- This topic has 2 ответа, 2 участника, and was last updated 14 years, 5 months назад by
.
-
Сообщения
-
Здравствуйте! Компьютер инфицирован, предположительно руткит или боткит. Пыталась проверить RSIT.exe , процесс прерван — такая ошибка
OTL logfile created on: 04.06.2010 00:54:21 — Run 1
OTL by OldTimer — Version 3.2.5.3 Folder = D:
Ultimate Edition (Version = 6.1.7600) — Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 77,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 87,00% Paging File free
Paging file location(s): ?:pagefile.sys [binary data]%SystemDrive% = C: | %SystemRoot% = C:Windows | %ProgramFiles% = C:Program Files
Drive C: | 98,16 Gb Total Space | 80,99 Gb Free Space | 82,51% Space Free | Partition Type: NTFS
Drive D: | 199,93 Gb Total Space | 170,89 Gb Free Space | 85,48% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loadedComputer Name: HELENA-PC
Current User Name: Helena
Logged in as Administrator.Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard========== Processes (SafeList) ==========
PRC — [2010.06.04 00:48:26 | 000,571,904 | —- | M] (OldTimer Tools) — D:OTL.exe
PRC — [2009.08.18 02:36:36 | 000,348,160 | —- | M] (AMD) — C:WindowsSystem32atieclxx.exe
PRC — [2009.08.18 02:36:08 | 000,176,128 | —- | M] (AMD) — C:WindowsSystem32atiesrxx.exe
PRC — [2009.07.14 03:14:42 | 000,049,152 | —- | M] (Microsoft Corporation) — C:WindowsSystem32taskhost.exe
PRC — [2009.07.14 03:14:29 | 003,179,520 | —- | M] (Microsoft Corporation) — C:WindowsSystem32sppsvc.exe
PRC — [2009.07.14 03:14:25 | 000,052,736 | —- | M] (Microsoft Corporation) — C:WindowsSystem32nfsclnt.exe
PRC — [2009.07.14 03:14:20 | 002,613,248 | —- | M] (Microsoft Corporation) — C:Windowsexplorer.exe========== Modules (SafeList) ==========
MOD — [2010.06.04 00:48:26 | 000,571,904 | —- | M] (OldTimer Tools) — D:OTL.exe
MOD — [2009.07.14 03:16:15 | 000,099,840 | —- | M] (Microsoft Corporation) — C:WindowsSystem32sspicli.dll
MOD — [2009.07.14 03:16:13 | 000,092,160 | —- | M] (Microsoft Corporation) — C:WindowsSystem32sechost.dll
MOD — [2009.07.14 03:16:13 | 000,050,688 | —- | M] (Microsoft Corporation) — C:WindowsSystem32samcli.dll
MOD — [2009.07.14 03:16:12 | 000,031,744 | —- | M] (Microsoft Corporation) — C:WindowsSystem32profapi.dll
MOD — [2009.07.14 03:16:03 | 000,022,016 | —- | M] (Microsoft Corporation) — C:WindowsSystem32netutils.dll
MOD — [2009.07.14 03:15:35 | 000,288,256 | —- | M] (Microsoft Corporation) — C:WindowsSystem32KernelBase.dll
MOD — [2009.07.14 03:15:13 | 000,067,072 | —- | M] (Microsoft Corporation) — C:WindowsSystem32dwmapi.dll
MOD — [2009.07.14 03:15:11 | 000,064,512 | —- | M] (Microsoft Corporation) — C:WindowsSystem32devobj.dll
MOD — [2009.07.14 03:15:07 | 000,036,864 | —- | M] (Microsoft Corporation) — C:WindowsSystem32cryptbase.dll
MOD — [2009.07.14 03:15:02 | 000,145,920 | —- | M] (Microsoft Corporation) — C:WindowsSystem32cfgmgr32.dll
MOD — [2009.07.14 03:14:10 | 000,095,232 | —- | M] (Microsoft Corporation) — C:WindowsSystem32msscript.ocx
MOD — [2009.07.14 03:03:50 | 001,680,896 | —- | M] (Microsoft Corporation) — C:Windowswinsxsx86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfccomctl32.dll========== Win32 Services (SafeList) ==========
SRV — File not found [Auto | Stopped] — — (UI0Detect)
SRV — [2009.08.18 02:36:08 | 000,176,128 | —- | M] (AMD) [Auto | Running] — C:WindowsSystem32atiesrxx.exe — (AMD External Events Utility)
SRV — [2009.07.14 03:16:21 | 000,185,856 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] — C:WindowsSystem32wwansvc.dll — (WwanSvc)
SRV — [2009.07.14 03:16:20 | 000,010,752 | —- | M] (Корпорация Майкрософт) [On_Demand | Stopped] — C:WindowsSystem32wpcsvc.dll — (WPCSvc)
SRV — [2009.07.14 03:16:17 | 000,151,552 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] — C:WindowsSystem32wbiosrvc.dll — (WbioSrvc)
SRV — [2009.07.14 03:16:17 | 000,119,808 | —- | M] (Microsoft Corporation) [Auto | Running] — C:WindowsSystem32umpo.dll — (Power)
SRV — [2009.07.14 03:16:16 | 000,037,376 | —- | M] (Microsoft Corporation) [Auto | Running] — C:WindowsSystem32themeservice.dll — (Themes)
SRV — [2009.07.14 03:16:15 | 000,053,760 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] — C:WindowsSystem32sppuinotify.dll — (sppuinotify)
SRV — [2009.07.14 03:16:13 | 000,043,520 | —- | M] (Microsoft Corporation) [Unknown | Running] — C:WindowsSystem32RpcEpMap.dll — (RpcEptMapper)
SRV — [2009.07.14 03:16:13 | 000,025,088 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] — C:WindowsSystem32sensrsvc.dll — (SensrSvc)
SRV — [2009.07.14 03:16:12 | 001,004,544 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] — C:WindowsSystem32PeerDistSvc.dll — (PeerDistSvc)
SRV — [2009.07.14 03:16:12 | 000,269,824 | —- | M] (Microsoft Corporation) [Disabled | Stopped] — C:WindowsSystem32pnrpsvc.dll — (PNRPsvc)
SRV — [2009.07.14 03:16:12 | 000,269,824 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] — C:WindowsSystem32pnrpsvc.dll — (p2pimsvc)
SRV — [2009.07.14 03:16:12 | 000,165,376 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] — C:WindowsSystem32provsvc.dll — (HomeGroupProvider)
SRV — [2009.07.14 03:16:12 | 000,020,480 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] — C:WindowsSystem32pnrpauto.dll — (PNRPAutoReg)
SRV — [2009.07.14 03:15:41 | 000,680,960 | —- | M] (Microsoft Corporation) [Auto | Running] — C:Program FilesWindows DefenderMpSvc.dll — (WinDefend)
SRV — [2009.07.14 03:15:36 | 000,194,560 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] — C:WindowsSystem32ListSvc.dll — (HomeGroupListener)
SRV — [2009.07.14 03:15:21 | 000,797,696 | —- | M] (Microsoft Corporation) [Auto | Running] — C:WindowsSystem32FntCache.dll — (FontCache)
SRV — [2009.07.14 03:15:11 | 000,253,440 | —- | M] (Microsoft Corporation) [Auto | Running] — C:WindowsSystem32dhcpcore.dll — (Dhcp)
SRV — [2009.07.14 03:15:10 | 000,218,624 | —- | M] (Корпорация Майкрософт) [Auto | Running] — C:WindowsSystem32defragsvc.dll — (defragsvc)
SRV — [2009.07.14 03:14:59 | 000,076,800 | —- | M] (Microsoft Corporation) [Unknown | Stopped] — C:WindowsSystem32bdesvc.dll — (BDESVC)
SRV — [2009.07.14 03:14:58 | 000,088,064 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] — C:WindowsSystem32AxInstSv.dll — (AxInstSV) Установщик ActiveX (AxInstSV)
SRV — [2009.07.14 03:14:53 | 000,027,648 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] — C:WindowsSystem32appidsvc.dll — (AppIDSvc)
SRV — [2009.07.14 03:14:29 | 003,179,520 | —- | M] (Microsoft Corporation) [Auto | Running] — C:WindowsSystem32sppsvc.exe — (sppsvc)
SRV — [2009.07.14 03:14:25 | 000,052,736 | —- | M] (Microsoft Corporation) [Auto | Running] — C:WindowsSystem32nfsclnt.exe — (NfsClnt)========== Driver Services (SafeList) ==========
DRV — [2009.08.18 03:48:06 | 004,994,560 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] — C:WindowsSystem32driversatikmdag.sys — (atikmdag)
DRV — [2009.07.14 03:26:21 | 000,015,952 | —- | M] (CMD Technology, Inc.) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERScmdide.sys — (cmdide)
DRV — [2009.07.14 03:26:17 | 000,297,552 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSadpahci.sys — (adpahci)
DRV — [2009.07.14 03:26:15 | 000,422,976 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSadp94xx.sys — (adp94xx)
DRV — [2009.07.14 03:26:15 | 000,159,312 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSamdsbs.sys — (amdsbs)
DRV — [2009.07.14 03:26:15 | 000,146,512 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSadpu320.sys — (adpu320)
DRV — [2009.07.14 03:26:15 | 000,086,608 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSarcsas.sys — (arcsas)
DRV — [2009.07.14 03:26:15 | 000,079,952 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSamdsata.sys — (amdsata)
DRV — [2009.07.14 03:26:15 | 000,076,368 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSarc.sys — (arc)
DRV — [2009.07.14 03:26:15 | 000,023,616 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] — C:Windowssystem32DRIVERSamdxata.sys — (amdxata)
DRV — [2009.07.14 03:26:15 | 000,014,400 | —- | M] (Acer Laboratories Inc.) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSaliide.sys — (aliide)
DRV — [2009.07.14 03:20:44 | 000,142,416 | —- | M] (NVIDIA Corporation) [Kernel | Boot | Running] — C:Windowssystem32DRIVERSnvstor.sys — (nvstor)
DRV — [2009.07.14 03:20:44 | 000,117,312 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSnvraid.sys — (nvraid)
DRV — [2009.07.14 03:20:44 | 000,078,416 | —- | M] (Корпорация Майкрософт) [Kernel | Boot | Running] — C:WindowsSystem32driversmountmgr.sys — (mountmgr)
DRV — [2009.07.14 03:20:44 | 000,044,624 | —- | M] (IBM Corporation) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSnfrd960.sys — (nfrd960)
DRV — [2009.07.14 03:20:37 | 000,089,168 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSlsi_sas.sys — (LSI_SAS)
DRV — [2009.07.14 03:20:36 | 000,332,352 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSiaStorV.sys — (iaStorV)
DRV — [2009.07.14 03:20:36 | 000,235,584 | —- | M] (LSI Corporation, Inc.) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSMegaSR.sys — (MegaSR)
DRV — [2009.07.14 03:20:36 | 000,133,200 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] — C:WindowsSystem32Driversksecpkg.sys — (KSecPkg)
DRV — [2009.07.14 03:20:36 | 000,096,848 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSlsi_scsi.sys — (LSI_SCSI)
DRV — [2009.07.14 03:20:36 | 000,095,824 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSlsi_fc.sys — (LSI_FC)
DRV — [2009.07.14 03:20:36 | 000,054,864 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSlsi_sas2.sys — (LSI_SAS2)
DRV — [2009.07.14 03:20:36 | 000,041,040 | —- | M] (Intel Corp./ICP vortex GmbH) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSiirsp.sys — (iirsp)
DRV — [2009.07.14 03:20:36 | 000,030,800 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSmegasas.sys — (megasas)
DRV — [2009.07.14 03:20:36 | 000,013,904 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] — C:WindowsSystem32drivershwpolicy.sys — (hwpolicy)
DRV — [2009.07.14 03:20:28 | 000,453,712 | —- | M] (Emulex) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSelxstor.sys — (elxstor)
DRV — [2009.07.14 03:20:28 | 000,070,720 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSdjsvs.sys — (aic78xx)
DRV — [2009.07.14 03:20:28 | 000,067,152 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSHpSAMD.sys — (HpSAMD)
DRV — [2009.07.14 03:20:28 | 000,046,160 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] — C:WindowsSystem32driversfsdepends.sys — (FsDepends)
DRV — [2009.07.14 03:19:11 | 000,297,040 | —- | M] (Корпорация Майкрософт) [Kernel | Boot | Running] — C:WindowsSystem32driversvolmgrx.sys — (volmgrx)
DRV — [2009.07.14 03:19:11 | 000,141,904 | —- | M] (VIA Technologies Inc.,Ltd) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSvsmraid.sys — (vsmraid)
DRV — [2009.07.14 03:19:10 | 000,175,824 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSvmbus.sys — (vmbus)
DRV — [2009.07.14 03:19:10 | 000,159,824 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSvhdmp.sys — (vhdmp)
DRV — [2009.07.14 03:19:10 | 000,040,896 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] — C:Windowssystem32DRIVERSvmstorfl.sys — (storflt)
DRV — [2009.07.14 03:19:10 | 000,032,832 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] — C:Windowssystem32DRIVERSvdrvroot.sys — (vdrvroot)
DRV — [2009.07.14 03:19:10 | 000,028,224 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSstorvsc.sys — (storvsc)
DRV — [2009.07.14 03:19:10 | 000,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] — C:WindowsSystem32driverswimmount.sys — (WIMMount)
DRV — [2009.07.14 03:19:10 | 000,016,976 | —- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSviaide.sys — (viaide)
DRV — [2009.07.14 03:19:04 | 001,383,488 | —- | M] (QLogic Corporation) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSql2300.sys — (ql2300)
DRV — [2009.07.14 03:19:04 | 000,173,648 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] — C:WindowsSystem32driversrdyboost.sys — (rdyboost)
DRV — [2009.07.14 03:19:04 | 000,106,064 | —- | M] (QLogic Corporation) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSql40xx.sys — (ql40xx)
DRV — [2009.07.14 03:19:04 | 000,077,888 | —- | M] (Silicon Integrated Systems) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSsisraid4.sys — (SiSRaid4)
DRV — [2009.07.14 03:19:04 | 000,043,088 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] — C:WindowsSystem32driverspcw.sys — (pcw)
DRV — [2009.07.14 03:19:04 | 000,040,016 | —- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSSiSRaid2.sys — (SiSRaid2)
DRV — [2009.07.14 03:19:04 | 000,021,072 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSstexstor.sys — (stexstor)
DRV — [2009.07.14 03:17:54 | 000,369,568 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] — C:WindowsSystem32Driverscng.sys — (CNG)
DRV — [2009.07.14 02:57:25 | 000,272,128 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] — C:WindowsSystem32DriversBrserid.sys — (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV — [2009.07.14 02:02:41 | 000,018,944 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] — C:WindowsSystem32driversrdpbus.sys — (rdpbus)
DRV — [2009.07.14 02:01:41 | 000,007,168 | —- | M] (Microsoft Corporation) [Kernel | System | Running] — C:WindowsSystem32driversRDPREFMP.sys — (RDPREFMP)
DRV — [2009.07.14 01:55:00 | 000,049,152 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] — C:WindowsSystem32driversagilevpn.sys — (RasAgileVpn) WAN Miniport (IKEv2)
DRV — [2009.07.14 01:53:51 | 000,009,728 | —- | M] (Microsoft Corporation) [Kernel | System | Running] — C:WindowsSystem32driverswfplwf.sys — (WfpLwf)
DRV — [2009.07.14 01:52:44 | 000,027,136 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] — C:WindowsSystem32driversndiscap.sys — (NdisCap)
DRV — [2009.07.14 01:52:02 | 000,019,968 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] — C:WindowsSystem32driversvwifibus.sys — (vwifibus)
DRV — [2009.07.14 01:52:00 | 000,163,328 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] — C:WindowsSystem32drivers1394ohci.sys — (1394ohci)
DRV — [2009.07.14 01:51:35 | 000,008,192 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSumpass.sys — (UmPass)
DRV — [2009.07.14 01:51:23 | 000,080,640 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] — C:WindowsSystem32driversUSBAUDIO.sys — (usbaudio) USB-Audiotreiber (WDM)
DRV — [2009.07.14 01:51:08 | 000,004,096 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] — C:WindowsSystem32driversmshidkmdf.sys — (mshidkmdf)
DRV — [2009.07.14 01:46:55 | 000,012,288 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSMTConfig.sys — (MTConfig)
DRV — [2009.07.14 01:45:26 | 000,031,232 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] — C:WindowsSystem32driversCompositeBus.sys — (CompositeBus)
DRV — [2009.07.14 01:36:52 | 000,050,176 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] — C:Windowssystem32driversappid.sys — (AppID)
DRV — [2009.07.14 01:33:50 | 000,026,624 | —- | M] (Microsoft Corporation) [Kernel | Unknown | Stopped] — C:WindowsSystem32driversscfilter.sys — (scfilter)
DRV — [2009.07.14 01:28:47 | 000,005,632 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSvms3cap.sys — (s3cap)
DRV — [2009.07.14 01:28:45 | 000,017,920 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSVMBusHID.sys — (VMBusHID)
DRV — [2009.07.14 01:24:05 | 000,032,256 | —- | M] (Microsoft Corporation) [Kernel | System | Running] — C:WindowsSystem32driversdiscache.sys — (discache)
DRV — [2009.07.14 01:19:21 | 000,021,504 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSHidBatt.sys — (HidBatt)
DRV — [2009.07.14 01:16:36 | 000,009,728 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSacpipmi.sys — (AcpiPmi)
DRV — [2009.07.14 01:14:44 | 000,086,528 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] — C:WindowsSystem32driversrpcxdr.sys — (RpcXdr) Сервер для NFS Open RPC (ONCRPC)
DRV — [2009.07.14 01:14:34 | 000,201,216 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Running] — C:WindowsSystem32driversnfsrdr.sys — (NfsRdr)
DRV — [2009.07.14 01:11:04 | 000,052,736 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSamdppm.sys — (AmdPPM)
DRV — [2009.07.14 00:54:14 | 000,026,624 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] — C:Windowssystem32drivershcw85cir.sys — (hcw85cir)
DRV — [2009.07.14 00:53:33 | 000,012,160 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] — C:WindowsSystem32DriversBrUsbMdm.sys — (BrUsbMdm)
DRV — [2009.07.14 00:53:33 | 000,011,904 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] — C:WindowsSystem32DriversBrUsbSer.sys — (BrUsbSer)
DRV — [2009.07.14 00:53:32 | 000,062,336 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] — C:WindowsSystem32DriversBrSerWdm.sys — (BrSerWdm)
DRV — [2009.07.14 00:53:28 | 000,013,568 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSBrFiltLo.sys — (BrFiltLo)
DRV — [2009.07.14 00:53:28 | 000,005,248 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSBrFiltUp.sys — (BrFiltUp)
DRV — [2009.07.14 00:02:53 | 000,311,296 | —- | M] (Marvell) [Kernel | On_Demand | Stopped] — C:WindowsSystem32driversyk62x86.sys — (yukonw7)
DRV — [2009.07.14 00:02:49 | 000,229,888 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] — C:WindowsSystem32driversb57nd60x.sys — (b57nd60x)
DRV — [2009.07.14 00:02:48 | 003,100,160 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSevbdx.sys — (ebdrv)
DRV — [2009.07.14 00:02:48 | 000,430,080 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] — C:Windowssystem32DRIVERSbxvbdx.sys — (b06bdrv)========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE — HKUS-1-5-21-3931017080-1882903214-522866229-1000SoftwareMicrosoftWindowsCurrentVersionInternet Settings: «ProxyEnable» = 0
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | —- | M]) — C:WindowsSystem32driversetchosts
O4 — HKUS-1-5-19..RunOnce: [mctadmin] C:WindowsSystem32mctadmin.exe (Microsoft Corporation)
O4 — HKUS-1-5-20..RunOnce: [mctadmin] C:WindowsSystem32mctadmin.exe (Microsoft Corporation)
O6 — HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesSystem: ConsentPromptBehaviorAdmin = 5
O6 — HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesSystem: ConsentPromptBehaviorUser = 3
O6 — HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesSystem: EnableSecureUIAPaths = 0
O13 — gopher Prefix: missing
O17 — HKLMSystemCCSServicesTcpipParameters: DhcpNameServer = 192.168.178.1
O20 — HKLM Winlogon: Shell — (explorer.exe) — C:Windowsexplorer.exe (Microsoft Corporation)
O20 — HKLM Winlogon: VMApplet — (SystemPropertiesPerformance.exe) — C:WindowsSystem32SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 — HKLM Winlogon: VMApplet — (/pagefile) — File not found
O21 — SSODL: WebCheck — {E6FB5E20-DE35-11CF-9C87-00AA005127ED} — CLSID or File not found.
O30 — LSA: Security Packages — (pku2u) — C:WindowsSystem32pku2u.dll (Microsoft Corporation)
O32 — HKLM CDRom: AutoRun — 1
O32 — AutoRun File — [2009.06.10 23:42:20 | 000,000,024 | —- | M] () — C:autoexec.bat — [ NTFS ]
O34 — HKLM BootExecute: (autocheck autochk *) — File not found
O35 — HKLM..comfile [open] — «%1» %*
O35 — HKLM..exefile [open] — «%1» %*
O37 — HKLM…com [@ = comfile] — «%1» %*
O37 — HKLM…exe [@ = exefile] — «%1» %*========== Files/Folders — Created Within 30 Days ==========
[2010.06.04 00:20:14 | 000,000,000 | —D | C] — C:Program Filestrend micro
[2010.06.04 00:20:14 | 000,000,000 | —D | C] — C:rsit
[2010.06.04 00:19:01 | 000,000,000 | -HSD | C] — C:WindowsInstaller
[2010.05.23 12:49:56 | 000,000,000 | —D | C] — C:UsersHelenaPlugins
[2010.05.23 12:49:22 | 000,000,000 | —D | C] — C:UsersHelenaDesktopPlugins
[2010.05.22 15:22:38 | 000,000,000 | —D | C] — C:Program FilesATS2
[2010.05.21 22:06:04 | 000,000,000 | —D | C] — C:UsersHelenaAppDataRoamingSony Corporation
[2010.05.21 22:04:18 | 000,118,520 | —- | C] (Sonic Solutions) — C:WindowsSystem32PxInsI64.exe
[2010.05.21 22:04:18 | 000,115,960 | —- | C] (Sonic Solutions) — C:WindowsSystem32PxCpyI64.exe
[2010.05.21 22:04:18 | 000,072,440 | —- | C] (Sonic Solutions) — C:WindowsSystem32pxhpinst.exe
[2010.05.21 22:04:18 | 000,064,760 | —- | C] (Sonic Solutions) — C:WindowsSystem32PxInsA64.exe
[2010.05.21 22:04:18 | 000,064,248 | —- | C] (Sonic Solutions) — C:WindowsSystem32PxCpyA64.exe
[2010.05.21 22:04:18 | 000,039,672 | —- | C] (Sonic Solutions) — C:WindowsSystem32vxblock.dll
[2010.05.21 22:04:18 | 000,002,560 | —- | C] (Sonic Solutions) — C:WindowsSystem32driverscdralw2k.sys
[2010.05.21 22:04:18 | 000,002,432 | —- | C] (Sonic Solutions) — C:WindowsSystem32driverscdr4_xp.sys
[2010.05.21 22:04:18 | 000,002,432 | —- | C] (Sonic Solutions) — C:WindowsSystem32driverscdr4_2k.sys
[2010.05.21 22:04:18 | 000,000,000 | —D | C] — C:WindowsSystem32Iosubsys
[2010.05.21 22:02:08 | 000,000,000 | —D | C] — C:Program FilesSony
[2010.05.21 22:02:07 | 000,000,000 | -H-D | C] — C:Program FilesInstallShield Installation Information
[2010.05.21 22:01:08 | 000,000,000 | —D | C] — C:Program FilesCommon FilesInstallShield
[2010.05.19 21:51:26 | 000,000,000 | —D | C] — C:UsersHelenaAppDataLocalAdobe
[2010.05.19 21:51:11 | 000,000,000 | —D | C] — C:UsersHelenaAppDataRoamingAdobe
[2010.05.19 21:44:22 | 000,000,000 | —D | C] — C:WindowsSystem32appmgmt
[2010.05.17 21:10:43 | 000,000,000 | —D | C] — C:UsersHelenaAppDataLocalMigWiz
[2010.05.17 19:16:37 | 000,000,000 | —D | C] — C:UsersHelenaAppDataLocalDiagnostics
[2010.05.17 19:14:47 | 000,000,000 | —D | C] — C:UsersHelenaAppDataRoamingCarambis
[2010.05.17 19:13:13 | 000,000,000 | —D | C] — C:Program FilesCommon FilesHewlett-Packard
[2010.05.17 19:13:12 | 000,000,000 | —D | C] — C:Program FilesHewlett-Packard
[2010.05.17 19:12:52 | 000,000,000 | —D | C] — C:Program FilesCommon FilesHP
[2010.05.17 18:53:34 | 000,000,000 | —D | C] — C:Program FilesHP
[2010.05.17 18:53:33 | 000,000,000 | -H-D | C] — C:Config.Msi
[2010.05.17 18:51:01 | 000,000,000 | —D | C] — C:ProgramDataHP
[2010.05.17 18:48:00 | 000,000,000 | —D | C] — C:UsersHelenaAppDataRoamingACD Systems
[2010.05.17 18:48:00 | 000,000,000 | —D | C] — C:UsersHelenaAppDataLocalACD Systems
[2010.05.17 18:47:37 | 000,000,000 | —D | C] — C:Program FilesCommon FilesACD Systems
[2010.05.17 18:47:13 | 000,000,000 | —D | C] — C:UsersHelenaAppDataLocalDownloaded Installations
[2010.05.17 18:45:01 | 000,278,528 | —- | C] (Real Networks, Inc) — C:WindowsSystem32pncrt.dll
[2010.05.17 18:45:01 | 000,185,920 | —- | C] (RealNetworks, Inc.) — C:WindowsSystem32rmoc3260.dll
[2010.05.17 18:45:01 | 000,006,656 | —- | C] (RealNetworks, Inc.) — C:WindowsSystem32pndx5016.dll
[2010.05.17 18:45:01 | 000,005,632 | —- | C] (RealNetworks, Inc.) — C:WindowsSystem32pndx5032.dll
[2010.05.17 18:44:59 | 000,839,680 | —- | C] (http://www.mp3dev.org/) — C:WindowsSystem32lameACM.acm
[2010.05.17 18:44:59 | 000,217,088 | —- | C] (http://www.helixcommunity.org) — C:WindowsSystem32yv12vfw.dll
[2010.05.17 18:44:59 | 000,151,552 | —- | C] (fccHandler) — C:WindowsSystem32ac3acm.acm
[2010.05.17 18:44:58 | 000,090,112 | —- | C] (DivX, Inc.) — C:WindowsSystem32dpl100.dll
[2010.05.17 18:44:57 | 000,685,056 | —- | C] (DivX, Inc.) — C:WindowsSystem32divx.dll
[2010.05.17 18:44:56 | 000,499,712 | —- | C] (Microsoft Corporation) — C:WindowsSystem32msvcp71.dll
[2010.05.17 18:44:56 | 000,348,160 | —- | C] (Microsoft Corporation) — C:WindowsSystem32msvcr71.dll
[2010.05.17 18:44:56 | 000,000,000 | —D | C] — C:Program FilesK-Lite Codec Pack
[2010.05.17 18:43:15 | 000,000,000 | —D | C] — C:WindowsSystem32Macromed
[2010.05.17 18:42:44 | 000,000,000 | —D | C] — C:ProgramDataAdobe
[2010.05.17 18:42:42 | 000,000,000 | —D | C] — C:Program FilesCommon FilesAdobe
[2010.05.17 18:42:42 | 000,000,000 | —D | C] — C:Program FilesAdobe
[2010.05.17 18:27:24 | 000,000,000 | —D | C] — C:Program FilesCarambis
[2010.05.17 18:11:18 | 000,000,000 | —D | C] — C:WindowsPanther
[2010.05.17 18:11:05 | 000,000,000 | -HSD | C] — C:Boot
[2010.05.17 18:08:27 | 000,000,000 | —D | C] — C:UsersHelenaAppDataLocalElevatedDiagnostics
[2010.05.17 17:30:04 | 000,000,000 | —D | C] — C:Windowsen-US
[2010.05.17 17:30:04 | 000,000,000 | —D | C] — C:WindowsSystem32en
[2010.05.17 17:30:04 | 000,000,000 | —D | C] — C:WindowsSystem32409
[2010.05.17 17:30:03 | 000,000,000 | —D | C] — C:WindowsSystem32driversen-US
[2010.05.17 17:30:02 | 000,000,000 | —D | C] — C:WindowsSystem32driversru-RU
[2010.05.17 17:29:59 | 000,000,000 | —D | C] — C:WindowsSystem32ru
[2010.05.17 17:29:48 | 000,000,000 | —D | C] — C:Windowsru-RU
[2010.05.17 17:26:51 | 000,025,088 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUusbport.sys.mui
[2010.05.17 17:26:51 | 000,023,552 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUvolsnap.sys.mui
[2010.05.17 17:26:51 | 000,011,776 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUusbhub.sys.mui
[2010.05.17 17:26:51 | 000,004,608 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUvhdmp.sys.mui
[2010.05.17 17:26:51 | 000,004,096 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUtpm.sys.mui
[2010.05.17 17:26:51 | 000,003,584 | —- | C] (SCM Microsystems, Inc.) — C:WindowsSystem32driversru-RUpscr.sys.mui
[2010.05.17 17:26:51 | 000,003,584 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUportcls.sys.mui
[2010.05.17 17:26:51 | 000,003,072 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUumbus.sys.mui
[2010.05.17 17:26:51 | 000,002,560 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUserscan.sys.mui
[2010.05.17 17:26:51 | 000,002,048 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUwd.sys.mui
[2010.05.17 17:26:50 | 000,038,400 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUmpio.sys.mui
[2010.05.17 17:26:50 | 000,033,792 | —- | C] (Marvell) — C:WindowsSystem32driversru-RUyk62x86.sys.mui
[2010.05.17 17:26:50 | 000,022,016 | —- | C] (Intel Corporation) — C:WindowsSystem32driversru-RUe1y6032.sys.mui
[2010.05.17 17:26:50 | 000,022,016 | —- | C] (Intel Corporation) — C:WindowsSystem32driversru-RUe1e6032.sys.mui
[2010.05.17 17:26:50 | 000,018,944 | —- | C] (Intel Corporation) — C:WindowsSystem32driversru-RUE1G60I32.sys.mui
[2010.05.17 17:26:50 | 000,012,800 | —- | C] (Broadcom Corporation) — C:WindowsSystem32driversru-RUk57nd60x.sys.mui
[2010.05.17 17:26:50 | 000,012,800 | —- | C] (Broadcom Corporation) — C:WindowsSystem32driversru-RUb57nd60x.sys.mui
[2010.05.17 17:26:50 | 000,011,264 | —- | C] (Корпорация Intel) — C:WindowsSystem32driversru-RUe1q6032.sys.mui
[2010.05.17 17:26:50 | 000,011,264 | —- | C] (Корпорация Intel) — C:WindowsSystem32driversru-RUe1k6032.sys.mui
[2010.05.17 17:26:50 | 000,010,752 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUserial.sys.mui
[2010.05.17 17:26:50 | 000,010,752 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUi8042prt.sys.mui
[2010.05.17 17:26:50 | 000,007,168 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUmsdsm.sys.mui
[2010.05.17 17:26:50 | 000,005,632 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUsermouse.sys.mui
[2010.05.17 17:26:50 | 000,005,632 | —- | C] (Broadcom Corporation) — C:WindowsSystem32driversru-RUbcm4sbxp.sys.mui
[2010.05.17 17:26:50 | 000,005,120 | —- | C] (Intel Corporation) — C:WindowsSystem32driversru-RUe100b325.sys.mui
[2010.05.17 17:26:50 | 000,004,608 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUmouclass.sys.mui
[2010.05.17 17:26:50 | 000,004,096 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUpcmcia.sys.mui
[2010.05.17 17:26:50 | 000,003,584 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUparport.sys.mui
[2010.05.17 17:26:50 | 000,003,584 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUataport.sys.mui
[2010.05.17 17:26:50 | 000,003,072 | —- | C] (VIA Technologies, Inc. ) — C:WindowsSystem32driversru-RUgetn62.sys.mui
[2010.05.17 17:26:50 | 000,003,072 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversen-USscsiport.sys.mui
[2010.05.17 17:26:50 | 000,003,072 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUrndismpx.sys.mui
[2010.05.17 17:26:50 | 000,003,072 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUrndismp6.sys.mui
[2010.05.17 17:26:50 | 000,002,560 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUvwifibus.sys.mui
[2010.05.17 17:26:50 | 000,002,560 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUparvdm.sys.mui
[2010.05.17 17:26:50 | 000,002,560 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUMTConfig.sys.mui
[2010.05.17 17:26:50 | 000,002,560 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUmouhid.sys.mui
[2010.05.17 17:26:50 | 000,002,048 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUamdide.sys.mui
[2010.05.17 17:26:49 | 000,050,176 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUtcpip.sys.mui
[2010.05.17 17:26:49 | 000,031,744 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUbfe.dll.mui
[2010.05.17 17:26:49 | 000,017,408 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUafd.sys.mui
[2010.05.17 17:26:49 | 000,008,704 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUtunnel.sys.mui
[2010.05.17 17:26:49 | 000,003,584 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUmodem.sys.mui
[2010.05.17 17:26:49 | 000,002,560 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUwdf01000.sys.mui
[2010.05.17 17:26:49 | 000,002,560 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUusbrpm.sys.mui
[2010.05.17 17:26:49 | 000,002,048 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUws2ifsl.sys.mui
[2010.05.17 17:26:48 | 000,016,384 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUfvevol.sys.mui
[2010.05.17 17:26:48 | 000,005,120 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUrdbss.sys.mui
[2010.05.17 17:26:48 | 000,002,560 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversen-USsrv.sys.mui
[2010.05.17 17:26:48 | 000,002,560 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUscfilter.sys.mui
[2010.05.17 17:26:47 | 000,060,416 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUntfs.sys.mui
[2010.05.17 17:26:47 | 000,037,888 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUndis.sys.mui
[2010.05.17 17:26:47 | 000,016,384 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUnwifi.sys.mui
[2010.05.17 17:26:47 | 000,015,360 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUpacer.sys.mui
[2010.05.17 17:26:47 | 000,003,072 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversen-USRNDISMP.sys.mui
[2010.05.17 17:26:47 | 000,003,072 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUndisuio.sys.mui
[2010.05.17 17:26:47 | 000,002,560 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUqwavedrv.sys.mui
[2010.05.17 17:26:47 | 000,002,560 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUpartmgr.sys.mui
[2010.05.17 17:26:46 | 000,005,632 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUndiscap.sys.mui
[2010.05.17 17:26:46 | 000,003,072 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUnfsrdr.sys.mui
[2010.05.17 17:26:46 | 000,003,072 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversen-USnfsrdr.sys.mui
[2010.05.17 17:26:45 | 000,007,168 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUluafv.sys.mui
[2010.05.17 17:26:45 | 000,003,584 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversen-USipnat.sys.mui
[2010.05.17 17:26:45 | 000,002,560 | —- | C] (Корпорация Майкрософт) — C:WindowsSystem32driversru-RUmountmgr.sys.mui
[2010.05.17 17:26:44 | 000,038,400 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUhttp.sys.mui
[2010.05.17 17:26:43 | 000,005,120 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUfltmgr.sys.mui
[2010.05.17 17:26:43 | 000,002,560 | —- | C] (Корпорация Майкрософт) — C:WindowsSystem32driversru-RUvolmgrx.sys.mui
[2010.05.17 17:26:42 | 000,020,992 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUviac7.sys.mui
[2010.05.17 17:26:42 | 000,020,992 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUprocessr.sys.mui
[2010.05.17 17:26:42 | 000,020,992 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUintelppm.sys.mui
[2010.05.17 17:26:42 | 000,020,992 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUamdppm.sys.mui
[2010.05.17 17:26:42 | 000,020,992 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUamdk8.sys.mui
[2010.05.17 17:26:42 | 000,010,752 | —- | C] (Brother Industries Ltd.) — C:WindowsSystem32driversru-RUBrSerId.sys.mui
[2010.05.17 17:26:42 | 000,010,752 | —- | C] (Brother Industries Ltd.) — C:WindowsSystem32driversru-RUBrSerIb.sys.mui
[2010.05.17 17:26:42 | 000,010,240 | —- | C] (Agere Systems) — C:WindowsSystem32driversru-RUltmdmnt.sys.mui
[2010.05.17 17:26:42 | 000,009,728 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUbattc.sys.mui
[2010.05.17 17:26:42 | 000,009,728 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUacpi.sys.mui
[2010.05.17 17:26:42 | 000,008,704 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUpci.sys.mui
[2010.05.17 17:26:42 | 000,007,680 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUbthport.sys.mui
[2010.05.17 17:26:42 | 000,006,144 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUIPMIDrv.sys.mui
[2010.05.17 17:26:42 | 000,004,608 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUvdrvroot.sys.mui
[2010.05.17 17:26:42 | 000,004,608 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUkbdclass.sys.mui
[2010.05.17 17:26:42 | 000,004,608 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUbthpan.sys.mui
[2010.05.17 17:26:42 | 000,004,096 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUwacompen.sys.mui
[2010.05.17 17:26:42 | 000,004,096 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUisapnp.sys.mui
[2010.05.17 17:26:42 | 000,004,096 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUhdaudbus.sys.mui
[2010.05.17 17:26:42 | 000,003,584 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUHdAudio.sys.mui
[2010.05.17 17:26:42 | 000,003,584 | —- | C] (ATI Technologies Inc.) — C:WindowsSystem32driversru-RUatikmdag.sys.mui
[2010.05.17 17:26:42 | 000,003,072 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUmssmbios.sys.mui
[2010.05.17 17:26:42 | 000,003,072 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUhidbth.sys.mui
[2010.05.17 17:26:42 | 000,002,560 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUVIAAGP.SYS.mui
[2010.05.17 17:26:42 | 000,002,560 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUULIAGPKX.SYS.mui
[2010.05.17 17:26:42 | 000,002,560 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUUAGP35.SYS.mui
[2010.05.17 17:26:42 | 000,002,560 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUSISAGP.SYS.mui
[2010.05.17 17:26:42 | 000,002,560 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUpnpmem.sys.mui
[2010.05.17 17:26:42 | 000,002,560 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUNV_AGP.SYS.mui
[2010.05.17 17:26:42 | 000,002,560 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUkbdhid.sys.mui
[2010.05.17 17:26:42 | 000,002,560 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUGAGP30KX.SYS.mui
[2010.05.17 17:26:42 | 000,002,560 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUDot4usb.sys.mui
[2010.05.17 17:26:42 | 000,002,560 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUBTHUSB.SYS.mui
[2010.05.17 17:26:42 | 000,002,560 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUAMDAGP.SYS.mui
[2010.05.17 17:26:42 | 000,002,560 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUAGP440.sys.mui
[2010.05.17 17:26:42 | 000,002,560 | —- | C] (Brother Industries Ltd.) — C:WindowsSystem32driversru-RUBrParwdm.sys.mui
[2010.05.17 17:26:42 | 000,002,048 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUdisk.sys.mui
[2010.05.17 17:26:42 | 000,002,048 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUcdrom.sys.mui
[2010.05.17 17:26:42 | 000,002,048 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUbthenum.sys.mui
[2010.05.17 17:26:41 | 000,011,776 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RUohci1394.sys.mui
[2010.05.17 17:26:41 | 000,011,776 | —- | C] (Microsoft Corporation) — C:WindowsSystem32driversru-RU1394ohci.sys.mui
[2010.05.17 17:25:17 | 000,000,000 | R—D | C] — C:UsersHelenaSearches
[2010.05.17 17:25:08 | 000,000,000 | —D | C] — C:UsersHelenaAppDataRoamingIdentities
[2010.05.17 17:25:07 | 000,000,000 | R—D | C] — C:UsersHelenaContacts
[2010.05.17 17:25:04 | 000,000,000 | —D | C] — C:UsersHelenaAppDataLocalVirtualStore
[2010.05.17 17:25:02 | 000,000,000 | —SD | C] — C:UsersHelenaAppDataRoamingMicrosoft
[2010.05.17 17:25:02 | 000,000,000 | R—D | C] — C:UsersHelenaVideos
[2010.05.17 17:25:02 | 000,000,000 | R—D | C] — C:UsersHelenaSaved Games
[2010.05.17 17:25:02 | 000,000,000 | R—D | C] — C:UsersHelenaPictures
[2010.05.17 17:25:02 | 000,000,000 | R—D | C] — C:UsersHelenaMusic
[2010.05.17 17:25:02 | 000,000,000 | R—D | C] — C:UsersHelenaLinks
[2010.05.17 17:25:02 | 000,000,000 | R—D | C] — C:UsersHelenaFavorites
[2010.05.17 17:25:02 | 000,000,000 | R—D | C] — C:UsersHelenaDownloads
[2010.05.17 17:25:02 | 000,000,000 | R—D | C] — C:UsersHelenaDocuments
[2010.05.17 17:25:02 | 000,000,000 | R—D | C] — C:UsersHelenaDesktop
[2010.05.17 17:25:02 | 000,000,000 | -HSD | C] — C:UsersHelenaVorlagen
[2010.05.17 17:25:02 | 000,000,000 | -HSD | C] — C:UsersHelenaAppDataLocalVerlauf
[2010.05.17 17:25:02 | 000,000,000 | -HSD | C] — C:UsersHelenaAppDataLocalTemporary Internet Files
[2010.05.17 17:25:02 | 000,000,000 | -HSD | C] — C:UsersHelenaStartmenü
[2010.05.17 17:25:02 | 000,000,000 | -HSD | C] — C:UsersHelenaSendTo
[2010.05.17 17:25:02 | 000,000,000 | -HSD | C] — C:UsersHelenaRecent
[2010.05.17 17:25:02 | 000,000,000 | -HSD | C] — C:UsersHelenaNetzwerkumgebung
[2010.05.17 17:25:02 | 000,000,000 | -HSD | C] — C:UsersHelenaLokale Einstellungen
[2010.05.17 17:25:02 | 000,000,000 | -HSD | C] — C:UsersHelenaDocumentsEigene Videos
[2010.05.17 17:25:02 | 000,000,000 | -HSD | C] — C:UsersHelenaDocumentsEigene Musik
[2010.05.17 17:25:02 | 000,000,000 | -HSD | C] — C:UsersHelenaEigene Dateien
[2010.05.17 17:25:02 | 000,000,000 | -HSD | C] — C:UsersHelenaDocumentsEigene Bilder
[2010.05.17 17:25:02 | 000,000,000 | -HSD | C] — C:UsersHelenaDruckumgebung
[2010.05.17 17:25:02 | 000,000,000 | -HSD | C] — C:UsersHelenaCookies
[2010.05.17 17:25:02 | 000,000,000 | -HSD | C] — C:UsersHelenaAppDataLocalAnwendungsdaten
[2010.05.17 17:25:02 | 000,000,000 | -HSD | C] — C:UsersHelenaAnwendungsdaten
[2010.05.17 17:25:02 | 000,000,000 | -H-D | C] — C:UsersHelenaAppData
[2010.05.17 17:25:02 | 000,000,000 | —D | C] — C:UsersHelenaAppDataLocalTemp
[2010.05.17 17:25:02 | 000,000,000 | —D | C] — C:UsersHelenaAppDataLocalMicrosoft
[2010.05.17 17:25:02 | 000,000,000 | —D | C] — C:UsersHelenaAppDataRoamingMedia Center Programs
[2010.05.17 17:24:49 | 000,000,000 | -HSD | C] — C:ProgramDataVorlagen
[2010.05.17 17:24:49 | 000,000,000 | -HSD | C] — C:ProgramDataStartmenü
[2010.05.17 17:24:49 | 000,000,000 | -HSD | C] — C:Recovery
[2010.05.17 17:24:49 | 000,000,000 | -HSD | C] — C:Programme
[2010.05.17 17:24:49 | 000,000,000 | -HSD | C] — C:Program FilesGemeinsame Dateien
[2010.05.17 17:24:49 | 000,000,000 | -HSD | C] — C:ProgramDataFavoriten
[2010.05.17 17:24:49 | 000,000,000 | -HSD | C] — C:UsersPublicDocumentsEigene Videos
[2010.05.17 17:24:49 | 000,000,000 | -HSD | C] — C:UsersPublicDocumentsEigene Musik
[2010.05.17 17:24:49 | 000,000,000 | -HSD | C] — C:UsersPublicDocumentsEigene Bilder
[2010.05.17 17:24:49 | 000,000,000 | -HSD | C] — C:Dokumente und Einstellungen
[2010.05.17 17:24:49 | 000,000,000 | -HSD | C] — C:ProgramDataDokumente
[2010.05.17 17:24:49 | 000,000,000 | -HSD | C] — C:ProgramDataAnwendungsdaten
[2010.05.17 17:14:54 | 000,000,000 | —D | C] — C:WindowsSoftwareDistribution
[2010.05.17 17:12:17 | 000,000,000 | —D | C] — C:WindowsPrefetch
[2010.05.17 17:12:01 | 000,000,000 | -HSD | C] — C:System Volume Information========== Files — Modified Within 30 Days ==========
[2010.06.04 00:54:14 | 000,000,438 | —- | M] () — C:Windowswin.ini
[2010.06.04 00:54:13 | 001,048,576 | -HS- | M] () — C:UsersHelenaNTUSER.DAT
[2010.06.04 00:52:01 | 000,000,006 | -H— | M] () — C:WindowstasksSA.DAT
[2010.06.04 00:51:59 | 000,067,584 | —S- | M] () — C:Windowsbootstat.dat
[2010.06.04 00:51:54 | 1610,260,480 | -HS- | M] () — C:hiberfil.sys
[2010.06.04 00:22:52 | 000,014,784 | -H— | M] () — C:WindowsSystem327B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010.06.04 00:22:51 | 000,014,784 | -H— | M] () — C:WindowsSystem327B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010.06.04 00:22:48 | 004,478,069 | -H— | M] () — C:UsersHelenaAppDataLocalIconCache.db
[2010.06.04 00:07:18 | 000,003,544 | —- | M] () — C:bootsqm.dat
[2010.06.01 07:55:43 | 002,130,706 | —- | M] () — C:WindowsSystem32PerfStringBackup.INI
[2010.06.01 07:55:43 | 000,629,988 | —- | M] () — C:WindowsSystem32perfh019.dat
[2010.06.01 07:55:43 | 000,603,832 | —- | M] () — C:WindowsSystem32perfh007.dat
[2010.06.01 07:55:43 | 000,571,696 | —- | M] () — C:WindowsSystem32perfh009.dat
[2010.06.01 07:55:43 | 000,120,914 | —- | M] () — C:WindowsSystem32perfc019.dat
[2010.06.01 07:55:43 | 000,118,106 | —- | M] () — C:WindowsSystem32perfc007.dat
[2010.06.01 07:55:43 | 000,095,590 | —- | M] () — C:WindowsSystem32perfc009.dat
[2010.05.22 15:25:47 | 000,000,000 | —- | M] () — C:WindowsSystem32settings.dat
[2010.05.22 00:01:46 | 000,000,017 | —- | M] () — C:UsersHelenaAppDataLocalresmon.resmoncfg
[2010.05.21 23:21:55 | 000,002,853 | —- | M] () — C:Windows_default.pif
[2010.05.21 22:51:37 | 000,000,000 | RHS- | M] () — C:MSDOS.SYS
[2010.05.21 22:51:37 | 000,000,000 | RHS- | M] () — C:IO.SYS
[2010.05.19 21:48:14 | 000,000,252 | —- | M] () — C:Windowssystem.ini
[2010.05.17 19:14:46 | 000,004,902 | —- | M] () — C:ProgramDatamtbjfghn.xbe
[2010.05.17 19:13:33 | 000,164,260 | —- | M] () — C:Windowshpoins19.dat
[2010.05.17 18:38:07 | 000,067,832 | —- | M] () — C:UsersHelenaDesktop3.PNG
[2010.05.17 18:33:10 | 000,060,582 | —- | M] () — C:UsersHelenaDesktop2.PNG
[2010.05.17 18:29:57 | 000,057,560 | —- | M] () — C:UsersHelenaAppDataLocalGDIPFONTCACHEV1.DAT
[2010.05.17 18:11:06 | 000,008,192 | RHS- | M] () — C:BOOTSECT.BAK
[2010.05.17 17:29:22 | 000,524,288 | -HS- | M] () — C:UsersHelenaNTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms
[2010.05.17 17:29:22 | 000,524,288 | -HS- | M] () — C:UsersHelenaNTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms
[2010.05.17 17:29:22 | 000,065,536 | -HS- | M] () — C:UsersHelenaNTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf
[2010.05.17 17:29:10 | 000,336,704 | —- | M] () — C:WindowsSystem32perfi019.dat
[2010.05.17 17:29:10 | 000,039,446 | —- | M] () — C:WindowsSystem32perfd019.dat
[2010.05.17 17:25:02 | 000,000,020 | -HS- | M] () — C:UsersHelenantuser.ini
[2010.05.17 17:16:33 | 000,265,640 | —- | M] () — C:WindowsSystem32FNTCACHE.DAT
[2010.05.17 17:15:32 | 000,053,911 | —- | M] () — C:WindowsSystem32license.rtf
[2010.05.17 17:13:52 | 000,000,000 | —- | M] () — C:Windowsativpsrm.bin
[2010.05.17 17:13:33 | 000,000,000 | -H— | M] () — C:WindowsSystem32driversMsft_User_WpdFs_01_09_00.Wdf========== Files Created — No Company Name ==========
[2010.06.04 00:07:18 | 000,003,544 | —- | C] () — C:bootsqm.dat
[2010.05.22 15:25:47 | 000,000,000 | —- | C] () — C:WindowsSystem32settings.dat
[2010.05.22 00:01:46 | 000,000,017 | —- | C] () — C:UsersHelenaAppDataLocalresmon.resmoncfg
[2010.05.21 22:51:37 | 000,000,000 | RHS- | C] () — C:MSDOS.SYS
[2010.05.21 22:51:37 | 000,000,000 | RHS- | C] () — C:IO.SYS
[2010.05.17 19:14:46 | 000,004,902 | —- | C] () — C:ProgramDatamtbjfghn.xbe
[2010.05.17 18:51:34 | 000,000,295 | —- | C] () — C:ProgramDatahpzinstall.log
[2010.05.17 18:51:33 | 000,164,260 | —- | C] () — C:Windowshpoins19.dat
[2010.05.17 18:45:00 | 000,165,376 | —- | C] () — C:WindowsSystem32unrar.dll
[2010.05.17 18:45:00 | 000,000,038 | —- | C] () — C:Windowsavisplitter.ini
[2010.05.17 18:44:59 | 000,881,664 | —- | C] () — C:WindowsSystem32xvidcore.dll
[2010.05.17 18:44:59 | 000,205,824 | —- | C] () — C:WindowsSystem32xvidvfw.dll
[2010.05.17 18:44:59 | 000,000,414 | —- | C] () — C:WindowsSystem32lame_acm.xml
[2010.05.17 18:44:58 | 003,596,288 | —- | C] () — C:WindowsSystem32qt-dx331.dll
[2010.05.17 18:44:57 | 000,085,504 | —- | C] () — C:WindowsSystem32ff_vfw.dll
[2010.05.17 18:44:57 | 000,000,547 | —- | C] () — C:WindowsSystem32ff_vfw.dll.manifest
[2010.05.17 18:38:07 | 000,067,832 | —- | C] () — C:UsersHelenaDesktop3.PNG
[2010.05.17 18:33:10 | 000,060,582 | —- | C] () — C:UsersHelenaDesktop2.PNG
[2010.05.17 18:11:06 | 000,008,192 | RHS- | C] () — C:BOOTSECT.BAK
[2010.05.17 18:11:05 | 000,383,562 | RHS- | C] () — C:bootmgr
[2010.05.17 17:32:03 | 000,336,704 | —- | C] () — C:WindowsSystem32perfi019.dat
[2010.05.17 17:32:02 | 000,629,988 | —- | C] () — C:WindowsSystem32perfh019.dat
[2010.05.17 17:32:02 | 000,120,914 | —- | C] () — C:WindowsSystem32perfc019.dat
[2010.05.17 17:32:02 | 000,039,446 | —- | C] () — C:WindowsSystem32perfd019.dat
[2010.05.17 17:25:02 | 001,048,576 | -HS- | C] () — C:UsersHelenaNTUSER.DAT
[2010.05.17 17:25:02 | 000,524,288 | -HS- | C] () — C:UsersHelenaNTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms
[2010.05.17 17:25:02 | 000,524,288 | -HS- | C] () — C:UsersHelenaNTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms
[2010.05.17 17:25:02 | 000,262,144 | -HS- | C] () — C:UsersHelenantuser.dat.LOG1
[2010.05.17 17:25:02 | 000,065,536 | -HS- | C] () — C:UsersHelenaNTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf
[2010.05.17 17:25:02 | 000,000,020 | -HS- | C] () — C:UsersHelenantuser.ini
[2010.05.17 17:25:02 | 000,000,000 | -HS- | C] () — C:UsersHelenantuser.dat.LOG2
[2010.05.17 17:13:52 | 000,000,000 | —- | C] () — C:Windowsativpsrm.bin
[2010.05.17 17:13:33 | 000,000,000 | -H— | C] () — C:WindowsSystem32driversMsft_User_WpdFs_01_09_00.Wdf
[2010.05.17 17:12:01 | 1610,260,480 | -HS- | C] () — C:hiberfil.sys
[2009.07.14 02:55:09 | 000,587,776 | —- | C] () — C:WindowsSystem32hpotscl1.dll
[2009.07.14 01:51:43 | 000,073,728 | —- | C] () — C:WindowsSystem32BthpanContextHandler.dll
[2009.07.14 01:42:10 | 000,064,000 | —- | C] () — C:WindowsSystem32BWContextHandler.dll
[2002.03.21 15:39:02 | 000,073,728 | —- | C] () — C:WindowsSystem32UNACEV2.DLL========== Files — Unicode (All) ==========
[2010.05.19 21:49:18 | 000,000,666 | —- | M] ()(C:UsersHelenaDesktopFOTOSCHOP — ?????.lnk) — C:UsersHelenaDesktopFOTOSCHOP — Ярлык.lnk
[2010.05.19 21:49:18 | 000,000,666 | —- | C] ()(C:UsersHelenaDesktopFOTOSCHOP — ?????.lnk) — C:UsersHelenaDesktopFOTOSCHOP — Ярлык.lnk
[2010.05.17 18:41:19 | 000,001,106 | —- | M] ()(C:UsersHelenaDesktopAdobe Photoshop CS3 — ?????.lnk) — C:UsersHelenaDesktopAdobe Photoshop CS3 — Ярлык.lnk
[2010.05.17 18:41:19 | 000,001,106 | —- | C] ()(C:UsersHelenaDesktopAdobe Photoshop CS3 — ?????.lnk) — C:UsersHelenaDesktopAdobe Photoshop CS3 — Ярлык.lnk
[2010.05.17 18:30:23 | 000,075,684 | —- | M] ()(C:UsersHelenaDesktop??????.PNG) — C:UsersHelenaDesktopСнимок.PNG
[2010.05.17 18:30:22 | 000,075,684 | —- | C] ()(C:UsersHelenaDesktop??????.PNG) — C:UsersHelenaDesktopСнимок.PNGЗдравствуйте, добро пожаловать на Spyware-ru форум.
Выполним дополнительную проверку.
Скачайте программу Combofix. Закройте все открытые окна и запустите эту программу.
После выполнения будет создан лог файл, пожалуйста вставьте его в ваш ответ.
- Для ответа в этой теме необходимо авторизоваться.
