SPYWARE-RU.COM

Созданные ответы форума

Просмотр 5 сообщений - с 1 по 5 (из 5 всего)

Автор

Сообщения
11 января, 2010 в 6:26 дп в ответ на: Вирус отключает интернет #27857
Saimon Wein
Participant
- Темы:1
- Сообщений:6
ДА,народ!!! НЕ ОТКЛЮЧАЙТЕ БРАНДМАУЭР И ПРОЧУЮ БАЗОВУЮ ЗАЩИТУ!!!!!!!!
11 января, 2010 в 6:24 дп в ответ на: Вирус отключает интернет #27856
Saimon Wein
Participant
- Темы:1
- Сообщений:6
по совету Strel-ка скачал : NoAutorun_vs_No_AutoShareWks.zip, вроде помогло,после этого аваст всё-таки осилил вирусы) обновил винду,тоже по его ссылкам.Пока все пашет нормально. ОГРОМНОЕ СПАСИБО ВАШЕМУ ФОРУМУ И СТРЕЛКУ ПЕРСОНАЛЬНО;)
10 января, 2010 в 7:09 пп в ответ на: Вирус отключает интернет #27855
Saimon Wein
Participant
- Темы:1
- Сообщений:6
кстати,до появления этого глюка был обнаружен какой-то вирус,я удалил его авастом.порезало почти все игры и программы(точнее файлы с расширением .ехе)
10 января, 2010 в 6:48 пп в ответ на: Вирус отключает интернет #27854
Saimon Wein
Participant
- Темы:1
- Сообщений:6
Logfile of random’s system information tool 1.06 (written by random/random)
Run by Admin at 2010-01-10 21:44:52
Microsoft Windows XP Professional Service Pack 3
System drive C: has 1 GB (20%) free of 5 GB
Total RAM: 254 MB (6% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:45:22, on 10.01.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20861)
Boot mode: Normal

Running processes:
C:WINDOWS.0System32smss.exe
C:WINDOWS.0system32csrss.exe
C:WINDOWS.0system32winlogon.exe
C:WINDOWS.0system32services.exe
C:WINDOWS.0system32lsass.exe
C:WINDOWS.0system32Ati2evxx.exe
C:WINDOWS.0system32svchost.exe
C:WINDOWS.0system32svchost.exe
C:WINDOWS.0System32svchost.exe
C:WINDOWS.0system32Ati2evxx.exe
C:WINDOWS.0system32svchost.exe
C:WINDOWS.0system32svchost.exe
C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
C:Program FilesAlwil SoftwareAvast4ashServ.exe
C:WINDOWS.0Explorer.EXE
C:WINDOWS.0livemessn.exe
C:WINDOWS.0RTHDCPL.EXE
C:PROGRA~1ALWILS~1Avast4ashDisp.exe
C:WINDOWS.0system32imPlayok.exe
C:WINDOWS.0system32ctfmon.exe
C:Program FilesVistaDriveIconVistaDrv.exe
C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
C:Documents and SettingsAdminimPlayok.exe
C:WINDOWS.0System32svchost.exe
C:WINDOWS.0System32svchost.exe
C:WINDOWS.0system32spoolsv.exe
D:programsAlcohol 120Alcohol 120StarWindStarWindService.exe
C:WINDOWS.0system32svchost.exe
C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:WINDOWS.0System32svchost.exe
C:WINDOWS.0System32svchost.exe
C:WINDOWS.0System32svchost.exe
C:Documents and SettingsAdminРабочий столRSIT.exe
C:WINDOWS.0system32wbemwmiprvse.exe
C:Program Filestrend microAdmin.exe

R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.apeha.ru
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: (no name) — {83821C2B-32A8-4DD7-B6D4-44309A78E668} — D:папка — ОБМЕННИКMradllnewmrasearch.dll
F2 — REG:system.ini: UserInit=C:WINDOWS.0system32userinit.exe,C:WINDOWS.0system32sdra64.exe,
O2 — BHO: SSVHelper Class — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — C:Program FilesJavajre1.6.0_07binssv.dll
O2 — BHO: Google Toolbar Helper — {AA58ED58-01DD-4d91-8333-CF10577473F7} — C:Program FilesGoogleGoogle ToolbarGoogleToolbar_32.dll
O2 — BHO: Google Toolbar Notifier BHO — {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} — C:Program FilesGoogleGoogleToolbarNotifier5.4.4525.1752swg.dll
O2 — BHO: EpsonToolBandKicker Class — {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} — C:Program FilesEPSONEPSON Web-To-PageEPSON Web-To-Page.dll
O3 — Toolbar: Google Toolbar — {2318C2B1-4965-11d4-9B18-009027A5CD4F} — C:Program FilesGoogleGoogle ToolbarGoogleToolbar_32.dll
O3 — Toolbar: EPSON Web-To-Page — {EE5D279F-081B-4404-994D-C6B60AAEBA6D} — C:Program FilesEPSONEPSON Web-To-PageEPSON Web-To-Page.dll
O4 — HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 — HKLM..Run: [Alcmtr] ALCMTR.EXE
O4 — HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 — HKLM..Run: [NeroFilterCheck] C:WINDOWS.0system32NeroCheck.exe
O4 — HKLM..Run: [EPSON Stylus CX3900 Series] C:WINDOWS.0System32spoolDRIVERSW32X863E_FATIBEP.EXE /FU «C:WINDOWS.0TEMPE_SD1.tmp» /EF «HKLM»
O4 — HKLM..Run: [Microsoft Driver Setup] C:WINDOWS.0livemessn.exe
O4 — HKLM..Run: [imPlayok] C:WINDOWS.0system32imPlayok.exe
O4 — HKLM..Run: [Regedit32] C:WINDOWS.0system32regedit.exe
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWS.0system32ctfmon.exe
O4 — HKCU..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe
O4 — HKCU..Run: [LClock] C:Program FilesLClocklclock.exe
O4 — HKCU..Run: [dc] C:WINDOWS.0dc.exe
O4 — HKCU..Run: [Fun] C:WINDOWS.0systemFun.exe
O4 — HKCU..Run: [swg] «C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe»
O4 — HKCU..Run: [Download Master] C:Program FilesDownload Masterdmaster.exe -autorun
O4 — HKCU..Run: [EPSON Stylus CX3900 Series] C:WINDOWS.0System32spoolDRIVERSW32X863E_FATIBEP.EXE /FU «C:DOCUME~1AdminLOCALS~1TempE_S17.tmp» /EF «HKCU»
O4 — HKCU..Run: [imPlayok] C:Documents and SettingsAdminimPlayok.exe
O4 — HKLM..PoliciesExplorerRun: [Microsoft Driver Setup] C:WINDOWS.0livemessn.exe
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWS.0system32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..RunOnce: [ZZZZ1_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWS.0INFcustom.inf,OnceFirstLogonInstall,0 (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..RunOnce: [IE7_012] rundll32 advpack.dll,LaunchINFSectionEx IE7int.inf,AfterUserStart,,4,N (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWS.0system32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-20..RunOnce: [ZZZZ1_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWS.0INFcustom.inf,OnceFirstLogonInstall,0 (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWS.0system32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWS.0INFcustom.inf,NewUserFirstLogonInstall,0 (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWS.0system32CTFMON.EXE (User ‘Default user’)
O4 — HKUS.DEFAULT..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWS.0INFcustom.inf,NewUserFirstLogonInstall,0 (User ‘Default user’)
O8 — Extra context menu item: Google ВикиКомментарии… — res://C:Program FilesGoogleGoogle ToolbarComponentGoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 — Extra button: (no name) — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_07binssv.dll
O9 — Extra ‘Tools’ menuitem: Sun Java Console — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_07binssv.dll
O9 — Extra button: Research — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~1Office12REFIEBAR.DLL
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWS.0Network Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWS.0Network Diagnosticxpnetdiag.exe
O20 — AppInit_DLLs: C:WINDOWS.0system32vksaver.dll
O23 — Service: ASP.NET State Service (aspnet_state) — Unknown owner — C:WINDOWS.0Microsoft.NETFrameworkv2.0.50727aspnet_state.exe (file missing)
O23 — Service: avast! iAVS4 Control Service (aswUpdSv) — ALWIL Software — C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 — Service: Ati HotKey Poller — ATI Technologies Inc. — C:WINDOWS.0system32Ati2evxx.exe
O23 — Service: avast! Antivirus — ALWIL Software — C:Program FilesAlwil SoftwareAvast4ashServ.exe
O23 — Service: avast! Mail Scanner — ALWIL Software — C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
O23 — Service: avast! Web Scanner — ALWIL Software — C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWS.0system32services.exe
O23 — Service: Google Software Updater (gusvc) — Google — C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWS.0system32imapi.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWS.0system32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWS.0system32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWS.0System32SCardSvr.exe
O23 — Service: ServiceLayer — Nokia. — C:Program FilesPC Connectivity SolutionServiceLayer.exe
O23 — Service: StarWind iSCSI Service (StarWindService) — Rocket Division Software — D:programsAlcohol 120Alcohol 120StarWindStarWindService.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWS.0system32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWS.0System32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWS.0system32wbemwmiapsrv.exe

—
End of file — 9323 bytes

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class — C:Program FilesJavajre1.6.0_07binssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper — C:Program FilesGoogleGoogle ToolbarGoogleToolbar_32.dll [2009-12-10 263280]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO — C:Program FilesGoogleGoogleToolbarNotifier5.4.4525.1752swg.dll [2009-12-10 764912]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}]
EpsonToolBandKicker Class — C:Program FilesEPSONEPSON Web-To-PageEPSON Web-To-Page.dll [2005-02-21 368640]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} — Google Toolbar — C:Program FilesGoogleGoogle ToolbarGoogleToolbar_32.dll [2009-12-10 263280]
{EE5D279F-081B-4404-994D-C6B60AAEBA6D} — EPSON Web-To-Page — C:Program FilesEPSONEPSON Web-To-PageEPSON Web-To-Page.dll [2005-02-21 368640]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«RTHDCPL»=C:WINDOWS.0RTHDCPL.EXE [2008-04-10 16861184]
«Alcmtr»=C:WINDOWS.0ALCMTR.EXE [2005-05-03 69632]
«avast!»=C:PROGRA~1ALWILS~1Avast4ashDisp.exe [2009-09-15 81000]
«NeroFilterCheck»=C:WINDOWS.0system32NeroCheck.exe [2006-01-12 155648]
«EPSON Stylus CX3900 Series»=C:WINDOWS.0System32spoolDRIVERSW32X863E_FATIBEP.EXE [2006-02-21 131072]
«Microsoft Driver Setup»=C:WINDOWS.0livemessn.exe [2010-01-08 52224]
«imPlayok»=C:WINDOWS.0system32imPlayok.exe [2010-01-06 28479]
«Regedit32″=C:WINDOWS.0system32regedit.exe []

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun]
«Microsoft Driver Setup»=C:WINDOWS.0livemessn.exe [2010-01-08 52224]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=C:WINDOWS.0system32ctfmon.exe [2008-08-19 30208]
«VistaIcon»=C:Program FilesVistaDriveIconVistaDrv.exe [2008-01-02 132096]
«LClock»=C:Program FilesLClocklclock.exe [2007-12-14 86016]
«dc»=C:WINDOWS.0dc.exe []
«Fun»=C:WINDOWS.0systemFun.exe []
«swg»=C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe [2009-12-10 39408]
«Download Master»=C:Program FilesDownload Masterdmaster.exe -autorun []
«EPSON Stylus CX3900 Series»=C:WINDOWS.0System32spoolDRIVERSW32X863E_FATIBEP.EXE [2006-02-21 131072]
«imPlayok»=C:Documents and SettingsAdminimPlayok.exe [2010-01-06 28479]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWindows]
«AppInit_DLLS»=»C:WINDOWS.0system32vksaver.dll»

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyAtiExtEvent]
C:WINDOWS.0system32Ati2evxx.dll [2008-02-26 126976]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWS.0system32wpdshserviceobj.dll [2008-03-02 133632]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=91000000
«NoSharedDocuments»=1
«NoSMConfigurePrograms»=1

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{2fada072-dc3c-11de-a5f7-0016766f5930}]
shell2command — G:Notepad.exe
shellAutoRuncommand — C:WINDOWS.0system32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Notepad.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{c7b3bb6d-f13d-11de-a625-0016766f5930}]
shellAutoRuncommand — C:WINDOWS.0system32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .RECYCLERS-5-3-42-2819952290-8240758988-879315005-3665jwgkvsq.vmx,ahaezedrn

======List of files/folders created in the last 1 months======

2010-01-10 21:44:58 —-D—- C:Program Filestrend micro
2010-01-10 21:44:52 —-D—- C:rsit
2010-01-10 21:15:26 —-SHD—- C:WINDOWS.0system32lowsec
2010-01-06 20:35:26 —-RSH—- C:WINDOWS.0updatd7.exe
2010-01-06 19:51:21 —-A—- C:WINDOWS.0system32imPlayok.exe
2010-01-06 19:51:14 —-A—- C:khot.exe
2010-01-05 20:17:05 —-RSH—- C:WINDOWS.0livemessn.exe
2010-01-03 14:17:39 —-A—- C:WINDOWS.0imsins.BAK
2010-01-03 14:17:27 —-D—- C:WINDOWS.0SxsCaPendDel
2010-01-03 14:16:10 —-SHD—- C:Config.Msi
2010-01-03 02:47:17 —-D—- C:WINDOWS.0system32appmgmt
2010-01-02 17:38:22 —-RSH—- C:WINDOWS.0wind7upd.exe
2009-12-23 15:58:54 —-D—- C:Documents and SettingsAdminApplication DataMra
2009-12-23 15:58:00 —-D—- C:Program FilesMail.Ru
2009-12-23 14:58:15 —-A—- C:WINDOWS.0epsswt_log.txt
2009-12-23 14:47:34 —-D—- C:Documents and SettingsAdminApplication DataEPSON
2009-12-23 14:47:34 —-A—- C:WINDOWS.0DEBUGSM.INI
2009-12-23 14:35:15 —-HD—- C:Program FilesInstallShield Installation Information
2009-12-23 14:35:03 —-D—- C:Documents and SettingsAll UsersApplication DataUDL
2009-12-23 14:33:06 —-A—- C:WINDOWS.0system32PICSDK2.dll
2009-12-23 14:33:06 —-A—- C:WINDOWS.0system32PICSDK.ini
2009-12-23 14:33:06 —-A—- C:WINDOWS.0system32PICSDK.dll
2009-12-23 14:33:05 —-A—- C:WINDOWS.0system32PICEntry.dll
2009-12-23 14:33:05 —-A—- C:WINDOWS.0system32EpPicPrt.dll
2009-12-23 14:33:05 —-A—- C:WINDOWS.0system32EPPicMgr.dll
2009-12-23 14:31:26 —-A—- C:WINDOWS.0EPSTPLOG.TXT
2009-12-23 14:31:26 —-A—- C:WINDOWS.0EPSTPLOG.BAK
2009-12-23 14:31:26 —-A—- C:WINDOWS.0EPSMTL32.TXT
2009-12-23 14:30:32 —-A—- C:WINDOWS.0CDE CX3900ERUK.ini
2009-12-23 14:29:24 —-D—- C:Program FilesEPSON
2009-12-23 14:29:10 —-A—- C:WINDOWS.0system32E_DCINST.DLL
2009-12-23 14:29:06 —-A—- C:WINDOWS.0system32E_FD4BBEP.DLL
2009-12-23 14:29:05 —-A—- C:WINDOWS.0system32E_FLBBEP.DLL
2009-12-23 14:27:32 —-A—- C:WINDOWS.0system32esccmd.dll
2009-12-23 14:27:31 —-A—- C:WINDOWS.0system32escwiad.dll
2009-12-23 14:27:31 —-A—- C:WINDOWS.0system32escimgd.dll
2009-12-17 00:22:00 —-D—- C:WINDOWS.0wb
2009-12-15 12:07:45 —-D—- C:Program FilesMulti Theft Auto
2009-12-15 09:25:41 —-A—- C:WINDOWS.0system32vbar332.dll
2009-12-11 04:42:12 —-A—- C:WINDOWS.0IsUninst.exe
2009-12-11 02:49:24 —-D—- C:Downloads

======List of files/folders modified in the last 1 months======

2010-01-10 21:44:58 —-AD—- C:Program Files
2010-01-10 21:30:38 —-D—- C:Program FilesMozilla Firefox
2010-01-10 21:30:19 —-D—- C:WINDOWS.0system32CatRoot2
2010-01-10 21:28:45 —-D—- C:WINDOWS.0Temp
2010-01-10 21:26:36 —-A—- C:WINDOWS.0SchedLgU.Txt
2010-01-10 21:15:26 —-AD—- C:WINDOWS.0system32
2010-01-10 21:15:23 —-D—- C:WINDOWS.0system32drivers
2010-01-09 02:56:51 —-A—- C:WINDOWS.0NeroDigital.ini
2010-01-07 11:59:56 —-SHD—- C:WINDOWS.0Installer
2010-01-07 11:59:49 —-AD—- C:Program FilesCommon Files
2010-01-07 11:59:47 —-D—- C:Program FilesNokia
2010-01-07 11:59:42 —-HD—- C:WINDOWS.0inf
2010-01-07 11:58:07 —-DC—- C:WINDOWS.0system32DRVSTORE
2010-01-07 11:57:51 —-D—- C:WINDOWS.0
2010-01-06 23:35:26 —-D—- C:Documents and SettingsAdminApplication DataGoogle
2010-01-03 14:16:46 —-RSD—- C:WINDOWS.0assembly
2010-01-03 14:16:41 —-D—- C:WINDOWS.0WinSxS
2009-12-30 17:04:52 —-D—- C:Program FilesOperaAC
2009-12-30 01:51:31 —-D—- C:Program FilesPower Data Recovery
2009-12-30 01:47:25 —-D—- C:Program FilesEverest
2009-12-29 20:07:37 —-D—- C:Documents and SettingsAdminApplication DatauTorrent
2009-12-27 18:23:57 —-D—- C:Program FilesuTorrent
2009-12-25 13:01:50 —-SHD—- C:RECYCLER
2009-12-23 15:04:09 —-D—- C:WINDOWS.0system32CatRoot
2009-12-23 14:42:09 —-SD—- C:WINDOWS.0Downloaded Program Files
2009-12-23 14:42:08 —-D—- C:Program FilesCommon FilesInstallShield
2009-12-23 14:28:08 —-RSHDC—- C:WINDOWS.0system32dllcache
2009-12-23 14:27:33 —-D—- C:WINDOWS.0twain_32
2009-12-19 09:13:31 —-SD—- C:Documents and SettingsAdminApplication DataMicrosoft
2009-12-17 14:36:19 —-D—- C:Documents and SettingsAdminApplication DataU3
2009-12-15 14:59:54 —-A—- C:WINDOWS.0win.ini
2009-12-13 07:22:43 —-D—- C:Program FilesDownload Master

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:WINDOWS.0system32driversAavmker4.sys [2009-09-15 27408]
R1 aswSP;avast! Self Protection; C:WINDOWS.0system32driversaswSP.sys [2009-09-15 114768]
R1 aswTdi;avast! Network Shield Support; C:WINDOWS.0system32driversaswTdi.sys [2009-09-15 52368]
R1 intelppm;Драйвер Intel процессора; C:WINDOWS.0system32DRIVERSintelppm.sys [2008-04-15 40704]
R1 kbdhid;Драйвер клавиатуры HID; C:WINDOWS.0system32DRIVERSkbdhid.sys [2008-04-15 14720]
R2 aswFsBlk;aswFsBlk; C:WINDOWS.0system32DRIVERSaswFsBlk.sys [2009-09-15 20560]
R2 aswMon2;avast! Standard Shield Support; C:WINDOWS.0system32driversaswMon2.sys [2009-09-15 94160]
R2 rspndr;Ответчик обнаружения топологии уровня связи; C:WINDOWS.0system32DRIVERSrspndr.sys [2008-07-08 62848]
R3 aswRdr;aswRdr; C:WINDOWS.0system32driversaswRdr.sys [2009-09-15 23152]
R3 ati2mtag;ati2mtag; C:WINDOWS.0system32DRIVERSati2mtag.sys [2008-02-26 2863616]
R3 HDAudBus;Драйвер шины Microsoft UAA для High Definition Audio; C:WINDOWS.0system32DRIVERSHDAudBus.sys [2008-04-15 144384]
R3 hidusb;Драйвер класса HID Microsoft; C:WINDOWS.0system32DRIVERShidusb.sys [2008-04-15 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:WINDOWS.0system32driversRtkHDAud.sys [2008-04-17 4707328]
R3 mouhid;Драйвер мыши HID; C:WINDOWS.0system32DRIVERSmouhid.sys [2008-04-15 12160]
R3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver; C:WINDOWS.0system32DRIVERSRtnicxp.sys [2007-11-21 104320]
R3 usbccgp;Драйвер универсального родительского устройства USB (Microsoft); C:WINDOWS.0system32DRIVERSusbccgp.sys [2008-04-15 32128]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWS.0system32DRIVERSusbehci.sys [2008-04-15 30208]
R3 usbhub;USB2 концентратор; C:WINDOWS.0system32DRIVERSusbhub.sys [2008-04-15 59520]
R3 usbohci;Драйвер минипорта Microsoft USB открытого хост-контроллера; C:WINDOWS.0system32DRIVERSusbohci.sys [2008-04-15 17152]
S3 nmwcd;Nokia USB Phone Parent; C:WINDOWS.0system32driversccdcmb.sys [2008-05-07 17536]
S3 nmwcdc;Nokia USB Generic; C:WINDOWS.0system32driversccdcmbo.sys [2008-05-07 20864]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:WINDOWS.0system32DRIVERSpccsmcfd.sys [2007-09-17 21632]
S3 upperdev;upperdev; C:WINDOWS.0system32DRIVERSusbser_lowerflt.sys [2008-06-06 8064]
S3 usbprint;Класс принтеров Microsoft USB; C:WINDOWS.0system32DRIVERSusbprint.sys [2008-08-19 25856]
S3 usbscan;Драйвер USB-сканера; C:WINDOWS.0system32DRIVERSusbscan.sys [2008-08-19 15104]
S3 usbser;USB Modem Driver; C:WINDOWS.0system32DRIVERSusbser.sys [2008-08-19 26112]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWS.0system32DRIVERSUSBSTOR.SYS [2008-08-19 26368]
S3 Wdf01000;Wdf01000; C:WINDOWS.0system32DRIVERSWdf01000.sys [2006-11-02 492000]
S4 IntelIde;IntelIde; C:WINDOWS.0system32driversIntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe [2009-09-15 18752]
R2 Ati HotKey Poller;Ati HotKey Poller; C:WINDOWS.0system32Ati2evxx.exe [2008-02-26 520192]
R2 avast! Antivirus;avast! Antivirus; C:Program FilesAlwil SoftwareAvast4ashServ.exe [2009-09-15 138680]
R2 StarWindService;StarWind iSCSI Service; D:programsAlcohol 120Alcohol 120StarWindStarWindService.exe [2005-04-02 217600]
R3 avast! Mail Scanner;avast! Mail Scanner; C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe [2009-09-15 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:Program FilesAlwil SoftwareAvast4ashWebSv.exe [2009-09-15 352920]
S2 pabzbiti;System Microsoft; C:WINDOWS.0system32svchost.exe [2008-04-15 14336]
S3 aspnet_state;ASP.NET State Service; C:WINDOWS.0Microsoft.NETFrameworkv2.0.50727aspnet_state.exe []
S3 gusvc;Google Software Updater; C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe [2009-12-10 182768]
S3 odserv;Microsoft Office Diagnostics Service; C:Program FilesCommon FilesMicrosoft SharedOFFICE12ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2006-10-26 145184]
S3 ServiceLayer;ServiceLayer; C:Program FilesPC Connectivity SolutionServiceLayer.exe [2008-08-07 575488]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:Program FilesWindows Media Playerwmpnetwk.exe [2006-10-18 913408]

EOF
10 января, 2010 в 6:47 пп в ответ на: Вирус отключает интернет #27853
Saimon Wein
Participant
- Темы:1
- Сообщений:6
info.txt logfile of random’s system information tool 1.06 2010-01-10 21:45:29

======Uninstall list======

—>MsiExec.exe /X{E9F81423-211E-46B6-9AE0-38568BC5CF6F}
—>msiexec /package {90120000-001B-0000-0000-0000000FF1CE} /uninstall {3520B304-0EF8-475D-8C52-47ABCCC75FC6}
—>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:WINDOWS.0INFPCHealth.inf
7-Zip 4.57—>»C:Program Files7-ZipUninstall.exe»
Adobe Flash Player 10 Plugin—>C:WINDOWS.0system32MacromedFlashuninstall_plugin.exe
Adobe Flash Player ActiveX—>C:WINDOWS.0system32MacromedFlashuninstall_activeX.exe
ATI Display Driver—>rundll32 C:WINDOWS.0system32atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
avast! Antivirus—>C:Program FilesAlwil SoftwareAvast4aswRunDll.exe «C:Program FilesAlwil SoftwareAvast4Setupsetiface.dll»,RunSetup
CCleaner (remove only)—>»C:Program FilesCCleaneruninst.exe»
CPU-Z and GPU-Z—>C:Program FilesCPU-ZUninstall.exe
EPSON Attach To Email—>C:Program FilesCommon FilesInstallShieldDriver8Intel 32IDriver.exe /M{20C45B32-5AB6-46A4-94EF-58950CAF05E5} /l1033 ADDREMOVEDLG
EPSON Copy Utility 3—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime701Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{67EDD823-135A-4D59-87BD-950616D6E857}SETUP.EXE» -l0x19 -UnInstall
EPSON Easy Photo Print—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime701Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{BC69DDB8-4840-4D9B-BB31-0D4DB2BA1312}SETUP.EXE» -l0x19 UNINST
EPSON File Manager—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime701Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{E86BC406-944E-41F6-ADE6-2C136734C96B}Setup.exe» -l0x19 UNINST
EPSON Printer Software—>C:WINDOWS.0System32spoolDRIVERSW32X863EPUPDATE.EXE /R
EPSON Scan Assistant—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime701Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}Setup.exe» -l0x19 -u
EPSON Scan—>C:Program Filesepsonescndvsetupsetup.exe /r
EPSON Web-To-Page—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}SETUP.EXE» -l0x19 -anything
ESDX4000_4050_CX3900 Руководство пользователя—>C:Program FilesEPSONTPMANUALESDX4000_4050_CX3900USE_G (Russian)DOCUNINS.EXE
Everest—>C:Program FilesEverestUninstall.exe
Flash Player Pro—>C:Program FilesFlash Player ProUninstall.exe
Google Toolbar for Internet Explorer—>»C:Program FilesGoogleGoogle ToolbarComponentGoogleToolbarManager_0E996B068B56FCA2.exe» /uninstall
Google Toolbar for Internet Explorer—>MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
HashTab&CDClose—>C:WINDOWS.0system32Uninstall.exe
Hide Folders XP 2.9.5 for Windows XP/Vista—>C:Program FilesHide Folders XP 2hfxpcp.exe /u
HijackThis 2.0.2—>»C:Program Filestrend microHijackThis.exe» /uninstall
iColorFolder 1.5.0.1—>C:Program FilesiColorFolderUninstall.exe
Java(TM) 6 Update 7—>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
K-Lite Mega Codec Pack 4.1.7—>»C:Program FilesK-Lite Codec Packunins000.exe»
LClock—>C:Program FilesLClockUninstall.exe
Microsoft .NET Framework 1.1 Russian Language Pack—>MsiExec.exe /X{2BB372D9-52B4-410A-BC1A-FEAB63181EEF}
Microsoft .NET Framework 1.1—>msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1—>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5—>»C:WINDOWS.0$NtUninstallWdf01005$spuninstspuninst.exe»
Microsoft Office Proof (English) 2007—>MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007—>MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Russian) 2007—>MsiExec.exe /X{90120000-001F-0419-0000-0000000FF1CE}
Microsoft Office Proof (Ukrainian) 2007—>MsiExec.exe /X{90120000-001F-0422-0000-0000000FF1CE}
Microsoft Office Proofing (Russian) 2007—>MsiExec.exe /X{90120000-002C-0419-0000-0000000FF1CE}
Microsoft Office Shared MUI (Russian) 2007—>MsiExec.exe /X{90120000-006E-0419-0000-0000000FF1CE}
Microsoft Office Word 2007—>»C:Program FilesCommon FilesMicrosoft SharedOFFICE12Office Setup Controllersetup.exe» /uninstall WORD /dll OSETUP.DLL
Microsoft Office Word 2007—>MsiExec.exe /X{90120000-001B-0000-0000-0000000FF1CE}
Microsoft Office Word MUI (Russian) 2007—>MsiExec.exe /X{90120000-001B-0419-0000-0000000FF1CE}
Mozilla Firefox—>C:Program FilesMozilla FirefoxUninstall.exe
MSVC80_x86—>MsiExec.exe /I{212748BB-0DA5-46DE-82A1-403736DC9F27}
Nero 6—>C:Program FilesAheadnerouninstallUNNERO.exe /UNINSTALL
Nokia Connectivity Cable Driver—>MsiExec.exe /X{C3F19A5F-35A8-4FDB-A6ED-0F4CE398DA48}
Paint.NET v3.35—>rundll32.exe advpack.dll,LaunchINFSection PaintDN.inf,Uninstall
PC Connectivity Solution—>MsiExec.exe /I{1A524CFE-DF85-4555-8BC2-0C89DBD8BC2C}
PIF DESIGNER—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{B90450DF-E781-46FD-B1F1-0C86DA40E443}SETUP.EXE» -l0x19 anything
Power Data Recovery 4.1.1—>C:Program FilesPower Data RecoveryUninstall.exe
Real Alternative 1.8.2—>»C:Program FilesReal Alternativeunins000.exe»
Realtek High Definition Audio Driver—>RtlUpd.exe -r -m -nrg2709
Red Alert—>C:WINDOWS.0IsUninst.exe -fd:gamesredalertUninst.isu
Resident Evil 2—>C:WINDOWS.0IsUninst.exe -f»d:gamesResident Evil 2Uninst.isu»
Resident Evil 3—>C:WINDOWS.0IsUninst.exe -f»d:gamesResident Evil 3Uninst.isu»
Resident Evil—>C:WINDOWS.0IsUninst.exe -f»d:gamesResident EvilUninst.isu»
Soldat 1.4.2—>C:Program FilesSoldatUninstall.exe
SpeedFinder 1.4—>C:Program FilesSpeedFinderUninstall.exe
The KMPlayer 1432 R2—>»C:Program FilesThe KMPlayerunins000.exe»
Unlocker—>C:Program FilesUnlockeruninst.exe
uTorrent—>C:Program FilesuTorrentUninstall.exe
Vista Drive Icon—>rundll32.exe advpack.dll,LaunchINFSection C:WINDOWS.0INFVistaDrv.inf,Uninstall
VLC—>C:Program FilesVLCUninstall.exe
Winamp 5.541—>C:Program FilesWinampUninstall.exe
Архиватор WinRAR—>C:Program FilesWinRARuninstall.exe
Пакет драйверов Windows — Nokia Modem (05/22/2008 3.8)—>C:PROGRA~1DIFX270581355A767BF1dpinst.exe /u C:WINDOWS.0system32DRVSTOREnokia_blue_6F90B0F4A73A2F780A1010B5D6CB5DDFB098181Enokia_bluetooth.inf
Пакет драйверов Windows — Nokia pccsmcfd (10/12/2007 6.85.4.0)—>C:PROGRA~1DIFX270581355A767BF1dpinst.exe /u C:WINDOWS.0system32DRVSTOREpccsmcfd_4A1E30386F4D0DEC8F5DF262CFBD8845EEBAB175pccsmcfd.inf

======Security center information======

AV: avast! antivirus 4.8.1356 [VPS 091229-0] (outdated)

======System event log======

Computer Name: MICROSOF-2A6BB0
Event Code: 6009
Message: Microsoft (R) Windows 2000 (R) 5.01. 2600 Service Pack 3 Uniprocessor Free.

Record Number: 4239
Source Name: EventLog
Time Written: 20091228142235.000000+180
Event Type: информация
User:

Computer Name: MICROSOF-2A6BB0
Event Code: 6006
Message: Служба журнала событий остановлена.

Record Number: 4238
Source Name: EventLog
Time Written: 20091228015809.000000+180
Event Type: информация
User:

Computer Name: MICROSOF-2A6BB0
Event Code: 7036
Message: Служба «Ati HotKey Poller» перешла в состояние Остановлена.

Record Number: 4237
Source Name: Service Control Manager
Time Written: 20091228015742.000000+180
Event Type: информация
User:

Computer Name: MICROSOF-2A6BB0
Event Code: 7036
Message: Служба «Служба COM записи компакт-дисков IMAPI» перешла в состояние Остановлена.

Record Number: 4236
Source Name: Service Control Manager
Time Written: 20091228010711.000000+180
Event Type: информация
User:

Computer Name: MICROSOF-2A6BB0
Event Code: 7036
Message: Служба «Служба COM записи компакт-дисков IMAPI» перешла в состояние Работает.

Record Number: 4235
Source Name: Service Control Manager
Time Written: 20091228010705.000000+180
Event Type: информация
User:

=====Application event log=====

Computer Name: MICROSOF-2A6BB0
Event Code: 1000
Message: Счетчики производительности для службы MSDTC (MSDTC) загружены успешно.
Данные записи содержат новые значение индекса,
назначенного этой службе.

Record Number: 5
Source Name: LoadPerf
Time Written: 20091125210429.000000+180
Event Type: информация
User:

Computer Name: MICROSOF-2A6BB0
Event Code: 1000
Message: Счетчики производительности для службы TermService (Службы терминалов) загружены успешно.
Данные записи содержат новые значение индекса,
назначенного этой службе.

Record Number: 4
Source Name: LoadPerf
Time Written: 20091125210424.000000+180
Event Type: информация
User:

Computer Name: MICROSOF-2A6BB0
Event Code: 1000
Message: Счетчики производительности для службы RemoteAccess (Маршрутизация и удаленный доступ) загружены успешно.
Данные записи содержат новые значение индекса,
назначенного этой службе.

Record Number: 3
Source Name: LoadPerf
Time Written: 20091125210306.000000+180
Event Type: информация
User:

Computer Name: MICROSOF-2A6BB0
Event Code: 1000
Message: Счетчики производительности для службы PSched (PSched) загружены успешно.
Данные записи содержат новые значение индекса,
назначенного этой службе.

Record Number: 2
Source Name: LoadPerf
Time Written: 20091125210302.000000+180
Event Type: информация
User:

Computer Name: MICROSOF-2A6BB0
Event Code: 1000
Message: Счетчики производительности для службы RSVP (QoS RSVP) загружены успешно.
Данные записи содержат новые значение индекса,
назначенного этой службе.

Record Number: 1
Source Name: LoadPerf
Time Written: 20091125210258.000000+180
Event Type: информация
User:

======Environment variables======

«ComSpec»=%SystemRoot%system32cmd.exe
«Path»=C:Program FilesPC Connectivity Solution;%SystemRoot%system32;%SystemRoot%;%SystemRoot%System32Wbem
«windir»=%SystemRoot%
«FP_NO_HOST_CHECK»=NO
«OS»=Windows_NT
«PROCESSOR_ARCHITECTURE»=x86
«PROCESSOR_LEVEL»=15
«PROCESSOR_IDENTIFIER»=x86 Family 15 Model 4 Stepping 9, GenuineIntel
«PROCESSOR_REVISION»=0409
«NUMBER_OF_PROCESSORS»=1
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP
«Page2Chm»=C:Program FilesOperaACMisc

EOF
Автор

Сообщения