..Run: [ISUSPM Startup] «C:Program FilesCommon FilesInstallShieldUpdateServiceisuspm.exe» -startup
O4 — HKLM..Run: [ISUSScheduler] «C:Program FilesCommon FilesInstallShieldUpdateServiceissch.exe» -start
O4 — HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 — HKLM..Run: [egui] «C:Program FilesESETESET NOD32 Antivirusegui.exe» /hide /waitservice
O4 — HKLM..Run: [QuickTime Task] «C:Program FilesQuickTimeqttask.exe» -atboottime
O4 — HKLM..Run: [MAgent] C:Program FilesMail.RuAgentmagent.exe -LM
O4 — HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 — HKLM..Run: [nwiz] nwiz.exe /install
O4 — HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 — HKLM..Run: [wmagent.exe] «C:Program FilesWebMoney Agentwmagent.exe»
O4 — HKLM..Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 — HKLM..Run: [Adobe Reader Speed Launcher] «C:Program FilesAdobeReader 8.0ReaderReader_sl.exe»
O4 — HKLM..Run: [SunJavaUpdateSched] «C:Program FilesJavajre6binjusched.exe»
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [WinXPChanger] C:DOCUME~1726E~1LOCALS~1TempRar$EX00.407winxpchanger.exe
O4 — HKCU..Run: [CS Update] copy /Y «C:Program FilesConnectionServicesConnectionServices.dll.upd» «C:Program FilesConnectionServicesConnectionServices.dll»
O4 — HKCU..Run: [DAEMON Tools] «C:Program FilesDAEMON Toolsdaemon.exe» -lang 1033
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — Startup: Proxomitron-RE.lnk = C:Program FilesProxomitronProxomitron.exe
O4 — Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOfficeOSA9.EXE
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 — Extra context menu item: Закачать ВСЕ при помощи Download Master — C:Program FilesDownload Masterdmieall.htm
O8 — Extra context menu item: Закачать при помощи Download Master — C:Program FilesDownload Masterdmie.htm
O9 — Extra button: WebMoney Advisor — {3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — C:Program FilesWebMoney Advisorwmadvisor.dll
O9 — Extra ‘Tools’ menuitem: WebMoney Advisor — {3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — C:Program FilesWebMoney Advisorwmadvisor.dll
O9 — Extra button: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra ‘Tools’ menuitem: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra button: Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
O9 — Extra ‘Tools’ menuitem: &Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
O9 — Extra button: Справочные материалы — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O16 — DPF: {463ED66E-431B-11D2-ADB0-0080C83DA4EB} (AcceptWM Class) — https://w3s.webmoney.ru/WMAcceptor.dll
O16 — DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) — http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 — DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) — http://www.acclaim.com/cabs/acclaim_v5.cab
O16 — DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) — http://my.foto.mail.ru/ImageUploader4.cab
O16 — DPF: {7C6E92FA-4429-4FB6-909B-798E2EFFAEF0} (NCWeb.Launcher) — http://lineage2.plaync.co.kr/common/ocx/ncweb.cab
O16 — DPF: {DC4207CE-C03E-4449-ACB1-032CA4137053} (Npz Control) — https://nprotect.ncsoft.co.kr/nProtect/netizen2004/ncsoft/npz.cab
O17 — HKLMSystemCCSServicesTcpip..{89A22DCC-BC13-4E52-A6E2-3F0E51BB6B4D}: NameServer = 195.34.32.116 212.188.4.10
O18 — Protocol: skype4com — {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} — C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O23 — Service: Apache2.2 — Apache Software Foundation — C:AppServApache2.2binhttpd.exe
O23 — Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) — Apple Computer, Inc. — C:Program FilesBonjourmDNSResponder.exe
O23 — Service: Eset HTTP Server (EhttpSrv) — ESET — C:Program FilesESETESET NOD32 AntivirusEHttpSrv.exe
O23 — Service: Eset Service (ekrn) — ESET — C:Program FilesESETESET NOD32 Antivirusekrn.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: FLEXnet Licensing Service — Macrovision Europe Ltd. — C:Program FilesCommon FilesMacrovision SharedFLEXnet PublisherFNPLicensingService.exe
O23 — Service: InstallDriver Table Manager (IDriverT) — Macrovision Corporation — C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: Java Quick Starter (JavaQuickStarterService) — Sun Microsystems, Inc. — C:Program FilesJavajre6binjqs.exe
O23 — Service: NetMeeting Remote Desktop Sharing (mnmsrvc) — Корпорация Майкрософт — C:WINDOWSsystem32mnmsrvc.exe
O23 — Service: MySQL — Unknown owner — C:Program.exe (file missing)
O23 — Service: NBService — Nero AG — C:Program FilesNeroNero 7Nero BackItUpNBService.exe
O23 — Service: NMIndexingService — Nero AG — C:Program FilesCommon FilesAheadLibNMIndexingService.exe
O23 — Service: nnCron — nnSoft — C:Program FilesnnCronnncron.exe
O23 — Service: NVIDIA Display Driver Service (NVSvc) — NVIDIA Corporation — C:WINDOWSsystem32nvsvc32.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) — CACE Technologies — C:Program FilesWinPcaprpcapd.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: ServiceLayer — Nokia. — C:Program FilesPC Connectivity SolutionServiceLayer.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe—
End of file — 11049 bytes======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll [2006-10-22 62080][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{1236D836-E9BA-4175-894F-2072A14D5A26}]
TBSB00196 Class — C:Program FilesWebMoney Advisorwmadvisor.dll [2008-03-05 2465792][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{6C517674-DE1C-4493-977C-34A1BFAB35BA}]
VirtualNetwork Class[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{6D7B211A-88EA-490c-BAB9-3600D8D7C503}]
ConnectionServices Class — C:Program FilesConnectionServicesConnectionServices.dll [][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{6E228C92-9153-44A8-BECA-50B14D276B0F}]
TBSB00901 Class — C:Program FilesCommon FilesMicrosoft SharedIEKB472817 System Support Fileszasta.dll [2008-03-13 2371584][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper — C:Program FilesJavajre6binssv.dll [2008-11-10 320920][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9961627E-4059-41B4-8E0E-A7D6B3854ADF}]
IE 4.x-6.x BHO for Download Master — C:PROGRA~1DOWNLO~1dmiehlp.dll [2008-10-24 157696][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9D64F819-9380-8473-DAB2-702FCB3D7A3E}]
BP Data Feeder — C:Documents and SettingsРоманApplication Databpfeed.dll [2009-03-15 73728][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper — C:Program FilesJavajre6binjp2ssv.dll [2008-11-10 34816][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll [2008-11-10 73728][HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — WebMoney Advisor — C:Program FilesWebMoney Advisorwmadvisor.dll [2008-03-05 2465792]
{A8C6F37D-75CB-42D0-9950-5549891B448A} — KB472817 System Support Files — C:Program FilesCommon FilesMicrosoft SharedIEKB472817 System Support Fileszasta.dll [2008-03-13 2371584][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«NeroFilterCheck»=C:Program FilesCommon FilesAheadLibNeroCheck.exe [2007-03-09 153136]
«Adobe Photo Downloader»=C:Program FilesAdobePhotoshop Album Starter Edition3.2Appsapdproxy.exe []
«ISUSPM Startup»=C:Program FilesCommon FilesInstallShieldUpdateServiceisuspm.exe [2005-08-11 249856]
«ISUSScheduler»=C:Program FilesCommon FilesInstallShieldUpdateServiceissch.exe [2005-08-11 81920]
«SoundMan»=C:WINDOWSSOUNDMAN.EXE [2006-11-17 577536]
«egui»=C:Program FilesESETESET NOD32 Antivirusegui.exe [2008-02-06 1443072]
«QuickTime Task»=C:Program FilesQuickTimeqttask.exe [2008-04-02 385024]
«MAgent»=C:Program FilesMail.RuAgentmagent.exe [2008-12-17 4428472]
«NvCplDaemon»=C:WINDOWSsystem32NvCpl.dll [2008-05-03 13529088]
«nwiz»=nwiz.exe /install []
«NvMediaCenter»=C:WINDOWSsystem32NvMcTray.dll [2008-05-03 86016]
«wmagent.exe»=C:Program FilesWebMoney Agentwmagent.exe [2008-10-01 209376]
«AdslTaskBar»=C:WINDOWSsystem32stmctrl.dll [2004-08-31 159744]
«Adobe Reader Speed Launcher»=C:Program FilesAdobeReader 8.0ReaderReader_sl.exe [2008-10-15 39792]
«SunJavaUpdateSched»=C:Program FilesJavajre6binjusched.exe [2008-11-10 136600][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=C:WINDOWSsystem32ctfmon.exe [2004-08-17 15360]
«WinXPChanger»=C:DOCUME~1726E~1LOCALS~1TempRar$EX00.407winxpchanger.exe []
«CS Update»=copy /Y C:Program FilesConnectionServicesConnectionServices.dll.upd C:Program FilesConnectionServicesConnectionServices.dll []
«DAEMON Tools»=C:Program FilesDAEMON Toolsdaemon.exe [2006-11-12 157592]C:Documents and SettingsAll UsersГлавное менюПрограммыАвтозагрузка
Microsoft Office.lnk — C:Program FilesMicrosoft OfficeOfficeOSA9.EXEC:Documents and SettingsРоманГлавное менюПрограммыАвтозагрузка
Proxomitron-RE.lnk — C:Program FilesProxomitronProxomitron.exe[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyWgaLogon]
C:WINDOWSsystem32WgaLogon.dll [2007-03-15 236928][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
UPnPMonitor — {e57ce738-33e8-4c51-8354-bb4de9d215d1} — C:WINDOWSsystem32upnpui.dll [2004-08-17 239616][HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworknm]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworknm.sys]
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=B1000000[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«HonorAutoRunSetting»=[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«D:GamesCounter-Strike_1.6_v19hl.exe»=»D:GamesCounter-Strike_1.6_v19hl.exe:*:Enabled:Half-Life Launcher»
«C:Program FilesuTorrent [tfile.ru]utorrent.exe»=»C:Program FilesuTorrent [tfile.ru]utorrent.exe:*:Enabled:µTorrent»
«D:GamesCounter-Strike_1.6_v19hlds.exe»=»D:GamesCounter-Strike_1.6_v19hlds.exe:*:Enabled:HLDS Launcher»
«D:GamesTony Hawk’s Underground 2THUG2.exe»=»D:GamesTony Hawk’s Underground 2THUG2.exe:*:Enabled:THUG2»
«C:WINDOWSsystem32dplaysvr.exe»=»C:WINDOWSsystem32dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper»
«D:GamesWZ2100WarRuss.exe»=»D:GamesWZ2100WarRuss.exe:*:Enabled:Warzone 2100»
«C:Program FilesQIPqip.exe»=»C:Program FilesQIPqip.exe:*:Enabled:Quiet Internet Pager»
«C:Program FilesGamblergambler.exe»=»C:Program FilesGamblergambler.exe:*:Enabled:gambler»
«C:Program FilesNamoWebEditor 2006binWebEditor.exe»=»C:Program FilesNamoWebEditor 2006binWebEditor.exe:*:Enabled:Namo WebEditor 2006»
«C:Program FilesNamoWebCanvas 2006binWebCanvas.exe»=»C:Program FilesNamoWebCanvas 2006binWebCanvas.exe:*:Enabled:WebCanvas Application»
«C:Program FilesMail.RuAgentmagent.exe»=»C:Program FilesMail.RuAgentmagent.exe:*:Enabled:Mail.Ru Агент»
«C:Program FilesTorrent101Torrent101.exe»=»C:Program FilesTorrent101Torrent101.exe:*:Enabled:Torrent P2P application»
«C:Program FilesuTorrentuTorrent.exe»=»C:Program FilesuTorrentuTorrent.exe:*:Enabled:µTorrent»
«C:Documents and SettingsРоманРабочий столНовая папкаeL2Walker10.6.3-FULLWP406F.exe»=»C:Documents and SettingsРоманРабочий столНовая папкаeL2Walker10.6.3-FULLWP406F.exe:*:Enabled:* WP Walker Patcher * VS Verify Server * PPC Proxy Packet Converter *»
«D:GamesCOD2_SFCoD2MP_s.exe»=»D:GamesCOD2_SFCoD2MP_s.exe:*:Enabled:CoD2MP_s»
«C:Program FilesInternet ExplorerIEXPLORE.EXE»=»C:Program FilesInternet ExplorerIEXPLORE.EXE:*:Enabled:Internet Explorer»
«D:GamesNFS Undergroundspeed.exe»=»D:GamesNFS Undergroundspeed.exe:*:Enabled:speed»
«C:Program FilesMessengermsmsgs.exe»=»C:Program FilesMessengermsmsgs.exe:*:Enabled:Windows Messenger»
«D:Gameslineage2 interludeGameGuard EmulatordatausrlocalApache2binApache.exe»=»D:Gameslineage2 interludeGameGuard EmulatordatausrlocalApache2binApache.exe:*:Enabled:Apache HTTP Server»
«D:GamesMOTOGP Ultimate Racing Technology 3motog_.exe»=»D:GamesMOTOGP Ultimate Racing Technology 3motog_.exe:*:Enabled:motog_»
«C:Program FilesEmulGGhttp.exe»=»C:Program FilesEmulGGhttp.exe:*:Enabled:http»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«C:Program FilesOperaOpera.exe»=»C:Program FilesOperaOpera.exe:*:Enabled:Opera Internet Browser»
«D:GamesCOD2_HWCoD2MP_s.exe»=»D:GamesCOD2_HWCoD2MP_s.exe:*:Enabled:CoD2MP_s»
«D:GamesBlizzardWarCraft3TFTWarcraft III.exe»=»D:GamesBlizzardWarCraft3TFTWarcraft III.exe:*:Enabled:Warcraft III»
«C:DownloadsАрхивы10.7.4l2asrv.exe»=»C:DownloadsАрхивы10.7.4l2asrv.exe:*:Enabled:l2asrv»
«D:Gameslineage2 l2newНовая папкаKillGGGGhttp.exe»=»D:Gameslineage2 l2newНовая папкаKillGGGGhttp.exe:*:Enabled:http»
«D:Gameslineage2 l2newKillGGGGhttp.exe»=»D:Gameslineage2 l2newKillGGGGhttp.exe:*:Enabled:http»
«C:WINDOWSsystem32java.exe»=»C:WINDOWSsystem32java.exe:*:Enabled:Java(TM) Platform SE binary»
«D:GamesMotocross Madness 2MCM2.EXE»=»D:GamesMotocross Madness 2MCM2.EXE:*:Enabled:Microsoft® Motocross Madness 2»
«C:Program FilesGolden FTP ServerGFTP.exe»=»C:Program FilesGolden FTP ServerGFTP.exe:*:Enabled:Easy to use FTP server for Windows.»
«C:WINDOWSsystem32dpnsvr.exe»=»C:WINDOWSsystem32dpnsvr.exe:*:Enabled:Сервер Microsoft DirectPlay8»
«D:GamesMat Hoffman’s Pro BMXBMX.exe»=»D:GamesMat Hoffman’s Pro BMXBMX.exe:*:Enabled:BMX»
«C:Program FilesIP-TV PlayerIpTvPlayer.exe»=»C:Program FilesIP-TV PlayerIpTvPlayer.exe:*:Enabled:BorPas-Soft IP-TV Player»
«C:Program FilesBonjourmDNSResponder.exe»=»C:Program FilesBonjourmDNSResponder.exe:*:Enabled:Bonjour»
«D:GamesMetin2_UKmetin2.bin»=»D:GamesMetin2_UKmetin2.bin:*:Enabled:metin2»
«C:Program FilesWebMoneyWebMoney.exe»=»C:Program FilesWebMoneyWebMoney.exe:*:Enabled:WebMoney Keeper Classic Runner Module»
«C:Program FilesFortress2GAME.exe»=»C:Program FilesFortress2GAME.exe:*:Enabled:Fortress2 Blue Forever Launcher»
«C:Documents and SettingsРоманРабочий столL2Walker 10.7.4l2asrv.exe»=»C:Documents and SettingsРоманРабочий столL2Walker 10.7.4l2asrv.exe:*:Enabled:l2asrv»
«C:Documents and SettingsРоманРабочий столL2 Walker 10.7.1 rusL2W_VSE.exe»=»C:Documents and SettingsРоманРабочий столL2 Walker 10.7.1 rusL2W_VSE.exe:*:Enabled:L2W_VSE»
«D:GamesserverdiskwusrlocalApache2binApache.exe»=»D:GamesserverdiskwusrlocalApache2binApache.exe:*:Enabled:Apache HTTP Server»
«D:Gamesserverdiskwusrlocalmysqlbinmysqld-nt.exe»=»D:Gamesserverdiskwusrlocalmysqlbinmysqld-nt.exe:*:Enabled:mysqld-nt»
«C:Program FilesWinamp RemotebinOrb.exe»=»C:Program FilesWinamp RemotebinOrb.exe:*:Enabled:Orb»
«C:Program FilesWinamp RemotebinOrbTray.exe»=»C:Program FilesWinamp RemotebinOrbTray.exe:*:Enabled:OrbTray»
«C:Program FilesWinamp RemotebinOrbStreamerClient.exe»=»C:Program FilesWinamp RemotebinOrbStreamerClient.exe:*:Enabled:Orb Stream Client»
«D:Program FilesSonyVegas Pro 8.0VegSrv80.exe»=»D:Program FilesSonyVegas Pro 8.0VegSrv80.exe:*:Enabled:Sony Vegas Network Render Service Control»
«E:Russobit-mWorms2Frontend.exe»=»E:Russobit-mWorms2Frontend.exe:*:Enabled:Worms 2 Frontend»
«D:GamesWorms2Frontend.exe»=»D:GamesWorms2Frontend.exe:*:Enabled:Worms 2 Frontend»
«C:Program FilesHamachihamachi.exe»=»C:Program FilesHamachihamachi.exe:*:Enabled:Hamachi Client»
«D:GamesRussobit-MWorms World Partywwp.exe»=»D:GamesRussobit-MWorms World Partywwp.exe:*:Enabled:Worms World Party»
«D:Gamesфайлы под сервак и т.дl2phx318l2phx.exe»=»D:Gamesфайлы под сервак и т.дl2phx318l2phx.exe:*:Enabled:l2phx»
«C:Program FilesTotal CommanderTotalcmd.exe»=»C:Program FilesTotal CommanderTotalcmd.exe:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows»
«C:Documents and SettingsРоманРабочий столfree-rus-Power-FTP-clientfree-rus-Power-FTP-client.exe»=»C:Documents and SettingsРоманРабочий столfree-rus-Power-FTP-clientfree-rus-Power-FTP-client.exe:*:Enabled:free-rus-Power-FTP-client»
«C:Program FilesElectronic ArtsEADMCore.exe»=»C:Program FilesElectronic ArtsEADMCore.exe:*:Enabled:EA Download Manager»
«D:GamesElectronic ArtsEADMCore.exe»=»D:GamesElectronic ArtsEADMCore.exe:*:Enabled:EA Download Manager»
«C:Program FilesPPLivePPLive.exe»=»C:Program FilesPPLivePPLive.exe:*:Enabled:PPLive»
«C:Program FilesGarenaGarena.exe»=»C:Program FilesGarenaGarena.exe:*:Enabled:Garena»
«D:GamesBlizzardWarCraft3TFTwar3.exe»=»D:GamesBlizzardWarCraft3TFTwar3.exe:*:Enabled:Warcraft III»
«C:Documents and SettingsРоманLocal SettingsTempRar$EX00.187wtvClient.exe»=»C:Documents and SettingsРоманLocal SettingsTempRar$EX00.187wtvClient.exe:*:Enabled:wtvClient»
«C:Documents and SettingsРоманРабочий столwarcraft3 progwtvClient0.96.02wtvClient.exe»=»C:Documents and SettingsРоманРабочий столwarcraft3 progwtvClient0.96.02wtvClient.exe:*:Enabled:wtvClient»
«C:Program FilesSkypePhoneSkype.exe»=»C:Program FilesSkypePhoneSkype.exe:*:Enabled:Skype. Take a deep breath «
«D:GamesCStrike_1.6hl.exe»=»D:GamesCStrike_1.6hl.exe:*:Enabled:Half-Life Launcher»
«D:GamesCStrike_1.6hlds.exe»=»D:GamesCStrike_1.6hlds.exe:*:Enabled:HLDS Launcher»
«C:Program FilesQIP Infiuminfium.exe»=»C:Program FilesQIP Infiuminfium.exe:*:Enabled:QIP Infium»
«D:AppServApache2.2binhttpd.exe»=»D:AppServApache2.2binhttpd.exe:*:Enabled:Apache HTTP Server»
«D:Gameslineage2systeml2.exe»=»D:Gameslineage2systeml2.exe:*:Enabled:l2»
«D:GamesWarzone2100WarRuss.exe»=»D:GamesWarzone2100WarRuss.exe:*:Enabled:Warzone 2100»
«D:GamesRCCarsRCCars.exe»=»D:GamesRCCarsRCCars.exe:*:Enabled:RCCars executable»
«C:Program FilesSHOUTcastsc_serv.exe»=»C:Program FilesSHOUTcastsc_serv.exe:*:Enabled:sc_serv»
«C:Program FilesProxy Switcher StandardProxySwitcher.exe»=»C:Program FilesProxy Switcher StandardProxySwitcher.exe:*:Enabled:Proxy Switcher»
«D:AppServMySQLbinmysqld-nt.exe»=»D:AppServMySQLbinmysqld-nt.exe:*:Enabled:mysqld-nt»
«C:AppServApache2.2binhttpd.exe»=»C:AppServApache2.2binhttpd.exe:*:Enabled:Apache HTTP Server»[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{c77f0f14-fe82-11dc-9805-92c609fb3fa2}]
shellAutoRuncommand — G:MafiaLauncher.EXE======List of files/folders created in the last 1 months======
2009-03-16 10:02:28 —-D—- C:Program Filestrend micro
2009-03-16 10:02:27 —-D—- C:rsit
2009-03-15 19:35:28 —-D—- C:acd7741803235b471a079008df
2009-03-15 17:39:43 —-A—- C:Documents and SettingsРоманApplication Databpfeed.dll
2009-03-15 11:04:26 —-HDC—- C:WINDOWS$NtUninstallKB960225$
2009-03-15 11:04:10 —-HDC—- C:WINDOWS$NtUninstallKB958690$
2009-03-14 16:02:59 —-D—- C:Documents and SettingsРоманApplication DataRadmin
2009-03-14 13:56:09 —-D—- C:AppServ
2009-03-14 13:52:39 —-D—- C:Program FilesMySQL
2009-03-14 13:52:39 —-D—- C:Documents and SettingsAll UsersApplication DataMySQL
2009-03-12 02:57:03 —-D—- C:Documents and SettingsРоманApplication DataInstallShield
2009-03-10 23:22:45 —-D—- C:Program FilesSHOUTcast
2009-03-09 13:44:31 —-D—- C:Documents and SettingsAll UsersApplication DataFugazo
2009-03-09 13:42:19 —-D—- C:Program FilesFishCo
2009-03-09 13:42:08 —-D—- C:Program FilesReflexiveArcade
2009-03-01 23:06:59 —-D—- C:Documents and SettingsРоманApplication DataDivX
2009-03-01 11:08:54 —-HDC—- C:WINDOWS$NtUninstallKB967715$
2009-02-27 18:10:01 —-D—- C:Documents and SettingsРоманApplication DataWNR
2009-02-27 17:41:13 —-D—- C:Program FilesHamachi
2009-02-24 20:00:09 —-D—- C:Program FilesAutoClick
2009-02-23 18:06:13 —-D—- C:Program FilesnnCron======List of files/folders modified in the last 1 months======
2009-03-16 10:02:30 —-D—- C:WINDOWSPrefetch
2009-03-16 10:02:28 —-RD—- C:Program Files
2009-03-16 10:02:28 —-D—- C:WINDOWSTemp
2009-03-16 06:00:37 —-A—- C:WINDOWSSchedLgU.Txt
2009-03-16 06:00:13 —-D—- C:Documents and SettingsРоманApplication DatauTorrent
2009-03-15 21:06:27 —-D—- C:WINDOWS
2009-03-15 12:47:03 —-D—- C:Documents and SettingsРоманApplication DataFileZilla
2009-03-15 11:10:59 —-D—- C:WINDOWSsystem32
2009-03-15 11:04:32 —-HD—- C:WINDOWSinf
2009-03-15 11:04:29 —-RSHDC—- C:WINDOWSsystem32dllcache
2009-03-15 11:04:20 —-A—- C:WINDOWSimsins.BAK
2009-03-15 11:03:33 —-D—- C:WINDOWSsystem32CatRoot2
2009-03-14 13:56:23 —-A—- C:WINDOWSphp.ini
2009-03-14 13:53:16 —-SHD—- C:WINDOWSInstaller
2009-03-14 01:45:14 —-A—- C:WINDOWSNeroDigital.ini
2009-03-12 02:57:33 —-HD—- C:Program FilesInstallShield Installation Information
2009-03-11 22:40:03 —-D—- C:Program FilesElcomSoft
2009-03-11 21:48:58 —-D—- C:Downloads
2009-03-11 18:43:40 —-HD—- C:WINDOWS$hf_mig$
2009-03-10 23:35:09 —-D—- C:Documents and SettingsРоманApplication DataWinamp
2009-03-10 23:21:33 —-D—- C:Program FilesWinamp
2009-03-08 12:27:24 —-D—- C:Program FilesQIP Infium
2009-03-08 11:33:19 —-D—- C:Program FilesDownload Master
2009-03-07 23:36:36 —-D—- C:Program FilesOpera
2009-03-01 22:01:37 —-AD—- C:Program Filesakm_chat
2009-03-01 11:55:16 —-D—- C:Program FilesDivX
2009-03-01 11:17:10 —-D—- C:Documents and SettingsРоманApplication DataHamachi
2009-02-28 18:40:31 —-D—- C:Program FilesMozilla Firefox
2009-02-27 17:41:23 —-D—- C:WINDOWSsystem32drivers
2009-02-26 10:30:51 —-AD—- C:Documents and SettingsAll UsersApplication DataTEMP
2009-02-25 23:54:59 —-A—- C:WINDOWSsystem32MRT.exe
2009-02-25 00:18:04 —-D—- C:Documents and SettingsРоманApplication DataWebMoney
2009-02-24 22:41:11 —-D—- C:Program FilesFileZilla FTP Client======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 easdrv;easdrv; C:WINDOWSsystem32DRIVERSeasdrv.sys [2008-02-06 29704]
R1 epfwtdir;epfwtdir; C:WINDOWSsystem32DRIVERSepfwtdir.sys [2008-02-06 34312]
R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2004-08-17 40448]
R2 eamon;EAMON; C:WINDOWSsystem32DRIVERSeamon.sys [2008-02-06 39944]
R2 irda;ИК-протокол IrDA; C:WINDOWSsystem32DRIVERSirda.sys [2004-08-03 87424]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:WINDOWSsystem32driversALCXWDM.SYS [2006-11-23 4025088]
R3 hamachi;Hamachi Network Interface; C:WINDOWSsystem32DRIVERShamachi.sys [2009-02-27 25280]
R3 ms_mpu401;Драйвер UART Microsoft MPU-401 MIDI; C:WINDOWSsystem32driversmsmpu401.sys [2001-08-18 2944]
R3 nv;nv; C:WINDOWSsystem32DRIVERSnv4_mini.sys [2008-05-03 6554496]
R3 Rasirda;Минипорт WAN (IrDA); C:WINDOWSsystem32DRIVERSrasirda.sys [2001-08-17 19584]
R3 Stmatm;ATM/ADSL miniport; C:WINDOWSsystem32DRIVERSstmatm.sys [2003-08-12 60255]
R3 TaurusUsb;ADSL Modem USB Service; C:WINDOWSsystem32DRIVERStorususb.sys [2004-05-12 542893]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2004-08-03 26624]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2004-08-03 57600]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2004-08-03 20480]
S3 a8mltfny;a8mltfny; C:WINDOWSsystem32driversa8mltfny.sys []
S3 nm;Драйвер сетевого монитора; C:WINDOWSsystem32DRIVERSNMnt.sys [2004-08-03 40320]
S3 NPF;NetGroup Packet Filter Driver; C:WINDOWSsystem32driversnpf.sys [2007-11-06 34064]
S3 NPFWFLT;NPFWFLT; ??C:WINDOWSsystem32NPFWFLT.SYS []
S3 npkcrypt;npkcrypt; ??D:Gameslineage2systemnpkcrypt.sys []
S3 npkycryp;npkycryp; ??D:Gameslineage2systemnpkycryp.sys []
S3 STIrUsb;SigmaTel USB-IrDA Dongle; C:WINDOWSsystem32DRIVERSirstusb.sys [2001-08-17 26624]
S3 usbscan;Драйвер USB-сканера; C:WINDOWSsystem32DRIVERSusbscan.sys [2004-08-03 15104]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2004-08-03 26496]
S4 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:WINDOWSSystem32driversws2ifsl.sys [2001-10-20 12032]======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 Apache2.2;Apache2.2; C:AppServApache2.2binhttpd.exe [2008-01-17 24635]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:Program FilesBonjourmDNSResponder.exe [2006-02-28 229376]
R2 ekrn;Eset Service; C:Program FilesESETESET NOD32 Antivirusekrn.exe [2008-02-06 472320]
R2 Irmon;Монитор инфракрасной связи; C:WINDOWSsystem32svchost.exe [2004-08-17 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:Program FilesJavajre6binjqs.exe [2008-11-10 152984]
R2 MySQL;MySQL; C:Program FilesMySQLMySQL Server 6.0binmysqld —defaults-file=C:Program FilesMySQLMySQL Server 6.0my.ini MySQL []
R2 NVSvc;NVIDIA Display Driver Service; C:WINDOWSsystem32nvsvc32.exe [2008-05-03 159812]
R2 UMWdf;Windows User Mode Driver Framework; C:WINDOWSsystem32wdfmgr.exe [2004-08-11 38912]
S2 nnCron;nnCron; C:Program FilesnnCronnncron.exe [2006-03-21 408576]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2007-10-24 70144]
S3 EhttpSrv;Eset HTTP Server; C:Program FilesESETESET NOD32 AntivirusEHttpSrv.exe [2008-02-06 19200]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:Program FilesCommon FilesMacrovision SharedFLEXnet PublisherFNPLicensingService.exe [2008-11-12 654848]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:WINDOWSMicrosoft.NetFrameworkv3.0WPFPresentationFontCache.exe [2006-10-20 36864]
S3 IDriverT;InstallDriver Table Manager; C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe [2005-04-03 69632]
S3 idsvc;Windows CardSpace; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication Foundationinfocard.exe [2006-10-30 741376]
S3 NBService;NBService; C:Program FilesNeroNero 7Nero BackItUpNBService.exe [2007-01-15 774144]
S3 NMIndexingService;NMIndexingService; C:Program FilesCommon FilesAheadLibNMIndexingService.exe [2007-03-12 271920]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2003-07-28 89136]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:Program FilesWinPcaprpcapd.exe [2007-11-06 92792]
S3 ServiceLayer;ServiceLayer; C:Program FilesPC Connectivity SolutionServiceLayer.exe [2007-11-06 352768]
S3 usprserv;User Privilege Service; C:WINDOWSSystem32svchost.exe [2004-08-17 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication FoundationSMSvcHost.exe [2006-10-30 122880]
EOF
