Блокирован доступ к сайтам

This topic has 13 ответов, 2 участника, and was last updated 14 years, 4 months назад by Helper.

Просмотр 14 сообщений - с 1 по 14 (из 14 всего)

Автор

Сообщения
17 июля, 2010 в 1:02 пп #18449
bakemono
Participant
- Темы:1
- Сообщений:8
Здравствуйте.
Все началось с надоедливого баннера и попытки его закрыть.Теперь все стало тормозить, сайты антивирусов и virusinfo не открываются, avz не обновляется и так далее. Помогите, пожалуйста, вот логи:

Logfile of random’s system information tool 1.08 (written by random/random)
Run by Kyo at 2010-07-17 16:33:41
Microsoft Windows XP Professional Service Pack 3
System drive C: has 3 GB (21%) free of 12 GB
Total RAM: 510 MB (24% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:34:13, on 17.07.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17055)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32csrss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32VTTimer.exe
C:Program FilesCommon FilesRealUpdate_OBrealsched.exe
C:WINDOWSSOUNDMAN.EXE
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesVIA Technologies, IncVIA Audio Driver Setup ProgramAudioDeckAudioDeck.exe
C:WINDOWSWebCamM1000M1000Mnt.exe
C:Program FilesJavajre6binjqs.exe
C:Program FilesCDBurnerXPNMSAccessU.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32alg.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:WINDOWSsystem32NOTEPAD.EXE
D:Program FilesSafari.exe
C:Documents and SettingsKyoРабочий столRSIT.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:Program Filestrend microKyo.exe

R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = about:blank
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = about:blank
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: QIPBHO Class — {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} — C:Documents and SettingsUlitkaApplication DataMicrosoftInternet Explorerqipsearchbar.dll (file missing)
R3 — URLSearchHook: QIPBHO Class — {95289393-33EA-4F8D-B952-483415B9C955} — C:Documents and SettingsUlitkaApplication DataMicrosoftInternet Explorerqipsearchbar.dll (file missing)
F2 — REG:system.ini: UserInit=C:WINDOWSSYSTEM32Userinit.exe,C:WINDOWSsystem32392cd3e5.exe,C:WINDOWSsystem32hwpscq.exe,
O2 — BHO: btorbit.com — {000123B4-9B42-4900-B3F7-F4B073EFC214} — D:Program FilesOrbitdownloaderorbitcth.dll
O2 — BHO: Adobe PDF Reader Link Helper — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 — BHO: SkypeIEPluginBHO — {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} — C:Program FilesSkypeToolbarsInternet Explorerskypeieplugin.dll
O2 — BHO: JQSIEStartDetectorImpl — {E7E6F031-17CE-4C07-BC86-EABFE594F69C} — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll
O3 — Toolbar: EBKTool — {4189165B-690F-4D24-A2E2-69F31E6EDA7C} — C:PROGRA~1EBKToolEBKTool4IEBAND~1.DLL
O3 — Toolbar: Grab Pro — {C55BBCD6-41AD-48AD-9953-3609C48EACC7} — D:Program FilesOrbitdownloaderGrabPro.dll
O4 — HKLM..Run: [VTTimer] VTTimer.exe
O4 — HKLM..Run: [VTTrayp] VTtrayp.exe
O4 — HKLM..Run: [M1000Mnt] M1000Rmv.exe /StartStillMnt
O4 — HKLM..Run: [TkBellExe] «C:Program FilesCommon FilesRealUpdate_OBrealsched.exe» -osboot
O4 — HKLM..Run: [Skype Recorder] «C:Program FilesSkype RecorderSkype Recorder.exe»
O4 — HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 — HKLM..Run: [IntelliPoint] «C:Program FilesMicrosoft IntelliPointipoint.exe»
O4 — HKLM..Run: [ATICCC] «C:Program FilesATI TechnologiesATI.ACEcli.exe» runtime -Delay
O4 — HKLM..Run: [NokiaMServer] C:Program FilesCommon FilesNokiaMPlatformNokiaMServer /watchfiles startup
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [MSMSGS] «C:Program FilesMessengermsmsgs.exe» /background
O4 — HKCU..Run: [YandexOnline] «C:Program FilesYandexOnlineonline.exe» -AutoStart
O4 — HKCU..Run: [BitTorrent] «D:Program FilesBitTorrent.exe»
O4 — HKCU..Run: [MX Skype Recorder] «C:Documents and SettingsKyoLocal SettingsApplication DataMXSkypeRecorderMXSkypeRecorder.exe» /autorun
O4 — HKCU..Run: [Pando Media Booster] C:Program FilesPando NetworksMedia BoosterPMB.exe
O4 — HKCU..Run: [Shell] C:Documents and SettingsAll Userssystems.exe
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe (User ‘Default user’)
O4 — Startup: Adobe Gamma.lnk = C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe
O4 — Startup: wwwznv32.exe
O4 — Global Startup: AudioDeck.lnk = C:Program FilesVIA Technologies, IncVIA Audio Driver Setup ProgramAudioDeckAudioDeck.exe
O4 — Global Startup: Fantastic Flame Agent.lnk = C:Program FilesFantastic Flame ScreensaverFantasticFlameAgent.exe
O8 — Extra context menu item: &Download by Orbit — res://D:Program FilesOrbitdownloaderorbitmxt.dll/201
O8 — Extra context menu item: &Grab video by Orbit — res://D:Program FilesOrbitdownloaderorbitmxt.dll/204
O8 — Extra context menu item: Append to existing PDF — res://D:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
O8 — Extra context menu item: Convert link target to Adobe PDF — res://D:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
O8 — Extra context menu item: Convert link target to existing PDF — res://D:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
O8 — Extra context menu item: Convert selected links to Adobe PDF — res://D:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 — Extra context menu item: Convert selected links to existing PDF — res://D:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 — Extra context menu item: Convert selection to Adobe PDF — res://D:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
O8 — Extra context menu item: Convert selection to existing PDF — res://D:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
O8 — Extra context menu item: Convert to Adobe PDF — res://D:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
O8 — Extra context menu item: Do&wnload selected by Orbit — res://D:Program FilesOrbitdownloaderorbitmxt.dll/203
O8 — Extra context menu item: Down&load all by Orbit — res://D:Program FilesOrbitdownloaderorbitmxt.dll/202
O9 — Extra button: Skype add-on for Internet Explorer — {898EA8C8-E7FF-479B-8935-AEC46303B9E5} — C:Program FilesSkypeToolbarsInternet Explorerskypeieplugin.dll
O9 — Extra ‘Tools’ menuitem: Skype add-on for Internet Explorer — {898EA8C8-E7FF-479B-8935-AEC46303B9E5} — C:Program FilesSkypeToolbarsInternet Explorerskypeieplugin.dll
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O16 — DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) — http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 — DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) — http://liveupdate.msi.com.tw/autobios/LOnline/install.cab
O18 — Protocol: skype-ie-addon-data — {91774881-D725-4E58-B298-07617B9B86A8} — C:Program FilesSkypeToolbarsInternet Explorerskypeieplugin.dll
O18 — Protocol: skype4com — {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} — C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O22 — SharedTaskScheduler: Предзагрузчик Browseui — {438755C2-A8BA-11D1-B96B-00A0C90312E1} — C:WINDOWSsystem32browseui.dll
O22 — SharedTaskScheduler: Демон кэша категорий компонентов — {8C7461EF-2B13-11d2-BE35-3078302C2030} — C:WINDOWSsystem32browseui.dll
O23 — Service: Adobe LM Service — Adobe Systems — C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe
O23 — Service: Ati HotKey Poller — ATI Technologies Inc. — C:WINDOWSsystem32Ati2evxx.exe
O23 — Service: ATI Smart — Unknown owner — C:WINDOWSsystem32ati2sgag.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: Java Quick Starter (JavaQuickStarterService) — Sun Microsystems, Inc. — C:Program FilesJavajre6binjqs.exe
O23 — Service: Ma-Config Service (maconfservice) — Unknown owner — C:Program Filesma-config.commaconfservice.exe
O23 — Service: NetMeeting Remote Desktop Sharing (mnmsrvc) — Корпорация Майкрософт — C:WINDOWSsystem32mnmsrvc.exe
O23 — Service: NMSAccessU — Unknown owner — C:Program FilesCDBurnerXPNMSAccessU.exe
O23 — Service: nProtect GameGuard Service (npggsvc) — Unknown owner — C:WINDOWSsystem32GameMon.des.exe (file missing)
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: ServiceLayer — Nokia — C:Program FilesPC Connectivity SolutionServiceLayer.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Ventrilo — Unknown owner — C:Program FilesVentSrvventrilo_svc.exe (file missing)
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe

—
End of file — 10443 bytes

======Scheduled tasks folder======

C:WINDOWStasksAppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{000123B4-9B42-4900-B3F7-F4B073EFC214}]
Octh Class — D:Program FilesOrbitdownloaderorbitcth.dll [2009-05-19 171208]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype add-on for Internet Explorer — C:Program FilesSkypeToolbarsInternet Explorerskypeieplugin.dll [2010-02-08 804136]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll [2009-10-11 73728]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{4189165B-690F-4D24-A2E2-69F31E6EDA7C} — EBKTool — C:PROGRA~1EBKToolEBKTool4IEBAND~1.DLL [2005-08-23 1934848]
{C55BBCD6-41AD-48AD-9953-3609C48EACC7} — Grab Pro — D:Program FilesOrbitdownloaderGrabPro.dll [2009-05-19 670840]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«VTTimer»=C:WINDOWSsystem32VTTimer.exe [2005-03-08 53248]
«VTTrayp»=C:WINDOWSsystem32VTtrayp.exe [2005-11-01 163840]
«M1000Mnt»=M1000Rmv.exe /StartStillMnt []
«TkBellExe»=C:Program FilesCommon FilesRealUpdate_OBrealsched.exe [2009-07-18 185896]
«Skype Recorder»=C:Program FilesSkype RecorderSkype Recorder.exe []
«SoundMan»=C:WINDOWSSOUNDMAN.EXE [2007-04-16 577536]
«IntelliPoint»=C:Program FilesMicrosoft IntelliPointipoint.exe [2009-05-28 1468296]
«ATICCC»=C:Program FilesATI TechnologiesATI.ACEcli.exe [2006-01-02 45056]
«NokiaMServer»=C:Program FilesCommon FilesNokiaMPlatformNokiaMServer /watchfiles startup []

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=C:WINDOWSsystem32ctfmon.exe [2008-05-09 15360]
«MSMSGS»=C:Program FilesMessengermsmsgs.exe /background []
«YandexOnline»=C:Program FilesYandexOnlineonline.exe -AutoStart []
«BitTorrent»=D:Program FilesBitTorrent.exe [2009-11-13 654128]
«MX Skype Recorder»=C:Documents and SettingsKyoLocal SettingsApplication DataMXSkypeRecorderMXSkypeRecorder.exe /autorun []
«Pando Media Booster»=C:Program FilesPando NetworksMedia BoosterPMB.exe [2010-02-01 2937528]
«Shell»=C:Documents and SettingsAll Userssystems.exe []

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAcrobat Assistant 8.0]
D:Program FilesAdobeAcrobat 8.0AcrobatAcrotray.exe []

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe Reader Speed Launcher]
C:Program FilesAdobeReader 8.0ReaderReader_sl.exe [2008-01-11 39792]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPrintToMon]
C:Program FilesEBKToolEBKTool4PrintToMon.exe [2005-08-15 1167872]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregRun]
C:Documents and SettingsKyoApplication DataAdobeManager.exe []

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupfolderC:^Documents and Settings^All Users^Главное меню^Программы^Автозагрузка^Orbit.lnk]
D:PROGRA~2ORBITD~1orbitdm.exe [2009-05-19 1719496]

C:Documents and SettingsAll UsersГлавное менюПрограммыАвтозагрузка
AudioDeck.lnk — C:Program FilesVIA Technologies, IncVIA Audio Driver Setup ProgramAudioDeckAudioDeck.exe
Fantastic Flame Agent.lnk — C:Program FilesFantastic Flame ScreensaverFantasticFlameAgent.exe

C:Documents and SettingsKyoГлавное менюПрограммыАвтозагрузка
Adobe Gamma.lnk — C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe
wwwznv32.exe

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyAtiExtEvent]
C:WINDOWSsystem32Ati2evxx.dll [2006-03-22 61440]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
UPnPMonitor — {e57ce738-33e8-4c51-8354-bb4de9d215d1} — C:WINDOWSsystem32upnpui.dll [2008-05-09 239616]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalahfekuit.sys]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalWdf01000.sys]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkahfekuit.sys]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkvsmon]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkWdf01000.sys]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=145

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«HonorAutoRunSetting»=1
«NoDriveTypeAutoRun»=28

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesDNAbtdna.exe»=»C:Program FilesDNAbtdna.exe:*:Enabled:DNA»
«C:Program FilesBitTorrentbittorrent.exe»=»C:Program FilesBitTorrentbittorrent.exe:*:Enabled:BitTorrent»
«C:Program FilesOperaopera.exe»=»C:Program FilesOperaopera.exe:*:Enabled:Opera Internet Browser»
«C:Program FilesVideoLANVLCvlc.exe»=»C:Program FilesVideoLANVLCvlc.exe:*:Enabled:VLC media player»
«C:WINDOWSsystem32dplaysvr.exe»=»C:WINDOWSsystem32dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper»
«C:Program FilesHamachihamachi.exe»=»C:Program FilesHamachihamachi.exe:*:Enabled:Hamachi Client»
«C:Program FilesQIPqip.exe»=»C:Program FilesQIPqip.exe:*:Disabled:Quiet Internet Pager»
«C:DOCUME~1KyoLOCALS~1TempwJQs.exe»=»C:DOCUME~1KyoLOCALS~1TempwJQs.exe:*:Enabled:EMOTIONS_EXECUTABLE»
«C:Program FilesTale of TalesThe Endless Forest 3ForestViewer.exe»=»C:Program FilesTale of TalesThe Endless Forest 3ForestViewer.exe:*:Enabled:ForestViewer»
«D:Program FilesOrbitdownloaderorbitdm.exe»=»D:Program FilesOrbitdownloaderorbitdm.exe:*:Enabled:Orbit»
«D:Program FilesOrbitdownloaderorbitnet.exe»=»D:Program FilesOrbitdownloaderorbitnet.exe:*:Enabled:Orbit»
«D:setupFar20b981.x86.20090606Far.exe»=»D:setupFar20b981.x86.20090606Far.exe:*:Enabled:Far.exe»
«C:WINDOWSsystem32r_server.exe»=»C:WINDOWSsystem32r_server.exe:*:Enabled:r_server»
«D:Program FilesTerraTecNOXON player BasiciRadio.exe»=»D:Program FilesTerraTecNOXON player BasiciRadio.exe:*:Enabled:NOXON player Basic»
«D:Program FilesBitTorrent.exe»=»D:Program FilesBitTorrent.exe:*:Enabled:BitTorrent»
«C:Program FilesSkypePlugin ManagerskypePM.exe»=»C:Program FilesSkypePlugin ManagerskypePM.exe:*:Enabled:Skype Extras Manager»
«C:Program Filesma-config.commaconfservice.exe»=»C:Program Filesma-config.commaconfservice.exe:LocalSubNet:Enabled:maconfservice»
«C:Program FilesInternet Exploreriexplore.exe»=»C:Program FilesInternet Exploreriexplore.exe:*:Disabled:Internet Explorer»
«D:Program Filesopera.exe»=»D:Program Filesopera.exe:*:Enabled:Opera Internet Browser»
«C:WINDOWSsystem32dpvsetup.exe»=»C:WINDOWSsystem32dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test»
«C:WINDOWSsystem32rundll32.exe»=»C:WINDOWSsystem32rundll32.exe:*:Enabled:Запуск библиотеки DLL как приложения»
«C:Program FilesVentSrvventrilo_srv.exe»=»C:Program FilesVentSrvventrilo_srv.exe:*:Enabled:ventrilo_srv»
«C:Documents and SettingsKyoLocal SettingsApplication DataMail.RuGameDownloaderAstrumDownloader.exe»=»C:Documents and SettingsKyoLocal SettingsApplication DataMail.RuGameDownloaderAstrumDownloader.exe:*:Enabled:ЗАГРУЗЧИК ИГР@MAIL.RU»
«C:Program FilesPando NetworksMedia BoosterPMB.exe»=»C:Program FilesPando NetworksMedia BoosterPMB.exe:*:Enabled:Pando Media Booster»
«D:Program FilesFar20b981.x86.20090606Far.exe»=»D:Program FilesFar20b981.x86.20090606Far.exe:*:Disabled:File and archive manager»
«C:Program FilesSkypePhoneSkype.exe»=»C:Program FilesSkypePhoneSkype.exe:*:Enabled:Skype»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»

======List of files/folders created in the last 1 months======

2010-07-17 16:33:41 —-D—- C:rsit
2010-07-17 15:54:07 —-A—- C:WINDOWSsystem32vmsgkdy.exe
2010-07-17 15:15:19 —-A—- C:WINDOWSsystem32srwhuuw.exe
2010-07-17 15:14:36 —-D—- C:Program FilesCommon Fileswm
2010-07-17 15:14:36 —-A—- C:Program FilesCommon Fileskeylog.txt
2010-07-17 15:14:09 —-A—- C:WINDOWSsystem32hwpscq.exe
2010-07-17 15:13:32 —-A—- C:WINDOWSsystem32392cd3e5.exe
2010-07-14 14:28:37 —-HDC—- C:WINDOWS$NtUninstallKB2229593$
2010-07-13 13:35:41 —-A—- C:WINDOWSsystem32unicows.dll
2010-07-10 14:09:43 —-HDC—- C:WINDOWS$NtUninstallXPSEPSCLP$
2010-07-08 01:12:09 —-A—- C:WINDOWSsystem32driversoreans32.sys
2010-07-01 00:46:31 —-D—- C:Documents and SettingsKyoApplication DataSkype
2010-07-01 00:44:59 —-D—- C:Program FilesCommon FilesSkype
2010-07-01 00:44:48 —-RD—- C:Program FilesSkype
2010-06-27 18:05:00 —-D—- C:Documents and SettingsKyoApplication DataInstallShield
2010-06-26 14:11:47 —-D—- C:Documents and SettingsKyoApplication DataSecondLife
2010-06-25 21:45:13 —-A—- C:WINDOWSsystem32XAudio2_7.dll
2010-06-25 21:45:13 —-A—- C:WINDOWSsystem32XAPOFX1_5.dll
2010-06-25 21:45:13 —-A—- C:WINDOWSsystem32xactengine3_7.dll
2010-06-25 21:45:13 —-A—- C:WINDOWSsystem32D3DCompiler_43.dll
2010-06-25 21:45:12 —-A—- C:WINDOWSsystem32d3dx11_43.dll
2010-06-25 21:45:12 —-A—- C:WINDOWSsystem32d3dcsx_43.dll
2010-06-25 21:45:11 —-A—- C:WINDOWSsystem32D3DX9_43.dll
2010-06-25 21:45:11 —-A—- C:WINDOWSsystem32d3dx10_43.dll
2010-06-25 21:45:10 —-A—- C:WINDOWSsystem32XAudio2_6.dll
2010-06-25 21:45:10 —-A—- C:WINDOWSsystem32XAPOFX1_4.dll
2010-06-25 21:45:10 —-A—- C:WINDOWSsystem32xactengine3_6.dll
2010-06-25 21:45:10 —-A—- C:WINDOWSsystem32X3DAudio1_7.dll
2010-06-25 21:45:09 —-A—- C:WINDOWSsystem32XAudio2_5.dll
2010-06-25 21:45:09 —-A—- C:WINDOWSsystem32xactengine3_5.dll
2010-06-25 21:45:09 —-A—- C:WINDOWSsystem32D3DCompiler_42.dll
2010-06-25 21:45:08 —-A—- C:WINDOWSsystem32d3dcsx_42.dll
2010-06-25 21:45:07 —-A—- C:WINDOWSsystem32d3dx11_42.dll
2010-06-25 21:45:07 —-A—- C:WINDOWSsystem32d3dx10_42.dll
2010-06-25 21:45:06 —-A—- C:WINDOWSsystem32D3DX9_42.dll
2010-06-25 21:45:06 —-A—- C:WINDOWSsystem32D3DX9_41.dll
2010-06-25 21:45:06 —-A—- C:WINDOWSsystem32d3dx10_41.dll
2010-06-25 21:45:06 —-A—- C:WINDOWSsystem32D3DCompiler_41.dll
2010-06-25 21:45:04 —-A—- C:WINDOWSsystem32XAudio2_4.dll
2010-06-25 21:45:04 —-A—- C:WINDOWSsystem32XAPOFX1_3.dll
2010-06-25 21:45:03 —-A—- C:WINDOWSsystem32xactengine3_4.dll
2010-06-25 21:45:03 —-A—- C:WINDOWSsystem32X3DAudio1_6.dll
2010-06-25 21:45:03 —-A—- C:WINDOWSsystem32d3dx10_40.dll
2010-06-25 21:45:03 —-A—- C:WINDOWSsystem32D3DCompiler_40.dll
2010-06-25 21:45:02 —-A—- C:WINDOWSsystem32D3DX9_40.dll
2010-06-25 21:45:01 —-A—- C:WINDOWSsystem32XAudio2_3.dll
2010-06-25 21:45:01 —-A—- C:WINDOWSsystem32XAPOFX1_2.dll
2010-06-25 21:45:01 —-A—- C:WINDOWSsystem32xactengine3_3.dll
2010-06-25 21:45:01 —-A—- C:WINDOWSsystem32X3DAudio1_5.dll
2010-06-25 21:45:00 —-A—- C:WINDOWSsystem32XAudio2_2.dll
2010-06-25 21:45:00 —-A—- C:WINDOWSsystem32XAPOFX1_1.dll
2010-06-25 21:45:00 —-A—- C:WINDOWSsystem32xactengine3_2.dll
2010-06-25 21:45:00 —-A—- C:WINDOWSsystem32d3dx10_39.dll
2010-06-25 21:45:00 —-A—- C:WINDOWSsystem32D3DCompiler_39.dll
2010-06-25 21:44:59 —-A—- C:WINDOWSsystem32D3DX9_39.dll
2010-06-25 21:44:57 —-A—- C:WINDOWSsystem32XAudio2_1.dll
2010-06-25 21:44:57 —-A—- C:WINDOWSsystem32XAPOFX1_0.dll
2010-06-25 21:44:56 —-A—- C:WINDOWSsystem32xactengine3_1.dll
2010-06-25 21:44:55 —-A—- C:WINDOWSsystem32X3DAudio1_4.dll
2010-06-25 21:44:54 —-A—- C:WINDOWSsystem32d3dx10_38.dll
2010-06-25 21:44:54 —-A—- C:WINDOWSsystem32D3DCompiler_38.dll
2010-06-25 21:44:49 —-A—- C:WINDOWSsystem32D3DX9_38.dll
2010-06-25 21:44:21 —-A—- C:WINDOWSsystem32d3dx9_29.dll
2010-06-25 21:11:41 —-D—- C:WINDOWSLogs

======List of files/folders modified in the last 1 months======

2010-07-17 16:34:13 —-D—- C:Program FilesTrend Micro
2010-07-17 15:58:20 —-D—- C:WINDOWSsystem32CatRoot2
2010-07-17 15:58:15 —-D—- C:WINDOWSsystem32drivers
2010-07-17 15:54:07 —-D—- C:WINDOWSsystem32
2010-07-17 15:53:34 —-AD—- C:WINDOWSTemp
2010-07-17 15:53:33 —-D—- C:WINDOWSPrefetch
2010-07-17 15:52:08 —-D—- C:Documents and SettingsKyoApplication DataBitTorrent
2010-07-17 15:51:36 —-SHD—- C:System Volume Information
2010-07-17 15:51:36 —-D—- C:WINDOWSsystem32Restore
2010-07-17 15:50:31 —-A—- C:WINDOWSSchedLgU.Txt
2010-07-17 15:14:36 —-D—- C:Program FilesCommon Files
2010-07-17 04:03:48 —-SHD—- C:WINDOWSInstaller
2010-07-15 22:57:53 —-RD—- C:Program Files
2010-07-14 15:27:50 —-D—- C:WINDOWS
2010-07-14 14:28:39 —-RSHDC—- C:WINDOWSsystem32dllcache
2010-07-14 14:28:19 —-HD—- C:WINDOWSinf
2010-07-14 14:28:15 —-HD—- C:WINDOWS$hf_mig$
2010-07-13 15:33:26 —-D—- C:Documents and SettingsKyoApplication Datavlc
2010-07-13 15:32:46 —-D—- C:Program FilesApollo
2010-07-12 21:53:54 —-D—- C:WINDOWSMinidump
2010-07-10 14:19:22 —-D—- C:WINDOWSMicrosoft.NET
2010-07-10 14:10:46 —-A—- C:WINDOWSimsins.BAK
2010-07-10 14:09:35 —-SHD—- C:Config.Msi
2010-07-10 14:09:35 —-RSD—- C:WINDOWSassembly
2010-07-10 14:09:23 —-D—- C:WINDOWSsystem32ru-ru
2010-07-10 14:09:22 —-D—- C:WINDOWSsystem32XPSViewer
2010-07-10 14:08:58 —-D—- C:WINDOWSsystem32mui
2010-07-09 22:28:22 —-HD—- C:Program FilesInstallShield Installation Information
2010-07-09 20:59:08 —-RSD—- C:WINDOWSFonts
2010-07-06 22:14:45 —-D—- C:Documents and SettingsKyoApplication DataOpenOffice.org2
2010-07-03 18:32:43 —-D—- C:Documents and SettingsKyoApplication Datadvdcss
2010-07-02 23:39:05 —-A—- C:WINDOWSsystem32MRT.exe
2010-07-01 00:47:29 —-D—- C:Documents and SettingsKyoApplication DataskypePM
2010-07-01 00:44:45 —-D—- C:Documents and SettingsAll UsersApplication DataSkype
2010-06-27 18:24:46 —-D—- C:WINDOWSsystem32DirectX
2010-06-25 21:37:22 —-D—- C:WINDOWSWinSxS
2010-06-25 21:34:59 —-D—- C:Documents and SettingsAll UsersApplication DataAdobe
2010-06-25 03:14:10 —-A—- C:WINDOWSsystem32PerfStringBackup.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 uagp35;Microsoft AGPv3.5 фильтр; C:WINDOWSsystem32DRIVERSuagp35.sys [2008-04-14 44672]
R0 videX32;videX32; C:WINDOWSsystem32DRIVERSvideX32.sys [2009-05-05 13976]
R0 xfilt;VIA SATA IDE Hot-plug Driver; C:WINDOWSsystem32DRIVERSxfilt.sys [2009-05-05 22168]
R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2008-05-09 40704]
R1 oreans32;oreans32; ??C:WINDOWSsystem32driversoreans32.sys []
R1 uzm5nju3;AVZ-RK Kernel Driver; ??C:WINDOWSsystem32Driversuzm5nju3.sys []
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:WINDOWSsystem32driversALCXWDM.SYS [2008-09-24 4122368]
R3 ati2mtag;ati2mtag; C:WINDOWSsystem32DRIVERSati2mtag.sys [2006-03-22 1522688]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service; C:WINDOWSsystem32DRIVERSfetnd5bv.sys [2009-06-16 46592]
R3 hidusb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2008-05-09 10368]
R3 mouhid;Драйвер мыши HID; C:WINDOWSsystem32DRIVERSmouhid.sys [2001-10-19 12160]
R3 Point32;Microsoft IntelliPoint Filter Driver; C:WINDOWSsystem32DRIVERSpoint32.sys [2009-05-28 27792]
R3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver; C:WINDOWSsystem32DRIVERSRtnicxp.sys [2009-03-25 130432]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2008-05-09 20608]
R3 vulfnths;VIA USB Host Controller Lower Filter; C:WINDOWSSystem32Driversvulfnth.sys [2005-01-05 6912]
R3 vulfntrs;VIA USB Roothub Lower Filter; C:WINDOWSSystem32Driversvulfntr.sys [2005-06-06 11264]
S1 kbdhid;Драйвер клавиатуры HID; C:WINDOWSsystem32DRIVERSkbdhid.sys [2008-05-09 14720]
S3 ariebk;ariebk; C:WINDOWSSystem32Driversariebk.sys [2005-07-11 16384]
S3 Bridge;MAC-мост; C:WINDOWSsystem32DRIVERSbridge.sys [2008-05-09 71552]
S3 BridgeMP;Минипорт MAC-моста; C:WINDOWSsystem32DRIVERSbridge.sys [2008-05-09 71552]
S3 CCDECODE;Closed Caption декодер; C:WINDOWSsystem32DRIVERSCCDECODE.sys [2008-04-14 17024]
S3 driverhardwarev2;driverhardwarev2; ??C:Program Filesma-config.comDriversdriverhardwarev2.sys []
S3 dump_wmimmc;dump_wmimmc; ??D:GamesGameGuarddump_wmimmc.sys []
S3 EagleNT;EagleNT; ??C:WINDOWSsystem32driversEagleNT.sys []
S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet адаптер, драйвер для NT; C:WINDOWSsystem32DRIVERSfetnd5.sys [2001-08-18 27165]
S3 GarenaPEngine;GarenaPEngine; ??C:DOCUME~1KyoLOCALS~1TempBTV25.tmp []
S3 hamachi;Hamachi Network Interface; C:WINDOWSsystem32DRIVERShamachi.sys [2009-09-23 26176]
S3 klim5;Kaspersky Anti-Virus NDIS Filter; C:WINDOWSsystem32DRIVERSklim5.sys []
S3 M1000Srv;M5603C USB2.0 Camera Driver; C:WINDOWSSystem32DriversM1000KNT.sys [2005-07-01 276930]
S3 mirrorv3;mirrorv3; C:WINDOWSsystem32DRIVERSrminiv3.sys [2006-11-01 3328]
S3 MSTEE;Преобразователь потоков Tee/Sink-to-Sink Microsoft; C:WINDOWSsystem32driversMSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI кодек; C:WINDOWSsystem32DRIVERSNABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft видео или ТВ подключение; C:WINDOWSsystem32DRIVERSNdisIP.sys [2008-04-14 10880]
S3 nmwcd;Nokia USB Phone Parent; C:WINDOWSsystem32driversccdcmb.sys [2009-10-06 17664]
S3 nmwcdc;Nokia USB Generic; C:WINDOWSsystem32driversccdcmbo.sys [2009-10-06 22016]
S3 npkcrypt;npkcrypt; ??D:GamesLineage2systemnpkcrypt.sys []
S3 NPPTNT2;NPPTNT2; ??C:WINDOWSsystem32npptNT2.sys []
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:WINDOWSsystem32DRIVERSpccsmcfd.sys [2008-08-26 18816]
S3 RivaTuner32;RivaTuner32; ??C:Program FilesRivaTuner v2.22RivaTuner32.sys []
S3 rtl8139;Compex RE100ATX PCI(winxp) Fast Ethernet Adapter NT Driver; C:WINDOWSsystem32DRIVERSRE100ND5.sys [2002-08-29 45696]
S3 SLIP;BDA Slip De-Framer; C:WINDOWSsystem32DRIVERSSLIP.sys [2008-04-14 11136]
S3 StarOpen;StarOpen; C:WINDOWSsystem32driversStarOpen.sys [2009-09-28 7168]
S3 streamip;BDA IPSink; C:WINDOWSsystem32DRIVERSStreamIP.sys [2008-04-14 15232]
S3 TVICHW32;TVICHW32; ??C:WINDOWSsystem32DRIVERSTVICHW32.SYS []
S3 upperdev;upperdev; C:WINDOWSsystem32DRIVERSusbser_lowerflt.sys [2009-10-06 7936]
S3 usbscan;Драйвер USB-сканера; C:WINDOWSsystem32DRIVERSusbscan.sys [2008-04-14 15104]
S3 usbser;USB Modem Driver; C:WINDOWSsystem32driversusbser.sys [2008-04-14 26112]
S3 UsbserFilt;UsbserFilt; C:WINDOWSsystem32DRIVERSusbser_lowerfltj.sys [2009-10-06 7936]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2008-04-14 26368]
S3 viagfx;viagfx; C:WINDOWSsystem32DRIVERSvtmini.sys [2005-12-27 247040]
S3 VIAudio;VIA AC’97 Audio Controller (WDM); C:WINDOWSsystem32driversviaudios.sys [2003-06-16 369920]
S3 Vsp;Vsp; ??C:WINDOWSsystem32driversVsp.sys []
S3 Wdf01000;Wdf01000; C:WINDOWSsystem32DRIVERSWdf01000.sys [2008-03-27 503008]
S3 WSTCODEC;World Standard Teletext кодек; C:WINDOWSsystem32DRIVERSWSTCODEC.SYS [2008-04-14 19200]
S3 WudfPf;Windows Driver Foundation — User-mode Driver Framework Platform Driver; C:WINDOWSsystem32DRIVERSWudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:WINDOWSsystem32Ati2evxx.exe [2006-03-22 405504]
R2 JavaQuickStarterService;Java Quick Starter; C:Program FilesJavajre6binjqs.exe [2009-10-11 153376]
R2 NMSAccessU;NMSAccessU; C:Program FilesCDBurnerXPNMSAccessU.exe [2009-09-06 71096]
S2 ATI Smart;ATI Smart; C:WINDOWSsystem32ati2sgag.exe [2006-05-03 520192]
S2 Ventrilo;Ventrilo; C:Program FilesVentSrvventrilo_svc.exe []
S3 Adobe LM Service;Adobe LM Service; C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe [2009-01-22 72704]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:WINDOWSMicrosoft.NETFrameworkv3.0WPFPresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication Foundationinfocard.exe [2008-07-29 881664]
S3 maconfservice;Ma-Config Service; C:Program Filesma-config.commaconfservice.exe [2009-09-23 238960]
S3 npggsvc;nProtect GameGuard Service; C:WINDOWSsystem32GameMon.des [2010-01-13 3477452]
S3 ServiceLayer;ServiceLayer; C:Program FilesPC Connectivity SolutionServiceLayer.exe [2009-10-27 657408]
S3 usprserv;User Privilege Service; C:WINDOWSSystem32svchost.exe [2008-05-09 14336]
S3 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2008-05-09 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication FoundationSMSvcHost.exe [2008-07-29 132096]

EOF
17 июля, 2010 в 1:04 пп #30059
bakemono
Participant
- Темы:1
- Сообщений:8
======Uninstall list======

—>C:Program FilesCommon FilesRealUpdate_OBr1puninst.exe RealNetworks|RealPlayer|6.0
—>MsiExec /X{74224F8D-4A17-4816-9EDB-7BB854DE532C}
—>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:WINDOWSINFPCHealth.inf
ACDSee 10 Photo Manager—>MsiExec.exe /I{F8B98EB6-FC06-45BF-87D4-9784E0408611}
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)—>MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe Bridge 1.0—>MsiExec.exe /I{B74D4E10-1033-0000-0000-000000000001}
Adobe Common File Installer—>MsiExec.exe /I{8EDBA74D-0686-4C99-BFDD-F894678E5B39}
Adobe Flash Player 10 Plugin—>C:WINDOWSsystem32MacromedFlashuninstall_plugin.exe
Adobe Flash Player ActiveX—>C:WINDOWSsystem32MacromedFlashuninstall_activeX.exe
Adobe Help Center 1.0—>MsiExec.exe /I{E9787678-1033-0000-8E67-000000000001}
Adobe Photoshop CS2—>msiexec /I {236BB7C4-4419-42FD-0409-1E257A25E34D}
Adobe Reader 8 — Russian—>MsiExec.exe /I{AC76BA86-7AD7-1049-7B44-A81200000003}
Adobe Stock Photos 1.0—>MsiExec.exe /I{786C5747-1033-0000-B58E-000000000001}
Apollo 37zz—>»C:Program FilesApollounins000.exe»
Apple Software Update—>MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Ask Toolbar—>»C:Program FilesAskBarDisunins000.exe»
ATI — Software Uninstall Utility—>C:Program FilesATI TechnologiesUninstallAllAtiCimUn.exe
ATI Catalyst Control Center—>MsiExec.exe /I{EA9FAF16-0E5C-42C4-9742-9AF8D5F6D69B}
ATI Display Driver—>rundll32 C:WINDOWSsystem32atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
Audio Record Wizard v4.0.1—>»D:Program FilesARWizard4unins000.exe»
CDBurnerXP—>»C:Program FilesCDBurnerXPunins000.exe»
EBKTool4—>C:WINDOWSISUNINST.EXE -f»C:Program FilesEBKToolEBKTool4Uninst.isu» -c»C:Program FilesEBKToolEBKTool4UninstallDLL.dll»
Fantastic Flame Screensaver—>C:Program FilesFantastic Flame Screensaveruninstall.exe
HFSExplorer 0.21—>C:Program FilesHFSExploreruninst.exe
HijackThis 2.0.2—>»C:Program FilesTrend MicroHijackThisHijackThis.exe» /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)—>C:WINDOWSsystem32msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=»»
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)—>C:WINDOWSsystem32msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=»»
Hotfix for Windows Media Format 11 SDK (KB929399)—>»C:WINDOWS$NtUninstallKB929399$spuninstspuninst.exe»
HP Product Detection—>MsiExec.exe /X{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}
iPicture ScreenShooter 1.0—>»C:Program FilesScreenShooterunins000.exe»
iriver plus 3 (remove only)—>»D:Downloadsiriver plus 3uninstall.exe»
Java(TM) 6 Update 17—>MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216014FF}
K-Lite Codec Pack 5.0.5 (Full)—>»C:Program FilesK-Lite Codec Packunins000.exe»
Ma-Config.com—>MsiExec.exe /X{425FFD94-36BD-4933-881B-FE0B9DADF2B7}
Malwarebytes’ Anti-Malware—>»C:Program FilesMalwarebytes’ Anti-Malwareunins000.exe»
Microsoft .NET Framework 2.0 Service Pack 1 Language Pack — RUS—>MsiExec.exe /I{34AB2437-1B34-3E2D-9DE8-3E2D35335B3F}
Microsoft .NET Framework 2.0 Service Pack 2—>MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 1 Language Pack — RUS—>MsiExec.exe /I{CFF15B94-E062-3701-869A-4CDF4590461E}
Microsoft .NET Framework 3.0 Service Pack 2—>MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 Language Pack — rus—>MsiExec.exe /I{95E44F11-19F0-39EA-A894-792E054AA1CF}
Microsoft .NET Framework 3.5 SP1—>C:WINDOWSMicrosoft.NETFrameworkv3.5Microsoft .NET Framework 3.5 SP1setup.exe
Microsoft .NET Framework 3.5 SP1—>MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Internationalized Domain Names Mitigation APIs—>»C:WINDOWS$NtServicePackUninstallIDNMitigationAPIs$spuninstspuninst.exe»
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7—>»C:WINDOWS$NtUninstallWdf01007$spuninstspuninst.exe»
Microsoft National Language Support Downlevel APIs—>»C:WINDOWS$NtServicePackUninstallNLSDownlevelMapping$spuninstspuninst.exe»
Microsoft User-Mode Driver Framework Feature Pack 1.0—>»C:WINDOWS$NtUninstallWudf01000$spuninstspuninst.exe»
Microsoft Visual C++ 2005 Redistributable—>MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 Redistributable — x86 9.0.30729.17—>MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Mp3tag v2.43—>C:Program FilesMp3tagMp3tagUninstall.EXE
MSVC80_x86_v2—>MsiExec.exe /I{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}
MSVC80_x86—>MsiExec.exe /I{212748BB-0DA5-46DE-82A1-403736DC9F27}
MSVC90_x86—>MsiExec.exe /I{AF111648-99A1-453E-81DD-80DBBF6DAD0D}
MSXML 4.0 SP2 (KB954430)—>MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)—>MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
MSXML 6.0 Parser (KB925673)—>MsiExec.exe /I{FE9126DB-5F84-495A-BB46-3C724F1C2D08}
Nokia Connectivity Cable Driver—>MsiExec.exe /I{C50EF365-2898-489A-B6C7-30DAA466E9A2}
Nokia Ovi Suite Software Updater—>MsiExec.exe /X{564B16F4-6B5B-47B0-9AB6-FF2E943947F7}
Nokia PC Suite—>C:Documents and SettingsAll UsersApplication DataInstallations{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}Nokia_PC_Suite_7_1_40_1_rus.exe
Nokia PC Suite—>MsiExec.exe /I{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}
NOXON player Basic—>C:Program FilesTerraTecNOXON player Basicuninstall.exe
NVIDIA PhysX v8.04.25—>MsiExec.exe /X{74224F8D-4A17-4816-9EDB-7BB854DE532C}
Nvu 1.0—>C:Program FilesNvuuninst.exe
OpenOffice.org 2.4—>MsiExec.exe /I{EDB1F57E-6EFF-4E53-B022-831CC38F53A3}
Opera 10.10—>MsiExec.exe /X{690BE098-6D0D-493D-B079-BD7E8F81A141}
Opera 9.64—>MsiExec.exe /X{A2A60894-E3ED-46FE-9A6A-7CF7A87572A0}
Opera 9.64—>MsiExec.exe /X{E1BBBAC5-2857-4155-82A6-54492CE88620}
Orbit Downloader—>»D:Program FilesOrbitdownloaderunins000.exe»
Ovi Desktop Sync Engine—>MsiExec.exe /X{F1C3541D-5B93-4131-B440-692FBA3DD250}
OviMPlatform—>MsiExec.exe /I{8D100E0C-1A5A-43AD-93EF-76F94AE61C30}
Paint.NET v3.36—>MsiExec.exe /X{43602F34-1AA3-44FB-AEB2-D08C2C73743F}
Pando Media Booster—>C:Program FilesPando NetworksMedia Boosteruninst.exe
PC Connectivity Solution—>MsiExec.exe /I{4CE6B3C4-D8E2-4A5D-BEF5-5B69AF843B0C}
Perfect World 1.3.4.2265—>»D:PWextremePerfect Worldunins000.exe»
QIP.Online—>C:Program FilesQIP.OnlineUninstall.exe
RealPlayer—>C:Program FilesCommon FilesRealUpdate_OBr1puninst.exe RealNetworks|RealPlayer|6.0
Realtek AC’97 Audio—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime1150Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{FB08F381-6533-4108-B7DD-039E11FBC27E}setup.exe» -l0x19 -removeonly
REALTEK GbE & FE Ethernet PCI NIC Driver—>C:Program FilesInstallShield Installation Information{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}setup.exe -runfromtemp -removeonly
Remote Administrator v2.1—>C:Program FilesRadminuninstal.exe
RivaTuner v2.22—>»C:Program FilesRivaTuner v2.22uninstall.exe»
Safari—>MsiExec.exe /I{E56D39F8-2A9F-44B4-B068-A72E45A073E6}
Sim 321C—>C:WINDOWSSystemM1000Rmv.exe
Skype Toolbars—>MsiExec.exe /I{981029E0-7FC9-4CF3-AB39-6F133621921A}
Skype™ 4.2—>MsiExec.exe /X{D103C4BA-F905-437A-8049-DB24763BBE36}
Slim 321C—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime701Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{0BD0374C-CC12-4812-BBC5-69481A385E52}setup.exe» -l0x19
SuperAVConverter V9.5 Build 6500—>»D:Program FilesSuperAVConverterunins000.exe»
Uniblue DriverScanner 2009—>»C:Documents and SettingsAll UsersApplication Data{66E2F539-12B6-4870-A500-7689CDE75C5E}DriverScanner_Setup.exe» REMOVE=TRUE MODIFY=FALSE
Uniblue DriverScanner 2009—>C:Documents and SettingsAll UsersApplication Data{66E2F539-12B6-4870-A500-7689CDE75C5E}DriverScanner_Setup.exe
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)—>C:WINDOWSsystem32msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=»»
VIA Audio Driver Setup Program—>RunDll32.exe UnAudioNT.dll,UninstallAudio C:WINDOWSIsUninst.exe -f»C:PROGRA~1VIATEC~1VIAAUD~1/Uninst.isu»
VIA Rhine-Family Fast-Ethernet Adapter—>Rundll32.exe vuins32.dll,vuins32Ex $Rhine $VIA
VIA Диспетчер устройств платформы—>C:PROGRA~1COMMON~1INSTAL~1Driver7INTEL3~1IDriver.exe /M{20D4A895-748C-4D88-871C-FDB1695B0169}
VIA/S3G Display Driver—>C:PROGRA~1S3UChromePs3minset.exe /u UChromeP.uns
ViewSonic Monitor Drivers—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{48963B63-7A10-49D6-8B08-61E6132453D0}Setup.exe» -l0x9
VLC media player 1.0.3—>C:Program FilesVideoLANVLCuninstall.exe
WinDjView 1.0.1—>D:Program FilesWinDjViewuninstall.exe
Windows Internet Explorer 7—>»C:WINDOWSie7spuninstspuninst.exe»
Windows Media Format 11 runtime—>»C:Program FilesWindows Media Playerwmsetsdk.exe» /UninstallAll
Windows Media Format 11 runtime—>»C:WINDOWS$NtUninstallWMFDist11$spuninstspuninst.exe»
XML Paper Specification Shared Components Language Pack 1.0—>»C:WINDOWS$NtUninstallXPSEPSCLP$spuninstspuninst.exe»
YouTube FLV to AVI converter Pro 2.2.5—>»C:Program FilesEasiestutilsYouTube FLV to AVI converter Prounins000.exe»
Архиватор WinRAR—>D:GamesWARCRAFTWarcraft IIIMapsDownloaduninstall.exe
Исправление для Windows XP (KB952287)—>»C:WINDOWS$NtUninstallKB952287$spuninstspuninst.exe»
Исправление для Windows XP (KB961118)—>»C:WINDOWS$NtUninstallKB961118$spuninstspuninst.exe»
Исправление для Windows XP (KB970653-v3)—>»C:WINDOWS$NtUninstallKB970653-v3$spuninstspuninst.exe»
Исправление для Windows XP (KB976098-v2)—>»C:WINDOWS$NtUninstallKB976098-v2$spuninstspuninst.exe»
Исправление для Windows XP (KB979306)—>»C:WINDOWS$NtUninstallKB979306$spuninstspuninst.exe»
Исправление для Windows XP (KB981793)—>»C:WINDOWS$NtUninstallKB981793$spuninstspuninst.exe»
Обновление безопасности для Windows Internet Explorer 7 (KB938127-v2)—>»C:WINDOWSie7updatesKB938127-v2-IE7spuninstspuninst.exe»
Обновление безопасности для Windows Internet Explorer 7 (KB953838)—>»C:WINDOWSie7updatesKB953838-IE7spuninstspuninst.exe»
Обновление безопасности для Windows Internet Explorer 7 (KB956390)—>»C:WINDOWSie7updatesKB956390-IE7spuninstspuninst.exe»
Обновление безопасности для Windows Internet Explorer 7 (KB958215)—>»C:WINDOWSie7updatesKB958215-IE7spuninstspuninst.exe»
Обновление безопасности для Windows Internet Explorer 7 (KB960714)—>»C:WINDOWSie7updatesKB960714-IE7spuninstspuninst.exe»
Обновление безопасности для Windows Internet Explorer 7 (KB961260)—>»C:WINDOWSie7updatesKB961260-IE7spuninstspuninst.exe»
Обновление безопасности для Windows Internet Explorer 7 (KB963027)—>»C:WINDOWSie7updatesKB963027-IE7spuninstspuninst.exe»
Обновление безопасности для Windows Internet Explorer 7 (KB969897)—>»C:WINDOWSie7updatesKB969897-IE7spuninstspuninst.exe»
Обновление безопасности для Windows Internet Explorer 7 (KB972260)—>»C:WINDOWSie7updatesKB972260-IE7spuninstspuninst.exe»
Обновление безопасности для Windows Internet Explorer 7 (KB974455)—>»C:WINDOWSie7updatesKB974455-IE7spuninstspuninst.exe»
Обновление безопасности для Windows Internet Explorer 7 (KB976325)—>»C:WINDOWSie7updatesKB976325-IE7spuninstspuninst.exe»
Обновление безопасности для Windows Internet Explorer 7 (KB978207)—>»C:WINDOWSie7updatesKB978207-IE7spuninstspuninst.exe»
Обновление безопасности для Windows Internet Explorer 7 (KB982381)—>»C:WINDOWSie7updatesKB982381-IE7spuninstspuninst.exe»
Обновление безопасности для Windows XP — (KB941569)—>»C:WINDOWS$NtUninstallKB941569$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB2229593)—>»C:WINDOWS$NtUninstallKB2229593$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB923561)—>»C:WINDOWS$NtUninstallKB923561$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB923789)—>C:WINDOWSsystem32MacroMedFlashgenuinst.exe C:WINDOWSsystem32MacroMedFlashKB923789.inf
Обновление безопасности для Windows XP (KB938464)—>»C:WINDOWS$NtUninstallKB938464$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB946648)—>»C:WINDOWS$NtUninstallKB946648$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB950762)—>»C:WINDOWS$NtUninstallKB950762$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB950974)—>»C:WINDOWS$NtUninstallKB950974$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB951066)—>»C:WINDOWS$NtUninstallKB951066$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB951376-v2)—>»C:WINDOWS$NtUninstallKB951376-v2$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB951698)—>»C:WINDOWS$NtUninstallKB951698$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB951748)—>»C:WINDOWS$NtUninstallKB951748$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB952004)—>»C:WINDOWS$NtUninstallKB952004$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB952954)—>»C:WINDOWS$NtUninstallKB952954$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB953838)—>»C:WINDOWS$NtUninstallKB953838$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB953839)—>»C:WINDOWS$NtUninstallKB953839$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB954211)—>»C:WINDOWS$NtUninstallKB954211$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB954459)—>»C:WINDOWS$NtUninstallKB954459$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB954600)—>»C:WINDOWS$NtUninstallKB954600$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB955069)—>»C:WINDOWS$NtUninstallKB955069$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB956391)—>»C:WINDOWS$NtUninstallKB956391$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB956572)—>»C:WINDOWS$NtUninstallKB956572$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB956744)—>»C:WINDOWS$NtUninstallKB956744$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB956802)—>»C:WINDOWS$NtUninstallKB956802$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB956803)—>»C:WINDOWS$NtUninstallKB956803$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB956841)—>»C:WINDOWS$NtUninstallKB956841$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB956844)—>»C:WINDOWS$NtUninstallKB956844$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB957095)—>»C:WINDOWS$NtUninstallKB957095$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB957097)—>»C:WINDOWS$NtUninstallKB957097$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB958644)—>»C:WINDOWS$NtUninstallKB958644$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB958687)—>»C:WINDOWS$NtUninstallKB958687$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB958690)—>»C:WINDOWS$NtUninstallKB958690$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB958869)—>»C:WINDOWS$NtUninstallKB958869$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB959426)—>»C:WINDOWS$NtUninstallKB959426$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB960225)—>»C:WINDOWS$NtUninstallKB960225$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB960715)—>»C:WINDOWS$NtUninstallKB960715$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB960803)—>»C:WINDOWS$NtUninstallKB960803$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB960859)—>»C:WINDOWS$NtUninstallKB960859$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB961371)—>»C:WINDOWS$NtUninstallKB961371$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB961373)—>»C:WINDOWS$NtUninstallKB961373$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB961501)—>»C:WINDOWS$NtUninstallKB961501$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB968537)—>»C:WINDOWS$NtUninstallKB968537$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB969059)—>»C:WINDOWS$NtUninstallKB969059$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB969898)—>»C:WINDOWS$NtUninstallKB969898$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB969947)—>»C:WINDOWS$NtUninstallKB969947$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB970238)—>»C:WINDOWS$NtUninstallKB970238$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB970430)—>»C:WINDOWS$NtUninstallKB970430$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB971468)—>»C:WINDOWS$NtUninstallKB971468$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB971486)—>»C:WINDOWS$NtUninstallKB971486$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB971557)—>»C:WINDOWS$NtUninstallKB971557$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB971633)—>»C:WINDOWS$NtUninstallKB971633$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB971657)—>»C:WINDOWS$NtUninstallKB971657$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB971961)—>»C:WINDOWS$NtUninstallKB971961$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB972270)—>»C:WINDOWS$NtUninstallKB972270$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB973346)—>»C:WINDOWS$NtUninstallKB973346$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB973354)—>»C:WINDOWS$NtUninstallKB973354$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB973507)—>»C:WINDOWS$NtUninstallKB973507$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB973525)—>»C:WINDOWS$NtUninstallKB973525$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB973869)—>»C:WINDOWS$NtUninstallKB973869$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB973904)—>»C:WINDOWS$NtUninstallKB973904$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB974112)—>»C:WINDOWS$NtUninstallKB974112$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB974318)—>»C:WINDOWS$NtUninstallKB974318$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB974392)—>»C:WINDOWS$NtUninstallKB974392$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB974571)—>»C:WINDOWS$NtUninstallKB974571$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB975025)—>»C:WINDOWS$NtUninstallKB975025$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB975467)—>»C:WINDOWS$NtUninstallKB975467$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB975560)—>»C:WINDOWS$NtUninstallKB975560$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB975561)—>»C:WINDOWS$NtUninstallKB975561$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB975562)—>»C:WINDOWS$NtUninstallKB975562$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB975713)—>»C:WINDOWS$NtUninstallKB975713$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB977165)—>»C:WINDOWS$NtUninstallKB977165$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB977816)—>»C:WINDOWS$NtUninstallKB977816$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB977914)—>»C:WINDOWS$NtUninstallKB977914$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB978037)—>»C:WINDOWS$NtUninstallKB978037$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB978251)—>»C:WINDOWS$NtUninstallKB978251$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB978262)—>»C:WINDOWS$NtUninstallKB978262$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB978338)—>»C:WINDOWS$NtUninstallKB978338$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB978542)—>»C:WINDOWS$NtUninstallKB978542$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB978601)—>»C:WINDOWS$NtUninstallKB978601$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB978706)—>»C:WINDOWS$NtUninstallKB978706$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB979309)—>»C:WINDOWS$NtUninstallKB979309$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB979482)—>»C:WINDOWS$NtUninstallKB979482$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB979559)—>»C:WINDOWS$NtUninstallKB979559$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB979683)—>»C:WINDOWS$NtUninstallKB979683$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB980195)—>»C:WINDOWS$NtUninstallKB980195$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB980218)—>»C:WINDOWS$NtUninstallKB980218$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB980232)—>»C:WINDOWS$NtUninstallKB980232$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB981349)—>»C:WINDOWS$NtUninstallKB981349$spuninstspuninst.exe»
Обновление безопасности для проигрывателя Windows Media — (KB952069)—>»C:WINDOWS$NtUninstallKB952069_WM9$spuninstspuninst.exe»
Обновление безопасности для проигрывателя Windows Media — (KB954155)—>»C:WINDOWS$NtUninstallKB954155_WM9$spuninstspuninst.exe»
Обновление безопасности для проигрывателя Windows Media — (KB968816)—>»C:WINDOWS$NtUninstallKB968816_WM9$spuninstspuninst.exe»
Обновление безопасности для проигрывателя Windows Media — (KB973540)—>»C:WINDOWS$NtUninstallKB973540_WM9$spuninstspuninst.exe»
Обновление безопасности для проигрывателя Windows Media — (KB978695)—>»C:WINDOWS$NtUninstallKB978695_WM9$spuninstspuninst.exe»
Обновление безопасности для проигрывателя Windows Media — (KB979402)—>»C:WINDOWS$NtUninstallKB979402_WM9$spuninstspuninst.exe»
Обновление для Windows Internet Explorer 7 (KB976749)—>»C:WINDOWSie7updatesKB976749-IE7spuninstspuninst.exe»
Обновление для Windows Internet Explorer 7 (KB980182)—>»C:WINDOWSie7updatesKB980182-IE7spuninstspuninst.exe»
Обновление для Windows XP (KB898461)—>»C:WINDOWS$NtUninstallKB898461$spuninstspuninst.exe»
Обновление для Windows XP (KB951072-v2)—>»C:WINDOWS$NtUninstallKB951072-v2$spuninstspuninst.exe»
Обновление для Windows XP (KB951978)—>»C:WINDOWS$NtUninstallKB951978$spuninstspuninst.exe»
Обновление для Windows XP (KB955759)—>»C:WINDOWS$NtUninstallKB955759$spuninstspuninst.exe»
Обновление для Windows XP (KB955839)—>»C:WINDOWS$NtUninstallKB955839$spuninstspuninst.exe»
Обновление для Windows XP (KB967715)—>»C:WINDOWS$NtUninstallKB967715$spuninstspuninst.exe»
Обновление для Windows XP (KB968389)—>»C:WINDOWS$NtUninstallKB968389$spuninstspuninst.exe»
Обновление для Windows XP (KB971737)—>»C:WINDOWS$NtUninstallKB971737$spuninstspuninst.exe»
Обновление для Windows XP (KB973687)—>»C:WINDOWS$NtUninstallKB973687$spuninstspuninst.exe»
Обновление для Windows XP (KB973815)—>»C:WINDOWS$NtUninstallKB973815$spuninstspuninst.exe»
Пакет драйверов Windows — Nokia Modem (06/01/2009 7.01.0.4)—>C:PROGRA~1DIFX270581355A767BF1dpinst.exe /u C:WINDOWSsystem32DRVSTOREnokbtmdm_0777326F40B753DD4E385F058ADB286B70A301FEnokbtmdm.inf
Пакет драйверов Windows — Nokia Modem (10/05/2009 4.2)—>C:PROGRA~1DIFX270581355A767BF1dpinst.exe /u C:WINDOWSsystem32DRVSTOREnokia_blue_AAB746D5658CCF4CAE7A35CED5F0ADA3C447A973nokia_bluetooth.inf
Пакет драйверов Windows — Nokia pccsmcfd (08/22/2008 7.0.0.0)—>C:PROGRA~1DIFXB4723E9A0713E5B1dpinst.exe /u C:WINDOWSsystem32DRVSTOREpccsmcfd_A3B3916E5D8138F59EE218321B27B044D3B18294pccsmcfd.inf
Языковой пакет Microsoft .NET Framework 3.5 — RUS—>C:WINDOWSMicrosoft.NETFrameworkv3.5Microsoft .NET Framework 3.5 Language Pack — russetup.exe

======Security center information======

AV: Антивирус Касперского

======System event log======

Computer Name: ADMIN
Event Code: 7035
Message: Служба «Адаптер производительности WMI» успешно отправила управляющий элемент «запустить».

Record Number: 7941
Source Name: Service Control Manager
Time Written: 20100628232145.000000+240
Event Type: информация
User: ADMINKyo

Computer Name: ADMIN
Event Code: 7036
Message: Служба «Адаптер производительности WMI» перешла в состояние Работает.

Record Number: 7940
Source Name: Service Control Manager
Time Written: 20100628232144.000000+240
Event Type: информация
User:

Computer Name: ADMIN
Event Code: 7034
Message: Служба «LogMeIn Hamachi 2.0 Tunneling Engine» неожиданно прервана. Это произошло (раз): 1.

Record Number: 7939
Source Name: Service Control Manager
Time Written: 20100628205238.000000+240
Event Type: ошибка
User:

Computer Name: ADMIN
Event Code: 7036
Message: Служба «Адаптер производительности WMI» перешла в состояние Остановлена.

Record Number: 7938
Source Name: Service Control Manager
Time Written: 20100628205142.000000+240
Event Type: информация
User:

Computer Name: ADMIN
Event Code: 7036
Message: Служба «Адаптер производительности WMI» перешла в состояние Работает.

Record Number: 7937
Source Name: Service Control Manager
Time Written: 20100628205142.000000+240
Event Type: информация
User:

=====Application event log=====

Computer Name: ADMIN
Event Code: 439
Message: wuauclt (336) Не удается записать теневой заголовок для файла C:WINDOWSSoftwareDistributionDataStoreLogstmp.edb. Ошибка -1808

Record Number: 256
Source Name: ESENT
Time Written: 20090825181820.000000+240
Event Type: ошибка
User:

Computer Name: ADMIN
Event Code: 482
Message: wuauclt (336) Попытка записи в файл «C:WINDOWSSoftwareDistributionDataStoreLogstmp.edb» в смещении 0 (0x0000000000000000) для 8192 (0x00002000) байт вызвала системную ошибку 112 (0x00000070): «Недостаточно места на диске. «. Операция записи приведет к ошибке -1808 (0xfffff8f0). Если ошибка повторится, то файл, возможно, поврежден, и потребуется восстановить его из предыдущей резервной копии.

Record Number: 255
Source Name: ESENT
Time Written: 20090825181820.000000+240
Event Type: ошибка
User:

Computer Name: ADMIN
Event Code: 439
Message: wuauclt (2892) Не удается записать теневой заголовок для файла C:WINDOWSSoftwareDistributionDataStoreLogstmp.edb. Ошибка -1808

Record Number: 254
Source Name: ESENT
Time Written: 20090825181819.000000+240
Event Type: ошибка
User:

Computer Name: ADMIN
Event Code: 482
Message: wuauclt (2892) Попытка записи в файл «C:WINDOWSSoftwareDistributionDataStoreLogstmp.edb» в смещении 0 (0x0000000000000000) для 8192 (0x00002000) байт вызвала системную ошибку 112 (0x00000070): «Недостаточно места на диске. «. Операция записи приведет к ошибке -1808 (0xfffff8f0). Если ошибка повторится, то файл, возможно, поврежден, и потребуется восстановить его из предыдущей резервной копии.

Record Number: 253
Source Name: ESENT
Time Written: 20090825181819.000000+240
Event Type: ошибка
User:

Computer Name: ADMIN
Event Code: 439
Message: wuauclt (2644) Не удается записать теневой заголовок для файла C:WINDOWSSoftwareDistributionDataStoreLogstmp.edb. Ошибка -1808

Record Number: 252
Source Name: ESENT
Time Written: 20090825181818.000000+240
Event Type: ошибка
User:

======Environment variables======

«ComSpec»=%SystemRoot%system32cmd.exe
«Path»=C:Program FilesPC Connectivity Solution;%SystemRoot%system32;%SystemRoot%;%SystemRoot%System32Wbem;C:Program FilesCommon FilesAdobeAGL
«windir»=%SystemRoot%
«FP_NO_HOST_CHECK»=NO
«OS»=Windows_NT
«PROCESSOR_ARCHITECTURE»=x86
«PROCESSOR_LEVEL»=15
«PROCESSOR_IDENTIFIER»=x86 Family 15 Model 4 Stepping 9, GenuineIntel
«PROCESSOR_REVISION»=0409
«NUMBER_OF_PROCESSORS»=1
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP

EOF
18 июля, 2010 в 8:25 дп #30060
Helper
Participant
- Темы:19
- Сообщений:712
Здравствуйте!Выполните, пожалуйста , все рекомендации.
Запустите HijackThis, для этого кликните Пуск, Выполнить, введите
```
C:Program Filestrend microKyo.exe
```
и нажмите Enter.
Откроется главное меню программы HijackThis.
Кликните по кнопке Do a system scan only.
Далее отметьте галочкой (слева) следующие строки, если они присутствуют:
```
F2 - REG:system.ini: UserInit=C:WINDOWSSYSTEM32Userinit.exe,C:WINDOWSsystem32392cd3e5.exe,C:WINDOWSsystem32hwpscq.exe,

O4 - Startup: wwwznv32.exe
```
Закройте все запущенные программы (включая InternetExplorer) и окна Windows.
Кликните по кнопке Fix и подтвердите свои действия выбрав YES.
Скачайте OTM by OldTimer или с зеркала и сохраните на рабочий стол.
Запустите OTM (в ОС Windows Vista необходимо запускать через правую кн. мыши от имени администратора)
временно выключите антивирус, firewall и другое защитное программное обеспечение[/url]. Выделите и скопируйте текст ниже (Ctrl+C)
```
:Processes

explorer.exe



:Services



:Files

C:Documents and SettingsKyoГлавное менюПрограммыАвтозагрузкаwwwznv32.exe

C:Documents and SettingsAll Userssystems.exe

C:WINDOWSsystem32vmsgkdy.exe

C:WINDOWSsystem32srwhuuw.exe

C:Program FilesCommon Fileskeylog.txt

C:WINDOWSsystem32hwpscq.exe

C:WINDOWSsystem32392cd3e5.exe

C:DOCUME~1KyoLOCALS~1TempwJQs.exe



:Reg

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]

"Shell"=-

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]

"C:DOCUME~1KyoLOCALS~1TempwJQs.exe"=-



:Commands

[purity]

[emptytemp]

[start explorer]

[Reboot]
```
В OTM под панелью «Paste Instructions for Items to be Moved» (под желтой панелью) вставьте скопированный текст и нажмите кнопку «MoveIt!».

Компьютер перезагрузится.
C:WINDOWSsystem32driversoreans32.sys
Проверьте файл на http://www.virustotal.com и выложите ссылку на результаты.
Прочитайте описание программы Malwarebytes Anti-malware (MBAM).
Скачайте и выполните сканирование вашего компьютера. Удалите всё что будет найдено. В конце работы будет показан лог, его содержимое вставьте в ваш ответ.Также повторите логи RSIT.
18 июля, 2010 в 9:16 дп #30061
bakemono
Participant
- Темы:1
- Сообщений:8
Здравствуйте! Сделала так, как вы сказали, но http://www.virustotal.com/ не открылся (остальные антивирусные сайты тоже, как и раньше).
Вот лог Malwarebytes:
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

18.07.2010 13:07:36
mbam-log-2010-07-18 (13-07-36).txt

Тип сканирования: Быстрое сканирование
Просканированные объекты: 149665
Времени прошло: 6 минут, 41 секунд

Зараженные процессы в памяти: 0
Зараженные модули в памяти: 0
Зараженные ключи в реестре: 0
Зараженные параметры в реестре: 204
Объекты реестра заражены: 0
Зараженные папки: 1
Зараженные файлы: 0

Зараженные процессы в памяти:
(Вредоносных программ не обнаружено)

Зараженные модули в памяти:
(Вредоносных программ не обнаружено)

Зараженные ключи в реестре:
(Вредоносных программ не обнаружено)

Зараженные параметры в реестре:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftoption_1 (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftoption_2 (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftoption_3 (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes128.111.48.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes128.130.56.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes128.130.60.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes139.91.222.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes141.202.248.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes149.101.225.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes150.70.93.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes155.35.248.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes162.40.10.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes165.160.15.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes166.70.98.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes174.120.184.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes174.120.185.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes174.120.186.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes174.133.38.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes18.85.2.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes188.40.74.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes188.93.8.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes192.150.94.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes193.0.6.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes193.1.193.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes193.110.109.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes193.17.85.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes193.193.194.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes193.24.237.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes193.66.251.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes193.69.114.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes193.71.68.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes194.0.200.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes194.109.142.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes194.112.106.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes194.206.126.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes194.33.180.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes195.137.160.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes195.146.235.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes195.2.240.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes195.210.42.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes195.55.72.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes195.64.225.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes195.70.37.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes198.6.49.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes199.203.243.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes203.160.188.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes204.14.90.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes205.178.145.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes205.227.136.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes206.204.52.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes207.44.154.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes207.44.254.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes207.46.18.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes207.46.20.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes207.46.232.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes207.66.0.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes208.43.44.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes208.43.71.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes208.79.250.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes209.124.55.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes209.157.69.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes209.160.22.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes209.216.46.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes209.51.167.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes209.62.112.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes209.62.68.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes209.87.209.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes212.47.219.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes212.67.88.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes212.72.62.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes212.8.79.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes213.133.34.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes213.171.218.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes213.198.89.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes213.220.100.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes213.31.172.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes216.10.192.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes216.12.145.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes216.239.122.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes216.246.90.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes216.49.88.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes216.49.94.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes216.55.183.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes216.99.133.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes217.106.234.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes217.16.16.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes217.170.21.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes217.174.103.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes38.113.1.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes62.14.249.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes62.146.210.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes62.146.66.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes62.189.194.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes62.213.110.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes62.67.184.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes62.75.163.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes62.75.216.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes63.85.36.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes64.128.133.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes64.13.134.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes64.202.189.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes64.246.4.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes64.41.142.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes64.41.151.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes64.66.190.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes64.78.182.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes65.175.38.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes65.55.184.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes65.55.240.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes66.223.50.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes66.249.17.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes66.77.70.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes67.134.208.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes67.15.103.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes67.15.231.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes67.19.34.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes67.192.135.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes67.225.206.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes67.227.172.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes68.177.102.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes69.162.79.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes69.18.148.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes69.20.104.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes69.57.142.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes69.93.226.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes70.84.211.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes72.232.246.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes72.3.254.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes72.32.125.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes72.32.149.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes72.32.70.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes74.125.77.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes74.208.158.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes74.208.20.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes74.50.0.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes74.52.233.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes74.53.201.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes74.53.70.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes74.54.130.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes74.54.139.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes74.54.46.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes74.55.40.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes74.55.74.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes74.86.125.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes74.86.232.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes75.125.185.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes75.125.189.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes75.125.212.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes75.125.29.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes75.125.43.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes75.125.82.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes78.108.86.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes78.137.164.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes78.47.87.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes79.125.5.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes80.153.193.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes80.190.130.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes80.190.154.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes80.237.132.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes80.86.107.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes81.176.66.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes81.176.67.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes81.177.31.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes81.24.35.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes82.117.238.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes82.151.107.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes82.165.103.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes82.98.86.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes83.102.130.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes83.202.175.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes83.222.23.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes83.222.31.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes83.223.117.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes84.40.30.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes85.12.57.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes85.17.210.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes85.214.106.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes85.255.19.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes85.31.222.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes87.106.242.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes87.106.254.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes87.230.79.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes87.238.48.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes87.242.72.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes87.242.74.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes87.242.75.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes87.242.79.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes88.221.119.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes89.108.66.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes89.111.176.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes89.202.149.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes89.202.157.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes90.156.159.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes90.183.101.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes91.121.97.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes91.199.212.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes91.209.196.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes92.123.155.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes92.53.106.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes93.184.71.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes93.191.13.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes94.23.206.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes94.236.0.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes95.140.225.0,255.255.255.0,192.168.10.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.

Объекты реестра заражены:
(Вредоносных программ не обнаружено)

Зараженные папки:
C:Program FilesCommon Fileswmkeys (Trojan.KeyLog) -> Quarantined and deleted successfully.

Зараженные файлы:
(Вредоносных программ не обнаружено)
18 июля, 2010 в 9:17 дп #30062
bakemono
Participant
- Темы:1
- Сообщений:8
RSIT создал только log.txt, вот он:

Logfile of random’s system information tool 1.08 (written by random/random)
Run by Kyo at 2010-07-18 13:08:36
Microsoft Windows XP Professional Service Pack 3
System drive C: has 3 GB (24%) free of 12 GB
Total RAM: 510 MB (38% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:08:41, on 18.07.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17055)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32VTTimer.exe
C:Program FilesCommon FilesRealUpdate_OBrealsched.exe
C:WINDOWSWebCamM1000M1000Mnt.exe
C:WINDOWSSOUNDMAN.EXE
C:Program FilesMicrosoft IntelliPointipoint.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:Program FilesCommon FilesNokiaMPlatformNokiaMServer.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesPando NetworksMedia BoosterPMB.exe
C:Program FilesVIA Technologies, IncVIA Audio Driver Setup ProgramAudioDeckAudioDeck.exe
C:Program FilesJavajre6binjqs.exe
C:Program FilesCDBurnerXPNMSAccessU.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:WINDOWSsystem32NOTEPAD.EXE
D:Program FilesSafari.exe
C:Documents and SettingsKyoРабочий столRSIT.exe
C:Program Filestrend microKyo.exe

R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = about:blank
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = about:blank
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: QIPBHO Class — {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} — C:Documents and SettingsUlitkaApplication DataMicrosoftInternet Explorerqipsearchbar.dll (file missing)
R3 — URLSearchHook: QIPBHO Class — {95289393-33EA-4F8D-B952-483415B9C955} — C:Documents and SettingsUlitkaApplication DataMicrosoftInternet Explorerqipsearchbar.dll (file missing)
F2 — REG:system.ini: UserInit=C:WINDOWSSYSTEM32Userinit.exe,C:WINDOWSsystem32392cd3e5.exe,C:WINDOWSsystem32hwpscq.exe,
O2 — BHO: btorbit.com — {000123B4-9B42-4900-B3F7-F4B073EFC214} — D:Program FilesOrbitdownloaderorbitcth.dll
O2 — BHO: SkypeIEPluginBHO — {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} — C:Program FilesSkypeToolbarsInternet Explorerskypeieplugin.dll
O2 — BHO: JQSIEStartDetectorImpl — {E7E6F031-17CE-4C07-BC86-EABFE594F69C} — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll
O3 — Toolbar: EBKTool — {4189165B-690F-4D24-A2E2-69F31E6EDA7C} — C:PROGRA~1EBKToolEBKTool4IEBAND~1.DLL
O3 — Toolbar: Grab Pro — {C55BBCD6-41AD-48AD-9953-3609C48EACC7} — D:Program FilesOrbitdownloaderGrabPro.dll
O4 — HKLM..Run: [VTTimer] VTTimer.exe
O4 — HKLM..Run: [VTTrayp] VTtrayp.exe
O4 — HKLM..Run: [M1000Mnt] M1000Rmv.exe /StartStillMnt
O4 — HKLM..Run: [TkBellExe] «C:Program FilesCommon FilesRealUpdate_OBrealsched.exe» -osboot
O4 — HKLM..Run: [Skype Recorder] «C:Program FilesSkype RecorderSkype Recorder.exe»
O4 — HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 — HKLM..Run: [IntelliPoint] «C:Program FilesMicrosoft IntelliPointipoint.exe»
O4 — HKLM..Run: [ATICCC] «C:Program FilesATI TechnologiesATI.ACEcli.exe» runtime -Delay
O4 — HKLM..Run: [NokiaMServer] C:Program FilesCommon FilesNokiaMPlatformNokiaMServer /watchfiles startup
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [MSMSGS] «C:Program FilesMessengermsmsgs.exe» /background
O4 — HKCU..Run: [YandexOnline] «C:Program FilesYandexOnlineonline.exe» -AutoStart
O4 — HKCU..Run: [BitTorrent] «D:Program FilesBitTorrent.exe»
O4 — HKCU..Run: [MX Skype Recorder] «C:Documents and SettingsKyoLocal SettingsApplication DataMXSkypeRecorderMXSkypeRecorder.exe» /autorun
O4 — HKCU..Run: [Pando Media Booster] C:Program FilesPando NetworksMedia BoosterPMB.exe
O4 — HKCU..Run: [DAEMON Tools Lite] «C:Program FilesDAEMON Tools LiteDTLite.exe» -autorun
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe (User ‘Default user’)
O4 — Startup: Adobe Gamma.lnk = C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe
O4 — Global Startup: AudioDeck.lnk = C:Program FilesVIA Technologies, IncVIA Audio Driver Setup ProgramAudioDeckAudioDeck.exe
O4 — Global Startup: Fantastic Flame Agent.lnk = C:Program FilesFantastic Flame ScreensaverFantasticFlameAgent.exe
O8 — Extra context menu item: &Download by Orbit — res://D:Program FilesOrbitdownloaderorbitmxt.dll/201
O8 — Extra context menu item: &Grab video by Orbit — res://D:Program FilesOrbitdownloaderorbitmxt.dll/204
O8 — Extra context menu item: Append to existing PDF — res://D:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
O8 — Extra context menu item: Convert link target to Adobe PDF — res://D:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
O8 — Extra context menu item: Convert link target to existing PDF — res://D:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
O8 — Extra context menu item: Convert selected links to Adobe PDF — res://D:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 — Extra context menu item: Convert selected links to existing PDF — res://D:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 — Extra context menu item: Convert selection to Adobe PDF — res://D:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
O8 — Extra context menu item: Convert selection to existing PDF — res://D:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
O8 — Extra context menu item: Convert to Adobe PDF — res://D:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
O8 — Extra context menu item: Do&wnload selected by Orbit — res://D:Program FilesOrbitdownloaderorbitmxt.dll/203
O8 — Extra context menu item: Down&load all by Orbit — res://D:Program FilesOrbitdownloaderorbitmxt.dll/202
O9 — Extra button: Skype add-on for Internet Explorer — {898EA8C8-E7FF-479B-8935-AEC46303B9E5} — C:Program FilesSkypeToolbarsInternet Explorerskypeieplugin.dll
O9 — Extra ‘Tools’ menuitem: Skype add-on for Internet Explorer — {898EA8C8-E7FF-479B-8935-AEC46303B9E5} — C:Program FilesSkypeToolbarsInternet Explorerskypeieplugin.dll
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O16 — DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) — http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 — DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) — http://liveupdate.msi.com.tw/autobios/LOnline/install.cab
O18 — Protocol: skype-ie-addon-data — {91774881-D725-4E58-B298-07617B9B86A8} — C:Program FilesSkypeToolbarsInternet Explorerskypeieplugin.dll
O18 — Protocol: skype4com — {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} — C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O22 — SharedTaskScheduler: Предзагрузчик Browseui — {438755C2-A8BA-11D1-B96B-00A0C90312E1} — C:WINDOWSsystem32browseui.dll
O22 — SharedTaskScheduler: Демон кэша категорий компонентов — {8C7461EF-2B13-11d2-BE35-3078302C2030} — C:WINDOWSsystem32browseui.dll
O23 — Service: Adobe LM Service — Adobe Systems — C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe
O23 — Service: Ati HotKey Poller — ATI Technologies Inc. — C:WINDOWSsystem32Ati2evxx.exe
O23 — Service: ATI Smart — Unknown owner — C:WINDOWSsystem32ati2sgag.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: Java Quick Starter (JavaQuickStarterService) — Sun Microsystems, Inc. — C:Program FilesJavajre6binjqs.exe
O23 — Service: Ma-Config Service (maconfservice) — Unknown owner — C:Program Filesma-config.commaconfservice.exe
O23 — Service: NetMeeting Remote Desktop Sharing (mnmsrvc) — Корпорация Майкрософт — C:WINDOWSsystem32mnmsrvc.exe
O23 — Service: NMSAccessU — Unknown owner — C:Program FilesCDBurnerXPNMSAccessU.exe
O23 — Service: nProtect GameGuard Service (npggsvc) — Unknown owner — C:WINDOWSsystem32GameMon.des.exe (file missing)
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: ServiceLayer — Nokia — C:Program FilesPC Connectivity SolutionServiceLayer.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Ventrilo — Unknown owner — C:Program FilesVentSrvventrilo_svc.exe (file missing)
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe

—
End of file — 10294 bytes

======Scheduled tasks folder======

C:WINDOWStasksAppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{000123B4-9B42-4900-B3F7-F4B073EFC214}]
Octh Class — D:Program FilesOrbitdownloaderorbitcth.dll [2009-05-19 171208]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype add-on for Internet Explorer — C:Program FilesSkypeToolbarsInternet Explorerskypeieplugin.dll [2010-02-08 804136]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll [2009-10-11 73728]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{4189165B-690F-4D24-A2E2-69F31E6EDA7C} — EBKTool — C:PROGRA~1EBKToolEBKTool4IEBAND~1.DLL [2005-08-23 1934848]
{C55BBCD6-41AD-48AD-9953-3609C48EACC7} — Grab Pro — D:Program FilesOrbitdownloaderGrabPro.dll [2009-05-19 670840]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«VTTimer»=C:WINDOWSsystem32VTTimer.exe [2005-03-08 53248]
«VTTrayp»=C:WINDOWSsystem32VTtrayp.exe [2005-11-01 163840]
«M1000Mnt»=M1000Rmv.exe /StartStillMnt []
«TkBellExe»=C:Program FilesCommon FilesRealUpdate_OBrealsched.exe [2009-07-18 185896]
«Skype Recorder»=C:Program FilesSkype RecorderSkype Recorder.exe []
«SoundMan»=C:WINDOWSSOUNDMAN.EXE [2007-04-16 577536]
«IntelliPoint»=C:Program FilesMicrosoft IntelliPointipoint.exe [2009-05-28 1468296]
«ATICCC»=C:Program FilesATI TechnologiesATI.ACEcli.exe [2006-01-02 45056]
«NokiaMServer»=C:Program FilesCommon FilesNokiaMPlatformNokiaMServer /watchfiles startup []

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=C:WINDOWSsystem32ctfmon.exe [2008-05-09 15360]
«MSMSGS»=C:Program FilesMessengermsmsgs.exe /background []
«YandexOnline»=C:Program FilesYandexOnlineonline.exe -AutoStart []
«BitTorrent»=D:Program FilesBitTorrent.exe [2009-11-13 654128]
«MX Skype Recorder»=C:Documents and SettingsKyoLocal SettingsApplication DataMXSkypeRecorderMXSkypeRecorder.exe /autorun []
«Pando Media Booster»=C:Program FilesPando NetworksMedia BoosterPMB.exe [2010-02-01 2937528]
«DAEMON Tools Lite»=C:Program FilesDAEMON Tools LiteDTLite.exe [2010-04-01 357696]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAcrobat Assistant 8.0]
D:Program FilesAdobeAcrobat 8.0AcrobatAcrotray.exe []

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe Reader Speed Launcher]
C:Program FilesAdobeReader 8.0ReaderReader_sl.exe []

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPrintToMon]
C:Program FilesEBKToolEBKTool4PrintToMon.exe [2005-08-15 1167872]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregRun]
C:Documents and SettingsKyoApplication DataAdobeManager.exe []

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupfolderC:^Documents and Settings^All Users^Главное меню^Программы^Автозагрузка^Orbit.lnk]
D:PROGRA~2ORBITD~1orbitdm.exe [2009-05-19 1719496]

C:Documents and SettingsAll UsersГлавное менюПрограммыАвтозагрузка
AudioDeck.lnk — C:Program FilesVIA Technologies, IncVIA Audio Driver Setup ProgramAudioDeckAudioDeck.exe

C:Documents and SettingsKyoГлавное менюПрограммыАвтозагрузка
Adobe Gamma.lnk — C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyAtiExtEvent]
C:WINDOWSsystem32Ati2evxx.dll [2006-03-22 61440]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
UPnPMonitor — {e57ce738-33e8-4c51-8354-bb4de9d215d1} — C:WINDOWSsystem32upnpui.dll [2008-05-09 239616]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalahfekuit.sys]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalWdf01000.sys]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkahfekuit.sys]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkvsmon]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkWdf01000.sys]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=145

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«HonorAutoRunSetting»=1
«NoDriveTypeAutoRun»=28

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesDNAbtdna.exe»=»C:Program FilesDNAbtdna.exe:*:Enabled:DNA»
«C:Program FilesBitTorrentbittorrent.exe»=»C:Program FilesBitTorrentbittorrent.exe:*:Enabled:BitTorrent»
«C:Program FilesOperaopera.exe»=»C:Program FilesOperaopera.exe:*:Enabled:Opera Internet Browser»
«C:Program FilesVideoLANVLCvlc.exe»=»C:Program FilesVideoLANVLCvlc.exe:*:Enabled:VLC media player»
«C:WINDOWSsystem32dplaysvr.exe»=»C:WINDOWSsystem32dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper»
«C:Program FilesHamachihamachi.exe»=»C:Program FilesHamachihamachi.exe:*:Enabled:Hamachi Client»
«C:Program FilesQIP Infiuminfium.exe»=»C:Program FilesQIP Infiuminfium.exe:*:Enabled:QIP Infium»
«C:Program FilesQIPqip.exe»=»C:Program FilesQIPqip.exe:*:Disabled:Quiet Internet Pager»
«D:Program FilesOrbitdownloaderorbitdm.exe»=»D:Program FilesOrbitdownloaderorbitdm.exe:*:Enabled:Orbit»
«D:Program FilesOrbitdownloaderorbitnet.exe»=»D:Program FilesOrbitdownloaderorbitnet.exe:*:Enabled:Orbit»
«D:setupFar20b981.x86.20090606Far.exe»=»D:setupFar20b981.x86.20090606Far.exe:*:Enabled:Far.exe»
«C:WINDOWSsystem32r_server.exe»=»C:WINDOWSsystem32r_server.exe:*:Enabled:r_server»
«D:Program FilesTerraTecNOXON player BasiciRadio.exe»=»D:Program FilesTerraTecNOXON player BasiciRadio.exe:*:Enabled:NOXON player Basic»
«D:Program FilesBitTorrent.exe»=»D:Program FilesBitTorrent.exe:*:Enabled:BitTorrent»
«C:Program FilesSkypePlugin ManagerskypePM.exe»=»C:Program FilesSkypePlugin ManagerskypePM.exe:*:Enabled:Skype Extras Manager»
«C:Program Filesma-config.commaconfservice.exe»=»C:Program Filesma-config.commaconfservice.exe:LocalSubNet:Enabled:maconfservice»
«C:Program FilesInternet Exploreriexplore.exe»=»C:Program FilesInternet Exploreriexplore.exe:*:Disabled:Internet Explorer»
«D:Program Filesopera.exe»=»D:Program Filesopera.exe:*:Enabled:Opera Internet Browser»
«C:WINDOWSsystem32dpvsetup.exe»=»C:WINDOWSsystem32dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test»
«C:WINDOWSsystem32rundll32.exe»=»C:WINDOWSsystem32rundll32.exe:*:Enabled:Запуск библиотеки DLL как приложения»
«C:Program FilesVentSrvventrilo_srv.exe»=»C:Program FilesVentSrvventrilo_srv.exe:*:Enabled:ventrilo_srv»
«C:Program FilesPando NetworksMedia BoosterPMB.exe»=»C:Program FilesPando NetworksMedia BoosterPMB.exe:*:Enabled:Pando Media Booster»
«D:Program FilesFar20b981.x86.20090606Far.exe»=»D:Program FilesFar20b981.x86.20090606Far.exe:*:Disabled:File and archive manager»
«C:Program FilesSkypePhoneSkype.exe»=»C:Program FilesSkypePhoneSkype.exe:*:Enabled:Skype»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»

======List of files/folders created in the last 1 months======

2010-07-18 12:34:25 —-D—- C:_OTM
2010-07-18 12:13:50 —-A—- C:WINDOWSsystem32klvnqta.exe
2010-07-17 22:34:56 —-A—- C:WINDOWSsystem32xxnruyc.exe
2010-07-17 22:31:41 —-D—- C:Program FilesDAEMON Tools Lite
2010-07-17 22:31:16 —-D—- C:Documents and SettingsKyoApplication DataDAEMON Tools Lite
2010-07-17 22:13:38 —-A—- C:WINDOWSsystem32fjhdyfhsn.bat
2010-07-17 22:13:38 —-A—- C:WINDOWSsystem32ejpdsxt.exe
2010-07-17 22:13:33 —-A—- C:WINDOWSsystem32111e48e0.exe
2010-07-17 18:28:47 —-A—- C:mbam-error.txt
2010-07-17 16:33:41 —-D—- C:rsit
2010-07-17 15:14:36 —-D—- C:Program FilesCommon Fileswm
2010-07-14 14:28:37 —-HDC—- C:WINDOWS$NtUninstallKB2229593$
2010-07-13 13:35:41 —-A—- C:WINDOWSsystem32unicows.dll
2010-07-10 14:09:43 —-HDC—- C:WINDOWS$NtUninstallXPSEPSCLP$
2010-07-08 01:12:09 —-A—- C:WINDOWSsystem32driversoreans32.sys
2010-07-01 00:46:31 —-D—- C:Documents and SettingsKyoApplication DataSkype
2010-07-01 00:44:59 —-D—- C:Program FilesCommon FilesSkype
2010-07-01 00:44:48 —-RD—- C:Program FilesSkype
2010-06-27 18:05:00 —-D—- C:Documents and SettingsKyoApplication DataInstallShield
2010-06-26 14:11:47 —-D—- C:Documents and SettingsKyoApplication DataSecondLife
2010-06-25 21:45:13 —-A—- C:WINDOWSsystem32XAudio2_7.dll
2010-06-25 21:45:13 —-A—- C:WINDOWSsystem32XAPOFX1_5.dll
2010-06-25 21:45:13 —-A—- C:WINDOWSsystem32xactengine3_7.dll
2010-06-25 21:45:13 —-A—- C:WINDOWSsystem32D3DCompiler_43.dll
2010-06-25 21:45:12 —-A—- C:WINDOWSsystem32d3dx11_43.dll
2010-06-25 21:45:12 —-A—- C:WINDOWSsystem32d3dcsx_43.dll
2010-06-25 21:45:11 —-A—- C:WINDOWSsystem32D3DX9_43.dll
2010-06-25 21:45:11 —-A—- C:WINDOWSsystem32d3dx10_43.dll
2010-06-25 21:45:10 —-A—- C:WINDOWSsystem32XAudio2_6.dll
2010-06-25 21:45:10 —-A—- C:WINDOWSsystem32XAPOFX1_4.dll
2010-06-25 21:45:10 —-A—- C:WINDOWSsystem32xactengine3_6.dll
2010-06-25 21:45:10 —-A—- C:WINDOWSsystem32X3DAudio1_7.dll
2010-06-25 21:45:09 —-A—- C:WINDOWSsystem32XAudio2_5.dll
2010-06-25 21:45:09 —-A—- C:WINDOWSsystem32xactengine3_5.dll
2010-06-25 21:45:09 —-A—- C:WINDOWSsystem32D3DCompiler_42.dll
2010-06-25 21:45:08 —-A—- C:WINDOWSsystem32d3dcsx_42.dll
2010-06-25 21:45:07 —-A—- C:WINDOWSsystem32d3dx11_42.dll
2010-06-25 21:45:07 —-A—- C:WINDOWSsystem32d3dx10_42.dll
2010-06-25 21:45:06 —-A—- C:WINDOWSsystem32D3DX9_42.dll
2010-06-25 21:45:06 —-A—- C:WINDOWSsystem32D3DX9_41.dll
2010-06-25 21:45:06 —-A—- C:WINDOWSsystem32d3dx10_41.dll
2010-06-25 21:45:06 —-A—- C:WINDOWSsystem32D3DCompiler_41.dll
2010-06-25 21:45:04 —-A—- C:WINDOWSsystem32XAudio2_4.dll
2010-06-25 21:45:04 —-A—- C:WINDOWSsystem32XAPOFX1_3.dll
2010-06-25 21:45:03 —-A—- C:WINDOWSsystem32xactengine3_4.dll
2010-06-25 21:45:03 —-A—- C:WINDOWSsystem32X3DAudio1_6.dll
2010-06-25 21:45:03 —-A—- C:WINDOWSsystem32d3dx10_40.dll
2010-06-25 21:45:03 —-A—- C:WINDOWSsystem32D3DCompiler_40.dll
2010-06-25 21:45:02 —-A—- C:WINDOWSsystem32D3DX9_40.dll
2010-06-25 21:45:01 —-A—- C:WINDOWSsystem32XAudio2_3.dll
2010-06-25 21:45:01 —-A—- C:WINDOWSsystem32XAPOFX1_2.dll
2010-06-25 21:45:01 —-A—- C:WINDOWSsystem32xactengine3_3.dll
2010-06-25 21:45:01 —-A—- C:WINDOWSsystem32X3DAudio1_5.dll
2010-06-25 21:45:00 —-A—- C:WINDOWSsystem32XAudio2_2.dll
2010-06-25 21:45:00 —-A—- C:WINDOWSsystem32XAPOFX1_1.dll
2010-06-25 21:45:00 —-A—- C:WINDOWSsystem32xactengine3_2.dll
2010-06-25 21:45:00 —-A—- C:WINDOWSsystem32d3dx10_39.dll
2010-06-25 21:45:00 —-A—- C:WINDOWSsystem32D3DCompiler_39.dll
2010-06-25 21:44:59 —-A—- C:WINDOWSsystem32D3DX9_39.dll
2010-06-25 21:44:57 —-A—- C:WINDOWSsystem32XAudio2_1.dll
2010-06-25 21:44:57 —-A—- C:WINDOWSsystem32XAPOFX1_0.dll
2010-06-25 21:44:56 —-A—- C:WINDOWSsystem32xactengine3_1.dll
2010-06-25 21:44:55 —-A—- C:WINDOWSsystem32X3DAudio1_4.dll
2010-06-25 21:44:54 —-A—- C:WINDOWSsystem32d3dx10_38.dll
2010-06-25 21:44:54 —-A—- C:WINDOWSsystem32D3DCompiler_38.dll
2010-06-25 21:44:49 —-A—- C:WINDOWSsystem32D3DX9_38.dll
2010-06-25 21:44:21 —-A—- C:WINDOWSsystem32d3dx9_29.dll
2010-06-25 21:11:41 —-D—- C:WINDOWSLogs

======List of files/folders modified in the last 1 months======

2010-07-18 13:08:39 —-D—- C:Program FilesTrend Micro
2010-07-18 12:54:47 —-D—- C:Documents and SettingsKyoApplication DataBitTorrent
2010-07-18 12:53:43 —-AD—- C:WINDOWSTemp
2010-07-18 12:44:59 —-D—- C:WINDOWSsystem32
2010-07-18 12:44:59 —-D—- C:WINDOWS
2010-07-18 12:34:28 —-D—- C:Program FilesCommon Files
2010-07-18 02:27:40 —-A—- C:WINDOWSSchedLgU.Txt
2010-07-18 01:54:49 —-D—- C:Documents and SettingsKyoApplication Datavlc
2010-07-17 22:35:26 —-HD—- C:WINDOWSinf
2010-07-17 22:35:19 —-D—- C:WINDOWSsystem32CatRoot2
2010-07-17 22:31:41 —-RD—- C:Program Files
2010-07-17 22:31:25 —-D—- C:Documents and SettingsAll UsersApplication DataDAEMON Tools Lite
2010-07-17 22:14:15 —-D—- C:WINDOWSPrefetch
2010-07-17 22:11:40 —-D—- C:WINDOWSsystem32drivers
2010-07-17 21:41:45 —-SHD—- C:WINDOWSInstaller
2010-07-17 21:40:19 —-SHD—- C:Config.Msi
2010-07-17 21:40:18 —-D—- C:Program FilesAdobe
2010-07-17 21:39:47 —-D—- C:Program FilesCommon FilesAdobe
2010-07-17 21:39:07 —-D—- C:Documents and SettingsAll UsersApplication DataAdobe
2010-07-17 18:28:42 —-D—- C:Program FilesMalwarebytes’ Anti-Malware
2010-07-17 15:51:36 —-SHD—- C:System Volume Information
2010-07-17 15:51:36 —-D—- C:WINDOWSsystem32Restore
2010-07-14 14:28:39 —-RSHDC—- C:WINDOWSsystem32dllcache
2010-07-14 14:28:15 —-HD—- C:WINDOWS$hf_mig$
2010-07-13 15:32:46 —-D—- C:Program FilesApollo
2010-07-12 21:53:54 —-D—- C:WINDOWSMinidump
2010-07-10 14:19:22 —-D—- C:WINDOWSMicrosoft.NET
2010-07-10 14:10:46 —-A—- C:WINDOWSimsins.BAK
2010-07-10 14:09:35 —-RSD—- C:WINDOWSassembly
2010-07-10 14:09:23 —-D—- C:WINDOWSsystem32ru-ru
2010-07-10 14:09:22 —-D—- C:WINDOWSsystem32XPSViewer
2010-07-10 14:08:58 —-D—- C:WINDOWSsystem32mui
2010-07-09 22:28:22 —-HD—- C:Program FilesInstallShield Installation Information
2010-07-09 20:59:08 —-RSD—- C:WINDOWSFonts
2010-07-06 22:14:45 —-D—- C:Documents and SettingsKyoApplication DataOpenOffice.org2
2010-07-03 18:32:43 —-D—- C:Documents and SettingsKyoApplication Datadvdcss
2010-07-02 23:39:05 —-A—- C:WINDOWSsystem32MRT.exe
2010-07-01 00:47:29 —-D—- C:Documents and SettingsKyoApplication DataskypePM
2010-07-01 00:44:45 —-D—- C:Documents and SettingsAll UsersApplication DataSkype
2010-06-27 18:24:46 —-D—- C:WINDOWSsystem32DirectX
2010-06-25 21:37:22 —-D—- C:WINDOWSWinSxS
2010-06-25 03:14:10 —-A—- C:WINDOWSsystem32PerfStringBackup.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 sptd;sptd; C:WINDOWSSystem32Driverssptd.sys [2010-07-17 691696]
R0 uagp35;Microsoft AGPv3.5 фильтр; C:WINDOWSsystem32DRIVERSuagp35.sys [2008-04-14 44672]
R0 videX32;videX32; C:WINDOWSsystem32DRIVERSvideX32.sys [2009-05-05 13976]
R0 xfilt;VIA SATA IDE Hot-plug Driver; C:WINDOWSsystem32DRIVERSxfilt.sys [2009-05-05 22168]
R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2008-05-09 40704]
R1 oreans32;oreans32; ??C:WINDOWSsystem32driversoreans32.sys []
R1 uzm5nju3;AVZ-RK Kernel Driver; ??C:WINDOWSsystem32Driversuzm5nju3.sys []
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:WINDOWSsystem32driversALCXWDM.SYS [2008-09-24 4122368]
R3 ati2mtag;ati2mtag; C:WINDOWSsystem32DRIVERSati2mtag.sys [2006-03-22 1522688]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service; C:WINDOWSsystem32DRIVERSfetnd5bv.sys [2009-06-16 46592]
R3 hidusb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2008-05-09 10368]
R3 mouhid;Драйвер мыши HID; C:WINDOWSsystem32DRIVERSmouhid.sys [2001-10-19 12160]
R3 Point32;Microsoft IntelliPoint Filter Driver; C:WINDOWSsystem32DRIVERSpoint32.sys [2009-05-28 27792]
R3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver; C:WINDOWSsystem32DRIVERSRtnicxp.sys [2009-03-25 130432]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2008-05-09 20608]
R3 vulfnths;VIA USB Host Controller Lower Filter; C:WINDOWSSystem32Driversvulfnth.sys [2005-01-05 6912]
R3 vulfntrs;VIA USB Roothub Lower Filter; C:WINDOWSSystem32Driversvulfntr.sys [2005-06-06 11264]
S1 kbdhid;Драйвер клавиатуры HID; C:WINDOWSsystem32DRIVERSkbdhid.sys [2008-05-09 14720]
S3 a3ob3iuj;a3ob3iuj; C:WINDOWSsystem32driversa3ob3iuj.sys []
S3 ae7p3vwb;ae7p3vwb; C:WINDOWSsystem32driversae7p3vwb.sys []
S3 ariebk;ariebk; C:WINDOWSSystem32Driversariebk.sys [2005-07-11 16384]
S3 Bridge;MAC-мост; C:WINDOWSsystem32DRIVERSbridge.sys [2008-05-09 71552]
S3 BridgeMP;Минипорт MAC-моста; C:WINDOWSsystem32DRIVERSbridge.sys [2008-05-09 71552]
S3 CCDECODE;Closed Caption декодер; C:WINDOWSsystem32DRIVERSCCDECODE.sys [2008-04-14 17024]
S3 driverhardwarev2;driverhardwarev2; ??C:Program Filesma-config.comDriversdriverhardwarev2.sys []
S3 dump_wmimmc;dump_wmimmc; ??D:GamesGameGuarddump_wmimmc.sys []
S3 EagleNT;EagleNT; ??C:WINDOWSsystem32driversEagleNT.sys []
S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet адаптер, драйвер для NT; C:WINDOWSsystem32DRIVERSfetnd5.sys [2001-08-18 27165]
S3 GarenaPEngine;GarenaPEngine; ??C:DOCUME~1KyoLOCALS~1TempBTV25.tmp []
S3 hamachi;Hamachi Network Interface; C:WINDOWSsystem32DRIVERShamachi.sys [2009-09-23 26176]
S3 klim5;Kaspersky Anti-Virus NDIS Filter; C:WINDOWSsystem32DRIVERSklim5.sys []
S3 M1000Srv;M5603C USB2.0 Camera Driver; C:WINDOWSSystem32DriversM1000KNT.sys [2005-07-01 276930]
S3 mirrorv3;mirrorv3; C:WINDOWSsystem32DRIVERSrminiv3.sys [2006-11-01 3328]
S3 MSTEE;Преобразователь потоков Tee/Sink-to-Sink Microsoft; C:WINDOWSsystem32driversMSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI кодек; C:WINDOWSsystem32DRIVERSNABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft видео или ТВ подключение; C:WINDOWSsystem32DRIVERSNdisIP.sys [2008-04-14 10880]
S3 nmwcd;Nokia USB Phone Parent; C:WINDOWSsystem32driversccdcmb.sys [2009-10-06 17664]
S3 nmwcdc;Nokia USB Generic; C:WINDOWSsystem32driversccdcmbo.sys [2009-10-06 22016]
S3 npkcrypt;npkcrypt; ??D:GamesLineage2systemnpkcrypt.sys []
S3 NPPTNT2;NPPTNT2; ??C:WINDOWSsystem32npptNT2.sys []
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:WINDOWSsystem32DRIVERSpccsmcfd.sys [2008-08-26 18816]
S3 RivaTuner32;RivaTuner32; ??C:Program FilesRivaTuner v2.22RivaTuner32.sys []
S3 rtl8139;Compex RE100ATX PCI(winxp) Fast Ethernet Adapter NT Driver; C:WINDOWSsystem32DRIVERSRE100ND5.sys [2002-08-29 45696]
S3 SLIP;BDA Slip De-Framer; C:WINDOWSsystem32DRIVERSSLIP.sys [2008-04-14 11136]
S3 StarOpen;StarOpen; C:WINDOWSsystem32driversStarOpen.sys [2009-09-28 7168]
S3 streamip;BDA IPSink; C:WINDOWSsystem32DRIVERSStreamIP.sys [2008-04-14 15232]
S3 TVICHW32;TVICHW32; ??C:WINDOWSsystem32DRIVERSTVICHW32.SYS []
S3 upperdev;upperdev; C:WINDOWSsystem32DRIVERSusbser_lowerflt.sys [2009-10-06 7936]
S3 usbscan;Драйвер USB-сканера; C:WINDOWSsystem32DRIVERSusbscan.sys [2008-04-14 15104]
S3 usbser;USB Modem Driver; C:WINDOWSsystem32driversusbser.sys [2008-04-14 26112]
S3 UsbserFilt;UsbserFilt; C:WINDOWSsystem32DRIVERSusbser_lowerfltj.sys [2009-10-06 7936]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2008-04-14 26368]
S3 viagfx;viagfx; C:WINDOWSsystem32DRIVERSvtmini.sys [2005-12-27 247040]
S3 VIAudio;VIA AC’97 Audio Controller (WDM); C:WINDOWSsystem32driversviaudios.sys [2003-06-16 369920]
S3 Vsp;Vsp; ??C:WINDOWSsystem32driversVsp.sys []
S3 Wdf01000;Wdf01000; C:WINDOWSsystem32DRIVERSWdf01000.sys [2008-03-27 503008]
S3 WSTCODEC;World Standard Teletext кодек; C:WINDOWSsystem32DRIVERSWSTCODEC.SYS [2008-04-14 19200]
S3 WudfPf;Windows Driver Foundation — User-mode Driver Framework Platform Driver; C:WINDOWSsystem32DRIVERSWudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:WINDOWSsystem32Ati2evxx.exe [2006-03-22 405504]
R2 JavaQuickStarterService;Java Quick Starter; C:Program FilesJavajre6binjqs.exe [2009-10-11 153376]
R2 NMSAccessU;NMSAccessU; C:Program FilesCDBurnerXPNMSAccessU.exe [2009-09-06 71096]
S2 ATI Smart;ATI Smart; C:WINDOWSsystem32ati2sgag.exe [2006-05-03 520192]
S2 Ventrilo;Ventrilo; C:Program FilesVentSrvventrilo_svc.exe []
S3 Adobe LM Service;Adobe LM Service; C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe [2009-01-22 72704]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:WINDOWSMicrosoft.NETFrameworkv3.0WPFPresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication Foundationinfocard.exe [2008-07-29 881664]
S3 maconfservice;Ma-Config Service; C:Program Filesma-config.commaconfservice.exe [2009-09-23 238960]
S3 npggsvc;nProtect GameGuard Service; C:WINDOWSsystem32GameMon.des [2010-01-13 3477452]
S3 ServiceLayer;ServiceLayer; C:Program FilesPC Connectivity SolutionServiceLayer.exe [2009-10-27 657408]
S3 usprserv;User Privilege Service; C:WINDOWSSystem32svchost.exe [2008-05-09 14336]
S3 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2008-05-09 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication FoundationSMSvcHost.exe [2008-07-29 132096]

EOF
18 июля, 2010 в 10:03 дп #30063
Helper
Participant
- Темы:19
- Сообщений:712
После создания лога MBAM сайты должны открываться, однако вирусы еще есть.Проверьте эти файлы(которые будут) на http://www.virustotal.com
```
C:WINDOWSsystem32driversVsp.sys

C:WINDOWSsystem32driversoreans32.sys

C:WINDOWSsystem32DRIVERSNABTSFEC.sys

C:WINDOWSSystem32Driversariebk.sys

C:WINDOWSsystem32DRIVERSuagp35.sys

C:WINDOWSsystem32DRIVERSusbser_lowerflt.sys
```
Выложите ссылки на результаты.
Запустите HijackThis еще раз , для этого кликните Пуск, Выполнить, введите
```
C:Program Filestrend microKyo.exe
```
и нажмите Enter.
Откроется главное меню программы HijackThis.
Кликните по кнопке Do a system scan only.
Далее отметьте галочкой (слева) следующие строки, если они присутствуют:
```
F2 - REG:system.ini: UserInit=C:WINDOWSSYSTEM32Userinit.exe,C:WINDOWSsystem32392cd3e5.exe,C:WINDOWSsystem32hwpscq.exe,
```
Закройте все запущенные программы (включая InternetExplorer) и окна Windows.
Кликните по кнопке Fix и подтвердите свои действия выбрав YES.
Запустите OTM еще раз(в ОС Windows Vista необходимо запускать через правую кн. мыши от имени администратора)
временно выключите антивирус, firewall и другое защитное программное обеспечение. Выделите и скопируйте текст ниже (Ctrl+C)
```
:Processes

explorer.exe



:Services



:Files

C:WINDOWSsystem32klvnqta.exe

C:WINDOWSsystem32xxnruyc.exe

C:WINDOWSsystem32fjhdyfhsn.bat

C:WINDOWSsystem32ejpdsxt.exe

C:WINDOWSsystem32111e48e0.exe



:Reg



:Commands

[purity]

[emptytemp]

[start explorer]

[Reboot]
```
В OTM под панелью «Paste Instructions for Items to be Moved» (под желтой панелью) вставьте скопированный текст и нажмите кнопку «MoveIt!».

Компьютер перезагрузится.
Повторите логи RSIT.+
запустите в MBAM полное сканирование, найденное удалите(если что будет) и лог предоставьте.
18 июля, 2010 в 10:38 дп #30064
bakemono
Participant
- Темы:1
- Сообщений:8
Ура, сайты теперь открываются, вот результаты проверки http://www.virustotal.com/:

http://www.virustotal.com/ru/analisis/db7e6834e4876d9d5238b6f7b4f2b08777fdf2561ea8db017a78e1395c50ea96-1277771946
http://www.virustotal.com/ru/analisis/d786de9fb254dcec3d131cbeae13e4020d9e353835ad2e4bef9580b1d638b4ad-1279110163
http://www.virustotal.com/ru/analisis/c16a554b6e1a7f5f98c94dfa88163e0f7426506bf2f51fd351b1a05fc0db3bc5-1277414561
http://www.virustotal.com/ru/analisis/51d57ad6be18cb5dfb209d9f226fbdf891c51b757a93b86f0c9b4221e596860d-1279448682
http://www.virustotal.com/ru/analisis/798328c8c06eee7b0852e6d2b16c3af24d529737eca2e9725415261a5736d051-1278411250
http://www.virustotal.com/ru/analisis/fa5d93ac01f7b14807c92c2bb082569ae8f495759d8d46c7453e75a82164ac16-1262984283

лог RSIT:

Logfile of random’s system information tool 1.08 (written by random/random)
Run by Kyo at 2010-07-18 14:33:04
Microsoft Windows XP Professional Service Pack 3
System drive C: has 3 GB (24%) free of 12 GB
Total RAM: 510 MB (27% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:33:10, on 18.07.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17055)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesJavajre6binjqs.exe
C:Program FilesCDBurnerXPNMSAccessU.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32VTTimer.exe
C:Program FilesCommon FilesRealUpdate_OBrealsched.exe
C:WINDOWSSOUNDMAN.EXE
C:Program FilesMicrosoft IntelliPointipoint.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:Program FilesCommon FilesNokiaMPlatformNokiaMServer.exe
C:WINDOWSsystem32ctfmon.exe
C:WINDOWSWebCamM1000M1000Mnt.exe
C:Program FilesPando NetworksMedia BoosterPMB.exe
C:Program FilesVIA Technologies, IncVIA Audio Driver Setup ProgramAudioDeckAudioDeck.exe
C:Program FilesFantastic Flame ScreensaverFantasticFlameAgent.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
D:Program FilesSafari.exe
C:Documents and SettingsKyoРабочий столRSIT.exe
C:Program Filestrend microKyo.exe

R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = about:blank
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = about:blank
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: QIPBHO Class — {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} — C:Documents and SettingsUlitkaApplication DataMicrosoftInternet Explorerqipsearchbar.dll (file missing)
R3 — URLSearchHook: QIPBHO Class — {95289393-33EA-4F8D-B952-483415B9C955} — C:Documents and SettingsUlitkaApplication DataMicrosoftInternet Explorerqipsearchbar.dll (file missing)
O2 — BHO: btorbit.com — {000123B4-9B42-4900-B3F7-F4B073EFC214} — D:Program FilesOrbitdownloaderorbitcth.dll
O2 — BHO: SkypeIEPluginBHO — {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} — C:Program FilesSkypeToolbarsInternet Explorerskypeieplugin.dll
O2 — BHO: JQSIEStartDetectorImpl — {E7E6F031-17CE-4C07-BC86-EABFE594F69C} — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll
O3 — Toolbar: EBKTool — {4189165B-690F-4D24-A2E2-69F31E6EDA7C} — C:PROGRA~1EBKToolEBKTool4IEBAND~1.DLL
O3 — Toolbar: Grab Pro — {C55BBCD6-41AD-48AD-9953-3609C48EACC7} — D:Program FilesOrbitdownloaderGrabPro.dll
O4 — HKLM..Run: [VTTimer] VTTimer.exe
O4 — HKLM..Run: [VTTrayp] VTtrayp.exe
O4 — HKLM..Run: [M1000Mnt] M1000Rmv.exe /StartStillMnt
O4 — HKLM..Run: [TkBellExe] «C:Program FilesCommon FilesRealUpdate_OBrealsched.exe» -osboot
O4 — HKLM..Run: [Skype Recorder] «C:Program FilesSkype RecorderSkype Recorder.exe»
O4 — HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 — HKLM..Run: [IntelliPoint] «C:Program FilesMicrosoft IntelliPointipoint.exe»
O4 — HKLM..Run: [ATICCC] «C:Program FilesATI TechnologiesATI.ACEcli.exe» runtime -Delay
O4 — HKLM..Run: [NokiaMServer] C:Program FilesCommon FilesNokiaMPlatformNokiaMServer /watchfiles startup
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [MSMSGS] «C:Program FilesMessengermsmsgs.exe» /background
O4 — HKCU..Run: [YandexOnline] «C:Program FilesYandexOnlineonline.exe» -AutoStart
O4 — HKCU..Run: [BitTorrent] «D:Program FilesBitTorrent.exe»
O4 — HKCU..Run: [MX Skype Recorder] «C:Documents and SettingsKyoLocal SettingsApplication DataMXSkypeRecorderMXSkypeRecorder.exe» /autorun
O4 — HKCU..Run: [Pando Media Booster] C:Program FilesPando NetworksMedia BoosterPMB.exe
O4 — HKCU..Run: [DAEMON Tools Lite] «C:Program FilesDAEMON Tools LiteDTLite.exe» -autorun
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe (User ‘Default user’)
O4 — Startup: Adobe Gamma.lnk = C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe
O4 — Global Startup: AudioDeck.lnk = C:Program FilesVIA Technologies, IncVIA Audio Driver Setup ProgramAudioDeckAudioDeck.exe
O4 — Global Startup: Fantastic Flame Agent.lnk = C:Program FilesFantastic Flame ScreensaverFantasticFlameAgent.exe
O8 — Extra context menu item: &Download by Orbit — res://D:Program FilesOrbitdownloaderorbitmxt.dll/201
O8 — Extra context menu item: &Grab video by Orbit — res://D:Program FilesOrbitdownloaderorbitmxt.dll/204
O8 — Extra context menu item: Append to existing PDF — res://D:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
O8 — Extra context menu item: Convert link target to Adobe PDF — res://D:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
O8 — Extra context menu item: Convert link target to existing PDF — res://D:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
O8 — Extra context menu item: Convert selected links to Adobe PDF — res://D:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 — Extra context menu item: Convert selected links to existing PDF — res://D:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 — Extra context menu item: Convert selection to Adobe PDF — res://D:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
O8 — Extra context menu item: Convert selection to existing PDF — res://D:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
O8 — Extra context menu item: Convert to Adobe PDF — res://D:Program FilesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
O8 — Extra context menu item: Do&wnload selected by Orbit — res://D:Program FilesOrbitdownloaderorbitmxt.dll/203
O8 — Extra context menu item: Down&load all by Orbit — res://D:Program FilesOrbitdownloaderorbitmxt.dll/202
O9 — Extra button: Skype add-on for Internet Explorer — {898EA8C8-E7FF-479B-8935-AEC46303B9E5} — C:Program FilesSkypeToolbarsInternet Explorerskypeieplugin.dll
O9 — Extra ‘Tools’ menuitem: Skype add-on for Internet Explorer — {898EA8C8-E7FF-479B-8935-AEC46303B9E5} — C:Program FilesSkypeToolbarsInternet Explorerskypeieplugin.dll
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O16 — DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) — http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 — DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) — http://liveupdate.msi.com.tw/autobios/LOnline/install.cab
O18 — Protocol: skype-ie-addon-data — {91774881-D725-4E58-B298-07617B9B86A8} — C:Program FilesSkypeToolbarsInternet Explorerskypeieplugin.dll
O18 — Protocol: skype4com — {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} — C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O22 — SharedTaskScheduler: Предзагрузчик Browseui — {438755C2-A8BA-11D1-B96B-00A0C90312E1} — C:WINDOWSsystem32browseui.dll
O22 — SharedTaskScheduler: Демон кэша категорий компонентов — {8C7461EF-2B13-11d2-BE35-3078302C2030} — C:WINDOWSsystem32browseui.dll
O23 — Service: Adobe LM Service — Adobe Systems — C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe
O23 — Service: Ati HotKey Poller — ATI Technologies Inc. — C:WINDOWSsystem32Ati2evxx.exe
O23 — Service: ATI Smart — Unknown owner — C:WINDOWSsystem32ati2sgag.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: Java Quick Starter (JavaQuickStarterService) — Sun Microsystems, Inc. — C:Program FilesJavajre6binjqs.exe
O23 — Service: Ma-Config Service (maconfservice) — Unknown owner — C:Program Filesma-config.commaconfservice.exe
O23 — Service: NetMeeting Remote Desktop Sharing (mnmsrvc) — Корпорация Майкрософт — C:WINDOWSsystem32mnmsrvc.exe
O23 — Service: NMSAccessU — Unknown owner — C:Program FilesCDBurnerXPNMSAccessU.exe
O23 — Service: nProtect GameGuard Service (npggsvc) — Unknown owner — C:WINDOWSsystem32GameMon.des.exe (file missing)
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: ServiceLayer — Nokia — C:Program FilesPC Connectivity SolutionServiceLayer.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Ventrilo — Unknown owner — C:Program FilesVentSrvventrilo_svc.exe (file missing)
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe

—
End of file — 10132 bytes

======Scheduled tasks folder======

C:WINDOWStasksAppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{000123B4-9B42-4900-B3F7-F4B073EFC214}]
Octh Class — D:Program FilesOrbitdownloaderorbitcth.dll [2009-05-19 171208]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype add-on for Internet Explorer — C:Program FilesSkypeToolbarsInternet Explorerskypeieplugin.dll [2010-02-08 804136]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll [2009-10-11 73728]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{4189165B-690F-4D24-A2E2-69F31E6EDA7C} — EBKTool — C:PROGRA~1EBKToolEBKTool4IEBAND~1.DLL [2005-08-23 1934848]
{C55BBCD6-41AD-48AD-9953-3609C48EACC7} — Grab Pro — D:Program FilesOrbitdownloaderGrabPro.dll [2009-05-19 670840]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«VTTimer»=C:WINDOWSsystem32VTTimer.exe [2005-03-08 53248]
«VTTrayp»=C:WINDOWSsystem32VTtrayp.exe [2005-11-01 163840]
«M1000Mnt»=M1000Rmv.exe /StartStillMnt []
«TkBellExe»=C:Program FilesCommon FilesRealUpdate_OBrealsched.exe [2009-07-18 185896]
«Skype Recorder»=C:Program FilesSkype RecorderSkype Recorder.exe []
«SoundMan»=C:WINDOWSSOUNDMAN.EXE [2007-04-16 577536]
«IntelliPoint»=C:Program FilesMicrosoft IntelliPointipoint.exe [2009-05-28 1468296]
«ATICCC»=C:Program FilesATI TechnologiesATI.ACEcli.exe [2006-01-02 45056]
«NokiaMServer»=C:Program FilesCommon FilesNokiaMPlatformNokiaMServer /watchfiles startup []

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=C:WINDOWSsystem32ctfmon.exe [2008-05-09 15360]
«MSMSGS»=C:Program FilesMessengermsmsgs.exe /background []
«YandexOnline»=C:Program FilesYandexOnlineonline.exe -AutoStart []
«BitTorrent»=D:Program FilesBitTorrent.exe [2009-11-13 654128]
«MX Skype Recorder»=C:Documents and SettingsKyoLocal SettingsApplication DataMXSkypeRecorderMXSkypeRecorder.exe /autorun []
«Pando Media Booster»=C:Program FilesPando NetworksMedia BoosterPMB.exe [2010-02-01 2937528]
«DAEMON Tools Lite»=C:Program FilesDAEMON Tools LiteDTLite.exe [2010-04-01 357696]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAcrobat Assistant 8.0]
D:Program FilesAdobeAcrobat 8.0AcrobatAcrotray.exe []

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe Reader Speed Launcher]
C:Program FilesAdobeReader 8.0ReaderReader_sl.exe []

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPrintToMon]
C:Program FilesEBKToolEBKTool4PrintToMon.exe [2005-08-15 1167872]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregRun]
C:Documents and SettingsKyoApplication DataAdobeManager.exe []

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupfolderC:^Documents and Settings^All Users^Главное меню^Программы^Автозагрузка^Orbit.lnk]
D:PROGRA~2ORBITD~1orbitdm.exe [2009-05-19 1719496]

C:Documents and SettingsAll UsersГлавное менюПрограммыАвтозагрузка
AudioDeck.lnk — C:Program FilesVIA Technologies, IncVIA Audio Driver Setup ProgramAudioDeckAudioDeck.exe
Fantastic Flame Agent.lnk — C:Program FilesFantastic Flame ScreensaverFantasticFlameAgent.exe

C:Documents and SettingsKyoГлавное менюПрограммыАвтозагрузка
Adobe Gamma.lnk — C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyAtiExtEvent]
C:WINDOWSsystem32Ati2evxx.dll [2006-03-22 61440]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
UPnPMonitor — {e57ce738-33e8-4c51-8354-bb4de9d215d1} — C:WINDOWSsystem32upnpui.dll [2008-05-09 239616]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalahfekuit.sys]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalWdf01000.sys]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkahfekuit.sys]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkvsmon]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkWdf01000.sys]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=145

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«HonorAutoRunSetting»=1
«NoDriveTypeAutoRun»=28

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesDNAbtdna.exe»=»C:Program FilesDNAbtdna.exe:*:Enabled:DNA»
«C:Program FilesBitTorrentbittorrent.exe»=»C:Program FilesBitTorrentbittorrent.exe:*:Enabled:BitTorrent»
«C:Program FilesOperaopera.exe»=»C:Program FilesOperaopera.exe:*:Enabled:Opera Internet Browser»
«C:Program FilesVideoLANVLCvlc.exe»=»C:Program FilesVideoLANVLCvlc.exe:*:Enabled:VLC media player»
«C:WINDOWSsystem32dplaysvr.exe»=»C:WINDOWSsystem32dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper»
«C:Program FilesHamachihamachi.exe»=»C:Program FilesHamachihamachi.exe:*:Enabled:Hamachi Client»
«C:Program FilesQIP Infiuminfium.exe»=»C:Program FilesQIP Infiuminfium.exe:*:Enabled:QIP Infium»
«C:Program FilesQIPqip.exe»=»C:Program FilesQIPqip.exe:*:Disabled:Quiet Internet Pager»
«D:Program FilesOrbitdownloaderorbitdm.exe»=»D:Program FilesOrbitdownloaderorbitdm.exe:*:Enabled:Orbit»
«D:Program FilesOrbitdownloaderorbitnet.exe»=»D:Program FilesOrbitdownloaderorbitnet.exe:*:Enabled:Orbit»
«D:setupFar20b981.x86.20090606Far.exe»=»D:setupFar20b981.x86.20090606Far.exe:*:Enabled:Far.exe»
«C:WINDOWSsystem32r_server.exe»=»C:WINDOWSsystem32r_server.exe:*:Enabled:r_server»
«D:Program FilesTerraTecNOXON player BasiciRadio.exe»=»D:Program FilesTerraTecNOXON player BasiciRadio.exe:*:Enabled:NOXON player Basic»
«D:Program FilesBitTorrent.exe»=»D:Program FilesBitTorrent.exe:*:Enabled:BitTorrent»
«C:Program FilesSkypePlugin ManagerskypePM.exe»=»C:Program FilesSkypePlugin ManagerskypePM.exe:*:Enabled:Skype Extras Manager»
«C:Program Filesma-config.commaconfservice.exe»=»C:Program Filesma-config.commaconfservice.exe:LocalSubNet:Enabled:maconfservice»
«C:Program FilesInternet Exploreriexplore.exe»=»C:Program FilesInternet Exploreriexplore.exe:*:Disabled:Internet Explorer»
«D:Program Filesopera.exe»=»D:Program Filesopera.exe:*:Enabled:Opera Internet Browser»
«C:WINDOWSsystem32dpvsetup.exe»=»C:WINDOWSsystem32dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test»
«C:WINDOWSsystem32rundll32.exe»=»C:WINDOWSsystem32rundll32.exe:*:Enabled:Запуск библиотеки DLL как приложения»
«C:Program FilesVentSrvventrilo_srv.exe»=»C:Program FilesVentSrvventrilo_srv.exe:*:Enabled:ventrilo_srv»
«D:Program FilesFar20b981.x86.20090606Far.exe»=»D:Program FilesFar20b981.x86.20090606Far.exe:*:Disabled:File and archive manager»
«C:Program FilesSkypePhoneSkype.exe»=»C:Program FilesSkypePhoneSkype.exe:*:Enabled:Skype»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»

======List of files/folders created in the last 1 months======

2010-07-18 12:34:25 —-D—- C:_OTM
2010-07-17 22:31:41 —-D—- C:Program FilesDAEMON Tools Lite
2010-07-17 22:31:16 —-D—- C:Documents and SettingsKyoApplication DataDAEMON Tools Lite
2010-07-17 18:28:47 —-A—- C:mbam-error.txt
2010-07-17 16:33:41 —-D—- C:rsit
2010-07-17 15:14:36 —-D—- C:Program FilesCommon Fileswm
2010-07-14 14:28:37 —-HDC—- C:WINDOWS$NtUninstallKB2229593$
2010-07-13 13:35:41 —-A—- C:WINDOWSsystem32unicows.dll
2010-07-10 14:09:43 —-HDC—- C:WINDOWS$NtUninstallXPSEPSCLP$
2010-07-08 01:12:09 —-A—- C:WINDOWSsystem32driversoreans32.sys
2010-07-01 00:46:31 —-D—- C:Documents and SettingsKyoApplication DataSkype
2010-07-01 00:44:59 —-D—- C:Program FilesCommon FilesSkype
2010-07-01 00:44:48 —-RD—- C:Program FilesSkype
2010-06-27 18:05:00 —-D—- C:Documents and SettingsKyoApplication DataInstallShield
2010-06-26 14:11:47 —-D—- C:Documents and SettingsKyoApplication DataSecondLife
2010-06-25 21:45:13 —-A—- C:WINDOWSsystem32XAudio2_7.dll
2010-06-25 21:45:13 —-A—- C:WINDOWSsystem32XAPOFX1_5.dll
2010-06-25 21:45:13 —-A—- C:WINDOWSsystem32xactengine3_7.dll
2010-06-25 21:45:13 —-A—- C:WINDOWSsystem32D3DCompiler_43.dll
2010-06-25 21:45:12 —-A—- C:WINDOWSsystem32d3dx11_43.dll
2010-06-25 21:45:12 —-A—- C:WINDOWSsystem32d3dcsx_43.dll
2010-06-25 21:45:11 —-A—- C:WINDOWSsystem32D3DX9_43.dll
2010-06-25 21:45:11 —-A—- C:WINDOWSsystem32d3dx10_43.dll
2010-06-25 21:45:10 —-A—- C:WINDOWSsystem32XAudio2_6.dll
2010-06-25 21:45:10 —-A—- C:WINDOWSsystem32XAPOFX1_4.dll
2010-06-25 21:45:10 —-A—- C:WINDOWSsystem32xactengine3_6.dll
2010-06-25 21:45:10 —-A—- C:WINDOWSsystem32X3DAudio1_7.dll
2010-06-25 21:45:09 —-A—- C:WINDOWSsystem32XAudio2_5.dll
2010-06-25 21:45:09 —-A—- C:WINDOWSsystem32xactengine3_5.dll
2010-06-25 21:45:09 —-A—- C:WINDOWSsystem32D3DCompiler_42.dll
2010-06-25 21:45:08 —-A—- C:WINDOWSsystem32d3dcsx_42.dll
2010-06-25 21:45:07 —-A—- C:WINDOWSsystem32d3dx11_42.dll
2010-06-25 21:45:07 —-A—- C:WINDOWSsystem32d3dx10_42.dll
2010-06-25 21:45:06 —-A—- C:WINDOWSsystem32D3DX9_42.dll
2010-06-25 21:45:06 —-A—- C:WINDOWSsystem32D3DX9_41.dll
2010-06-25 21:45:06 —-A—- C:WINDOWSsystem32d3dx10_41.dll
2010-06-25 21:45:06 —-A—- C:WINDOWSsystem32D3DCompiler_41.dll
2010-06-25 21:45:04 —-A—- C:WINDOWSsystem32XAudio2_4.dll
2010-06-25 21:45:04 —-A—- C:WINDOWSsystem32XAPOFX1_3.dll
2010-06-25 21:45:03 —-A—- C:WINDOWSsystem32xactengine3_4.dll
2010-06-25 21:45:03 —-A—- C:WINDOWSsystem32X3DAudio1_6.dll
2010-06-25 21:45:03 —-A—- C:WINDOWSsystem32d3dx10_40.dll
2010-06-25 21:45:03 —-A—- C:WINDOWSsystem32D3DCompiler_40.dll
2010-06-25 21:45:02 —-A—- C:WINDOWSsystem32D3DX9_40.dll
2010-06-25 21:45:01 —-A—- C:WINDOWSsystem32XAudio2_3.dll
2010-06-25 21:45:01 —-A—- C:WINDOWSsystem32XAPOFX1_2.dll
2010-06-25 21:45:01 —-A—- C:WINDOWSsystem32xactengine3_3.dll
2010-06-25 21:45:01 —-A—- C:WINDOWSsystem32X3DAudio1_5.dll
2010-06-25 21:45:00 —-A—- C:WINDOWSsystem32XAudio2_2.dll
2010-06-25 21:45:00 —-A—- C:WINDOWSsystem32XAPOFX1_1.dll
2010-06-25 21:45:00 —-A—- C:WINDOWSsystem32xactengine3_2.dll
2010-06-25 21:45:00 —-A—- C:WINDOWSsystem32d3dx10_39.dll
2010-06-25 21:45:00 —-A—- C:WINDOWSsystem32D3DCompiler_39.dll
2010-06-25 21:44:59 —-A—- C:WINDOWSsystem32D3DX9_39.dll
2010-06-25 21:44:57 —-A—- C:WINDOWSsystem32XAudio2_1.dll
2010-06-25 21:44:57 —-A—- C:WINDOWSsystem32XAPOFX1_0.dll
2010-06-25 21:44:56 —-A—- C:WINDOWSsystem32xactengine3_1.dll
2010-06-25 21:44:55 —-A—- C:WINDOWSsystem32X3DAudio1_4.dll
2010-06-25 21:44:54 —-A—- C:WINDOWSsystem32d3dx10_38.dll
2010-06-25 21:44:54 —-A—- C:WINDOWSsystem32D3DCompiler_38.dll
2010-06-25 21:44:49 —-A—- C:WINDOWSsystem32D3DX9_38.dll
2010-06-25 21:44:21 —-A—- C:WINDOWSsystem32d3dx9_29.dll
2010-06-25 21:11:41 —-D—- C:WINDOWSLogs

======List of files/folders modified in the last 1 months======

2010-07-18 14:33:07 —-D—- C:Program FilesTrend Micro
2010-07-18 14:17:34 —-D—- C:Documents and SettingsKyoApplication DataBitTorrent
2010-07-18 14:15:01 —-AD—- C:WINDOWSTemp
2010-07-18 14:13:20 —-D—- C:WINDOWSsystem32
2010-07-18 14:10:02 —-D—- C:WINDOWSsystem32drivers
2010-07-18 14:10:02 —-D—- C:WINDOWSDebug
2010-07-18 14:09:40 —-A—- C:WINDOWSSchedLgU.Txt
2010-07-18 12:44:59 —-D—- C:WINDOWS
2010-07-18 12:34:28 —-D—- C:Program FilesCommon Files
2010-07-18 01:54:49 —-D—- C:Documents and SettingsKyoApplication Datavlc
2010-07-17 22:35:26 —-HD—- C:WINDOWSinf
2010-07-17 22:35:19 —-D—- C:WINDOWSsystem32CatRoot2
2010-07-17 22:31:41 —-RD—- C:Program Files
2010-07-17 22:31:25 —-D—- C:Documents and SettingsAll UsersApplication DataDAEMON Tools Lite
2010-07-17 22:14:15 —-D—- C:WINDOWSPrefetch
2010-07-17 21:41:45 —-SHD—- C:WINDOWSInstaller
2010-07-17 21:40:19 —-SHD—- C:Config.Msi
2010-07-17 21:40:18 —-D—- C:Program FilesAdobe
2010-07-17 21:39:47 —-D—- C:Program FilesCommon FilesAdobe
2010-07-17 21:39:07 —-D—- C:Documents and SettingsAll UsersApplication DataAdobe
2010-07-17 18:28:42 —-D—- C:Program FilesMalwarebytes’ Anti-Malware
2010-07-17 15:51:36 —-SHD—- C:System Volume Information
2010-07-17 15:51:36 —-D—- C:WINDOWSsystem32Restore
2010-07-14 14:28:39 —-RSHDC—- C:WINDOWSsystem32dllcache
2010-07-14 14:28:15 —-HD—- C:WINDOWS$hf_mig$
2010-07-13 15:32:46 —-D—- C:Program FilesApollo
2010-07-12 21:53:54 —-D—- C:WINDOWSMinidump
2010-07-10 14:19:22 —-D—- C:WINDOWSMicrosoft.NET
2010-07-10 14:10:46 —-A—- C:WINDOWSimsins.BAK
2010-07-10 14:09:35 —-RSD—- C:WINDOWSassembly
2010-07-10 14:09:23 —-D—- C:WINDOWSsystem32ru-ru
2010-07-10 14:09:22 —-D—- C:WINDOWSsystem32XPSViewer
2010-07-10 14:08:58 —-D—- C:WINDOWSsystem32mui
2010-07-09 22:28:22 —-HD—- C:Program FilesInstallShield Installation Information
2010-07-09 20:59:08 —-RSD—- C:WINDOWSFonts
2010-07-06 22:14:45 —-D—- C:Documents and SettingsKyoApplication DataOpenOffice.org2
2010-07-03 18:32:43 —-D—- C:Documents and SettingsKyoApplication Datadvdcss
2010-07-02 23:39:05 —-A—- C:WINDOWSsystem32MRT.exe
2010-07-01 00:47:29 —-D—- C:Documents and SettingsKyoApplication DataskypePM
2010-07-01 00:44:45 —-D—- C:Documents and SettingsAll UsersApplication DataSkype
2010-06-27 18:24:46 —-D—- C:WINDOWSsystem32DirectX
2010-06-25 21:37:22 —-D—- C:WINDOWSWinSxS
2010-06-25 03:14:10 —-A—- C:WINDOWSsystem32PerfStringBackup.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 sptd;sptd; C:WINDOWSSystem32Driverssptd.sys [2010-07-17 691696]
R0 uagp35;Microsoft AGPv3.5 фильтр; C:WINDOWSsystem32DRIVERSuagp35.sys [2008-04-14 44672]
R0 videX32;videX32; C:WINDOWSsystem32DRIVERSvideX32.sys [2009-05-05 13976]
R0 xfilt;VIA SATA IDE Hot-plug Driver; C:WINDOWSsystem32DRIVERSxfilt.sys [2009-05-05 22168]
R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2008-05-09 40704]
R1 oreans32;oreans32; ??C:WINDOWSsystem32driversoreans32.sys []
R1 uzm5nju3;AVZ-RK Kernel Driver; ??C:WINDOWSsystem32Driversuzm5nju3.sys []
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:WINDOWSsystem32driversALCXWDM.SYS [2008-09-24 4122368]
R3 ati2mtag;ati2mtag; C:WINDOWSsystem32DRIVERSati2mtag.sys [2006-03-22 1522688]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service; C:WINDOWSsystem32DRIVERSfetnd5bv.sys [2009-06-16 46592]
R3 hidusb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2008-05-09 10368]
R3 mouhid;Драйвер мыши HID; C:WINDOWSsystem32DRIVERSmouhid.sys [2001-10-19 12160]
R3 Point32;Microsoft IntelliPoint Filter Driver; C:WINDOWSsystem32DRIVERSpoint32.sys [2009-05-28 27792]
R3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver; C:WINDOWSsystem32DRIVERSRtnicxp.sys [2009-03-25 130432]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2008-05-09 20608]
R3 vulfnths;VIA USB Host Controller Lower Filter; C:WINDOWSSystem32Driversvulfnth.sys [2005-01-05 6912]
R3 vulfntrs;VIA USB Roothub Lower Filter; C:WINDOWSSystem32Driversvulfntr.sys [2005-06-06 11264]
S1 kbdhid;Драйвер клавиатуры HID; C:WINDOWSsystem32DRIVERSkbdhid.sys [2008-05-09 14720]
S3 ariebk;ariebk; C:WINDOWSSystem32Driversariebk.sys [2005-07-11 16384]
S3 auro28d7;auro28d7; C:WINDOWSsystem32driversauro28d7.sys []
S3 az5xztvk;az5xztvk; C:WINDOWSsystem32driversaz5xztvk.sys []
S3 Bridge;MAC-мост; C:WINDOWSsystem32DRIVERSbridge.sys [2008-05-09 71552]
S3 BridgeMP;Минипорт MAC-моста; C:WINDOWSsystem32DRIVERSbridge.sys [2008-05-09 71552]
S3 CCDECODE;Closed Caption декодер; C:WINDOWSsystem32DRIVERSCCDECODE.sys [2008-04-14 17024]
S3 driverhardwarev2;driverhardwarev2; ??C:Program Filesma-config.comDriversdriverhardwarev2.sys []
S3 dump_wmimmc;dump_wmimmc; ??D:GamesGameGuarddump_wmimmc.sys []
S3 EagleNT;EagleNT; ??C:WINDOWSsystem32driversEagleNT.sys []
S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet адаптер, драйвер для NT; C:WINDOWSsystem32DRIVERSfetnd5.sys [2001-08-18 27165]
S3 GarenaPEngine;GarenaPEngine; ??C:DOCUME~1KyoLOCALS~1TempBTV25.tmp []
S3 hamachi;Hamachi Network Interface; C:WINDOWSsystem32DRIVERShamachi.sys [2009-09-23 26176]
S3 klim5;Kaspersky Anti-Virus NDIS Filter; C:WINDOWSsystem32DRIVERSklim5.sys []
S3 M1000Srv;M5603C USB2.0 Camera Driver; C:WINDOWSSystem32DriversM1000KNT.sys [2005-07-01 276930]
S3 mirrorv3;mirrorv3; C:WINDOWSsystem32DRIVERSrminiv3.sys [2006-11-01 3328]
S3 MSTEE;Преобразователь потоков Tee/Sink-to-Sink Microsoft; C:WINDOWSsystem32driversMSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI кодек; C:WINDOWSsystem32DRIVERSNABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft видео или ТВ подключение; C:WINDOWSsystem32DRIVERSNdisIP.sys [2008-04-14 10880]
S3 nmwcd;Nokia USB Phone Parent; C:WINDOWSsystem32driversccdcmb.sys [2009-10-06 17664]
S3 nmwcdc;Nokia USB Generic; C:WINDOWSsystem32driversccdcmbo.sys [2009-10-06 22016]
S3 npkcrypt;npkcrypt; ??D:GamesLineage2systemnpkcrypt.sys []
S3 NPPTNT2;NPPTNT2; ??C:WINDOWSsystem32npptNT2.sys []
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:WINDOWSsystem32DRIVERSpccsmcfd.sys [2008-08-26 18816]
S3 RivaTuner32;RivaTuner32; ??C:Program FilesRivaTuner v2.22RivaTuner32.sys []
S3 rtl8139;Compex RE100ATX PCI(winxp) Fast Ethernet Adapter NT Driver; C:WINDOWSsystem32DRIVERSRE100ND5.sys [2002-08-29 45696]
S3 SLIP;BDA Slip De-Framer; C:WINDOWSsystem32DRIVERSSLIP.sys [2008-04-14 11136]
S3 StarOpen;StarOpen; C:WINDOWSsystem32driversStarOpen.sys [2009-09-28 7168]
S3 streamip;BDA IPSink; C:WINDOWSsystem32DRIVERSStreamIP.sys [2008-04-14 15232]
S3 TVICHW32;TVICHW32; ??C:WINDOWSsystem32DRIVERSTVICHW32.SYS []
S3 upperdev;upperdev; C:WINDOWSsystem32DRIVERSusbser_lowerflt.sys [2009-10-06 7936]
S3 usbscan;Драйвер USB-сканера; C:WINDOWSsystem32DRIVERSusbscan.sys [2008-04-14 15104]
S3 usbser;USB Modem Driver; C:WINDOWSsystem32driversusbser.sys [2008-04-14 26112]
S3 UsbserFilt;UsbserFilt; C:WINDOWSsystem32DRIVERSusbser_lowerfltj.sys [2009-10-06 7936]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2008-04-14 26368]
S3 viagfx;viagfx; C:WINDOWSsystem32DRIVERSvtmini.sys [2005-12-27 247040]
S3 VIAudio;VIA AC’97 Audio Controller (WDM); C:WINDOWSsystem32driversviaudios.sys [2003-06-16 369920]
S3 Vsp;Vsp; ??C:WINDOWSsystem32driversVsp.sys []
S3 Wdf01000;Wdf01000; C:WINDOWSsystem32DRIVERSWdf01000.sys [2008-03-27 503008]
S3 WSTCODEC;World Standard Teletext кодек; C:WINDOWSsystem32DRIVERSWSTCODEC.SYS [2008-04-14 19200]
S3 WudfPf;Windows Driver Foundation — User-mode Driver Framework Platform Driver; C:WINDOWSsystem32DRIVERSWudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:WINDOWSsystem32Ati2evxx.exe [2006-03-22 405504]
R2 JavaQuickStarterService;Java Quick Starter; C:Program FilesJavajre6binjqs.exe [2009-10-11 153376]
R2 NMSAccessU;NMSAccessU; C:Program FilesCDBurnerXPNMSAccessU.exe [2009-09-06 71096]
S2 ATI Smart;ATI Smart; C:WINDOWSsystem32ati2sgag.exe [2006-05-03 520192]
S2 Ventrilo;Ventrilo; C:Program FilesVentSrvventrilo_svc.exe []
S3 Adobe LM Service;Adobe LM Service; C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe [2009-01-22 72704]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:WINDOWSMicrosoft.NETFrameworkv3.0WPFPresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication Foundationinfocard.exe [2008-07-29 881664]
S3 maconfservice;Ma-Config Service; C:Program Filesma-config.commaconfservice.exe [2009-09-23 238960]
S3 npggsvc;nProtect GameGuard Service; C:WINDOWSsystem32GameMon.des [2010-01-13 3477452]
S3 ServiceLayer;ServiceLayer; C:Program FilesPC Connectivity SolutionServiceLayer.exe [2009-10-27 657408]
S3 usprserv;User Privilege Service; C:WINDOWSSystem32svchost.exe [2008-05-09 14336]
S3 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2008-05-09 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication FoundationSMSvcHost.exe [2008-07-29 132096]

EOF
18 июля, 2010 в 11:01 дп #30065
Helper
Participant
- Темы:19
- Сообщений:712
запустите в MBAM полное сканирование, найденное удалите(если что будет) и лог предоставьте.

Жду этот лог.
18 июля, 2010 в 12:09 пп #30066
bakemono
Participant
- Темы:1
- Сообщений:8
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

18.07.2010 16:07:25
mbam-log-2010-07-18 (16-07-25).txt

Тип сканирования: Полное сканирование (C:|D:|)
Просканированные объекты: 222152
Времени прошло: 1 часов, 9 минут, 30 секунд

Зараженные процессы в памяти: 0
Зараженные модули в памяти: 0
Зараженные ключи в реестре: 0
Зараженные параметры в реестре: 0
Объекты реестра заражены: 0
Зараженные папки: 0
Зараженные файлы: 0

Зараженные процессы в памяти:
(Вредоносных программ не обнаружено)

Зараженные модули в памяти:
(Вредоносных программ не обнаружено)

Зараженные ключи в реестре:
(Вредоносных программ не обнаружено)

Зараженные параметры в реестре:
(Вредоносных программ не обнаружено)

Объекты реестра заражены:
(Вредоносных программ не обнаружено)

Зараженные папки:
(Вредоносных программ не обнаружено)

Зараженные файлы:
(Вредоносных программ не обнаружено)
18 июля, 2010 в 12:11 пп #30067
Helper
Participant
- Темы:19
- Сообщений:712
Что с проблемами? 🙂
18 июля, 2010 в 12:22 пп #30068
bakemono
Participant
- Темы:1
- Сообщений:8
Да в целом все нормально, но при проверке программой AVZ мне выдает вот что: 😯
1.5 Проверка обработчиков IRP
Драйвер успешно загружен
FileSystemntfs[IRP_MJ_CREATE] = 82DDE1F8 -> перехватчик не определен
FileSystemntfs[IRP_MJ_CLOSE] = 82DDE1F8 -> перехватчик не определен
FileSystemntfs[IRP_MJ_WRITE] = 82DDE1F8 -> перехватчик не определен
FileSystemntfs[IRP_MJ_QUERY_INFORMATION] = 82DDE1F8 -> перехватчик не определен
FileSystemntfs[IRP_MJ_SET_INFORMATION] = 82DDE1F8 -> перехватчик не определен
FileSystemntfs[IRP_MJ_QUERY_EA] = 82DDE1F8 -> перехватчик не определен
FileSystemntfs[IRP_MJ_SET_EA] = 82DDE1F8 -> перехватчик не определен
FileSystemntfs[IRP_MJ_QUERY_VOLUME_INFORMATION] = 82DDE1F8 -> перехватчик не определен
FileSystemntfs[IRP_MJ_SET_VOLUME_INFORMATION] = 82DDE1F8 -> перехватчик не определен
FileSystemntfs[IRP_MJ_DIRECTORY_CONTROL] = 82DDE1F8 -> перехватчик не определен
FileSystemntfs[IRP_MJ_FILE_SYSTEM_CONTROL] = 82DDE1F8 -> перехватчик не определен
FileSystemntfs[IRP_MJ_DEVICE_CONTROL] = 82DDE1F8 -> перехватчик не определен
FileSystemntfs[IRP_MJ_LOCK_CONTROL] = 82DDE1F8 -> перехватчик не определен
FileSystemntfs[IRP_MJ_QUERY_SECURITY] = 82DDE1F8 -> перехватчик не определен
FileSystemntfs[IRP_MJ_SET_SECURITY] = 82DDE1F8 -> перехватчик не определен
FileSystemntfs[IRP_MJ_PNP] = 82DDE1F8 -> перехватчик не определен
18 июля, 2010 в 12:54 пп #30069
Helper
Participant
- Темы:19
- Сообщений:712
Раз вы знакомы с авз, то:
обновите базы;
выполните стандартный скрипт№2 и №3, перезагрузите компьютер.В сообщении своем нажмите добавить вложения и приложите архивы из папки авз:
virusinfo_syscheck.zip и virusinfo_syscure.zip
Посмотрим эти логи.А вообще думаю ничего страшного нет 😉
18 июля, 2010 в 1:38 пп #30070
bakemono
Participant
- Темы:1
- Сообщений:8
ага, ну мало ли)
18 июля, 2010 в 1:56 пп #30071
Helper
Participant
- Темы:19
- Сообщений:712
C:Program Filesma-config.comDriversdriverhardwarev2.sys
C:Program FilesYandexOnlineonline.exe
C:Program FilesPando Networks
Известно?+
C:Program Filesma-config.comDriversdriverhardwarev2.sys
проверьте на http://www.virustotal.com
А также запакуйте в архив папку C:_OTM с паролем virus и прикрепите к сообщению.
Автор

Сообщения