Созданные ответы форума
-
Сообщения
-
я так и сделал прошлый раз. Считаю тему надо закрыть и просто переустановить Винду. Спасибо за потраченное время.
Ничего не изменилось. Просто там(в настройках), что-то нужно было разрешить ,что-то не блокировать, но на самом деле я думаю , что просто проявился банер,как только я начал пользоваться IE. Можно просто перечислить какие «програмки или библиотеки» используются для запуска ИМЕННО IE и которые остаются при деинстоляции или обновлении IE. Уверен что просто » модифицировали » оригинальный файл. А так же название файла отвечающего за домашнюю страницу. Просто есть вероятность сознательного вмешательства(((
а вот 2 лог
OTViewIt logfile created on: 04.03.2009 12:34:46 — Run
OTViewIt by OldTimer — Version 1.0.21.0 Folder = C:Documents and SettingsАлексейРабочий стол
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) — Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000419 | Country: Россия | Language: RUS | Date Format: dd.MM.yyyy1,44 Gb Total Physical Memory | 0,79 Gb Available Physical Memory | 54,79% Memory free
3,29 Gb Paging File | 2,72 Gb Available in Paging File | 82,83% Paging File free
Paging file location(s): C:pagefile.sys 2046 4092;%SystemDrive% = C: | %SystemRoot% = C:WINDOWS | %ProgramFiles% = C:Program Files
Drive C: | 9,77 Gb Total Space | 0,88 Gb Free Space | 9,01% Space Free | Partition Type: NTFS
Drive D: | 29,29 Gb Total Space | 8,77 Gb Free Space | 29,95% Space Free | Partition Type: NTFS
Drive E: | 37,62 Gb Total Space | 9,09 Gb Free Space | 24,16% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loadedComputer Name: KITCHEN
Current User Name: Алексей
Logged in as Administrator.Current Boot Mode: Normal
Scan Mode: All users
Whitelist: On
File Age = 30 Days========== Processes ==========
[2006.03.02 15:00:00 | 00,050,688 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32smss.exe
[2006.03.02 15:00:00 | 00,503,808 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32winlogon.exe
[2006.03.02 15:00:00 | 00,108,544 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32services.exe
[2006.03.02 15:00:00 | 01,032,704 | —- | M] (Корпорация Майкрософт) — C:WINDOWSexplorer.exe
[2006.03.02 15:00:00 | 00,033,280 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32rundll32.exe
[2005.06.20 16:42:20 | 00,077,824 | R— | M] (Realtek Semiconductor Corp.) — C:WINDOWSSOUNDMAN.EXE
[2008.05.17 07:58:44 | 00,949,376 | —- | M] (Eset ) — C:Program FilesEsetnod32kui.exe
[2005.05.25 11:12:36 | 00,517,632 | —- | M] (Lavasoft Sweden) — C:Program FilesLavasoftAd-Aware SE ProfessionalAd-Watch.exe
[2006.02.19 04:21:22 | 00,288,472 | —- | M] (Hewlett-Packard Development Company, L.P.) — C:Program FilesHPDigital Imagingbinhpqtra08.exe
[2006.02.17 10:17:08 | 00,020,543 | —- | M] (Apache Software Foundation) — C:Program FilesNVIDIA CorporationNetworkAccessManagerApache GroupApache2binApache.exe
[2009.01.02 11:28:13 | 00,152,984 | —- | M] (Sun Microsystems, Inc.) — C:Program FilesJavajre6binjqs.exe
[2006.10.26 12:40:34 | 00,335,872 | —- | M] (Microsoft Corporation) — C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGmdm.exe
[2008.05.17 07:58:44 | 00,552,064 | —- | M] (Eset ) — C:Program FilesEsetnod32krn.exe
[2006.02.17 10:35:42 | 00,061,503 | —- | M] (NVIDIA) — C:Program FilesNVIDIA CorporationNetworkAccessManagerbinnSvcLog.exe
[2005.09.18 03:32:00 | 00,131,139 | —- | M] (NVIDIA Corporation) — C:WINDOWSsystem32nvsvc32.exe
[2006.02.17 10:17:08 | 00,020,543 | —- | M] (Apache Software Foundation) — C:Program FilesNVIDIA CorporationNetworkAccessManagerApache GroupApache2binApache.exe
[2006.02.19 05:24:52 | 00,239,320 | —- | M] (Hewlett-Packard Development Company, L.P.) — C:Program FilesHPDigital Imagingbinhpqste08.exe
[2006.03.02 15:00:00 | 00,013,824 | —- | M] (Microsoft Corporation) — C:WINDOWSsystem32wscntfy.exe
[2006.03.03 20:03:10 | 00,069,632 | —- | M] (HP) — C:WINDOWSsystem32HPZipm12.exe
[2009.02.07 12:29:05 | 00,307,704 | —- | M] (Mozilla Corporation) — C:Program FilesMozilla Firefoxfirefox.exe
[2008.12.19 08:25:25 | 00,634,024 | —- | M] (Microsoft Corporation) — C:Program FilesInternet Exploreriexplore.exe
[2008.12.19 08:25:25 | 00,634,024 | —- | M] (Microsoft Corporation) — C:Program FilesInternet Exploreriexplore.exe
[2009.03.04 12:32:01 | 00,422,912 | —- | M] (OldTimer Tools) — C:Documents and SettingsАлексейРабочий столOTViewIt.exe========== (O23) Win32 Services ==========
[2004.07.15 00:49:26 | 00,032,768 | —- | M] (Microsoft Corporation) — C:WINDOWSMicrosoft.NETFrameworkv1.1.4322aspnet_state.exe — (aspnet_state [On_Demand | Stopped])
[2008.01.14 21:22:26 | 00,077,944 | —- | M] (Autodesk) — C:Program FilesCommon FilesAutodesk SharedServiceAdskScSrv.exe — (Autodesk Licensing Service [On_Demand | Stopped])
[2006.03.02 15:00:00 | 00,108,544 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32services.exe — (Eventlog [Auto | Running])
[2006.02.17 10:17:08 | 00,020,543 | —- | M] (Apache Software Foundation) — C:Program FilesNVIDIA CorporationNetworkAccessManagerApache GroupApache2binApache.exe — (ForcewareWebInterface [Auto | Running])
[2006.03.02 15:00:00 | 00,150,016 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32imapi.exe — (ImapiService [On_Demand | Stopped])
[2009.01.02 11:28:13 | 00,152,984 | —- | M] (Sun Microsystems, Inc.) — C:Program FilesJavajre6binjqs.exe — (JavaQuickStarterService [Auto | Running])
[2006.10.26 12:40:34 | 00,335,872 | —- | M] (Microsoft Corporation) — C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGmdm.exe — (MDM [Auto | Running])
[2006.10.26 23:47:54 | 00,065,824 | —- | M] (Microsoft Corporation) — C:Program FilesMicrosoft OfficeOffice12GrooveAuditService.exe — (Microsoft Office Groove Audit Service [On_Demand | Stopped])
[2006.03.02 15:00:00 | 00,032,768 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32mnmsrvc.exe — (mnmsrvc [On_Demand | Stopped])
[2006.03.02 15:00:00 | 00,113,664 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32netdde.exe — (NetDDE [Disabled | Stopped])
[2006.03.02 15:00:00 | 00,113,664 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32netdde.exe — (NetDDEdsdm [Disabled | Stopped])
[2008.05.17 07:58:44 | 00,552,064 | —- | M] (Eset ) — C:Program FilesEsetnod32krn.exe — (NOD32krn [Auto | Running])
[2006.02.17 10:35:42 | 00,061,503 | —- | M] (NVIDIA) — C:Program FilesNVIDIA CorporationNetworkAccessManagerbinnSvcLog.exe — (nSvcLog [Auto | Running])
[2005.09.18 03:32:00 | 00,131,139 | —- | M] (NVIDIA Corporation) — C:WINDOWSsystem32nvsvc32.exe — (NVSvc [Auto | Running])
[2006.10.26 18:49:34 | 00,441,136 | —- | M] (Microsoft Corporation) — C:Program FilesCommon FilesMicrosoft SharedOFFICE12ODSERV.EXE — (odserv [On_Demand | Stopped])
[2006.10.26 13:03:08 | 00,145,184 | —- | M] (Microsoft Corporation) — C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE — (ose [On_Demand | Stopped])
[2006.03.02 15:00:00 | 00,108,544 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32services.exe — (PlugPlay [Auto | Running])
[2006.03.03 20:03:10 | 00,069,632 | —- | M] (HP) — C:WINDOWSsystem32HPZipm12.exe — (Pml Driver HPZ12 [Unknown | Running])
[2006.03.02 15:00:00 | 00,141,312 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32sessmgr.exe — (RDSessMgr [On_Demand | Stopped])
[2006.03.02 15:00:00 | 00,096,768 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32scardsvr.exe — (SCardSvr [On_Demand | Stopped])
[2006.03.02 15:00:00 | 00,091,648 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32smlogsvc.exe — (SysmonLog [On_Demand | Stopped])
[2006.03.02 15:00:00 | 00,290,304 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32vssvc.exe — (VSS [On_Demand | Stopped])
[2006.03.02 15:00:00 | 00,126,464 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32wbemwmiapsrv.exe — (WmiApSrv [On_Demand | Stopped])========== Driver Services ==========
[2006.03.02 15:00:00 | 00,188,288 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32driversacpi.sys — (ACPI [Boot | Running])
[2006.03.02 15:00:00 | 00,011,776 | —- | M] (Корпорация Майкрософт) — C:WINDOWSSystem32driversacpiec.sys — (ACPIEC [Disabled | Stopped])
[2005.06.20 17:08:44 | 02,324,480 | R— | M] (Realtek Semiconductor Corp.) — C:WINDOWSsystem32driversALCXWDM.SYS — (ALCXWDM [On_Demand | Running])
[2008.05.17 07:58:45 | 00,512,096 | —- | M] (Eset ) — C:WINDOWSsystem32driversamon.sys — (AMON [Auto | Running])
[2006.05.31 15:35:15 | 00,003,008 | —- | M] (ConsultantPlus) — C:WINDOWSSystem32driversCONSULT.SYS — (Consult [Auto | Running])
[2006.03.02 15:00:00 | 00,034,944 | —- | M] (Корпорация Майкрософт) — C:WINDOWSSystem32driversfips.sys — (Fips [System | Running])
[2006.03.02 15:00:00 | 00,125,440 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32driversftdisk.sys — (Ftdisk [Boot | Running])
[2009.03.02 19:27:04 | 00,085,969 | —- | M] (GMER) — C:WINDOWSsystem32driversgmer.sys — (gmer [On_Demand | Stopped])
[2006.04.13 03:04:39 | 00,049,664 | —- | M] (HP) — C:WINDOWSsystem32driversHPZid412.sys — (HPZid412 [On_Demand | Running])
[2006.04.13 03:04:39 | 00,016,496 | —- | M] (HP) — C:WINDOWSsystem32driversHPZipr12.sys — (HPZipr12 [On_Demand | Running])
[2006.04.13 03:04:39 | 00,021,568 | —- | M] (HP) — C:WINDOWSsystem32driversHPZius12.sys — (HPZius12 [On_Demand | Running])
[2006.03.02 15:00:00 | 00,053,376 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32driversi8042prt.sys — (i8042prt [System | Running])
[2006.03.02 15:00:00 | 00,036,096 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32driversisapnp.sys — (isapnp [Boot | Running])
[2006.03.02 15:00:00 | 00,024,832 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32driverskbdclass.sys — (Kbdclass [System | Running])
[2006.03.02 15:00:00 | 00,030,208 | —- | M] (Корпорация Майкрософт) — C:WINDOWSSystem32driversmodem.sys — (Modem [On_Demand | Stopped])
[2006.03.02 15:00:00 | 00,023,296 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32driversmouclass.sys — (Mouclass [System | Running])
[2006.03.02 15:00:00 | 00,012,160 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32driversmouhid.sys — (mouhid [On_Demand | Running])
[2008.05.02 10:58:12 | 00,017,536 | —- | M] (Nokia) — C:WINDOWSsystem32driversccdcmb.sys — (nmwcd [On_Demand | Stopped])
[2008.05.02 10:58:14 | 00,020,864 | —- | M] (Nokia) — C:WINDOWSsystem32driversccdcmbo.sys — (nmwcdc [On_Demand | Stopped])
[2008.05.17 07:58:44 | 00,015,424 | —- | M] () — C:WINDOWSsystem32driversnod32drv.sys — (nod32drv [System | Running])
[2005.09.18 03:32:00 | 03,493,984 | —- | M] (NVIDIA Corporation) — C:WINDOWSsystem32driversnv4_mini.sys — (nv [On_Demand | Running])
[2006.04.24 16:52:28 | 00,100,736 | —- | M] (NVIDIA Corporation) — C:WINDOWSsystem32driversnvata.sys — (nvata [Boot | Running])
[2006.02.17 10:28:30 | 00,034,176 | —- | M] (NVIDIA Corporation) — C:WINDOWSsystem32driversNVENETFD.sys — (NVENETFD [On_Demand | Running])
[2006.02.17 10:28:32 | 00,013,056 | —- | M] (NVIDIA Corporation) — C:WINDOWSsystem32driversnvnetbus.sys — (nvnetbus [On_Demand | Running])
[2006.03.02 15:00:00 | 00,080,128 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32driversparport.sys — (Parport [On_Demand | Running])
[2006.03.02 15:00:00 | 00,006,912 | —- | M] (Корпорация Майкрософт) — C:WINDOWSSystem32driversparvdm.sys — (ParVdm [Auto | Running])
[2006.03.02 15:00:00 | 00,068,480 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32driverspci.sys — (PCI [Boot | Running])
[2006.03.02 15:00:00 | 00,003,328 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32driverspciide.sys — (PCIIde [Boot | Running])
[2006.03.02 15:00:00 | 00,119,936 | —- | M] (Корпорация Майкрософт) — C:WINDOWSSystem32driverspcmcia.sys — (Pcmcia [Disabled | Stopped])
[2004.04.07 17:01:34 | 00,054,592 | —- | M] (Protection Technology) — C:WINDOWSsystem32driversprodrv06.sys — (prodrv06 [System | Running])
[2004.04.07 18:21:04 | 00,106,528 | —- | M] (Protection Technology) — C:WINDOWSsystem32driversprohlp02.sys — (prohlp02 [Boot | Running])
[2006.03.02 15:00:00 | 00,017,792 | —- | M] (Parallel Technologies, Inc.) — C:WINDOWSsystem32driversptilink.sys — (Ptilink [On_Demand | Running])
[2004.08.17 18:49:32 | 00,058,112 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32driversredbook.sys — (redbook [System | Running])
[2006.03.02 15:00:00 | 00,027,440 | —- | M] () — C:WINDOWSsystem32driverssecdrv.sys — (Secdrv [On_Demand | Stopped])
[2006.03.02 15:00:00 | 00,065,408 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32driversserial.sys — (Serial [System | Running])
[2003.12.01 18:20:52 | 00,004,832 | —- | M] (Protection Technology) — C:WINDOWSsystem32driverssfhlp01.sys — (sfhlp01 [Boot | Running])
[2006.03.02 15:00:00 | 00,073,472 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32driverssr.sys — (sr [Boot | Running])
[2008.05.02 10:58:14 | 00,008,064 | —- | M] (Windows (R) Codename Longhorn DDK provider) — C:WINDOWSsystem32driversusbser_lowerflt.sys — (upperdev [On_Demand | Stopped])
[2004.08.04 02:07:56 | 00,059,264 | —- | M] (Microsoft Corporation) — C:WINDOWSsystem32driversUSBAUDIO.sys — (usbaudio [On_Demand | Running])
[2004.08.03 23:08:44 | 00,025,600 | —- | M] (Microsoft Corporation) — C:WINDOWSsystem32driversusbser.sys — (usbser [On_Demand | Stopped])
[2008.05.02 10:58:28 | 00,008,064 | —- | M] (Windows (R) Codename Longhorn DDK provider) — C:WINDOWSsystem32driversusbser_lowerfltj.sys — (UsbserFilt [On_Demand | Stopped])
[2006.03.02 15:00:00 | 00,051,968 | —- | M] (Корпорация Майкрософт) — C:WINDOWSSystem32driversvolsnap.sys — (VolSnap [Boot | Running])
[2006.11.02 07:22:54 | 00,492,000 | —- | M] (Microsoft Corporation) — C:WINDOWSsystem32driverswdf01000.sys — (Wdf01000 [On_Demand | Stopped])
[2006.03.02 15:00:00 | 00,012,032 | —- | M] (Microsoft Corporation) — C:WINDOWSsystem32driversws2ifsl.sys — (WS2IFSL [System | Running])========== (R ) Internet Explorer ==========
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerMain]
«Default_Page_URL»=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
«Default_Search_URL»=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
«Default_Secondary_Page_URL»=
«Extensions Off Page»=about:NoAdd-ons
«Local Page»=%SystemRoot%system32blank.htm
«Search Page»=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
«Security Risk Page»=about:SecurityRisk
«Start Page»=http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerSearch]
«CustomizeSearch»=http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
«SearchAssistant»=http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm[HKEY_CURRENT_USERSOFTWAREMicrosoftInternet ExplorerMain]
«Local Page»=C:WINDOWSsystem32blank.htm
«Page_Transitions»=
«Search Page»=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
«Start Page»=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerSearchURL]
«provider»=[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]
«{CFBFAE00-17A6-11D0-99CB-00C04FD64497}» (HKLM) — C:WINDOWSsystem32ieframe.dll (Microsoft Corporation)[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings]
«ProxyEnable» = 0[HKEY_USERS.DEFAULTSOFTWAREMicrosoftInternet ExplorerMain]
«Search Page»=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
«Start Page»=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome[HKEY_USERSS-1-5-18SOFTWAREMicrosoftInternet ExplorerMain]
«Search Page»=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
«Start Page»=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome[HKEY_USERSS-1-5-19SOFTWAREMicrosoftInternet ExplorerMain]
[HKEY_USERSS-1-5-20SOFTWAREMicrosoftInternet ExplorerMain]
[HKEY_USERSS-1-5-21-1644491937-1214440339-839522115-1004SOFTWAREMicrosoftInternet ExplorerMain]
«Local Page»=C:WINDOWSsystem32blank.htm
«Page_Transitions»=
«Search Page»=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
«Start Page»=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome[HKEY_USERSS-1-5-21-1644491937-1214440339-839522115-1004SoftwareMicrosoftInternet ExplorerSearchURL]
«provider»=[HKEY_USERSS-1-5-21-1644491937-1214440339-839522115-1004SoftwareMicrosoftInternet ExplorerURLSearchHooks]
«{CFBFAE00-17A6-11D0-99CB-00C04FD64497}» (HKLM) — C:WINDOWSsystem32ieframe.dll (Microsoft Corporation)[HKEY_USERSS-1-5-21-1644491937-1214440339-839522115-1004SoftwareMicrosoftWindowsCurrentVersionInternet Settings]
«ProxyEnable» = 0========== (O1) Hosts File ==========
HOSTS File = (0 bytes) — C:WINDOWSSystem32driversetcHosts
First 25 entries…========== (O2) BHO’s ==========
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects]
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} (HKLM) — C:Program FilesMicrosoft OfficeOffice12GrooveShellExtensions.dll (Microsoft Corporation)
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (HKLM) — C:Program FilesJavajre6binssv.dll (Sun Microsystems, Inc.)
{9961627E-4059-41B4-8E0E-A7D6B3854ADF} (HKLM) — C:Program FilesDownload Masterdmiehlp.dll (WestByte)
{AA58ED58-01DD-4D91-8333-CF10577473F7} (HKLM) — C:Documents and SettingsАлексейGooglegoogletoolbar1.dll ()
{DBC80044-A445-435b-BC74-9C25C1C588A9} (HKLM) — C:Program FilesJavajre6binjp2ssv.dll (Sun Microsystems, Inc.)
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} (HKLM) — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll (Sun Microsystems, Inc.)========== (O3) Toolbars ==========
[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarShellBrowser]
«{01E04581-4EEE-11D0-BFE9-00AA005B4383}» (HKLM) — C:WINDOWSsystem32browseui.dll (Корпорация Майкрософт)[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarShellBrowser]
«{0E5CBF21-D15F-11D0-8301-00AA005B4383}» (HKLM) — C:WINDOWSsystem32shell32.dll (Корпорация Майкрософт)[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebBrowser]
«{01E04581-4EEE-11D0-BFE9-00AA005B4383}» (HKLM) — C:WINDOWSsystem32browseui.dll (Корпорация Майкрософт)[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebBrowser]
«{0E5CBF21-D15F-11D0-8301-00AA005B4383}» (HKLM) — C:WINDOWSsystem32shell32.dll (Корпорация Майкрософт)[HKEY_USERSS-1-5-21-1644491937-1214440339-839522115-1004SoftwareMicrosoftInternet ExplorerToolbarShellBrowser]
«{01E04581-4EEE-11D0-BFE9-00AA005B4383}» (HKLM) — C:WINDOWSsystem32browseui.dll (Корпорация Майкрософт)[HKEY_USERSS-1-5-21-1644491937-1214440339-839522115-1004SoftwareMicrosoftInternet ExplorerToolbarShellBrowser]
«{0E5CBF21-D15F-11D0-8301-00AA005B4383}» (HKLM) — C:WINDOWSsystem32shell32.dll (Корпорация Майкрософт)[HKEY_USERSS-1-5-21-1644491937-1214440339-839522115-1004SoftwareMicrosoftInternet ExplorerToolbarWebBrowser]
«{01E04581-4EEE-11D0-BFE9-00AA005B4383}» (HKLM) — C:WINDOWSsystem32browseui.dll (Корпорация Майкрософт)[HKEY_USERSS-1-5-21-1644491937-1214440339-839522115-1004SoftwareMicrosoftInternet ExplorerToolbarWebBrowser]
«{0E5CBF21-D15F-11D0-8301-00AA005B4383}» (HKLM) — C:WINDOWSsystem32shell32.dll (Корпорация Майкрософт)========== (O4) Run Keys ==========
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«nod32kui»=»C:Program FilesEsetnod32kui.exe» /WAITSERVICE (Eset )
«NvCplDaemon»=RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup (NVIDIA Corporation)
«NvMediaCenter»=RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit (NVIDIA Corporation)
«nwiz»=nwiz.exe /install ()
«SoundMan»=SOUNDMAN.EXE (Realtek Semiconductor Corp.)[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«AWMON»=»C:Program FilesLavasoftAd-Aware SE ProfessionalAd-Watch.exe» (Lavasoft Sweden)[HKEY_USERSS-1-5-21-1644491937-1214440339-839522115-1004SOFTWAREMicrosoftWindowsCurrentVersionRun]
«AWMON»=»C:Program FilesLavasoftAd-Aware SE ProfessionalAd-Watch.exe» (Lavasoft Sweden)========== (O4) Startup Folders ==========
[2005.03.05 06:18:22 | 00,010,872 | —- | M] (Autodesk, Inc) — C:Documents and SettingsAll Users.WINDOWSГлавное менюПрограммыАвтозагрузкаAutoCAD Startup Accelerator.lnk = C:Program FilesCommon FilesAutodesk Sharedacstart16.exe
[2006.02.19 04:21:22 | 00,288,472 | —- | M] (Hewlett-Packard Development Company, L.P.) — C:Documents and SettingsAll Users.WINDOWSГлавное менюПрограммыАвтозагрузкаHP Digital Imaging Monitor.lnk = C:Program FilesHPDigital Imagingbinhpqtra08.exe
[2006.10.26 19:24:54 | 00,098,632 | —- | M] (Microsoft Corporation) — C:Documents and SettingsАлексейГлавное менюПрограммыАвтозагрузкаВырезка экрана и программа запуска для OneNote 2007.lnk = C:Program FilesMicrosoft OfficeOffice12ONENOTEM.EXE========== (O6 & O7) Current Version Policies ==========
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionpoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer]
«NoDriveTypeAutoRun»=323[HKEY_USERS.DEFAULTSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer]
«NoDriveTypeAutoRun»=145
«NoDriveAutoRun»=67108863[HKEY_USERSS-1-5-18SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer]
«NoDriveTypeAutoRun»=145
«NoDriveAutoRun»=67108863[HKEY_USERSS-1-5-19SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer]
«NoDriveTypeAutoRun»=145[HKEY_USERSS-1-5-20SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer]
«NoDriveTypeAutoRun»=145[HKEY_USERSS-1-5-21-1644491937-1214440339-839522115-1004SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer]
«NoDriveTypeAutoRun»=323========== (O8) IE Context Menu Extensions ==========
[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMenuExt]
&Экспорт в Microsoft Excel: C:Program FilesMicrosoft OfficeOffice12EXCEL.EXE [2006.10.27 14:07:36 | 17,891,112 | —- | M] (Microsoft Corporation)
Закачать ВСЕ при помощи Download Master: C:Program FilesDownload Masterdmieall.htm [2002.12.02 14:07:00 | 00,000,556 | —- | M] ()
Закачать при помощи Download Master: C:Program FilesDownload Masterdmie.htm [2002.10.11 09:01:56 | 00,001,039 | —- | M] ()[HKEY_USERSS-1-5-21-1644491937-1214440339-839522115-1004SoftwareMicrosoftInternet ExplorerMenuExt]
&Экспорт в Microsoft Excel: C:Program FilesMicrosoft OfficeOffice12EXCEL.EXE [2006.10.27 14:07:36 | 17,891,112 | —- | M] (Microsoft Corporation)
Закачать ВСЕ при помощи Download Master: C:Program FilesDownload Masterdmieall.htm [2002.12.02 14:07:00 | 00,000,556 | —- | M] ()
Закачать при помощи Download Master: C:Program FilesDownload Masterdmie.htm [2002.10.11 09:01:56 | 00,001,039 | —- | M] ()========== (O9) IE Extensions ==========
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerExtensions]
{2670000A-7350-4f3c-8081-5663EE0C6C49}: Button: Отправить в OneNote — %ProgramFiles%Microsoft OfficeOffice12ONBttnIE.dll [2006.10.26 19:32:42 | 00,604,000 | —- | M] (Microsoft Corporation)
{2670000A-7350-4f3c-8081-5663EE0C6C49}: Menu: &Отправить в OneNote — %ProgramFiles%Microsoft OfficeOffice12ONBttnIE.dll [2006.10.26 19:32:42 | 00,604,000 | —- | M] (Microsoft Corporation)
{8DAE90AD-4583-4977-9DD4-4360F7A45C74}: Button: Download Master — %ProgramFiles%Download Masterdmaster.exe [2008.11.18 17:27:28 | 03,297,280 | —- | M] (WestByte)
{8DAE90AD-4583-4977-9DD4-4360F7A45C74}: Menu: &Download Master — %ProgramFiles%Download Masterdmaster.exe [2008.11.18 17:27:28 | 03,297,280 | —- | M] (WestByte)
{92780B25-18CC-41C8-B9BE-3C9C571A8263}: Button: Research — %ProgramFiles%Microsoft OfficeOffice12REFIEBAR.DLL [2006.10.26 19:12:22 | 00,040,424 | —- | M] (Microsoft Corporation)
{e2e2dd38-d088-4134-82b7-f2ba38496583}: Menu: @xpsp3res.dll,-20001 — %SystemRoot%network diagnosticxpnetdiag.exe [2006.10.10 15:44:50 | 00,557,568 | —- | M] (Microsoft Corporation)
{FB5F1910-F110-11d2-BB9E-00C04F795683}: Button: Messenger — %ProgramFiles%Messengermsmsgs.exe [2004.08.17 16:17:40 | 01,667,584 | -HS- | M] (Microsoft Corporation)
{FB5F1910-F110-11d2-BB9E-00C04F795683}: Menu: Windows Messenger — %ProgramFiles%Messengermsmsgs.exe [2004.08.17 16:17:40 | 01,667,584 | -HS- | M] (Microsoft Corporation)[HKEY_CURRENT_USERSOFTWAREMicrosoftInternet ExplorerExtensions]
CmdMapping\{2670000A-7350-4f3c-8081-5663EE0C6C49} [HKLM] -> %ProgramFiles%Microsoft OfficeOffice12ONBttnIE.dll [Отправить в OneNote] -> [2006.10.26 19:32:42 | 00,604,000 | —- | M] (Microsoft Corporation)
CmdMapping\{8DAE90AD-4583-4977-9DD4-4360F7A45C74} [HKLM] -> %ProgramFiles%Download Masterdmaster.exe [Download Master] -> [2008.11.18 17:27:28 | 03,297,280 | —- | M] (WestByte)
CmdMapping\{92780B25-18CC-41C8-B9BE-3C9C571A8263} [HKLM] -> %ProgramFiles%Microsoft OfficeOffice12REFIEBAR.DLL [Research] -> [2006.10.26 19:12:22 | 00,040,424 | —- | M] (Microsoft Corporation)
CmdMapping\{e2e2dd38-d088-4134-82b7-f2ba38496583} [HKLM] -> %SystemRoot%network diagnosticxpnetdiag.exe [@xpsp3res.dll,-20001] -> [2006.10.10 15:44:50 | 00,557,568 | —- | M] (Microsoft Corporation)
CmdMapping\{FB5F1910-F110-11d2-BB9E-00C04F795683} [HKLM] -> %ProgramFiles%Messengermsmsgs.exe [Messenger] -> [2004.08.17 16:17:40 | 01,667,584 | -HS- | M] (Microsoft Corporation)[HKEY_USERS.DEFAULTSOFTWAREMicrosoftInternet ExplorerExtensions]
CmdMapping\{FB5F1910-F110-11d2-BB9E-00C04F795683} [HKLM] -> %ProgramFiles%Messengermsmsgs.exe [Messenger] -> [2004.08.17 16:17:40 | 01,667,584 | -HS- | M] (Microsoft Corporation)[HKEY_USERSS-1-5-18SOFTWAREMicrosoftInternet ExplorerExtensions]
CmdMapping\{FB5F1910-F110-11d2-BB9E-00C04F795683} [HKLM] -> %ProgramFiles%Messengermsmsgs.exe [Messenger] -> [2004.08.17 16:17:40 | 01,667,584 | -HS- | M] (Microsoft Corporation)[HKEY_USERSS-1-5-21-1644491937-1214440339-839522115-1004SOFTWAREMicrosoftInternet ExplorerExtensions]
CmdMapping\{2670000A-7350-4f3c-8081-5663EE0C6C49} [HKLM] -> %ProgramFiles%Microsoft OfficeOffice12ONBttnIE.dll [Отправить в OneNote] -> [2006.10.26 19:32:42 | 00,604,000 | —- | M] (Microsoft Corporation)
CmdMapping\{8DAE90AD-4583-4977-9DD4-4360F7A45C74} [HKLM] -> %ProgramFiles%Download Masterdmaster.exe [Download Master] -> [2008.11.18 17:27:28 | 03,297,280 | —- | M] (WestByte)
CmdMapping\{92780B25-18CC-41C8-B9BE-3C9C571A8263} [HKLM] -> %ProgramFiles%Microsoft OfficeOffice12REFIEBAR.DLL [Research] -> [2006.10.26 19:12:22 | 00,040,424 | —- | M] (Microsoft Corporation)
CmdMapping\{e2e2dd38-d088-4134-82b7-f2ba38496583} [HKLM] -> %SystemRoot%network diagnosticxpnetdiag.exe [@xpsp3res.dll,-20001] -> [2006.10.10 15:44:50 | 00,557,568 | —- | M] (Microsoft Corporation)
CmdMapping\{FB5F1910-F110-11d2-BB9E-00C04F795683} [HKLM] -> %ProgramFiles%Messengermsmsgs.exe [Messenger] -> [2004.08.17 16:17:40 | 01,667,584 | -HS- | M] (Microsoft Corporation)========== (O12) Internet Explorer Plugins ==========
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerPlugins]
PluginsPage: «» = http://activex.microsoft.com/controls/find.asp?ext=%s&mime=%s
PluginsPageFriendlyName: «» = Microsoft ActiveX Gallery========== (O13) Default Prefixes ==========
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionURLDefaultPrefix]
«»=http://========== (O15) Trusted Sites ==========
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsZoneMapDomains]
1 domain(s) and sub-domain(s) not assigned to a zone.[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsZoneMapDomains]
consultant.rubase: https in My Computer
1 domain(s) and sub-domain(s) not assigned to a zone.[HKEY_USERSS-1-5-21-1644491937-1214440339-839522115-1004SOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsZoneMapDomains]
consultant.rubase: https in My Computer
1 domain(s) and sub-domain(s) not assigned to a zone.========== (O16) DPF ==========
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftCode Store DatabaseDistribution Units]
{6414512B-B978-451D-A0D8-FCFDF33E833C}: http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1211001900187 — WUWebControl Class
{6E32070A-766D-4EE6-879C-DC1FA91D2FC3}: http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1211001881515 — MUWebControl Class
{8AD9C840-044E-11D1-B3E9-00805F499D93}: http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab — Java Plug-in 1.6.0_11
{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}: http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab — Reg Error: Key does not exist or could not be opened.
{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}: http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab — Java Plug-in 1.6.0_11
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}: http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab — Java Plug-in 1.6.0_11
{D27CDB6E-AE6D-11CF-96B8-444553540000}: http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab — Reg Error: Key does not exist or could not be opened.========== (O20) HKLM Winlogon Settings ==========
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogon]
«Shell»=Explorer.exe
>[2006.03.02 15:00:00 | 01,032,704 | —- | M] (Корпорация Майкрософт) — C:WINDOWSexplorer.exe«UserInit»=C:WINDOWSsystem32userinit.exe,
>[2006.03.02 15:00:00 | 00,025,088 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32userinit.exe«UIHost»=logonui.exe
>[2006.03.02 15:00:00 | 00,515,072 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32logonui.exe«VMApplet»=rundll32 shell32,Control_RunDLL «sysdm.cpl»
>[2006.03.02 15:00:00 | 08,401,408 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32shell32.dll
>[2006.03.02 15:00:00 | 00,300,032 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32sysdm.cpl========== (O20) Winlogon Notify Settings ==========
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotify]
crypt32chain: «DllName» = crypt32.dll — C:WINDOWSsystem32crypt32.dll (Корпорация Майкрософт)
cscdll: «DllName» = cscdll.dll — C:WINDOWSsystem32cscdll.dll (Корпорация Майкрософт)
ScCertProp: «DllName» = wlnotify.dll — C:WINDOWSsystem32wlnotify.dll (Корпорация Майкрософт)
Schedule: «DllName» = wlnotify.dll — C:WINDOWSsystem32wlnotify.dll (Корпорация Майкрософт)
sclgntfy: «DllName» = sclgntfy.dll — C:WINDOWSsystem32sclgntfy.dll (Корпорация Майкрософт)
SensLogn: «DllName» = WlNotify.dll — C:WINDOWSsystem32wlnotify.dll (Корпорация Майкрософт)
termsrv: «DllName» = wlnotify.dll — C:WINDOWSsystem32wlnotify.dll (Корпорация Майкрософт)
wlballoon: «DllName» = wlnotify.dll — C:WINDOWSsystem32wlnotify.dll (Корпорация Майкрософт)========== (O21) SSODL Settings ==========
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
«CDBurn»={fbeb8a05-beee-4442-804e-409d6c4515e9} (HKLM) — C:WINDOWSsystem32shell32.dll (Корпорация Майкрософт)[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
«PostBootReminder»={7849596a-48ea-486e-8937-a2a3009f31a9} (HKLM) — C:WINDOWSsystem32shell32.dll (Корпорация Майкрософт)[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
«SysTray»={35CEC8A3-2BE6-11D2-8773-92E220524153} (HKLM) — C:WINDOWSsystem32stobject.dll (Корпорация Майкрософт)[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
«UPnPMonitor»={e57ce738-33e8-4c51-8354-bb4de9d215d1} (HKLM) — C:WINDOWSsystem32upnpui.dll (Корпорация Майкрософт)========== (O22) Shared Task Scheduler ==========
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler]
«{438755C2-A8BA-11D1-B96B-00A0C90312E1}» (HKLM) = Предзагрузчик Browseui — C:WINDOWSsystem32browseui.dll (Корпорация Майкрософт)[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler]
«{8C7461EF-2B13-11d2-BE35-3078302C2030}» (HKLM) = Демон кэша категорий компонентов — C:WINDOWSsystem32browseui.dll (Корпорация Майкрософт)========== Shell Execute Hooks ==========
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks]
«{AEB6717E-7E19-11d0-97EE-00C04FD91972}» (HKLM) — C:WINDOWSsystem32shell32.dll (Корпорация Майкрософт)[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks]
«{B5A7F190-DDA6-4420-B3BA-52453494E6CD}» (HKLM) — C:Program FilesMicrosoft OfficeOffice12GrooveShellExtensions.dll (Microsoft Corporation)========== HKLM *SecurityProviders* ==========
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSecurityProviders]
«SecurityProviders»=msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll
>[2006.03.02 15:00:00 | 00,068,608 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32digest.dll
>[2006.03.02 15:00:00 | 00,290,816 | —- | M] (Корпорация Майкрософт) — C:WINDOWSsystem32msnsspc.dll========== Safeboot Options ==========
«AlternateShell»=cmd.exe
========== CDRom AutoRun Settings ==========
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesCdrom]
«AutoRun» = 1========== Autorun Files on Drives ==========
AUTOEXEC.BAT []
[2008.01.13 18:58:46 | 00,000,000 | —- | M] () — C:AUTOEXEC.BAT — [ NTFS ]========== Files/Folders — Created Within 30 Days ==========
[1 C:WINDOWS*.tmp files]
[2009.03.04 12:31:40 | 00,422,912 | —- | C] (OldTimer Tools) — C:Documents and SettingsАлексейРабочий столOTViewIt.exe
[2009.03.04 12:20:57 | 00,185,199 | —- | C] () — C:Documents and SettingsАлексейРабочий столmail.JPG
[2009.03.04 12:20:16 | 00,183,308 | —- | C] () — C:Documents and SettingsАлексейРабочий столmail2.JPG
[2009.03.02 22:47:23 | 00,000,000 | —D | C] — C:Documents and SettingsАлексейРабочий стол
[2009.03.02 19:27:05 | 00,000,250 | —- | C] () — C:WINDOWSgmer.ini
[2009.03.02 19:27:04 | 00,884,736 | —- | C] () — C:WINDOWSgmer.dll
[2009.03.02 19:27:04 | 00,811,008 | —- | C] () — C:WINDOWSgmer.exe
[2009.03.02 19:27:04 | 00,085,969 | —- | C] (GMER) — C:WINDOWSSystem32driversgmer.sys
[2009.03.02 19:27:04 | 00,000,080 | —- | C] () — C:WINDOWSgmer_uninstall.cmd
[2009.03.02 19:19:25 | 00,811,008 | —- | C] () — C:Documents and SettingsАлексейРабочий столgmer.exe
[2009.02.27 19:18:37 | 00,000,000 | —D | C] — C:rsit
[2009.02.27 19:18:37 | 00,000,000 | —D | C] — C:Program Filestrend micro
[2009.02.26 16:04:37 | 00,000,000 | -HSD | C] — C:RECYCLER
[2009.02.26 15:43:16 | 00,000,000 | —D | C] — C:ComboFix
[2009.02.22 21:30:43 | 00,029,696 | —- | C] (NirSoft) — C:WINDOWSNIRCMD.exe
[2009.02.22 21:30:42 | 00,212,480 | —- | C] (SteelWerX) — C:WINDOWSSWXCACLS.exe
[2009.02.22 21:30:42 | 00,161,792 | —- | C] (SteelWerX) — C:WINDOWSSWREG.exe
[2009.02.22 21:30:42 | 00,136,704 | —- | C] (SteelWerX) — C:WINDOWSSWSC.exe
[2009.02.22 21:30:42 | 00,098,816 | —- | C] () — C:WINDOWSsed.exe
[2009.02.22 21:30:42 | 00,089,504 | —- | C] (Smallfrogs Studio) — C:WINDOWSfdsv.exe
[2009.02.22 21:30:42 | 00,080,412 | —- | C] () — C:WINDOWSgrep.exe
[2009.02.22 21:30:42 | 00,068,096 | —- | C] () — C:WINDOWSzip.exe
[2009.02.22 21:30:42 | 00,049,152 | —- | C] () — C:WINDOWSVFIND.exe
[2009.02.22 21:25:41 | 00,000,000 | —D | C] — C:WINDOWSERDNT
[2009.02.22 21:25:41 | 00,000,000 | —D | C] — C:Qoobox
[2009.02.22 20:27:33 | 00,000,000 | -H-D | C] — C:WINDOWSie7
[2009.02.22 19:54:53 | 00,000,724 | —- | C] () — C:WINDOWSActive Setup Log.BAK
[2009.02.22 19:26:37 | 00,267,776 | —- | C] (Microsoft Corporation) — C:WINDOWSSystem32iertutil.dll
[2009.02.22 18:10:13 | 00,000,000 | -H-D | C] — C:WINDOWSPIF
[2009.02.22 15:49:20 | 00,001,910 | —- | C] () — C:Documents and SettingsАлексейРабочий столКупить лицензионную версию Lavasoft Ad-Aware SE.lnk
[2009.02.14 00:19:54 | 00,000,000 | —D | C] — C:Documents and SettingsАлексейРабочий столМУЖ
[2009.02.14 00:15:23 | 00,000,000 | —D | C] — C:Documents and SettingsАлексейРабочий столM
[2009.02.13 09:22:03 | 00,025,600 | —- | C] (Microsoft Corporation) — C:WINDOWSSystem32driversusbser.sys
[2009.02.13 09:19:04 | 00,000,000 | -H— | C] () — C:WINDOWSSystem32driversMsft_Kernel_ccdcmb_01005.Wdf
[2009.02.13 09:19:00 | 00,000,000 | -H— | C] () — C:WINDOWSSystem32driversMsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
[2009.02.10 22:25:29 | 00,000,000 | —D | C] — C:Documents and SettingsАлексейМои документы
[2009.02.10 12:07:06 | 00,000,000 | —D | C] — C:Documents and SettingsАлексейМои документыПоиск работы
[2009.02.04 11:47:03 | 00,001,085 | —- | C] () — C:Documents and SettingsАлексейРабочий столЯрлык для сканирование0014.lnk
[2009.02.03 23:58:08 | 00,557,056 | —- | C] () — C:Documents and SettingsАлексейМои документыСамый дорогой дом в мире.doc
[2009.02.03 23:43:17 | 00,449,536 | —- | C] () — C:Documents and SettingsАлексейМои документы10 САМЫХ ДОРОГИХ ДОМА МИРА.doc========== Files — Modified Within 30 Days ==========
[1 C:WINDOWS*.tmp files]
[2009.03.04 12:32:01 | 00,422,912 | —- | M] (OldTimer Tools) — C:Documents and SettingsАлексейРабочий столOTViewIt.exe
[2009.03.04 12:20:57 | 00,185,199 | —- | M] () — C:Documents and SettingsАлексейРабочий столmail.JPG
[2009.03.04 12:20:17 | 00,183,308 | —- | M] () — C:Documents and SettingsАлексейРабочий столmail2.JPG
[2009.03.04 05:26:38 | 00,030,277 | —- | M] () — C:WINDOWSSystem32nvapps.xml
[2009.03.04 05:26:37 | 00,000,006 | -H— | M] () — C:WINDOWStasksSA.DAT
[2009.03.04 05:26:35 | 00,002,048 | —S- | M] () — C:WINDOWSbootstat.dat
[2009.03.02 19:27:05 | 00,000,250 | —- | M] () — C:WINDOWSgmer.ini
[2009.03.02 19:27:04 | 00,884,736 | —- | M] () — C:WINDOWSgmer.dll
[2009.03.02 19:27:04 | 00,085,969 | —- | M] (GMER) — C:WINDOWSSystem32driversgmer.sys
[2009.03.02 19:27:04 | 00,000,080 | —- | M] () — C:WINDOWSgmer_uninstall.cmd
[2009.02.26 15:44:38 | 00,000,227 | —- | M] () — C:WINDOWSsystem.ini
[2009.02.26 15:09:01 | 00,013,674 | —- | M] () — C:WINDOWSSystem32wpa.dbl
[2009.02.24 13:00:45 | 00,046,592 | —- | M] () — C:Documents and SettingsАлексейLocal SettingsApplication DataDCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.02.22 20:31:28 | 00,000,247 | -HS- | M] () — C:Documents and SettingsАлексейМои документыdesktop.ini
[2009.02.22 20:29:05 | 00,001,374 | —- | M] () — C:WINDOWSimsins.BAK
[2009.02.22 19:55:00 | 00,000,724 | —- | M] () — C:WINDOWSActive Setup Log.BAK
[2009.02.22 19:40:19 | 00,935,034 | —- | M] () — C:WINDOWSSystem32PerfStringBackup.INI
[2009.02.22 19:40:19 | 00,424,230 | —- | M] () — C:WINDOWSSystem32perfh019.dat
[2009.02.22 19:40:19 | 00,383,254 | —- | M] () — C:WINDOWSSystem32perfh009.dat
[2009.02.22 19:40:19 | 00,065,616 | —- | M] () — C:WINDOWSSystem32perfc019.dat
[2009.02.22 19:40:19 | 00,053,608 | —- | M] () — C:WINDOWSSystem32perfc009.dat
[2009.02.22 15:49:20 | 00,001,910 | —- | M] () — C:Documents and SettingsАлексейРабочий столКупить лицензионную версию Lavasoft Ad-Aware SE.lnk
[2009.02.16 18:07:46 | 00,000,347 | —- | M] () — C:WINDOWSwincmd.ini
[2009.02.13 09:19:04 | 00,000,000 | -H— | M] () — C:WINDOWSSystem32driversMsft_Kernel_ccdcmb_01005.Wdf
[2009.02.13 09:19:00 | 00,000,000 | -H— | M] () — C:WINDOWSSystem32driversMsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
[2009.02.11 20:56:18 | 21,244,872 | —- | M] (Microsoft Corporation) — C:WINDOWSSystem32MRT.exe
[2009.02.04 11:47:03 | 00,001,085 | —- | M] () — C:Documents and SettingsАлексейРабочий столЯрлык для сканирование0014.lnk
[2009.02.03 23:58:08 | 00,557,056 | —- | M] () — C:Documents and SettingsАлексейМои документыСамый дорогой дом в мире.doc
[2009.02.03 23:49:08 | 00,449,536 | —- | M] () — C:Documents and SettingsАлексейМои документы10 САМЫХ ДОРОГИХ ДОМА МИРА.doc
< End of report >Добрый день.
Пару месяцев назад, видимо, что-то поймал ,пришлось откатить винду все работало, но с IE было что-то не так, удалил и переустановил его. потом выставил настройки для сайта консультанта, вот тогда банер и появился.
(принтскрины сделал, но как их вставить не знаю)
[img]C:Documents%20and%20SettingsАлексейРабочий%20столmail[/img]
[img]C:Documents%20and%20SettingsАлексейРабочий%20столmail2[/img]
Ощущение что был изменена «программа» домашней страницы либо запуска IE, тк при запуске он сразу отправляет куки на какие-то сайты, а при смене страницы выводит банер. А еще есть разница на какую страницу переходишь после домашней- разные банеры+ ад-аваре прекращает работу IE(например, если после домашней перехожу на яндекс)вот 1 лог
OTViewIt Extras logfile created on: 04.03.2009 12:34:46 — Run
OTViewIt by OldTimer — Version 1.0.21.0 Folder = C:Documents and SettingsАлексейРабочий стол
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) — Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000419 | Country: Россия | Language: RUS | Date Format: dd.MM.yyyy1,44 Gb Total Physical Memory | 0,79 Gb Available Physical Memory | 54,79% Memory free
3,29 Gb Paging File | 2,72 Gb Available in Paging File | 82,83% Paging File free
Paging file location(s): C:pagefile.sys 2046 4092;%SystemDrive% = C: | %SystemRoot% = C:WINDOWS | %ProgramFiles% = C:Program Files
Drive C: | 9,77 Gb Total Space | 0,88 Gb Free Space | 9,01% Space Free | Partition Type: NTFS
Drive D: | 29,29 Gb Total Space | 8,77 Gb Free Space | 29,95% Space Free | Partition Type: NTFS
Drive E: | 37,62 Gb Total Space | 9,09 Gb Free Space | 24,16% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loadedComputer Name: KITCHEN
Current User Name: Алексей
Logged in as Administrator.Current Boot Mode: Normal
Scan Mode: All users
Whitelist: On
File Age = 30 Days========== File Associations ==========
[HKEY_LOCAL_MACHINESOFTWAREClasses
]
.html [@ = FirefoxHTML] — C:Program FilesMozilla Firefoxfirefox.exe (Mozilla Corporation)========== Security Center Settings ==========
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity Center]
«FirstRunDisabled»=1
«AntiVirusDisableNotify»=0
«FirewallDisableNotify»=0
«UpdatesDisableNotify»=0
«AntiVirusOverride»=0
«FirewallOverride»=0
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoring]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringAhnlabAntiVirus]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringKasperskyAntiVirus]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringMcAfeeAntiVirus]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringMcAfeeFirewall]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringPandaAntiVirus]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringPandaFirewall]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringSophosAntiVirus]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringSymantecAntiVirus]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringSymantecFirewall]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringTinyFirewall]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringTrendAntiVirus]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringTrendFirewall]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringZoneLabsFirewall]HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfile
«EnableFirewall»=0
«DisableNotifications»=0
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplications]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileGloballyOpenPorts]========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyDomainProfileAuthorizedApplicationsList]
[2006.03.02 15:00:00 | 00,141,312 | —- | M] (Корпорация Майкрософт) — %windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
[2006.10.10 15:44:50 | 00,557,568 | —- | M] (Microsoft Corporation) — %windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList]
[2006.03.02 15:00:00 | 00,141,312 | —- | M] (Корпорация Майкрософт) — %windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
[2006.02.17 10:17:08 | 00,020,543 | —- | M] (Apache Software Foundation) — C:Program FilesNVIDIA CorporationNetworkAccessManagerApache GroupApache2binApache.exe:*:Enabled:Apache HTTP Server
[2006.10.27 14:16:48 | 12,813,096 | —- | M] (Microsoft Corporation) — C:Program FilesMicrosoft OfficeOffice12OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook
[2006.10.27 14:37:44 | 00,338,216 | —- | M] (Microsoft Corporation) — C:Program FilesMicrosoft OfficeOffice12GROOVE.EXE:*:Enabled:Microsoft Office Groove
[2006.10.27 14:03:04 | 01,018,664 | —- | M] (Microsoft Corporation) — C:Program FilesMicrosoft OfficeOffice12ONENOTE.EXE:*:Enabled:Microsoft Office OneNote
[2006.02.19 04:21:22 | 00,288,472 | —- | M] (Hewlett-Packard Development Company, L.P.) — C:Program FilesHPDigital Imagingbinhpqtra08.exe:*:Enabled:hpqtra08.exe
[2006.02.19 05:24:52 | 00,239,320 | —- | M] (Hewlett-Packard Development Company, L.P.) — C:Program FilesHPDigital Imagingbinhpqste08.exe:*:Enabled:hpqste08.exe
[2006.04.21 00:13:30 | 00,231,000 | —- | M] (Hewlett-Packard Development Company, L.P.) — C:Program FilesHPDigital Imagingbinhpofxm08.exe:*:Enabled:hpofxm08.exe
[2006.04.20 21:28:12 | 00,040,960 | —- | M] (Hewlett-Packard Development Company, L.P.) — C:Program FilesHPDigital Imagingbinhposfx08.exe:*:Enabled:hposfx08.exe
[2006.04.20 23:43:46 | 00,087,640 | —- | M] (Hewlett-Packard Development Company, L.P.) — C:Program FilesHPDigital Imagingbinhposid01.exe:*:Enabled:hposid01.exe
[2006.02.17 00:19:34 | 00,192,512 | —- | M] () — C:Program FilesHPDigital Imagingbinhpqscnvw.exe:*:Enabled:hpqscnvw.exe
[2006.02.16 22:49:52 | 01,085,440 | R— | M] (Hewlett-Packard) — C:Program FilesHPDigital Imagingbinhpqkygrp.exe:*:Enabled:hpqkygrp.exe
[2006.04.21 00:06:26 | 00,181,848 | —- | M] (Hewlett-Packard Development Company, L.P.) — C:Program FilesHPDigital ImagingbinhpqCopy.exe:*:Enabled:hpqcopy.exe
[2006.02.15 10:37:26 | 00,147,511 | R— | M] (Hewlett-Packard) — C:Program FilesHPDigital Imagingbinhpfccopy.exe:*:Enabled:hpfccopy.exe
[2006.04.21 00:13:00 | 00,456,280 | —- | M] (Hewlett-Packard Development Company, L.P.) — C:Program FilesHPDigital Imagingbinhpzwiz01.exe:*:Enabled:hpzwiz01.exe
[2006.02.09 16:43:36 | 00,110,592 | R— | M] (Hewlett-Packard) — C:Program FilesHPDigital ImagingUnloadHpqPhUnl.exe:*:Enabled:hpqphunl.exe
[2006.02.09 16:41:28 | 00,573,440 | —- | M] ( ) — C:Program FilesHPDigital ImagingUnloadHpqDIA.exe:*:Enabled:hpqdia.exe
[2006.04.20 23:42:18 | 00,063,064 | —- | M] (Hewlett-Packard Development Company, L.P.) — C:Program FilesHPDigital Imagingbinhpoews01.exe:*:Enabled:hpoews01.exe
[2006.02.19 05:29:46 | 00,139,264 | —- | M] (Hewlett-Packard Development Company, L.P.) — C:Program FilesHPDigital Imagingbinhpqnrs08.exe:*:Enabled:hpqnrs08.exe
[2006.03.02 15:00:00 | 00,083,456 | —- | M] (Microsoft Corporation) — C:WINDOWSsystem32dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test
[2008.09.23 19:56:34 | 00,881,296 | —- | M] (Blizzard Entertainment, Inc.) — D:World of WarcraftRepair.exe:*:Enabled:Blizzard Repair Utility
[2006.10.10 15:44:50 | 00,557,568 | —- | M] (Microsoft Corporation) — %windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000========== (O10) Winsock2 Catalogs ==========
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWinSock2Parameters]
NameSpace_Catalog5Catalog_Entries 00000000001 [TCP/IP] — C:WINDOWSsystem32mswsock.dll (Корпорация Майкрософт)
NameSpace_Catalog5Catalog_Entries 00000000003 [Пространство имен службы сетевого расположения (NLA)] — C:WINDOWSsystem32mswsock.dll (Корпорация Майкрософт)
Protocol_Catalog9Catalog_Entries 00000000001 — C:WINDOWSsystem32imon.dll (Eset )
Protocol_Catalog9Catalog_Entries 00000000002 — C:WINDOWSsystem32imon.dll (Eset )
Protocol_Catalog9Catalog_Entries 00000000003 — C:WINDOWSsystem32imon.dll (Eset )
Protocol_Catalog9Catalog_Entries 00000000004 — C:WINDOWSsystem32imon.dll (Eset )
Protocol_Catalog9Catalog_Entries 00000000005 — C:WINDOWSsystem32imon.dll (Eset )
Protocol_Catalog9Catalog_Entries 00000000006 — C:WINDOWSsystem32imon.dll (Eset )
Protocol_Catalog9Catalog_Entries 00000000007 — C:WINDOWSsystem32imon.dll (Eset )
Protocol_Catalog9Catalog_Entries 00000000008 — C:WINDOWSsystem32imon.dll (Eset )
Protocol_Catalog9Catalog_Entries 00000000009 — C:WINDOWSsystem32imon.dll (Eset )
Protocol_Catalog9Catalog_Entries 00000000010 — C:WINDOWSsystem32imon.dll (Eset )
Protocol_Catalog9Catalog_Entries 00000000011 — C:WINDOWSsystem32imon.dll (Eset )
Protocol_Catalog9Catalog_Entries 00000000012 — C:WINDOWSsystem32imon.dll (Eset )
Protocol_Catalog9Catalog_Entries 00000000013 — C:WINDOWSsystem32imon.dll (Eset )
Protocol_Catalog9Catalog_Entries 00000000014 — C:WINDOWSsystem32imon.dll (Eset )
Protocol_Catalog9Catalog_Entries 00000000015 — C:WINDOWSsystem32imon.dll (Eset )
Protocol_Catalog9Catalog_Entries 00000000016 — C:WINDOWSsystem32imon.dll (Eset )
Protocol_Catalog9Catalog_Entries 00000000017 — C:WINDOWSsystem32imon.dll (Eset )========== (O18) Protocol Handlers ==========
[HKEY_LOCAL_MACHINESOFTWAREClassesPROTOCOLSHandler]
[2006.03.02 15:00:00 | 01,431,040 | —- | M] (Корпорация Майкрософт) C:WINDOWSsystem32msvidctl.dll (dvd:{12D51199-0DB5-46FE-A120-47A3D7D937CC} (HKLM) [DVD: подключаемый протокол])[HKEY_LOCAL_MACHINESOFTWAREClassesPROTOCOLSHandler]
[2006.10.26 23:48:02 | 00,222,512 | —- | M] (Microsoft Corporation) C:Program FilesMicrosoft OfficeOffice12GrooveSystemServices.dll (grooveLocalGWS:{88FED34C-F0CA-4636-A375-3CB6248B04CD} (HKLM) [Local Groove Web Services Protocol])[HKEY_LOCAL_MACHINESOFTWAREClassesPROTOCOLSHandler]
ipp: [HKLM — No CLSID value][HKEY_LOCAL_MACHINESOFTWAREClassesPROTOCOLSHandler] — Protocol Handlers
[2006.10.14 07:42:14 | 01,011,488 | —- | M] (Microsoft Corporation) C:Program FilesCommon FilesSystemOle DBMSDAIPP.DLL ipp x00000001:{E1D2BF42-A96B-11d1-9C6B-0000F875AC61} (HKLM) [HKLM — MSDAMON.BINDER][HKEY_LOCAL_MACHINESOFTWAREClassesPROTOCOLSHandler]
msdaipp: [HKLM — No CLSID value][HKEY_LOCAL_MACHINESOFTWAREClassesPROTOCOLSHandler] — Protocol Handlers
[2006.10.14 07:42:14 | 01,011,488 | —- | M] (Microsoft Corporation) C:Program FilesCommon FilesSystemOle DBMSDAIPP.DLL msdaipp x00000001:{E1D2BF42-A96B-11d1-9C6B-0000F875AC61} (HKLM) [HKLM — MSDAMON.BINDER][HKEY_LOCAL_MACHINESOFTWAREClassesPROTOCOLSHandler] — Protocol Handlers
[2006.10.14 07:42:14 | 01,011,488 | —- | M] (Microsoft Corporation) C:Program FilesCommon FilesSystemOle DBMSDAIPP.DLL msdaippoledb:{E1D2BF40-A96B-11d1-9C6B-0000F875AC61} (HKLM) [HKLM — MSDAIPP.BINDER][HKEY_LOCAL_MACHINESOFTWAREClassesPROTOCOLSHandler]
[2006.10.26 12:45:02 | 00,873,216 | —- | M] (Microsoft Corporation) C:Program FilesCommon FilesMicrosoft SharedHelphxds.dll (ms-help:{314111c7-a502-11d2-bbca-00c04f8ec294} (HKLM) [HxProtocol Class])[HKEY_LOCAL_MACHINESOFTWAREClassesPROTOCOLSHandler]
[2006.03.02 15:00:00 | 01,431,040 | —- | M] (Корпорация Майкрософт) C:WINDOWSsystem32msvidctl.dll (tv:{CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} (HKLM) [ТВ: подключаемый протокол])========== (O18) Protocol Filters ==========
[HKEY_LOCAL_MACHINESOFTWAREClassesPROTOCOLSFilter] — Protocol Filters
[2006.03.02 15:00:00 | 08,401,408 | —- | M] (Корпорация Майкрософт) C:WINDOWSsystem32shell32.dll text/webviewhtml:{733AC4CB-F1A4-11d0-B951-00A0C90312E1} (HKLM) [WebView MIME Filter][HKEY_LOCAL_MACHINESOFTWAREClassesPROTOCOLSFilter] — Protocol Filters
[2006.10.26 20:41:48 | 00,044,344 | —- | M] (Microsoft Corporation) C:Program FilesCommon FilesMicrosoft SharedOFFICE12MSOXMLMF.DLL text/xml:{807563E5-5146-11D5-A672-00B0D022E945} (HKLM) [Microsoft Office InfoPath XML Mime Filter]========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall]
«{1F6423DE-7959-4178-80E0-023C7EAA5347}»=NVIDIA ForceWare Network Access Manager
«{2376813B-2E5A-4641-B7B3-A0D5ADB55229}»=HPPhotoSmartExpress
«{26A24AE4-039D-4CA4-87B4-2F83216011FF}»=Java(TM) 6 Update 11
«{350C9419-3D7C-4EE8-BAA9-00BCB3D54227}»=WebFldrs XP
«{363790D2-DA98-41DD-9C9F-69FA36B169DE}»=PanoStandAlone
«{45B8A76B-57EC-4242-B019-066400CD8428}»=BufferChm
«{4EA684E9-5C81-4033-A696-3019EC57AC3A}»=HPProductAssistant
«{5783F2D7-4001-0409-0002-0060B0CE6BBA}»=AutoCAD 2006 — English
«{66910000-8B30-4973-A159-6371345AFFA5}»=WebReg
«{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}»=eSupportQFolder
«{68763C27-235D-4165-A961-FDEA228CE504}»=AiOSoftwareNPI
«{6909F917-5499-482e-9AA1-FAD06A99F231}»=Toolbox
«{6994491D-D491-48F1-AE1F-E179C1FFFC2F}»=HP Photosmart Essential
«{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}»=CustomerResearchQFolder
«{736C803C-DD3B-4015-BC51-AFB9E67B9076}»=Readme
«{7E7B7865-6C80-4373-8BC1-C2EB9431F9DE}»=ProductContextNPI
«{8331C3EA-0C91-43AA-A4D4-27221C631139}»=Status
«{87E2B986-07E8-477a-93DC-AF0B6758B192}»=DocProcQFolder
«{892F2C46-D7F3-4E69-8929-4BCB2D77CD82}»=Ad-Aware SE Language Pack
«{8A4CE7FD-9657-4B06-9943-E1819F3D5D67}»=DocProc
«{8CE4E6E9-9D55-43FB-9DDB-688C976BFC05}»=Unload
«{90120000-0010-0419-0000-0000000FF1CE}»=Microsoft Software Update for Web Folders (Russian) 12
«{90120000-0015-0419-0000-0000000FF1CE}»=Microsoft Office Access MUI (Russian) 2007
«{90120000-0016-0419-0000-0000000FF1CE}»=Microsoft Office Excel MUI (Russian) 2007
«{90120000-0018-0419-0000-0000000FF1CE}»=Microsoft Office PowerPoint MUI (Russian) 2007
«{90120000-0019-0419-0000-0000000FF1CE}»=Microsoft Office Publisher MUI (Russian) 2007
«{90120000-001A-0419-0000-0000000FF1CE}»=Microsoft Office Outlook MUI (Russian) 2007
«{90120000-001B-0419-0000-0000000FF1CE}»=Microsoft Office Word MUI (Russian) 2007
«{90120000-001F-0407-0000-0000000FF1CE}»=Microsoft Office Proof (German) 2007
«{90120000-001F-0409-0000-0000000FF1CE}»=Microsoft Office Proof (English) 2007
«{90120000-001F-0419-0000-0000000FF1CE}»=Microsoft Office Proof (Russian) 2007
«{90120000-001F-0422-0000-0000000FF1CE}»=Microsoft Office Proof (Ukrainian) 2007
«{90120000-002C-0419-0000-0000000FF1CE}»=Microsoft Office Proofing (Russian) 2007
«{90120000-0030-0000-0000-0000000FF1CE}»=Microsoft Office Enterprise 2007
«{90120000-0044-0419-0000-0000000FF1CE}»=Microsoft Office InfoPath MUI (Russian) 2007
«{90120000-006E-0419-0000-0000000FF1CE}»=Microsoft Office Shared MUI (Russian) 2007
«{90120000-00A1-0419-0000-0000000FF1CE}»=Microsoft Office OneNote MUI (Russian) 2007
«{90120000-00BA-0419-0000-0000000FF1CE}»=Microsoft Office Groove MUI (Russian) 2007
«{996512CF-F35B-48DE-9291-557FA5316967}»=ScannerCopy
«{9FC8D8F8-AF3A-4488-98AF-51C6DEC732F2}»=c3100_Help
«{AB5D51AE-EBC3-438D-872C-705C7C2084B0}»=DeviceManagementQFolder
«{AC76BA86-7AD7-1049-7B44-A81200000003}»=Adobe Reader 8 — Russian
«{BB85ED9C-AFC9-43BD-B8DC-258C3C7DF72E}»=HP Software Update
«{BC4AE628-81A4-4FC6-863A-7A9BA2E2531F}»=Nokia Connectivity Cable Driver
«{BDBE2F3E-42DB-4d4a-8CB1-19BA765DBC6C}»=HP Photosmart, Officejet and Deskjet 7.0.A
«{C7F54CF8-D6FB-4E0A-93A3-E68AE0D6C476}»=SolutionCenter
«{C8753E28-2680-49BF-BD48-DD38FD086EFE}»=AiO_Scan_CDA
«{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}»=Microsoft .NET Framework 1.1
«{DBC20735-34E6-4E97-A9E5-2066B66B243D}»=TrayApp
«{E1B80DEE-A795-4258-8445-074C06AE3AB8}»=MarketResearch
«{EB8C9964-09AC-48bf-8B98-027609C78251}»=C3100
«{F157460F-720E-482f-8625-AD7843891E5F}»=InstantShareDevicesMFC
«{F3760724-B29D-465B-BC53-E5D72095BCC4}»=Scan
«{F6076EF9-08E1-442F-B6A2-BFB61B295A14}»=Fax_CDA
«{FB08F381-6533-4108-B7DD-039E11FBC27E}»=Realtek AC’97 Audio
«{FB15E224-67C3-491F-9F5C-F257BC418412}»=Destinations
«{FBB980B0-63F8-4B48-8D65-90F1D9F81D9F}»=NewCopy_CDA
«Ad-Aware SE Professional»=Ad-Aware SE Professional
«Adobe Flash Player Plugin»=Adobe Flash Player 10 Plugin
«Autodesk DWF Viewer»=Autodesk DWF Viewer
«Directmedia»=Directmedia
«Download Master_is1″=Download Master version 5.5.7.1145
«ENTERPRISE»=Microsoft Office Enterprise 2007
«FLVPlayer»=FLV Player 1.3.3
«HijackThis»=HijackThis 2.0.2
«HP Imaging Device Functions»=HP Imaging Device Functions 7.0
«HP Solution Center & Imaging Support Tools»=HP Solution Center 7.0
«HPExtendedCapabilities»=HP Customer Participation Program 7.0
«HPOCR»=OCR Software by I.R.I.S 7.0
«IDNMitigationAPIs»=Microsoft Internationalized Domain Names Mitigation APIs
«ie7″=Windows Internet Explorer 7
«InstallShield_{1F6423DE-7959-4178-80E0-023C7EAA5347}»=NVIDIA ForceWare Network Access Manager
«KLiteCodecPack_is1″=K-Lite Mega Codec Pack 2.2.0
«Microsoft .NET Framework 1.1 (1033)»=Microsoft .NET Framework 1.1
«Mozilla Firefox (3.0.6)»=Mozilla Firefox (3.0.6)
«NLSDownlevelMapping»=Microsoft National Language Support Downlevel APIs
«NOD32″=Антивирусная система NOD32
«NVIDIA Drivers»=NVIDIA Drivers
«Totalcmd»=Total Commander (Remove or Repair)
«Wdf01005″=Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
«WinRAR archiver»=Архиватор WinRAR (только удаление)========== Last 10 Event Log Errors ==========
[ Application Events ]
Error — 22.02.2009 16:44:56 | Computer Name = KITCHEN | Source = MsiInstaller | ID = 11308
Description = Product: Antispyware — Error 1308. Source file not found: C:DOCUME~1 7C4~1LOCALS~1Temp7zS16CF.tmpAntispywareTCL.dll.
Verify that the file exists and that you can access it.Error — 22.02.2009 16:44:57 | Computer Name = KITCHEN | Source = MsiInstaller | ID = 11308
Description = Product: Antispyware — Error 1308. Source file not found: C:DOCUME~1 7C4~1LOCALS~1Temp7zS16CF.tmpAntispywareTCL.dll.
Verify that the file exists and that you can access it.Error — 22.02.2009 16:44:58 | Computer Name = KITCHEN | Source = MsiInstaller | ID = 11308
Description = Product: Antispyware — Error 1308. Source file not found: C:DOCUME~1 7C4~1LOCALS~1Temp7zS16CF.tmpAntispywareTCL.dll.
Verify that the file exists and that you can access it.Error — 26.02.2009 8:28:52 | Computer Name = KITCHEN | Source = Application Error | ID = 1000
Description = Ошибка приложения ad-watch.exe, версия 3.1.2.17, модуль kernel32.dll,
версия 5.1.2600.2180, адрес 0x0001eb33.Error — 26.02.2009 8:45:58 | Computer Name = KITCHEN | Source = Application Error | ID = 1000
Description = Ошибка приложения ad-watch.exe, версия 3.1.2.17, модуль kernel32.dll,
версия 5.1.2600.2180, адрес 0x0001eb33.Error — 02.03.2009 15:12:53 | Computer Name = KITCHEN | Source = Microsoft Office 12 | ID = 1000
Description = Faulting application winword.exe, version 12.0.4518.1014, stamp 45428028,
faulting module wwlib.dll, version 12.0.4518.1014, stamp 454285fb, debug? 0, fault
address 0x00113ecd.Error — 02.03.2009 15:13:21 | Computer Name = KITCHEN | Source = Microsoft Office 12 | ID = 1000
Description = Faulting application winword.exe, version 12.0.4518.1014, stamp 45428028,
faulting module wwlib.dll, version 12.0.4518.1014, stamp 454285fb, debug? 0, fault
address 0x00113ecd.Error — 02.03.2009 15:13:26 | Computer Name = KITCHEN | Source = Microsoft Office 12 | ID = 1000
Description = Faulting application winword.exe, version 12.0.4518.1014, stamp 45428028,
faulting module wwlib.dll, version 12.0.4518.1014, stamp 454285fb, debug? 0, fault
address 0x00113ecd.Error — 02.03.2009 15:14:11 | Computer Name = KITCHEN | Source = Microsoft Office 12 | ID = 1000
Description = Faulting application winword.exe, version 12.0.4518.1014, stamp 45428028,
faulting module wwlib.dll, version 12.0.4518.1014, stamp 454285fb, debug? 0, fault
address 0x00113ecd.Error — 02.03.2009 15:14:30 | Computer Name = KITCHEN | Source = Microsoft Office 12 | ID = 1000
Description = Faulting application winword.exe, version 12.0.4518.1014, stamp 45428028,
faulting module wwlib.dll, version 12.0.4518.1014, stamp 454285fb, debug? 0, fault
address 0x00113ecd.[ Application Events ]
Error — 22.02.2009 16:44:56 | Computer Name = KITCHEN | Source = MsiInstaller | ID = 11308
Description = Product: Antispyware — Error 1308. Source file not found: C:DOCUME~1 7C4~1LOCALS~1Temp7zS16CF.tmpAntispywareTCL.dll.
Verify that the file exists and that you can access it.Error — 22.02.2009 16:44:57 | Computer Name = KITCHEN | Source = MsiInstaller | ID = 11308
Description = Product: Antispyware — Error 1308. Source file not found: C:DOCUME~1 7C4~1LOCALS~1Temp7zS16CF.tmpAntispywareTCL.dll.
Verify that the file exists and that you can access it.Error — 22.02.2009 16:44:58 | Computer Name = KITCHEN | Source = MsiInstaller | ID = 11308
Description = Product: Antispyware — Error 1308. Source file not found: C:DOCUME~1 7C4~1LOCALS~1Temp7zS16CF.tmpAntispywareTCL.dll.
Verify that the file exists and that you can access it.Error — 26.02.2009 8:28:52 | Computer Name = KITCHEN | Source = Application Error | ID = 1000
Description = Ошибка приложения ad-watch.exe, версия 3.1.2.17, модуль kernel32.dll,
версия 5.1.2600.2180, адрес 0x0001eb33.Error — 26.02.2009 8:45:58 | Computer Name = KITCHEN | Source = Application Error | ID = 1000
Description = Ошибка приложения ad-watch.exe, версия 3.1.2.17, модуль kernel32.dll,
версия 5.1.2600.2180, адрес 0x0001eb33.Error — 02.03.2009 15:12:53 | Computer Name = KITCHEN | Source = Microsoft Office 12 | ID = 1000
Description = Faulting application winword.exe, version 12.0.4518.1014, stamp 45428028,
faulting module wwlib.dll, version 12.0.4518.1014, stamp 454285fb, debug? 0, fault
address 0x00113ecd.Error — 02.03.2009 15:13:21 | Computer Name = KITCHEN | Source = Microsoft Office 12 | ID = 1000
Description = Faulting application winword.exe, version 12.0.4518.1014, stamp 45428028,
faulting module wwlib.dll, version 12.0.4518.1014, stamp 454285fb, debug? 0, fault
address 0x00113ecd.Error — 02.03.2009 15:13:26 | Computer Name = KITCHEN | Source = Microsoft Office 12 | ID = 1000
Description = Faulting application winword.exe, version 12.0.4518.1014, stamp 45428028,
faulting module wwlib.dll, version 12.0.4518.1014, stamp 454285fb, debug? 0, fault
address 0x00113ecd.Error — 02.03.2009 15:14:11 | Computer Name = KITCHEN | Source = Microsoft Office 12 | ID = 1000
Description = Faulting application winword.exe, version 12.0.4518.1014, stamp 45428028,
faulting module wwlib.dll, version 12.0.4518.1014, stamp 454285fb, debug? 0, fault
address 0x00113ecd.Error — 02.03.2009 15:14:30 | Computer Name = KITCHEN | Source = Microsoft Office 12 | ID = 1000
Description = Faulting application winword.exe, version 12.0.4518.1014, stamp 45428028,
faulting module wwlib.dll, version 12.0.4518.1014, stamp 454285fb, debug? 0, fault
address 0x00113ecd.[ OSession Events ]
Error — 30.07.2008 18:28:54 | Computer Name = KITCHEN | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 604
seconds with 600 seconds of active time. This session ended with a crash.Error — 31.07.2008 0:13:05 | Computer Name = KITCHEN | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 20636
seconds with 8040 seconds of active time. This session ended with a crash.Error — 30.01.2009 19:10:53 | Computer Name = KITCHEN | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 50616
seconds with 2520 seconds of active time. This session ended with a crash.Error — 02.02.2009 5:42:10 | Computer Name = KITCHEN | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 9
seconds with 0 seconds of active time. This session ended with a crash.Error — 02.02.2009 5:42:32 | Computer Name = KITCHEN | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 15
seconds with 0 seconds of active time. This session ended with a crash.Error — 02.03.2009 15:12:51 | Computer Name = KITCHEN | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 6
seconds with 0 seconds of active time. This session ended with a crash.Error — 02.03.2009 15:13:20 | Computer Name = KITCHEN | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 1
seconds with 0 seconds of active time. This session ended with a crash.Error — 02.03.2009 15:13:25 | Computer Name = KITCHEN | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 2
seconds with 0 seconds of active time. This session ended with a crash.Error — 02.03.2009 15:14:10 | Computer Name = KITCHEN | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 37
seconds with 0 seconds of active time. This session ended with a crash.Error — 02.03.2009 15:14:30 | Computer Name = KITCHEN | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 6
seconds with 0 seconds of active time. This session ended with a crash.< End of report >
Добрый день.
Отключил интернет запустил IE , естестественно ничего не вышло, переключился на другой сайт и включил провод интернета. банер не вышел. стоило перезапустить IE при наличии и-нета и вот он опять красуется.привожу лог( при сканировании банер был на странице):
GMER 1.0.14.14536 — http://www.gmer.net
Rootkit scan 2009-03-02 19:35:05
Windows 5.1.2600 Service Pack 2—- User code sections — GMER 1.0.14 —-
.text C:Program FilesInternet Exploreriexplore.exe[860] USER32.dll!DialogBoxParamW 77D46702 5 Bytes JMP 4360F341 C:WINDOWSsystem32IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:Program FilesInternet Exploreriexplore.exe[860] USER32.dll!DialogBoxParamA 77D488E1 5 Bytes JMP 437A1844 C:WINDOWSsystem32IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:Program FilesInternet Exploreriexplore.exe[860] USER32.dll!DialogBoxIndirectParamW 77D52598 5 Bytes JMP 437A187F C:WINDOWSsystem32IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:Program FilesInternet Exploreriexplore.exe[860] USER32.dll!MessageBoxIndirectA 77D5AEF1 5 Bytes JMP 437A1800 C:WINDOWSsystem32IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:Program FilesInternet Exploreriexplore.exe[860] USER32.dll!MessageBoxExW 77D70559 5 Bytes JMP 437A178C C:WINDOWSsystem32IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:Program FilesInternet Exploreriexplore.exe[860] USER32.dll!MessageBoxExA 77D7057D 5 Bytes JMP 437A17C6 C:WINDOWSsystem32IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:Program FilesInternet Exploreriexplore.exe[860] USER32.dll!DialogBoxIndirectParamA 77D76CED 5 Bytes JMP 437A18BA C:WINDOWSsystem32IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:Program FilesInternet Exploreriexplore.exe[860] USER32.dll!MessageBoxIndirectW 77D860B7 5 Bytes JMP 436316F6 C:WINDOWSsystem32IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:Program Filesinternet exploreriexplore.exe[3376] USER32.dll!DialogBoxParamW 77D46702 5 Bytes JMP 4360F341 C:WINDOWSsystem32IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:Program Filesinternet exploreriexplore.exe[3376] USER32.dll!DialogBoxParamA 77D488E1 5 Bytes JMP 437A1844 C:WINDOWSsystem32IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:Program Filesinternet exploreriexplore.exe[3376] USER32.dll!DialogBoxIndirectParamW 77D52598 5 Bytes JMP 437A187F C:WINDOWSsystem32IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:Program Filesinternet exploreriexplore.exe[3376] USER32.dll!MessageBoxIndirectA 77D5AEF1 5 Bytes JMP 437A1800 C:WINDOWSsystem32IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:Program Filesinternet exploreriexplore.exe[3376] USER32.dll!MessageBoxExW 77D70559 5 Bytes JMP 437A178C C:WINDOWSsystem32IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:Program Filesinternet exploreriexplore.exe[3376] USER32.dll!MessageBoxExA 77D7057D 5 Bytes JMP 437A17C6 C:WINDOWSsystem32IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:Program Filesinternet exploreriexplore.exe[3376] USER32.dll!DialogBoxIndirectParamA 77D76CED 5 Bytes JMP 437A18BA C:WINDOWSsystem32IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:Program Filesinternet exploreriexplore.exe[3376] USER32.dll!MessageBoxIndirectW 77D860B7 5 Bytes JMP 436316F6 C:WINDOWSsystem32IEFRAME.dll (Internet Explorer/Microsoft Corporation)—- Devices — GMER 1.0.14 —-
AttachedDevice FileSystemNtfs Ntfs amon.sys (Amon monitor/Eset )
Device Driverprodrv06 DeviceProDrv06 E1AF2478
Device Driverprohlp02 DeviceProHlp02 E100F0C8—- Registry — GMER 1.0.14 —-
Reg HKLMSYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 W A N ( L 002 T P ) 1?
Reg HKLMSYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 W A N ( P P T P ) 1?
Reg HKLMSYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 W A N ( P P P o E ) 1?
Reg HKLMSYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@374@4O4<4>494 ? 0404@ 0404;4; 0454;4L4=4K494 ?4>4@4B4 1?
Reg HKLMSYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 W A N ( I P ) 1?
Reg HKLMSYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 ?4; 0404=484@4> 0424I484: 0404 ? 0404: 0454B4> 0424 1?2?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 W A N ( L 002 T P ) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 W A N ( P P T P ) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 W A N ( P P P o E ) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@374@4O4<4>494 ? 0404@ 0404;4; 0454;4L4=4K494 ?4>4@4B4 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 W A N ( I P ) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 ?4; 0404=484@4> 0424I484: 0404 ? 0404: 0454B4> 0424 1?2?
Reg HKLMSYSTEMControlSet004ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 W A N ( L 002 T P ) 1?
Reg HKLMSYSTEMControlSet004ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 W A N ( P P T P ) 1?
Reg HKLMSYSTEMControlSet004ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 W A N ( P P P o E ) 1?
Reg HKLMSYSTEMControlSet004ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@374@4O4<4>494 ? 0404@ 0404;4; 0454;4L4=4K494 ?4>4@4B4 1?
Reg HKLMSYSTEMControlSet004ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 W A N ( I P ) 1?
Reg HKLMSYSTEMControlSet004ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 ?4; 0404=484@4> 0424I484: 0404 ? 0404: 0454B4> 0424 1?2?—- EOF — GMER 1.0.14 —-
Спасибо
Добрый день.
Банер исключительно в IE , причем я не могу изменить домашнюю страницу, если я прописываю к-либо страницу, то все равно будет обращаться на микрософтовский сайт, но не догрузив его переходит на msn.com.Ад-аваре ругается
на сторонние куки типа алексей@atdmt.com .алексей@doubleclick.net. Мне кажется он интегрирован в сам IE,но удаление и переустановка результатов не дают. При переходе с домашней страницы на любую другую появляется либо надпись в середине, либо выезжает снизу. закрывается, если нажать на крестик, но выезжает через время. Если таких очевидных решений нет , то… придется переставить винду.Добрый день.
Не вижу причин для извинений, а, наоборот , СПАСИБО Вам за то что находите для меня время.Проблема сохранилась. Этот банер висит уже пару месяцев. появляется строго при наличии инета. если вытащить шнур, то банер не появляется
выкладываю лог
ComboFix 09-02-21.01 — Алексей 2009-02-26 15:43:46.4 — NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1251.1.1049.18.1471.993 [GMT 3:00]
Running from: e:akella gamesComboFix.exe
AV: Антивирусная система Eset NOD32 2.70 *On-access scanning enabled* (Outdated)
* Resident AV is activeWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.((((((((((((((((((((((((( Files Created from 2009-01-26 to 2009-02-26 )))))))))))))))))))))))))))))))
.2009-02-22 23:09 . 2009-02-23 21:58
d
c:program filestrend micro
2009-02-22 19:54 . 2009-02-22 19:55 724 —a
c:windowsActive Setup Log.BAK
2009-02-22 18:10 . 2009-02-22 18:10d—h
c:windowsPIF
2009-02-13 09:22 . 2004-08-03 23:08 25,600 —a
c:windowssystem32driversusbser.sys
2009-02-13 09:19 . 2009-02-13 09:19 0 —ah
c:windowssystem32driversMsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-02-13 09:19 . 2009-02-13 09:19 0 —ah
c:windowssystem32driversMsft_Kernel_ccdcmb_01005.Wdf.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-23 19:19
d—h—w c:program filesInstallShield Installation Information
2009-02-22 18:33
d
w c:program filesGoogle
2009-02-22 18:17
d
w c:program filesYandex
2009-02-22 18:17
d
w c:program filesCommon FilesYandex
2009-02-22 12:48
d
w c:program filesCommon FilesWise Installation Wizard
2009-02-09 08:45
d
w c:documents and settingsAll Users.WINDOWSApplication DataMicrosoft Help
2009-01-10 07:34
d
w c:program filesMSXML 4.0
2009-01-08 17:49
d
w c:documents and settingsАлексейApplication DataDownload Master
2009-01-02 08:28 410,984 —-a-w c:windowssystem32deploytk.dll
2009-01-02 08:28
d
w c:program filesJava
2008-12-20 23:03 826,368 —-a-w c:windowssystem32wininet.dll
.((((((((((((((((((((((((((((( SnapShot@2009-02-22_21.34.11,78 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-02-26 12:09:47 16,384 —-atw c:windowsTempPerflib_Perfdata_7cc.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2006-03-02 15360]
«AWMON»=»c:program filesLavasoftAd-Aware SE ProfessionalAd-Watch.exe» [2005-05-25 517632][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2005-09-18 7204864]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2005-09-18 86016]
«nod32kui»=»c:program filesEsetnod32kui.exe» [2008-05-17 949376]
«nwiz»=»nwiz.exe» [2005-09-18 c:windowssystem32nwiz.exe]
«SoundMan»=»SOUNDMAN.EXE» [2005-06-20 c:windowsSOUNDMAN.EXE][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2006-03-02 15360]c:documents and settingsЂ«ҐЄбҐ©ѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
‚л१Є нЄа Ё Їа®Ја ¬¬ § ЇгбЄ ¤«п OneNote 2007.lnk — c:program filesMicrosoft OfficeOffice12ONENOTEM.EXE [2006-10-26 98632]c:documents and settingsAll Users.WINDOWSѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
AutoCAD Startup Accelerator.lnk — c:program filesCommon FilesAutodesk Sharedacstart16.exe [2005-03-05 10872]
HP Digital Imaging Monitor.lnk — c:program filesHPDigital Imagingbinhpqtra08.exe [2006-02-19 288472][HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]
«msacm.l3fhg»= mp3fhg.acm
«msacm.ac3filter»= ac3filter.acm
«msacm.divxa32″= divxa32.acm[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe»=
«c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE»=
«c:\Program Files\Microsoft Office\Office12\GROOVE.EXE»=
«c:\Program Files\Microsoft Office\Office12\ONENOTE.EXE»=
«c:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe»=
«c:\Program Files\HP\Digital Imaging\bin\hpqste08.exe»=
«c:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe»=
«c:\Program Files\HP\Digital Imaging\bin\hposfx08.exe»=
«c:\Program Files\HP\Digital Imaging\bin\hposid01.exe»=
«c:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe»=
«c:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe»=
«c:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe»=
«c:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe»=
«c:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe»=
«c:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe»=
«c:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe»=
«c:\Program Files\HP\Digital Imaging\bin\hpoews01.exe»=
«c:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe»=
«c:\WINDOWS\system32\dpvsetup.exe»=
«d:\World of Warcraft\Repair.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=R1 nod32drv;nod32drv;c:windowssystem32driversnod32drv.sys [2008-05-17 15424]
R2 Consult;Consult;c:windowssystem32driversCONSULT.SYS [2008-07-28 3008]
.
.
Supplementary Scan
.
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
IE: Закачать ВСЕ при помощи Download Master — c:program filesDownload Masterdmieall.htm
IE: Закачать при помощи Download Master — c:program filesDownload Masterdmie.htm
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe
LSP: c:windowssystem32imon.dll
Trusted Zone: consultant.rubase
FF — ProfilePath — c:documents and settingsАлексейApplication DataMozillaFirefoxProfilesn7ji11fb.default
FF — prefs.js: browser.search.defaulturl — hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF — prefs.js: browser.search.selectedEngine — Google
FF — prefs.js: browser.startup.homepage — hxxp://www.yandex.ru/.
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnppl3260.dll
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnprpjplug.dll
FF — plugin: c:program filesMozilla Firefoxpluginsnpdm.dll
.**************************************************************************
catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-26 15:44:37
Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘lsass.exe'(688)
c:windowssystem32imon.dll
c:program filesEsetpr_imon.dll
.
Completion time: 2009-02-26 15:45:58
ComboFix-quarantined-files.txt 2009-02-26 12:45:41
ComboFix2.txt 2009-02-26 12:28:52
ComboFix3.txt 2009-02-22 18:35:25Pre-Run: 1 109 360 640 байт свободно
Post-Run: 1,097,416,704 байт свободно126 — E O F — 2009-01-14 20:04:30
Спасибо
