Созданные ответы форума
-
Сообщения
-
Сейчас, как ни странно, видимых сбоев и глюков не наблюдается, а также NOD32 ничего в системе и на других дисках не обнаруживает. Хотя и не разобрался в причинах, большое спасибо за помощь и поддержку.
С уважением vist.И это:
info.txt logfile of random’s system information tool 1.05 2009-02-08 16:53:22
======Uninstall list======
«ИСКАТЕЛЬ. Фантазер»—>D:MYGAME~137E0~1CDE4~1UNWISE.EXE D:MYGAME~137E0~1CDE4~1INSTALL.LOG
—>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:WINDOWSINFPCHealth.inf
7-Zip 4.64—>»C:Program Files7-ZipUninstall.exe»
Adobe Anchor Service CS3—>MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}
Adobe Asset Services CS3—>MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}
Adobe Bridge CS3—>MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}
Adobe Bridge Start Meeting—>MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}
Adobe Camera Raw 4.0—>MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}
Adobe CMaps—>MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}
Adobe Color — Photoshop Specific—>MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E}
Adobe Color Common Settings—>MsiExec.exe /I{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}
Adobe Color EU Extra Settings—>MsiExec.exe /I{51846830-E7B2-4218-8968-B77F0FF475B8}
Adobe Color JA Extra Settings—>MsiExec.exe /I{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}
Adobe Color NA Recommended Settings—>MsiExec.exe /I{95655ED4-7CA5-46DF-907F-7144877A32E5}
Adobe Default Language CS3—>MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}
Adobe Device Central CS3—>MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}
Adobe ExtendScript Toolkit 2—>MsiExec.exe /I{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}
Adobe Flash Player 10 ActiveX—>C:WINDOWSsystem32MacromedFlashuninstall_activeX.exe
Adobe Flash Player Plugin—>C:WINDOWSsystem32MacromedFlashuninstall_plugin.exe
Adobe Fonts All—>MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B}
Adobe Help Viewer CS3—>MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245}
Adobe Linguistics CS3—>MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078}
Adobe PDF Library Files—>MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}
Adobe Photoshop CS3—>C:Program FilesCommon FilesAdobeInstallers719d6f144d0c086a0dfa7ff76bb9ac1Setup.exe
Adobe Photoshop CS3—>MsiExec.exe /I{3D7E3EC9-46CF-4359-9289-39CE01DFB82F}
Adobe Reader 6.0.2 CE—>MsiExec.exe /I{AC76BA86-7AD7-1049-7B44-CEA000000001}
Adobe Setup—>MsiExec.exe /I{FF11004C-F42A-4A31-9BCF-7F5C8FDBE53C}
Adobe Stock Photos CS3—>MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183}
Adobe Type Support—>MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}
Adobe Update Manager CS3—>MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}
Adobe Version Cue CS3 Client—>MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}
Adobe WinSoft Linguistics Plugin—>MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}
Adobe XMP Panels CS3—>MsiExec.exe /I{802771A9-A856-4A41-ACF7-1450E523C923}
Agnitum Outpost Firewall Pro—>C:Program FilesAgnitumOutpost Firewalluninst.exe
AIMP2—>C:Program FilesAIMP2UnInstall.exe
ATI Display Driver—>rundll32 C:WINDOWSsystem32atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
AutoCAD 2006 — Русский—>MsiExec.exe /I{5783F2D7-4001-0419-0002-0060B0CE6BBA}
Autodesk DWF Viewer—>C:PROGRA~1AutodeskAUTODE~1Setup.exe /remove
BSPlayer—>»C:Program FilesWebtehBSplayerProuninstall.exe»
CDClose—>C:WINDOWSsystem32ShellExtCDClosedel.bat
CorelDRAW Graphics Suite X4 — Capture—>MsiExec.exe /I{7F05E704-30A6-421A-97A7-8EEB1C7FF012}
CorelDRAW Graphics Suite X4 — Content—>MsiExec.exe /I{7F05E704-30A6-421A-97A7-8EEB1C7FF016}
CorelDRAW Graphics Suite X4 — Draw—>MsiExec.exe /I{7F05E704-30A6-421A-97A7-8EEB1C7FF013}
CorelDRAW Graphics Suite X4 — Filters—>MsiExec.exe /I{7F05E704-30A6-421A-97A7-8EEB1C7FF017}
CorelDRAW Graphics Suite X4 — FontNav—>MsiExec.exe /I{7F05E704-30A6-421A-97A7-8EEB1C7FF019}
CorelDRAW Graphics SUite X4 — ICA—>MsiExec.exe /I{7F05E704-30A6-421A-97A7-8EEB1C7FF010}
CorelDRAW Graphics Suite X4 — IPM—>MsiExec.exe /I{9D0798D0-AF6C-4E62-94B1-AEBF1A43E00A}
CorelDRAW Graphics Suite X4 — Lang RU—>MsiExec.exe /I{C4CBA661-9184-48E3-86C4-7F27F6849749}
CorelDRAW Graphics Suite X4 — PP—>MsiExec.exe /I{7F05E704-30A6-421A-97A7-8EEB1C7FF014}
CorelDRAW Graphics Suite X4 — VBA—>MsiExec.exe /I{BF439B41-0252-48DE-8B8B-0430CB26A181}
CorelDRAW Graphics Suite X4—>MsiExec.exe /I{44A27085-0616-4181-A0C3-81C7ECA17F73}
CorelDRAW(R) Graphics Suite X4 — Windows Shell Extension—>c:Program FilesCommon FilesCorelSharedShell ExtensionUninst.exe
CorelDRAW(R) Graphics Suite X4 — Windows Shell Extension—>MsiExec.exe /X{CE2DA11A-917F-4CF5-AB55-755EC115DD10}
CorelDRAW(R) Graphics Suite X4—>c:Program FilesCorelCorelDRAW Graphics Suite X4SetupSetupARP.exe /arp
CPU-Control—>»C:Program FilesCPU-Controlunins000.exe»
Crysis WARHEAD(R)—>»C:Documents and SettingsAll UsersApplication Data{0691F710-1ECA-4B5A-9727-25554F1BFDC6}setup.exe» REMOVE=TRUE MODIFY=FALSE
Crysis WARHEAD(R)—>C:Documents and SettingsAll UsersApplication Data{0691F710-1ECA-4B5A-9727-25554F1BFDC6}setup.exe
DjVu Solo 3.1—>C:WINDOWSIsUninst.exe -f»C:Program FilesLizardTechDjVu Solo 3.1Uninst.isu»
FastStone Image Viewer 3.3 Beta—>C:Program FilesFastStone Image Vieweruninst.exe
FlylinkDC++ r373—>»C:FlylinkDC++unins000.exe»
HashTab 2.1.0—>C:WINDOWSsystem32ShellExthtdel32.bat
HEXelon MAX 6.07—>»C:Program FilesHEXelon MAX 6unins000.exe»
HijackThis 2.0.2—>»C:Program FilesTrend MicroHijackThisHijackThis.exe» /uninstall
Java(TM) 6 Update 7—>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
K-Lite Mega Codec Pack 4.1.0—>»C:Program FilesK-Lite Codec Packunins000.exe»
Light Alloy 4.1—>C:Program FilesLight Alloyuninst.exe
Matrix Новосибирск 6.0.8—>C:Program FilesMatrixuninst.exe
Microsoft .NET Framework 1.1 Russian Language Pack—>MsiExec.exe /X{2BB372D9-52B4-410A-BC1A-FEAB63181EEF}
Microsoft .NET Framework 1.1—>msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1—>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Language Pack — RUS—>MsiExec.exe /X{F4D0F248-2BF7-4912-814E-4FD751923838}
Microsoft .NET Framework 2.0 Service Pack 1—>MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft .NET Framework 3.0 Service Pack 1—>MsiExec.exe /I{2BA00471-0328-3743-93BD-FA813353A783}
Microsoft .NET Framework 3.5—>C:WINDOWSMicrosoft.NETFrameworkv3.5Microsoft .NET Framework 3.5setup.exe
Microsoft .NET Framework 3.5—>MsiExec.exe /I{2FC099BD-AC9B-33EB-809C-D332E1B27C40}
Microsoft ActiveSync 4.0—>MsiExec.exe /I{B208806F-A231-4FA0-AB3F-5C1B8979223E}
Microsoft Office Access MUI (Russian) 2007—>MsiExec.exe /X{90120000-0015-0419-0000-0000000FF1CE}
Microsoft Office Excel MUI (Russian) 2007—>MsiExec.exe /X{90120000-0016-0419-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (Russian) 2007—>MsiExec.exe /X{90120000-0044-0419-0000-0000000FF1CE}
Microsoft Office Outlook MUI (Russian) 2007—>MsiExec.exe /X{90120000-001A-0419-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (Russian) 2007—>MsiExec.exe /X{90120000-0018-0419-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007—>MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007—>MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007—>MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Russian) 2007—>MsiExec.exe /X{90120000-001F-0419-0000-0000000FF1CE}
Microsoft Office Proof (Ukrainian) 2007—>MsiExec.exe /X{90120000-001F-0422-0000-0000000FF1CE}
Microsoft Office Proofing (Russian) 2007—>MsiExec.exe /X{90120000-002C-0419-0000-0000000FF1CE}
Microsoft Office Publisher MUI (Russian) 2007—>MsiExec.exe /X{90120000-0019-0419-0000-0000000FF1CE}
Microsoft Office Shared MUI (Russian) 2007—>MsiExec.exe /X{90120000-006E-0419-0000-0000000FF1CE}
Microsoft Office Word MUI (Russian) 2007—>MsiExec.exe /X{90120000-001B-0419-0000-0000000FF1CE}
Microsoft Office Профессиональный плюс 2007—>»C:Program FilesCommon FilesMicrosoft SharedOFFICE12Office Setup Controllersetup.exe» /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Visual C++ 2005 Redistributable—>MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mozilla Thunderbird (2.0.0.19)—>C:Program FilesMozilla Thunderbirduninstallhelper.exe
MSXML 4.0 SP2 (KB941833)—>MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MSXML 6.0 Parser—>MsiExec.exe /I{AEB9948B-4FF2-47C9-990E-47014492A0FE}
Nero 6 Ultra Edition—>C:Program FilesAheadnerouninstallUNNERO.exe /UNINSTALL
Opera 9.51—>MsiExec.exe /X{7EC0E9C3-1EC8-4C68-B2C4-8CE5BC512FCB}
Orbit Downloader—>»C:Program FilesOrbitdownloaderunins000.exe»
PDF Settings—>MsiExec.exe /I{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}
PIMS & File Manager—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{3F340FE0-E93E-4A53-B5E4-19ED2648FCAE}setup.exe» -l0x9
Pocket ДубльГИС от 10.04.2007—>»C:Program Files2gisPocketunins001.exe»
Punto Switcher 2.9—>C:Program FilesPunto Switcheruninstall.exe
QIP Infium 2.0.9024 RC4—>»C:Program FilesQIP Infiumunins000.exe»
QIP.Online—>C:Program FilesQIP.OnlineUninstall.exe
Rainlendar (remove only)—>»C:Program FilesRainlendaruninst.exe»
Realtek AC’97 Audio—>Alcrmv.exe -r -m
Total Commander 7.04 PowerPack—>»C:Program FilesTotal Commanderuninstall.exe»
VIA Rhine-Family Fast-Ethernet Adapter—>Rundll32.exe vuins32.dll,vuins32Ex $Rhine $VIA
Vista Drive Icon—>rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFVistaDrv.inf,Uninstall
Vit Registry Fix 6.0 (remove only)—>C:Program FilesVitSoftVit Registry FixUninstall.exe
Академия магии—>D:My gamesФлешкиAlawar.ruАкадемия магииAlawar.ruАкадемия магииuninstal.exe
Антивирусная система NOD32—>C:Program FilesEsetSetupsetup.exe /UNINSTALL
Архиватор WinRAR (только удаление)—>C:Program FilesWinRARuninstall.exe
Баба-Яга учится читать—>D:My gamesигры ТаняБаба ЯгаABC_Games.exe -u
Данные ДубльГИС г.Новосибирск 01.02.2009—>MsiExec.exe /X{C1A0BC01-514D-4F60-BA86-FD9A086B4D70}
Дополнительные аплеты панели управления—>rundll32.exe advpack.dll,LaunchINFSection CPLDAPU.inf,uninstall
ДубльГИС 3.0.4.1—>MsiExec.exe /X{FA671504-B676-42B9-A5E5-30399BD8F676}
КОМПАС-3D Viewer V10—>MsiExec.exe /I{FE6C8B48-62F9-4556-9909-248228AEF552}
Новосибирск для Pocket ДубльГИС—>»C:Program Files2gisPocketunins000.exe»
Справочник «БИС товар +» № 0817—>»C:Program FilesBis077unins000.exe»
Центр обновлений ДубльГИС—>MsiExec.exe /X{2FB165EB-69C0-416D-9B4E-E805ABC8CB1F}======Hosts File======
127.0.0.1 localhost
======Security center information======
AV: Антивирусная система Eset NOD32 2.70
FW: Outpost Firewall ProSystem event log
Computer Name: MICROSOF-F5CEED
Event Code: 6005
Message: Запущена служба журнала событий.Record Number: 9407
Source Name: EventLog
Time Written: 20090201172622.000000+360
Event Type: информация
User:Computer Name: MICROSOF-F5CEED
Event Code: 6009
Message: Microsoft (R) Windows 2000 (R) 5.01. 2600 Service Pack 3 Multiprocessor Free.Record Number: 9406
Source Name: EventLog
Time Written: 20090201172622.000000+360
Event Type: информация
User:Computer Name: MICROSOF-F5CEED
Event Code: 6006
Message: Служба журнала событий остановлена.Record Number: 9405
Source Name: EventLog
Time Written: 20090201172529.000000+360
Event Type: информация
User:Computer Name: MICROSOF-F5CEED
Event Code: 20159
Message: Подключение пользователя «v1008540» к «dom.ru», выполненное с помощью устройства «PPPoE7-0», было прервано.Record Number: 9404
Source Name: RemoteAccess
Time Written: 20090201172524.000000+360
Event Type: информация
User:Computer Name: MICROSOF-F5CEED
Event Code: 7036
Message: Служба «Ati HotKey Poller» перешла в состояние Остановлена.Record Number: 9403
Source Name: Service Control Manager
Time Written: 20090201172516.000000+360
Event Type: информация
User:Application event log
Computer Name: MICROSOF-F5CEED
Event Code: 1
Message:
Record Number: 583
Source Name: Bonjour Service
Time Written: 20081101164647.000000+360
Event Type: информация
User:Computer Name: MICROSOF-F5CEED
Event Code: 0
Message:
Record Number: 582
Source Name: 2GIS UpdateClientService
Time Written: 20081101164642.000000+360
Event Type: информация
User:Computer Name: MICROSOF-F5CEED
Event Code: 1517
Message: Реестр пользователя MICROSOF-F5CEEDСережа был сохранен в то время, как приложение или служба продолжали использовать его во время выхода из системы. Используемая реестром пользователя память не была освобождена. Реестр будет выгружен, когда он не будет использоваться.Возможная причина — службы, выполняемые от имени пользователя. Попробуйте изменить настройку служб и задать их выполнение с учетными записями LocalService или NetworkService.
Record Number: 581
Source Name: Userenv
Time Written: 20081101111024.000000+360
Event Type: предупреждение
User: NT AUTHORITYSYSTEMComputer Name: MICROSOF-F5CEED
Event Code: 1
Message:
Record Number: 580
Source Name: Bonjour Service
Time Written: 20081101084303.000000+360
Event Type: информация
User:Computer Name: MICROSOF-F5CEED
Event Code: 0
Message:
Record Number: 579
Source Name: 2GIS UpdateClientService
Time Written: 20081101084257.000000+360
Event Type: информация
User:======Environment variables======
«ComSpec»=%SystemRoot%system32cmd.exe
«Path»=%systemroot%system32;%systemroot%;%systemroot%system32wbem;C:Program FilesCommon FilesAutodesk Shared
«windir»=%SystemRoot%
«FP_NO_HOST_CHECK»=NO
«OS»=Windows_NT
«PROCESSOR_ARCHITECTURE»=x86
«PROCESSOR_LEVEL»=15
«PROCESSOR_IDENTIFIER»=x86 Family 15 Model 2 Stepping 9, GenuineIntel
«PROCESSOR_REVISION»=0209
«NUMBER_OF_PROCESSORS»=2
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP
EOF
Еще результат сканирования HijackThis:
Logfile of random’s system information tool 1.05 (written by random/random)
Run by Толя at 2009-02-08 16:53:08
Microsoft Windows XP Professional Service Pack 3
System drive C: has 16 GB (42%) free of 38 GB
Total RAM: 1023 MB (59% free)Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:53:15, on 08.02.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20861)
Boot mode: NormalRunning processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32spoolsv.exe
C:Program Files2gisUpdateClientWin32UpdateClientService.exe
C:Program FilesBonjourmDNSResponder.exe
C:Program FilesEsetnod32krn.exe
C:Program FilesAgnitumOutpost Firewalloutpost.exe
c:Program FilesCommon FilesProtexisLicense ServicePsiService_2.exe
C:WINDOWSExplorer.EXE
C:WINDOWSSOUNDMAN.EXE
C:Program FilesDAEMON Toolsdaemon.exe
C:Program FilesEsetnod32kui.exe
C:Program Files2gisUpdateClientWin32UpdateClientUI.exe
C:Program FilesVistaDriveIconVistaDrv.exe
C:Program FilesPunto Switcherps.exe
C:Program FilesMicrosoft ActiveSyncwcescomm.exe
C:Program FilesHEXelon MAX 6hexelon.exe
C:Program FilesCPU-ControlCPU_Control.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesOrbitdownloaderorbitdm.exe
C:PROGRA~1MICROS~3rapimgr.exe
C:Program FilesOrbitdownloaderorbitnet.exe
C:WINDOWSsystem32wscntfy.exe
C:Program FilesOperaopera.exe
C:Documents and SettingsТоляРабочий столRSIT.exe
C:Program FilesTrend MicroHijackThisТоля.exeR0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://search.orbitdownloader.com
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page =
R1 — HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *.local
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
O2 — BHO: btorbit.com — {000123B4-9B42-4900-B3F7-F4B073EFC214} — C:Program FilesOrbitdownloaderorbitcth.dll
O2 — BHO: AcroIEHlprObj Class — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesAdobeAcrobat 6.0 CEReaderActiveXAcroIEHelper.dll
O2 — BHO: SSVHelper Class — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — C:Program FilesJavajre1.6.0_07binssv.dll
O3 — Toolbar: Grab Pro — {C55BBCD6-41AD-48AD-9953-3609C48EACC7} — C:Program FilesOrbitdownloaderGrabPro.dll
O4 — HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 — HKLM..Run: [Outpost Firewall] C:Program FilesAgnitumOutpost Firewalloutpost.exe /waitservice
O4 — HKLM..Run: [OutpostFeedBack] C:Program FilesAgnitumOutpost Firewallfeedback.exe /dump:os_startup
O4 — HKLM..Run: [DAEMON Tools] «C:Program FilesDAEMON Toolsdaemon.exe» -lang 1049
O4 — HKLM..Run: [nod32kui] «C:Program FilesEsetnod32kui.exe» /WAITSERVICE
O4 — HKLM..Run: [2gis update client UI] «C:Program Files2gisUpdateClientWin32UpdateClientUI.exe» -minimized
O4 — HKCU..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe
O4 — HKCU..Run: [Punto Switcher] C:Program FilesPunto Switcherps.exe
O4 — HKCU..Run: [H/PC Connection Agent] «C:Program FilesMicrosoft ActiveSyncwcescomm.exe»
O4 — HKCU..Run: [HEXelon MAX] «C:Program FilesHEXelon MAX 6hexelon.exe» /auto
O4 — HKCU..Run: [CPU_Control] C:Program FilesCPU-ControlCPU_Control.exe
O4 — HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..RunOnce: [IE7_011] regsvr32 /s /n /i:u shell32 (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — HKUS.DEFAULT..RunOnce: [IE7_011] regsvr32 /s /n /i:u shell32 (User ‘Default user’)
O4 — Global Startup: Orbit.lnk = C:Program FilesOrbitdownloaderorbitdm.exe
O4 — Global Startup: Быстрый запуск AutoCAD.lnk = C:Program FilesCommon FilesAutodesk Sharedacstart16.exe
O8 — Extra context menu item: &Download by Orbit — res://C:Program FilesOrbitdownloaderorbitmxt.dll/201
O8 — Extra context menu item: &Grab video by Orbit — res://C:Program FilesOrbitdownloaderorbitmxt.dll/204
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2Office12EXCEL.EXE/3000
O8 — Extra context menu item: Do&wnload selected by Orbit — res://C:Program FilesOrbitdownloaderorbitmxt.dll/203
O8 — Extra context menu item: Down&load all by Orbit — res://C:Program FilesOrbitdownloaderorbitmxt.dll/202
O9 — Extra button: (no name) — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_07binssv.dll
O9 — Extra ‘Tools’ menuitem: Sun Java Console — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_07binssv.dll
O9 — Extra button: Create Mobile Favorite — {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} — C:PROGRA~1MICROS~3INetRepl.dll
O9 — Extra button: (no name) — {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} — C:PROGRA~1MICROS~3INetRepl.dll
O9 — Extra ‘Tools’ menuitem: Создание избранного на мобильном устройстве… — {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} — C:PROGRA~1MICROS~3INetRepl.dll
O9 — Extra button: (no name) — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — (no file)
O9 — Extra button: Research — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2Office12REFIEBAR.DLL
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O16 — DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) — http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 — HKLMSystemCCSServicesTcpip..{610C49BF-872B-4686-B793-F0664080844C}: NameServer = 217.70.106.5,217.70.96.34
O17 — HKLMSystemCCSServicesTcpip..{AE0E689B-8296-49C2-99EE-D2AF12D0DF12}: NameServer = 91.144.180.1 91.144.182.1
O23 — Service: 2GIS UpdateClientService — ДубльГИС — C:Program Files2gisUpdateClientWin32UpdateClientService.exe
O23 — Service: Ati HotKey Poller — ATI Technologies Inc. — C:WINDOWSsystem32Ati2evxx.exe
O23 — Service: Autodesk Licensing Service — Autodesk — C:Program FilesCommon FilesAutodesk SharedServiceAdskScSrv.exe
O23 — Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) — Apple Computer, Inc. — C:Program FilesBonjourmDNSResponder.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: FLEXnet Licensing Service — Macrovision Europe Ltd. — C:Program FilesCommon FilesMacrovision SharedFLEXnet PublisherFNPLicensingService.exe
O23 — Service: InstallDriver Table Manager (IDriverT) — Macrovision Corporation — C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: NOD32 Kernel Service (NOD32krn) — Eset — C:Program FilesEsetnod32krn.exe
O23 — Service: Outpost Firewall Service (OutpostFirewall) — Agnitum Ltd. — C:Program FilesAgnitumOutpost Firewalloutpost.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Protexis Licensing V2 (PSI_SVC_2) — Protexis Inc. — c:Program FilesCommon FilesProtexisLicense ServicePsiService_2.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe—
End of file — 8564 bytes======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{000123B4-9B42-4900-B3F7-F4B073EFC214}]
Octh Class — C:Program FilesOrbitdownloaderorbitcth.dll [2008-12-19 134344][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class — C:Program FilesAdobeAcrobat 6.0 CEReaderActiveXAcroIEHelper.dll [2003-11-04 54248][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class — C:Program FilesJavajre1.6.0_07binssv.dll [2008-06-10 509328][HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{C55BBCD6-41AD-48AD-9953-3609C48EACC7} — Grab Pro — C:Program FilesOrbitdownloaderGrabPro.dll [2008-12-19 482424][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«SoundMan»=C:WINDOWSSOUNDMAN.EXE [2007-04-17 577536]
«Outpost Firewall»=C:Program FilesAgnitumOutpost Firewalloutpost.exe [2007-04-05 94720]
«OutpostFeedBack»=C:Program FilesAgnitumOutpost Firewallfeedback.exe [2007-06-28 335872]
«DAEMON Tools»=C:Program FilesDAEMON Toolsdaemon.exe [2006-11-12 157592]
«nod32kui»=C:Program FilesEsetnod32kui.exe [2008-11-10 949376]
«2gis update client UI»=C:Program Files2gisUpdateClientWin32UpdateClientUI.exe [2008-09-17 4055040][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«VistaIcon»=C:Program FilesVistaDriveIconVistaDrv.exe [2008-03-23 132096]
«Punto Switcher»=C:Program FilesPunto Switcherps.exe [2004-11-14 205824]
«H/PC Connection Agent»=C:Program FilesMicrosoft ActiveSyncwcescomm.exe [2006-06-21 1211176]
«HEXelon MAX»=C:Program FilesHEXelon MAX 6hexelon.exe [2007-06-28 2816512]
«CPU_Control»=C:Program FilesCPU-ControlCPU_Control.exe [2008-11-03 1034240]
«ctfmon.exe»=C:WINDOWSsystem32ctfmon.exe [2008-09-15 37376][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupreg2gis update client UI]
C:Program Files2gisUpdateClientWin32UpdateClientUI.exe [2008-09-17 4055040]C:Documents and SettingsAll UsersГлавное менюПрограммыАвтозагрузка
Orbit.lnk — C:Program FilesOrbitdownloaderorbitdm.exe
Быстрый запуск AutoCAD.lnk — C:Program FilesCommon FilesAutodesk Sharedacstart16.exe[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyAtiExtEvent]
C:WINDOWSsystem32Ati2evxx.dll [2008-01-09 122880][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32wpdshserviceobj.dll [2007-06-18 133632][HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworknm]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworknm.sys]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetwork{1a3e09be-1e45-494b-9174-d7385b45bbf5}]
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=323
«NoThumbnailCache»=1
«NoSMConfigurePrograms»=1
«NoSMHelp»=1
«NoDriveAutoRun»=67108863
«NoDrives»=0[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveAutoRun»=
«NoDriveTypeAutoRun»=
«NoDrives»=[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesMicrosoft ActiveSyncrapimgr.exe»=»C:Program FilesMicrosoft ActiveSyncrapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager»
«C:Program FilesMicrosoft ActiveSyncwcescomm.exe»=»C:Program FilesMicrosoft ActiveSyncwcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager»
«C:Program FilesMicrosoft ActiveSyncWCESMgr.exe»=»C:Program FilesMicrosoft ActiveSyncWCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application»
«C:Program FilesOrbitdownloaderorbitdm.exe»=»C:Program FilesOrbitdownloaderorbitdm.exe:*:Enabled:Orbit»
«C:Program FilesOrbitdownloaderorbitnet.exe»=»C:Program FilesOrbitdownloaderorbitnet.exe:*:Enabled:Orbit»
«C:Program FilesBonjourmDNSResponder.exe»=»C:Program FilesBonjourmDNSResponder.exe:*:Enabled:Bonjour»[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesMicrosoft ActiveSyncrapimgr.exe»=»C:Program FilesMicrosoft ActiveSyncrapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager»
«C:Program FilesMicrosoft ActiveSyncwcescomm.exe»=»C:Program FilesMicrosoft ActiveSyncwcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager»
«C:Program FilesMicrosoft ActiveSyncWCESMgr.exe»=»C:Program FilesMicrosoft ActiveSyncWCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application»======File associations======
.scr — open — «C:WINDOWSsystem32notepad.exe» «%1»
.scr — install —
.scr — config —======List of files/folders created in the last 1 months======
2009-02-08 16:53:08 —-D—- C:rsit
2009-02-08 16:25:47 —-D—- C:WINDOWStemp
2009-02-08 16:25:45 —-A—- C:ComboFix.txt
2009-02-08 16:20:07 —-A—- C:WINDOWSNIRCMD.exe
2009-02-08 16:18:38 —-A—- C:WINDOWSzip.exe
2009-02-08 16:18:38 —-A—- C:WINDOWSVFIND.exe
2009-02-08 16:18:38 —-A—- C:WINDOWSSWREG.exe
2009-02-08 16:18:38 —-A—- C:WINDOWSsed.exe
2009-02-08 16:18:38 —-A—- C:WINDOWSgrep.exe
2009-02-08 16:18:38 —-A—- C:WINDOWSfdsv.exe
2009-02-08 16:18:37 —-A—- C:WINDOWSSWXCACLS.exe
2009-02-08 16:18:37 —-A—- C:WINDOWSSWSC.exe
2009-02-08 16:17:31 —-D—- C:WINDOWSERDNT
2009-02-08 16:17:30 —-D—- C:Qoobox
2009-02-08 15:40:32 —-D—- C:Documents and SettingsТоляApplication DataWinRAR
2009-02-08 15:31:41 —-D—- C:WINDOWSERUNT
2009-02-08 15:03:08 —-A—- C:WINDOWSntbtlog.txt
2009-02-01 16:15:50 —-D—- C:FlylinkDC++
2009-01-29 22:56:38 —-D—- C:Documents and SettingsТоляApplication DataASCON
2009-01-29 22:13:15 —-D—- C:Program FilesASCON
2009-01-27 21:29:27 —-D—- C:Documents and SettingsТоляApplication DataThunderbird
2009-01-27 21:29:13 —-D—- C:Program FilesMozilla Thunderbird
2009-01-18 00:44:29 —-D—- C:Documents and SettingsТоляApplication DataCorel
2009-01-18 00:42:03 —-D—- C:Program FilesCommon FilesProtexis
2009-01-18 00:42:02 —-D—- C:Documents and SettingsAll UsersApplication DataCorel
2009-01-18 00:39:53 —-D—- C:Program FilesCommon FilesCorel
2009-01-18 00:38:47 —-D—- C:Program FilesCorel
2009-01-12 22:01:23 —-D—- C:WINDOWSMinidump
2009-01-11 20:20:52 —-A—- C:WINDOWSsystem32VBAR332.DLL
2009-01-11 20:20:52 —-A—- C:WINDOWSsystem32msxbse35.dll
2009-01-11 20:20:52 —-A—- C:WINDOWSsystem32mstext35.dll
2009-01-11 20:20:52 —-A—- C:WINDOWSsystem32msrpfs35.dll
2009-01-11 20:20:52 —-A—- C:WINDOWSsystem32msrepl35.dll
2009-01-11 20:20:52 —-A—- C:WINDOWSsystem32msrd2x35.dll
2009-01-11 20:20:52 —-A—- C:WINDOWSsystem32mspdox35.dll
2009-01-11 20:20:52 —-A—- C:WINDOWSsystem32msltus35.dll
2009-01-11 20:20:52 —-A—- C:WINDOWSsystem32msjt4jlt.dll
2009-01-11 20:20:52 —-A—- C:WINDOWSsystem32msjet35.dll
2009-01-11 20:20:52 —-A—- C:WINDOWSsystem32msexcl35.dll
2009-01-11 20:20:52 —-A—- C:WINDOWSsystem32msexch35.dll
2009-01-11 20:20:52 —-A—- C:WINDOWSsystem32JETCOMP.exe
2009-01-11 20:20:51 —-A—- C:WINDOWSsystem32msjter35.dll
2009-01-11 20:20:51 —-A—- C:WINDOWSsystem32msjint35.dll
2009-01-11 20:20:48 —-HD—- C:Program FilesInstallShield Installation Information
2009-01-11 20:20:48 —-D—- C:Program FilesSamsung
2009-01-10 12:36:29 —-D—- C:Program FilesMatrix======List of files/folders modified in the last 1 months======
2009-02-08 16:52:14 —-D—- C:Documents and SettingsТоляApplication DataOrbit
2009-02-08 16:33:42 —-D—- C:WINDOWS
2009-02-08 16:33:33 —-A—- C:WINDOWSODBC.INI
2009-02-08 16:32:09 —-A—- C:WINDOWSSchedLgU.Txt
2009-02-08 16:25:51 —-D—- C:WINDOWSsystem32
2009-02-08 16:25:44 —-D—- C:WINDOWSPrefetch
2009-02-08 16:24:04 —-A—- C:WINDOWSsystem.ini
2009-02-08 16:22:59 —-D—- C:WINDOWSsystem32drivers
2009-02-08 16:22:58 —-D—- C:WINDOWSAppPatch
2009-02-08 16:22:58 —-AD—- C:Program FilesCommon Files
2009-02-08 16:17:39 —-D—- C:WINDOWSsystem32CatRoot2
2009-02-08 15:48:04 —-A—- C:WINDOWSsystem32PerfStringBackup.INI
2009-02-08 15:44:23 —-D—- C:SDFix
2009-02-08 15:42:08 —-D—- C:Documents and Settings
2009-02-08 15:38:32 —-SHD—- C:System Volume Information
2009-02-08 15:38:32 —-D—- C:WINDOWSsystem32Restore
2009-02-08 15:33:42 —-RSHDC—- C:WINDOWSsystem32dllcache
2009-02-08 14:18:17 —-D—- C:Program FilesOrbitdownloader
2009-02-08 12:48:08 —-A—- C:WINDOWSsetuplog.txt
2009-02-07 13:02:06 —-D—- C:temp
2009-02-06 18:33:50 —-D—- C:Program FilesQIP Infium
2009-02-05 23:47:05 —-A—- C:WINDOWSNeroDigital.ini
2009-02-02 23:36:48 —-A—- C:WINDOWSUpdateClientUI.INI
2009-02-02 23:36:05 —-SHD—- C:WINDOWSInstaller
2009-02-01 22:06:26 —-AD—- C:Program Files
2009-02-01 22:06:24 —-D—- C:Documents and SettingsТоляApplication DataMozilla
2009-02-01 17:54:46 —-D—- C:Program FilesOpera
2009-01-29 23:21:05 —-D—- C:WINDOWSsystem32config
2009-01-29 22:13:22 —-D—- C:WINDOWSWinSxS
2009-01-29 22:13:15 —-RSD—- C:WINDOWSFonts
2009-01-18 11:15:22 —-D—- C:Documents and SettingsAll UsersApplication DataMicrosoft Help
2009-01-12 21:45:40 —-HD—- C:WINDOWSinf
2009-01-11 20:21:01 —-AD—- C:Program FilesCommon FilesMicrosoft Shared
2009-01-11 20:20:58 —-HD—- C:Program FilesUninstall Information
2009-01-11 20:20:37 —-D—- C:Program FilesCommon FilesInstallShield======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2008-04-15 40704]
R1 kbdhid;Драйвер клавиатуры HID; C:WINDOWSsystem32DRIVERSkbdhid.sys [2008-04-14 14720]
R1 nod32drv;nod32drv; C:WINDOWSsystem32driversnod32drv.sys [2008-11-10 15424]
R1 SandBox;Outpost Firewall Sandbox Driver; ??C:Program FilesAgnitumOutpost FirewallkernelSandbox.SYS []
R1 VFILT;Outpost Firewall Kernel Driver; ??C:Program FilesAgnitumOutpost FirewallkernelFILTNT.SYS []
R1 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:WINDOWSSystem32driversws2ifsl.sys [2008-04-15 12032]
R2 AMON;AMON; C:WINDOWSsystem32driversamon.sys [2008-11-10 512096]
R2 rspndr;Ответчик обнаружения топологии уровня связи; C:WINDOWSsystem32DRIVERSrspndr.sys [2008-07-08 62848]
R3 ADBLOCK.DLL;Outpost Firewall PlugIn (ADBLOCK.DLL); ??C:Program FilesAgnitumOutpost FirewallkernelADBLOCK.DLL []
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:WINDOWSsystem32driversALCXWDM.SYS [2008-01-25 4127488]
R3 ARP.DLL;Outpost Firewall PlugIn (ARP.DLL); ??C:Program FilesAgnitumOutpost FirewallkernelARP.DLL []
R3 Arp1394;Протокол клиента 1394 ARP; C:WINDOWSsystem32DRIVERSarp1394.sys [2008-09-15 60800]
R3 ati2mtag;ati2mtag; C:WINDOWSsystem32DRIVERSati2mtag.sys [2008-01-09 2846720]
R3 CONTENT.DLL;Outpost Firewall PlugIn (CONTENT.DLL); ??C:Program FilesAgnitumOutpost FirewallkernelCONTENT.DLL []
R3 DNSCACHE.DLL;Outpost Firewall PlugIn (DNSCACHE.DLL); ??C:Program FilesAgnitumOutpost FirewallkernelDNSCACHE.DLL []
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service; C:WINDOWSsystem32DRIVERSfetnd5bv.sys [2007-09-22 43520]
R3 FTPFILT.DLL;Outpost Firewall PlugIn (FTPFILT.DLL); ??C:Program FilesAgnitumOutpost FirewallkernelFTPFILT.DLL []
R3 HdAudAddService;ATI Function Driver for High Definition Audio Service; C:WINDOWSsystem32driversAtiHdAud.sys [2006-12-28 84992]
R3 HDAudBus;Драйвер шины Microsoft UAA для High Definition Audio; C:WINDOWSsystem32DRIVERSHDAudBus.sys [2008-04-15 144384]
R3 hidusb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2008-04-15 10368]
R3 HTMLFILT.DLL;Outpost Firewall PlugIn (HTMLFILT.DLL); ??C:Program FilesAgnitumOutpost FirewallkernelHTMLFILT.DLL []
R3 HTTPFILT.DLL;Outpost Firewall PlugIn (HTTPFILT.DLL); ??C:Program FilesAgnitumOutpost FirewallkernelHTTPFILT.DLL []
R3 IMAPFILT.DLL;Outpost Firewall PlugIn (IMAPFILT.DLL); ??C:Program FilesAgnitumOutpost FirewallkernelIMAPFILT.DLL []
R3 MAILFILT.DLL;Outpost Firewall PlugIn (MAILFILT.DLL); ??C:Program FilesAgnitumOutpost FirewallkernelMAILFILT.DLL []
R3 mouhid;Драйвер мыши HID; C:WINDOWSsystem32DRIVERSmouhid.sys [2008-04-15 12160]
R3 NIC1394;Сетевой драйвер 1394; C:WINDOWSsystem32DRIVERSnic1394.sys [2008-09-15 61824]
R3 NNTPFILT.DLL;Outpost Firewall PlugIn (NNTPFILT.DLL); ??C:Program FilesAgnitumOutpost FirewallkernelNNTPFILT.DLL []
R3 nvmpu401;Service for NVIDIA(R) nForce(TM) MIDI UART; C:WINDOWSsystem32driversnvmpu401.sys [2006-02-26 10240]
R3 POP3FILT.DLL;Outpost Firewall PlugIn (POP3FILT.DLL); ??C:Program FilesAgnitumOutpost FirewallkernelPOP3FILT.DLL []
R3 PROTECT.DLL;Outpost Firewall PlugIn (PROTECT.DLL); ??C:Program FilesAgnitumOutpost FirewallkernelPROTECT.DLL []
R3 SECRET.DLL;Outpost Firewall PlugIn (SECRET.DLL); ??C:Program FilesAgnitumOutpost FirewallkernelSECRET.DLL []
R3 usbccgp;Драйвер универсального родительского устройства USB (Microsoft); C:WINDOWSsystem32DRIVERSusbccgp.sys [2008-04-14 32128]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2008-04-15 30208]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2008-04-14 59520]
R3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2008-04-14 20608]
S3 arwn11ap;arwn11ap; C:WINDOWSsystem32driversarwn11ap.sys []
S3 usb_rndisx;Адаптер USB RNDIS; C:WINDOWSsystem32DRIVERSusb8023x.sys [2008-04-13 12800]
S3 usb2vcom;USB Data Cable; C:WINDOWSsystem32DRIVERSusb2vcom.sys [2005-05-25 22760]
S3 WudfPf;Windows Driver Foundation — User-mode Driver Framework Platform Driver; C:WINDOWSsystem32DRIVERSWudfPf.sys [2007-06-18 77568]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2007-06-18 82944]
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 2GIS UpdateClientService;2GIS UpdateClientService; C:Program Files2gisUpdateClientWin32UpdateClientService.exe [2008-09-17 1134592]
R2 Ati HotKey Poller;Ati HotKey Poller; C:WINDOWSsystem32Ati2evxx.exe [2008-01-09 512000]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:Program FilesBonjourmDNSResponder.exe [2006-02-28 229376]
R2 NOD32krn;NOD32 Kernel Service; C:Program FilesEsetnod32krn.exe [2008-11-10 552064]
R2 OutpostFirewall;Outpost Firewall Service; C:Program FilesAgnitumOutpost Firewalloutpost.exe [2007-04-05 94720]
R2 PSI_SVC_2;Protexis Licensing V2; c:Program FilesCommon FilesProtexisLicense ServicePsiService_2.exe [2007-07-24 185632]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2007-10-24 33800]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:Program FilesCommon FilesAutodesk SharedServiceAdskScSrv.exe [2009-01-06 77944]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2007-10-24 70144]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:Program FilesCommon FilesMacrovision SharedFLEXnet PublisherFNPLicensingService.exe [2008-10-13 654848]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:WINDOWSMicrosoft.NetFrameworkv3.0WPFPresentationFontCache.exe [2007-10-09 36864]
S3 IDriverT;InstallDriver Table Manager; C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication Foundationinfocard.exe [2007-10-11 864256]
S3 odserv;Microsoft Office Diagnostics Service; C:Program FilesCommon FilesMicrosoft SharedOFFICE12ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:Program FilesWindows Media Playerwmpnetwk.exe [2006-10-18 913408]
S3 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2008-04-15 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication FoundationSMSvcHost.exe [2007-10-11 122880]
EOF
Результат ComboFix:
ComboFix 09-02-06.04 — Толя 2009-02-08 16:21:23.1 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.1.1049.18.1023.605 [GMT 6:00]
Running from: c:documents and settingsТоляРабочий столComboFix.exe
AV: Антивирусная система Eset NOD32 2.70 *On-access scanning enabled* (Updated)
FW: Outpost Firewall Pro *disabled*
* Created a new restore point
* Resident AV is activeWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.((((((((((((((((((((((((( Files Created from 2009-01-08 to 2009-02-08 )))))))))))))))))))))))))))))))
.2009-02-08 15:40 . 2009-02-08 15:40
d
c:documents and settingsТоляApplication DataWinRAR
2009-02-08 15:33 . 2009-02-08 15:33 592,896 —a—c— c:windowssystem32dllcacheuser32.dll
2009-02-08 15:31 . 2009-02-08 15:31d
c:windowsERUNT
2009-02-01 16:15 . 2009-02-01 16:16d
C:FlylinkDC++
2009-01-29 22:56 . 2009-01-29 22:56d
c:documents and settingsТоляApplication DataASCON
2009-01-29 22:13 . 2009-01-29 22:13d
c:program filesASCON
2009-01-27 21:29 . 2009-02-08 14:27d
c:program filesMozilla Thunderbird
2009-01-27 21:29 . 2009-01-27 21:29d
c:documents and settingsТоляApplication DataThunderbird
2009-01-27 21:29 . 2009-01-27 21:29 0 —a
c:windowsnsreg.dat
2009-01-18 23:55 . 2009-01-18 23:55 60,735 —a
c:windowsFontData.fdb
2009-01-18 00:44 . 2009-01-18 00:44d
c:documents and settingsТоляApplication DataCorel
2009-01-18 00:44 . 2009-01-19 23:06 3,192 —ahs—- c:documents and settingsAll UsersApplication DataKGyGaAvL.sys
2009-01-18 00:44 . 2009-01-18 00:44 8 -r-hs—- c:documents and settingsAll UsersApplication Data984F80BE39.sys
2009-01-18 00:42 . 2009-01-18 00:42d
c:program filesCommon FilesProtexis
2009-01-18 00:42 . 2009-01-18 00:42d
c:documents and settingsAll UsersApplication DataCorel
2009-01-18 00:39 . 2009-01-18 00:39d
c:program filesCommon FilesCorel
2009-01-18 00:38 . 2009-01-18 00:38d
c:program filesCorel
2009-01-11 20:20 . 2009-01-11 20:20d
c:program filesSamsung
2009-01-11 20:20 . 2009-01-11 20:20d—h
c:program filesInstallShield Installation Information
2009-01-11 20:15 . 2005-05-25 09:24 22,760 -ra
c:windowssystem32driversusb2vcom.sys
2009-01-10 12:36 . 2009-02-02 20:35d
c:program filesMatrix.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-08 10:16
d
w c:documents and settingsТоляApplication DataOrbit
2009-02-08 08:18
d
w c:program filesOrbitdownloader
2009-02-08 03:39
d
w c:documents and settingsСережаApplication DataOrbit
2009-02-06 12:33
d
w c:program filesQIP Infium
2009-02-01 11:54
d
w c:program filesOpera
2009-01-18 05:15
d
w c:documents and settingsAll UsersApplication DataMicrosoft Help
2009-01-11 14:20
d
w c:program filesCommon FilesInstallShield
2009-01-08 13:29
d
w c:program filesESET
2009-01-07 14:27
d
w c:program filesPunto Switcher
2009-01-06 16:09
d
w c:program filesAutoCAD 2006
2009-01-06 16:08
d
w c:program filesCommon FilesAutodesk Shared
2009-01-06 16:08
d
w c:program filesAnswerWorks 4.0
2009-01-06 16:07
d
w c:documents and settingsAll UsersApplication DataAutodesk
2009-01-06 16:05
d
w c:program filesAutodesk
2009-01-06 14:06
d
w c:program filesaTunes
2009-01-06 13:54
d
w c:program files7-Zip
2009-01-04 16:31
d
w c:documents and settingsТоляApplication DataGrabPro
2008-12-23 14:35
d
w c:documents and settingsТоляApplication DataMagic Academy
2008-12-17 10:15
d
w c:documents and settingsСережаApplication DataMagic Academy
2008-12-14 13:53
d
w c:program filesCommon FilesYandex
2008-12-13 15:43
d
w c:documents and settingsСережаApplication DataHEXelon
2008-12-11 17:00
d
w c:program filesTrend Micro
2008-11-14 09:25 107,888 —-a-w c:windowssystem32CmdLineExt.dll
2008-11-10 15:51 298,104 —-a-w c:windowssystem32imon.dll
2008-10-10 18:16 16,384 —sha-w c:windowssystem32configsystemprofileCookiesindex.dat
2008-10-10 18:16 32,768 —sha-w c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5index.dat
2008-10-10 18:16 32,768 —sha-w c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5MSHist012008101020081011index.dat
2008-10-10 18:16 32,768 —sha-w c:windowssystem32configsystemprofileLocal SettingsTemporary Internet FilesContent.IE5index.dat
.
Sigcheck
2008-09-15 03:35 592896 f7af57aa04ec029609f083c07e691e37 c:windowssystem32user32.dll
2009-02-08 15:33 592896 f7af57aa04ec029609f083c07e691e37 c:windowssystem32dllcacheuser32.dll2008-09-15 03:36 1061376 b4c6c4d50f2dab96d7f66bd11482c8a5 c:windowssystem32wininet.dll
2008-04-15 16:00 361344 eaec6ea32bdabd7622371c10b8d68a17 c:windowssystem32driverstcpip.sys
2008-09-15 03:30 2165248 9c8b91ff9f5cc6c6c17a1593255f46d3 c:windowssystem32ntkrnlpa.exe
2008-09-15 03:26 2286592 047953a8b30891f5f8f0bf68abfea339 c:windowssystem32ntoskrnl.exe
2008-09-15 03:34 1619456 a6add9aaa27cfc44b8af42732ebea899 c:windowsexplorer.exe
2008-09-15 03:34 37376 01e0bc2b993ebcca9dbc6d878f14a878 c:windowssystem32ctfmon.exe
2008-09-15 03:36 76488 8c0c6aeb8e39913d95c66b1040f0d7bb c:windowssystem32wuauclt.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-03-23 132096]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2004-11-14 205824]
«H/PC Connection Agent»=»c:program filesMicrosoft ActiveSyncwcescomm.exe» [2006-06-21 1211176]
«HEXelon MAX»=»c:program filesHEXelon MAX 6hexelon.exe» [2007-06-28 2816512]
«CPU_Control»=»c:program filesCPU-ControlCPU_Control.exe» [2008-11-03 1034240]
«ctfmon.exe»=»c:windowssystem32ctfmon.exe» [2008-09-15 37376][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«Outpost Firewall»=»c:program filesAgnitumOutpost Firewalloutpost.exe» [2007-04-05 94720]
«OutpostFeedBack»=»c:program filesAgnitumOutpost Firewallfeedback.exe» [2007-06-28 335872]
«DAEMON Tools»=»c:program filesDAEMON Toolsdaemon.exe» [2006-11-12 157592]
«nod32kui»=»c:program filesEsetnod32kui.exe» [2008-11-10 949376]
«2gis update client UI»=»c:program files2gisUpdateClientWin32UpdateClientUI.exe» [2008-09-17 4055040]
«SoundMan»=»SOUNDMAN.EXE» [2007-04-17 c:windowsSOUNDMAN.EXE][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-09-15 37376]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-03-23 132096][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«IE7_012″=»advpack.dll» [2008-09-15 c:windowssystem32advpack.dll]c:documents and settingsЂ¤¬ЁЁбва в®аѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
Rainlendar.lnk — c:program filesRainlendarRainlendar.exe [2005-07-22 118784]c:documents and settingsAll Usersѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
Orbit.lnk — c:program filesOrbitdownloaderorbitdm.exe [2009-01-04 1711304]
Ѓлбвал© § ЇгбЄ AutoCAD.lnk — c:program filesCommon FilesAutodesk Sharedacstart16.exe [2007-03-23 10872][HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoThumbnailCache»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)
«NoSMHelp»= 1 (0x1)[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoThumbnailCache»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)
«NoSMHelp»= 1 (0x1)[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupreg2gis update client UI]
—a
2008-09-17 11:03 4055040 c:program files2gisUpdateClientWin32UpdateClientUI.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«UpdatesOverride»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)
«DisableNotifications»= 1 (0x1)[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:program filesMicrosoft ActiveSyncrapimgr.exe»= c:program filesMicrosoft ActiveSyncrapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
«c:program filesMicrosoft ActiveSyncwcescomm.exe»= c:program filesMicrosoft ActiveSyncwcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
«c:program filesMicrosoft ActiveSyncWCESMgr.exe»= c:program filesMicrosoft ActiveSyncWCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
«c:\Program Files\Orbitdownloader\orbitdm.exe»=
«c:\Program Files\Orbitdownloader\orbitnet.exe»=
«c:\Program Files\Bonjour\mDNSResponder.exe»=[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«26675:TCP»= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync ServiceR1 nod32drv;nod32drv;c:windowssystem32driversnod32drv.sys [2008-11-03 15424]
R1 SandBox;Outpost Firewall Sandbox Driver;c:program filesAgnitumOutpost FirewallKernelSandBox.sys [2008-10-11 408352]
R1 VFILT;Outpost Firewall Kernel Driver;c:program filesAgnitumOutpost FirewallKernelfiltnt.sys [2008-10-11 163840]
R2 2GIS UpdateClientService;2GIS UpdateClientService;c:program files2gisUpdateClientWin32UpdateClientService.exe [2008-09-17 1134592]
S3 ADBLOCK.DLL;Outpost Firewall PlugIn (ADBLOCK.DLL);c:program filesAgnitumOutpost FirewallKerneladblock.dll [2008-10-11 33568]
S3 ARP.DLL;Outpost Firewall PlugIn (ARP.DLL);c:program filesAgnitumOutpost FirewallKernelarp.dll [2008-10-11 17632]
S3 CONTENT.DLL;Outpost Firewall PlugIn (CONTENT.DLL);c:program filesAgnitumOutpost FirewallKernelcontent.dll [2008-10-11 4896]
S3 DNSCACHE.DLL;Outpost Firewall PlugIn (DNSCACHE.DLL);c:program filesAgnitumOutpost FirewallKerneldnscache.dll [2008-10-11 14656]
S3 FTPFILT.DLL;Outpost Firewall PlugIn (FTPFILT.DLL);c:program filesAgnitumOutpost FirewallKernelftpfilt.dll [2008-10-11 9248]
S3 HTMLFILT.DLL;Outpost Firewall PlugIn (HTMLFILT.DLL);c:program filesAgnitumOutpost FirewallKernelhtmlfilt.dll [2008-10-11 11552]
S3 HTTPFILT.DLL;Outpost Firewall PlugIn (HTTPFILT.DLL);c:program filesAgnitumOutpost FirewallKernelhttpfilt.dll [2008-10-11 13216]
S3 IMAPFILT.DLL;Outpost Firewall PlugIn (IMAPFILT.DLL);c:program filesAgnitumOutpost FirewallKernelimapfilt.dll [2008-10-11 7168]
S3 MAILFILT.DLL;Outpost Firewall PlugIn (MAILFILT.DLL);c:program filesAgnitumOutpost FirewallKernelmailfilt.dll [2008-10-11 14880]
S3 NNTPFILT.DLL;Outpost Firewall PlugIn (NNTPFILT.DLL);c:program filesAgnitumOutpost FirewallKernelnntpfilt.dll [2008-10-11 6752]
S3 POP3FILT.DLL;Outpost Firewall PlugIn (POP3FILT.DLL);c:program filesAgnitumOutpost FirewallKernelpop3filt.dll [2008-10-11 10048]
S3 PROTECT.DLL;Outpost Firewall PlugIn (PROTECT.DLL);c:program filesAgnitumOutpost FirewallKernelprotect.dll [2008-10-11 15200]
S3 SECRET.DLL;Outpost Firewall PlugIn (SECRET.DLL);c:program filesAgnitumOutpost FirewallKernelsecret.dll [2008-10-11 13056]
S3 usb2vcom;USB Data Cable;c:windowssystem32driversusb2vcom.sys [2009-01-11 22760]— Other Services/Drivers In Memory —
*NewlyCreated* — SRSERVICE
.
.
Supplementary Scan
.
uStart Page = hxxp://search.orbitdownloader.com
IE: &Download by Orbit — c:program filesOrbitdownloaderorbitmxt.dll/201
IE: &Grab video by Orbit — c:program filesOrbitdownloaderorbitmxt.dll/204
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
IE: Do&wnload selected by Orbit — c:program filesOrbitdownloaderorbitmxt.dll/203
IE: Down&load all by Orbit — c:program filesOrbitdownloaderorbitmxt.dll/202
IE: Закачать ВСЕ при помощи Download Master
IE: Закачать при помощи Download Master
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74}
LSP: c:windowssystem32imon.dll
TCP: {610C49BF-872B-4686-B793-F0664080844C} = 217.70.106.5,217.70.96.34
.**************************************************************************
catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-08 16:24:00
Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(696)
c:windowssystem32SETUPAPI.dll
c:program filesAgnitumOutpost Firewallwl_hook.dll
c:windowssystem32Ati2evxx.dll
c:windowssystem32cscui.dll
c:windowssystem32COMRes.dll— — — — — — — > ‘lsass.exe'(756)
c:windowssystem32setupapi.dll
c:windowssystem32imon.dll
c:program filesEsetpr_imon.dll
.
Completion time: 2009-02-08 16:25:41
ComboFix-quarantined-files.txt 2009-02-08 10:25:38Pre-Run: 16 523 378 688 байт свободно
Post-Run: 16,739,094,528 байт свободно194
Результат сканирования SDFix:
SDFix: Version 1.240
Run by ’®«п on 08.02.2009 at 15:34Microsoft Windows XP [‚ҐабЁп 5.1.2600]
Running From: C:SDFixChecking Services :
Restoring Default Security Values
Restoring Default Hosts FileRebooting
Checking Files :
No Trojan Files Found
Removing Temp Files
ADS Check :
Final Check :
catchme 0.3.1361.2 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-08 15:42:08
Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes …
scanning hidden services & system hive …
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions]
«! 0454B 045 0424>494 ?0 044 0404?4B 0454@4 ?1?3?9?4?»=str(7):»1 »
«34484=484?4>4@4B4 ??4; 0404=484@4> 0424I484: 0404 ?? 0404: 0454B4> 0424″=str(7):»1 002 »
«34484=484?4>4@4B4 ?W?A?N? ?(?L?2?T?P?)?»=str(7):»1 »
«34484=484?4>4@4B4 ?W?A?N? ?(?P?P?T?P?)?»=str(7):»1 »
«34484=484?4>4@4B4 ?W?A?N? ?(?P?P?P?o?E?)?»=str(7):»1 »
«374@4O4<4>494 ?? 0404@ 0404;4; 0454;4L4=4K494 ??4>4@4B4″=str(7):»1 »
«34484=484?4>4@4B4 ?W?A?N? ?(?I?P?)?»=str(7):»1 »
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicessptdCfg]
«s1″=dword:2df9c43f
«s2″=dword:110480d0
«h0″=dword:00000001[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA4]
«p0″=»C:Program FilesDAEMON Tools»
«h0″=dword:00000000
«khjeh»=hex:cb,d6,93,2b,c3,85,79,ca,54,1d,10,97,96,6d,6b,52,d3,b5,b2,e9,96,..[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA4 0000001]
«a0″=hex:20,01,00,00,5a,ed,b5,22,83,df,30,6a,2e,a9,0d,77,6a,c8,93,1f,5c,..
«khjeh»=hex:90,b7,e7,d7,10,c1,ff,06,a0,18,3f,ff,ba,82,13,52,aa,de,c3,5d,e1,..[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA4 0000001 Jf40]
«khjeh»=hex:b5,15,b9,fd,ef,93,56,48,e0,16,c7,22,74,45,b5,7c,e8,bb,6a,ae,05,..
[HKEY_LOCAL_MACHINESYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions]
«! 0454B 045 0424>494 ?0 044 0404?4B 0454@4 ?1?3?9?4?»=str(7):»1 »
«34484=484?4>4@4B4 ??4; 0404=484@4> 0424I484: 0404 ?? 0404: 0454B4> 0424″=str(7):»1 002 »
«34484=484?4>4@4B4 ?W?A?N? ?(?L?2?T?P?)?»=str(7):»1 »
«34484=484?4>4@4B4 ?W?A?N? ?(?P?P?T?P?)?»=str(7):»1 »
«34484=484?4>4@4B4 ?W?A?N? ?(?P?P?P?o?E?)?»=str(7):»1 »
«374@4O4<4>494 ?? 0404@ 0404;4; 0454;4L4=4K494 ??4>4@4B4″=str(7):»1 »
«34484=484?4>4@4B4 ?W?A?N? ?(?I?P?)?»=str(7):»1 »
[HKEY_LOCAL_MACHINESYSTEMControlSet002ServicessptdCfg19659239224E364682FA4BAF72C53EA4]
«p0″=»C:Program FilesDAEMON Tools»
«h0″=dword:00000000
«khjeh»=hex:cb,d6,93,2b,c3,85,79,ca,54,1d,10,97,96,6d,6b,52,d3,b5,b2,e9,96,..[HKEY_LOCAL_MACHINESYSTEMControlSet002ServicessptdCfg19659239224E364682FA4BAF72C53EA4 0000001]
«a0″=hex:20,01,00,00,5a,ed,b5,22,83,df,30,6a,2e,a9,0d,77,6a,c8,93,1f,5c,..
«khjeh»=hex:90,b7,e7,d7,10,c1,ff,06,a0,18,3f,ff,ba,82,13,52,aa,de,c3,5d,e1,..[HKEY_LOCAL_MACHINESYSTEMControlSet002ServicessptdCfg19659239224E364682FA4BAF72C53EA4 0000001 Jf40]
«khjeh»=hex:b5,15,b9,fd,ef,93,56,48,e0,16,c7,22,74,45,b5,7c,e8,bb,6a,ae,05,..scanning hidden registry entries …
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionControl PanelCursorsSchemes]
«304= 042 0454@4A4= 0404O4″=str(2):»%SYSTEMROOT%CursorsI_arrow.cur,%SYSTEMROOT%CursorsI_help.cur,%SYSTEMROOT%CursorsI_wait.cur,%SYSTEMROOT%CursorsI_busy.cur,%SYSTEMROOT%CursorsI_cross.cur,%SYSTEMROOT%CursorsI_beam.cur,%SYSTEMROOT%CursorsI_pen.cur,%SYSTEMROOT%CursorsI_no.cur,%SYSTEMROOT%CursorsI_size4.cur,%SYSTEMROOT%CursorsI_size3.cur,%SYSTEMROOT%CursorsI_size2.cur,%SYSTEMROOT%CursorsI_size1.cur,%SYSTEMROOT%CursorsI_move.cur,%SYSTEMROOT%CursorsI_up.cur,»
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerDocFolderPaths]
«20 0444<484=484A4B4@ 0404B4>4@4″=»C:Documents and Settings4<8=8AB@0B>@>8 4>:C<5=BK"
«! 0454@ 045 046 0404″=»C:Documents and Settings!5@560>8 4>:C<5=BK"
«»4>4;4O4″=»C:Documents and Settings»>;O>8 4>:C<5=BK"
[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionGrpConvMapGroups]
«30 0434@4K4″=»!B0=40@B=K53@K»scanning hidden files …
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0Remaining Services :
Authorized Application Key Export:
[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%\Network Diagnostic\xpnetdiag.exe»=»%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%\system32\sessmgr.exe»=»%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:\Program Files\Microsoft ActiveSync\rapimgr.exe»=»C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager»
«C:\Program Files\Microsoft ActiveSync\wcescomm.exe»=»C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager»
«C:\Program Files\Microsoft ActiveSync\WCESMgr.exe»=»C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application»
«C:\Program Files\Orbitdownloader\orbitdm.exe»=»C:\Program Files\Orbitdownloader\orbitdm.exe:*:Enabled:Orbit»
«C:\Program Files\Orbitdownloader\orbitnet.exe»=»C:\Program Files\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit»
«C:\Program Files\Bonjour\mDNSResponder.exe»=»C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour»[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%\Network Diagnostic\xpnetdiag.exe»=»%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%\system32\sessmgr.exe»=»%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:\Program Files\Microsoft ActiveSync\rapimgr.exe»=»C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager»
«C:\Program Files\Microsoft ActiveSync\wcescomm.exe»=»C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager»
«C:\Program Files\Microsoft ActiveSync\WCESMgr.exe»=»C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application»Remaining Files :
Files with Hidden Attributes :
Sun 18 Jan 2009 8 ..SHR — «C:Documents and SettingsAll UsersApplication Data984F80BE39.sys»
Mon 19 Jan 2009 3,192 A.SH. — «C:Documents and SettingsAll UsersApplication DataKGyGaAvL.sys»
Thu 23 Dec 2004 76,568 ..SHR — «C:Program FilesAutodeskAutodesk DWF ViewerSetup.exe»
Thu 13 Jan 2005 11,360 A.SHR — «C:Program FilesAutodeskAutodesk DWF Viewer_Setupx.dll»Finished!
