Обнаружен TroJan/ Что делать?

This topic has 15 ответов, 2 участника, and was last updated 15 years назад by Admin.

Просмотр 15 сообщений - с 1 по 15 (из 16 всего)

1 2 →

Автор

Сообщения
6 октября, 2009 в 7:27 пп #17232
Ma3e6ka
Participant
- Темы:7
- Сообщений:22
Не могла скачать Media-программу с файлообменника, воспользовалась предложением скачать и установить Free Download Manager. После установки появилось приложение Softwear Manager (притом, что я не разрешила WinPatrol’ю установку), оно стало требовать обновления нескольких программ (упоминался браузер IE8, хоть я пользуюсь Мозиллой). С рабочего стола и нижней панели исчезли ярлыки всех антивирусов и антишпионов (DrWeb, WinPatrol, Хайджек, RKU, RegistryBooster, Unlocker). Сканер DrWeb определил Trojan’а в Spybot-Search&Destroy. Хотела удалить — и не могу, три файла заблокированы. В Хайджеке профиксила две строки, перезагрузилась, но после повторного сканирования они повторились.
Посмотрите отчеты, пожалуйста, и скажите, что еще сделать.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:12:10, on 06.10.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesAskBarDisbarbinAskService.exe
c:Program FilesBonjourmDNSResponder.exe
C:Program FilesCommon FilesDoctor WebScanning Enginedwengine.exe
C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGmdm.exe
C:WINDOWSsystem32nvsvc32.exe
C:PROGRA~1DrWebspidernt.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32SearchIndexer.exe
C:WINDOWSExplorer.EXE
C:Program FilesDrWebSpIDerAgent.exe
C:Program FilesDrWebspiderml.exe
C:Program FilesDrWebspidergate.exe
C:PROGRA~1DrWebspiderui.exe
C:Program FilesAnalog DevicesCoresmax4pnp.exe
C:Program FilesWinampwinampa.exe
C:Program FilesBillP StudiosWinPatrolwinpatrol.exe
E:Program FilesABBYY Lingvo 9.0 Multilingual DictionaryLvagent.exe
C:Program FilesABBYY FineReader 7.0 Professional EditionAbbyyNewsReader.exe
C:Program FilesScanSoftOmniPageSE2.0OpwareSE2.exe
E:Program FilesUnlockerUnlockerAssistant.exe
C:WINDOWSsystem32ctfmon.exe
C:Documents and SettingsЕленаLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe
C:Program FilesSpybot — Search & DestroyTeaTimer.exe
E:Program FilesFree Download Managerfdm.exe
C:Program FilesWindows Desktop SearchWindowsSearch.exe
C:WINDOWSsystem32wuauclt.exe
C:Program FilesTrend MicroHijackThisHijackThis.exe

R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://www.rambler.ru/ie8
R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.rambler.ru/ie8
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page =
R1 — HKCUSoftwareMicrosoftInternet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Window Title = Windows Internet Explorer предоставлен: Rambler
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: Winamp Search Class — {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} — C:Program FilesWinamp Toolbarwinamptb.dll
O2 — BHO: Adobe PDF Reader Link Helper — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 — BHO: AskBar BHO — {201f27d4-3704-41d6-89c1-aa35e39143ed} — C:Program FilesAskBarDisbarbinaskBar.dll
O2 — BHO: Winamp Toolbar Loader — {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} — C:Program FilesWinamp Toolbarwinamptb.dll
O2 — BHO: Spybot-S&D IE Protection — {53707962-6F74-2D53-2644-206D7942484F} — C:PROGRA~1SPYBOT~1SDHelper.dll
O2 — BHO: (no name) — {A5366673-E8CA-11D3-9CD9-0090271D075B} — (no file)
O2 — BHO: FDMIECookiesBHO Class — {CC59E0F9-7E43-44FA-9FAA-8377850BF205} — E:Program FilesFree Download Manageriefdm2.dll
O3 — Toolbar: Ask Toolbar — {3041d03e-fd4b-44e0-b742-2d9b88305f98} — C:Program FilesAskBarDisbarbinaskBar.dll
O3 — Toolbar: Rambler-Ассистент — {468CD8A9-7C25-45FA-969E-3D925C689DC4} — C:Program FilesRambler AssistantramblertoolbarU5950.dll
O3 — Toolbar: Winamp Toolbar — {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} — C:Program FilesWinamp Toolbarwinamptb.dll
O3 — Toolbar: Easy-WebPrint — {327C2873-E90D-4c37-AA9D-10AC9BABA46C} — C:Program FilesCanonEasy-WebPrintToolband.dll
O4 — HKLM..Run: [SpIDerAgent] «C:Program FilesDrWebSpIDerAgent.exe»
O4 — HKLM..Run: [SpIDerMail] «C:Program FilesDrWebspiderml.exe»
O4 — HKLM..Run: [SpIDerGate] «C:Program FilesDrWebspidergate.exe» -autorun
O4 — HKLM..Run: [SpIDerNT] C:PROGRA~1DrWebspiderui.exe /agent
O4 — HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:windowssystem32NvCpl.dll,NvStartup
O4 — HKLM..Run: [SoundMAXPnP] C:Program FilesAnalog DevicesCoresmax4pnp.exe
O4 — HKLM..Run: [WinampAgent] «C:Program FilesWinampwinampa.exe»
O4 — HKLM..Run: [update_smartcleaner] «E:Program FilesSmart CleanerUUpdate.exe»
O4 — HKLM..Run: [SmartCleaner] E:Program FilesSmart CleanerSmartCleaner.exe /SCHEDULED
O4 — HKLM..Run: [WinPatrol] C:Program FilesBillP StudiosWinPatrolwinpatrol.exe -expressboot
O4 — HKLM..Run: [Lingvo Launcher] «E:Program FilesABBYY Lingvo 9.0 Multilingual DictionaryLvagent.exe» /STARTUP
O4 — HKLM..Run: [FineReader7NewsReaderPro] C:Program FilesABBYY FineReader 7.0 Professional EditionAbbyyNewsReader.exe
O4 — HKLM..Run: [OpwareSE2] «C:Program FilesScanSoftOmniPageSE2.0OpwareSE2.exe»
O4 — HKLM..Run: [OPSE reminder] «C:Program FilesScanSoftOmniPageSE2.0EregEngEreg.exe» -r «C:Program FilesScanSoftOmniPageSE2.0EregEngereg.ini»
O4 — HKLM..Run: [UnlockerAssistant] «E:Program FilesUnlockerUnlockerAssistant.exe»
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [Google Update] «C:Documents and SettingsЕленаLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe» /c
O4 — HKCU..Run: [SpybotSD TeaTimer] C:Program FilesSpybot — Search & DestroyTeaTimer.exe
O4 — HKCU..Run: [Free Download Manager] «E:Program FilesFree Download Managerfdm.exe» -autorun
O4 — HKCU..Run: [Software Informer] «C:Program FilesSoftware Informersoftinfo.exe» -autorun
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-20..RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-21-1659004503-963894560-1801674531-1001..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe (User ‘Пользователь’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — HKUS.DEFAULT..RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User ‘Default user’)
O4 — S-1-5-18 Startup: Start HASP-Emu.lnk = C:Program FilesSableWINNTstartnt.bat (User ‘SYSTEM’)
O4 — .DEFAULT Startup: Start HASP-Emu.lnk = C:Program FilesSableWINNTstartnt.bat (User ‘Default user’)
O4 — Startup: Start HASP-Emu.lnk = C:Program FilesSableWINNTstartnt.bat
O4 — Global Startup: Windows Search.lnk = C:Program FilesWindows Desktop SearchWindowsSearch.exe
O8 — Extra context menu item: &Winamp Search — C:Documents and SettingsAll UsersApplication DataWinamp ToolbarieToolbarresourcesen-USlocalsearch.html
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2Office12EXCEL.EXE/3000
O8 — Extra context menu item: Scan link by Dr.Web — http://www.drweb.com/online/drweb-online-en.html
O8 — Extra context menu item: Закачать все при помощи FlashGet — C:Program FilesFlashGetjc_all.htm
O8 — Extra context menu item: Закачать все с помощью FDM — file://E:Program FilesFree Download Managerdlall.htm
O8 — Extra context menu item: Закачать выбранное с помощью FDM — file://E:Program FilesFree Download Managerdlselected.htm
O8 — Extra context menu item: Закачать при помощи FlashGet — C:Program FilesFlashGetjc_link.htm
O8 — Extra context menu item: Закачать с помощью FDM — file://E:Program FilesFree Download Managerdllink.htm
O8 — Extra context menu item: Скачать видео с Free Download Manager — file://E:Program FilesFree Download Managerdlfvideo.htm
O9 — Extra button: Research — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2Office12REFIEBAR.DLL
O9 — Extra button: FlashGet — {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} — C:PROGRA~1FlashGetflashget.exe (file missing)
O9 — Extra ‘Tools’ menuitem: &FlashGet — {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} — C:PROGRA~1FlashGetflashget.exe (file missing)
O9 — Extra button: (no name) — {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} — C:PROGRA~1SPYBOT~1SDHelper.dll
O9 — Extra ‘Tools’ menuitem: Spybot — Search & Destroy Configuration — {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} — C:PROGRA~1SPYBOT~1SDHelper.dll
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O16 — DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) — http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1239361321687
O16 — DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) — http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1240583994578
O16 — DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) — http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 — HKLMSystemCCSServicesTcpip..{D358EA3B-175F-4DFE-A801-4825A76E29D1}: NameServer = 192.168.1.1
O23 — Service: 4AEBF67C — Unknown owner — C:WINDOWSsystem324AEBF67C.exe (file missing)
O23 — Service: Adobe LM Service — Unknown owner — C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe
O23 — Service: ASKService — Unknown owner — C:Program FilesAskBarDisbarbinAskService.exe
O23 — Service: ASKUpgrade — Unknown owner — C:Program FilesAskBarDisbarbinASKUpgrade.exe
O23 — Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) — Apple Computer, Inc. — c:Program FilesBonjourmDNSResponder.exe
O23 — Service: Dr.Web Scanning Engine (DrWebEngine) (DrWebEngine) — Doctor Web, Ltd. — C:Program FilesCommon FilesDoctor WebScanning Enginedwengine.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: FLEXnet Licensing Service — Macrovision Europe Ltd. — C:Program FilesCommon FilesMacrovision SharedFLEXnet PublisherFNPLicensingService.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: NVIDIA Display Driver Service (NVSvc) — NVIDIA Corporation — C:WINDOWSsystem32nvsvc32.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: SpIDer Guard for Windows (SPIDERNT) — Doctor Web, Ltd. — C:PROGRA~1DrWebspidernt.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe
—
End of file — 12098 bytes
6 октября, 2009 в 7:33 пп #26214
Ma3e6ka
Participant
- Темы:7
- Сообщений:22
GMER 1.0.15.15125 — http://www.gmer.net
Rootkit scan 2009-10-06 22:22:26
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:Temppxtdapob.sys

—- System — GMER 1.0.15 —-

SSDT dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.) ZwOpenSection [0xBA6CEF86]
SSDT dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.) ZwSystemDebugControl [0xBA6CEEBC]

—- User code sections — GMER 1.0.15 —-

.text C:WINDOWSsystem32SearchIndexer.exe[332] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 00585C0C C:WINDOWSsystem32MSSRCH.DLL (mssrch.dll/Microsoft Corporation)
.text C:WINDOWSExplorer.EXE[2732] SHELL32.dll!SHFileOperationW 7CA70924 5 Bytes JMP 00B31102 E:Program FilesUnlockerUnlockerHook.dll

—- Devices — GMER 1.0.15 —-

AttachedDevice FileSystemNtfs Ntfs IRP_MJ_CREATE AttachedDevice FileSystemNtfs Ntfs IRP_MJ_CREATE_NAMED_PIPE AttachedDevice FileSystemNtfs Ntfs IRP_MJ_CLOSE AttachedDevice FileSystemNtfs Ntfs IRP_MJ_READ AttachedDevice FileSystemNtfs Ntfs IRP_MJ_WRITE AttachedDevice FileSystemNtfs Ntfs IRP_MJ_QUERY_INFORMATION AttachedDevice FileSystemNtfs Ntfs IRP_MJ_SET_INFORMATION AttachedDevice FileSystemNtfs Ntfs IRP_MJ_QUERY_EA AttachedDevice FileSystemNtfs Ntfs IRP_MJ_SET_EA AttachedDevice FileSystemNtfs Ntfs IRP_MJ_FLUSH_BUFFERS AttachedDevice FileSystemNtfs Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION AttachedDevice FileSystemNtfs Ntfs IRP_MJ_SET_VOLUME_INFORMATION AttachedDevice FileSystemNtfs Ntfs IRP_MJ_DIRECTORY_CONTROL AttachedDevice FileSystemNtfs Ntfs IRP_MJ_FILE_SYSTEM_CONTROL AttachedDevice FileSystemNtfs Ntfs IRP_MJ_DEVICE_CONTROL AttachedDevice FileSystemNtfs Ntfs IRP_MJ_INTERNAL_DEVICE_CONTROL AttachedDevice FileSystemNtfs Ntfs IRP_MJ_SHUTDOWN AttachedDevice FileSystemNtfs Ntfs IRP_MJ_LOCK_CONTROL AttachedDevice FileSystemNtfs Ntfs IRP_MJ_CLEANUP AttachedDevice FileSystemNtfs Ntfs IRP_MJ_CREATE_MAILSLOT AttachedDevice FileSystemNtfs Ntfs IRP_MJ_QUERY_SECURITY AttachedDevice FileSystemNtfs Ntfs IRP_MJ_SET_SECURITY AttachedDevice FileSystemNtfs Ntfs IRP_MJ_POWER AttachedDevice FileSystemNtfs Ntfs IRP_MJ_SYSTEM_CONTROL AttachedDevice FileSystemNtfs Ntfs IRP_MJ_DEVICE_CHANGE AttachedDevice FileSystemNtfs Ntfs IRP_MJ_QUERY_QUOTA AttachedDevice FileSystemNtfs Ntfs IRP_MJ_SET_QUOTA AttachedDevice FileSystemNtfs Ntfs IRP_MJ_CREATE AttachedDevice FileSystemNtfs Ntfs IRP_MJ_CREATE_NAMED_PIPE AttachedDevice FileSystemNtfs Ntfs IRP_MJ_CLOSE AttachedDevice FileSystemNtfs Ntfs IRP_MJ_READ AttachedDevice FileSystemNtfs Ntfs IRP_MJ_WRITE AttachedDevice FileSystemNtfs Ntfs IRP_MJ_QUERY_INFORMATION AttachedDevice FileSystemNtfs Ntfs IRP_MJ_SET_INFORMATION AttachedDevice FileSystemNtfs Ntfs IRP_MJ_QUERY_EA AttachedDevice FileSystemNtfs Ntfs IRP_MJ_SET_EA AttachedDevice FileSystemNtfs Ntfs IRP_MJ_FLUSH_BUFFERS AttachedDevice FileSystemNtfs Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION AttachedDevice FileSystemNtfs Ntfs IRP_MJ_SET_VOLUME_INFORMATION AttachedDevice FileSystemNtfs Ntfs IRP_MJ_DIRECTORY_CONTROL AttachedDevice FileSystemNtfs Ntfs IRP_MJ_FILE_SYSTEM_CONTROL AttachedDevice FileSystemNtfs Ntfs IRP_MJ_DEVICE_CONTROL AttachedDevice FileSystemNtfs Ntfs IRP_MJ_INTERNAL_DEVICE_CONTROL AttachedDevice FileSystemNtfs Ntfs IRP_MJ_SHUTDOWN AttachedDevice FileSystemNtfs Ntfs IRP_MJ_LOCK_CONTROL AttachedDevice FileSystemNtfs Ntfs IRP_MJ_CLEANUP AttachedDevice FileSystemNtfs Ntfs IRP_MJ_CREATE_MAILSLOT AttachedDevice FileSystemNtfs Ntfs IRP_MJ_QUERY_SECURITY AttachedDevice FileSystemNtfs Ntfs IRP_MJ_SET_SECURITY AttachedDevice FileSystemNtfs Ntfs IRP_MJ_POWER AttachedDevice FileSystemNtfs Ntfs IRP_MJ_SYSTEM_CONTROL AttachedDevice FileSystemNtfs Ntfs IRP_MJ_DEVICE_CHANGE AttachedDevice FileSystemNtfs Ntfs IRP_MJ_QUERY_QUOTA AttachedDevice FileSystemNtfs Ntfs IRP_MJ_SET_QUOTA AttachedDevice DriverTcpip DeviceIp IRP_MJ_CREATE AttachedDevice DriverTcpip DeviceIp IRP_MJ_CREATE_NAMED_PIPE AttachedDevice DriverTcpip DeviceIp IRP_MJ_CLOSE AttachedDevice DriverTcpip DeviceIp IRP_MJ_READ AttachedDevice DriverTcpip DeviceIp IRP_MJ_WRITE AttachedDevice DriverTcpip DeviceIp IRP_MJ_QUERY_INFORMATION AttachedDevice DriverTcpip DeviceIp IRP_MJ_SET_INFORMATION AttachedDevice DriverTcpip DeviceIp IRP_MJ_QUERY_EA AttachedDevice DriverTcpip DeviceIp IRP_MJ_SET_EA AttachedDevice DriverTcpip DeviceIp IRP_MJ_FLUSH_BUFFERS AttachedDevice DriverTcpip DeviceIp IRP_MJ_QUERY_VOLUME_INFORMATION AttachedDevice DriverTcpip DeviceIp IRP_MJ_SET_VOLUME_INFORMATION AttachedDevice DriverTcpip DeviceIp IRP_MJ_DIRECTORY_CONTROL AttachedDevice DriverTcpip DeviceIp IRP_MJ_FILE_SYSTEM_CONTROL AttachedDevice DriverTcpip DeviceIp IRP_MJ_DEVICE_CONTROL AttachedDevice DriverTcpip DeviceIp IRP_MJ_INTERNAL_DEVICE_CONTROL AttachedDevice DriverTcpip DeviceIp IRP_MJ_SHUTDOWN AttachedDevice DriverTcpip DeviceIp IRP_MJ_LOCK_CONTROL AttachedDevice DriverTcpip DeviceIp IRP_MJ_CLEANUP AttachedDevice DriverTcpip DeviceIp IRP_MJ_CREATE_MAILSLOT AttachedDevice DriverTcpip DeviceIp IRP_MJ_QUERY_SECURITY AttachedDevice DriverTcpip DeviceIp IRP_MJ_SET_SECURITY AttachedDevice DriverTcpip DeviceIp IRP_MJ_POWER AttachedDevice DriverTcpip DeviceIp IRP_MJ_SYSTEM_CONTROL AttachedDevice DriverTcpip DeviceIp IRP_MJ_DEVICE_CHANGE AttachedDevice DriverTcpip DeviceIp IRP_MJ_QUERY_QUOTA AttachedDevice DriverTcpip DeviceIp IRP_MJ_SET_QUOTA AttachedDevice DriverTcpip DeviceTcp IRP_MJ_CREATE AttachedDevice DriverTcpip DeviceTcp IRP_MJ_CREATE_NAMED_PIPE AttachedDevice DriverTcpip DeviceTcp IRP_MJ_CLOSE AttachedDevice DriverTcpip DeviceTcp IRP_MJ_READ AttachedDevice DriverTcpip DeviceTcp IRP_MJ_WRITE AttachedDevice DriverTcpip DeviceTcp IRP_MJ_QUERY_INFORMATION AttachedDevice DriverTcpip DeviceTcp IRP_MJ_SET_INFORMATION AttachedDevice DriverTcpip DeviceTcp IRP_MJ_QUERY_EA AttachedDevice DriverTcpip DeviceTcp IRP_MJ_SET_EA AttachedDevice DriverTcpip DeviceTcp IRP_MJ_FLUSH_BUFFERS AttachedDevice DriverTcpip DeviceTcp IRP_MJ_QUERY_VOLUME_INFORMATION AttachedDevice DriverTcpip DeviceTcp IRP_MJ_SET_VOLUME_INFORMATION AttachedDevice DriverTcpip DeviceTcp IRP_MJ_DIRECTORY_CONTROL AttachedDevice DriverTcpip DeviceTcp IRP_MJ_FILE_SYSTEM_CONTROL AttachedDevice DriverTcpip DeviceTcp IRP_MJ_DEVICE_CONTROL AttachedDevice DriverTcpip DeviceTcp IRP_MJ_INTERNAL_DEVICE_CONTROL AttachedDevice DriverTcpip DeviceTcp IRP_MJ_SHUTDOWN AttachedDevice DriverTcpip DeviceTcp IRP_MJ_LOCK_CONTROL AttachedDevice DriverTcpip DeviceTcp IRP_MJ_CLEANUP AttachedDevice DriverTcpip DeviceTcp IRP_MJ_CREATE_MAILSLOT AttachedDevice DriverTcpip DeviceTcp IRP_MJ_QUERY_SECURITY AttachedDevice DriverTcpip DeviceTcp IRP_MJ_SET_SECURITY AttachedDevice DriverTcpip DeviceTcp IRP_MJ_POWER AttachedDevice DriverTcpip DeviceTcp IRP_MJ_SYSTEM_CONTROL AttachedDevice DriverTcpip DeviceTcp IRP_MJ_DEVICE_CHANGE AttachedDevice DriverTcpip DeviceTcp IRP_MJ_QUERY_QUOTA AttachedDevice DriverTcpip DeviceTcp IRP_MJ_SET_QUOTA AttachedDevice DriverTcpip DeviceTcp IRP_MJ_CREATE AttachedDevice DriverTcpip DeviceTcp IRP_MJ_CREATE_NAMED_PIPE AttachedDevice DriverTcpip DeviceTcp IRP_MJ_CLOSE AttachedDevice DriverTcpip DeviceTcp IRP_MJ_READ AttachedDevice DriverTcpip DeviceTcp IRP_MJ_WRITE AttachedDevice DriverTcpip DeviceTcp IRP_MJ_QUERY_INFORMATION AttachedDevice DriverTcpip DeviceTcp IRP_MJ_SET_INFORMATION AttachedDevice DriverTcpip DeviceTcp IRP_MJ_QUERY_EA AttachedDevice DriverTcpip DeviceTcp IRP_MJ_SET_EA AttachedDevice DriverTcpip DeviceTcp IRP_MJ_FLUSH_BUFFERS AttachedDevice DriverTcpip DeviceTcp IRP_MJ_QUERY_VOLUME_INFORMATION AttachedDevice DriverTcpip DeviceTcp IRP_MJ_SET_VOLUME_INFORMATION AttachedDevice DriverTcpip DeviceTcp IRP_MJ_DIRECTORY_CONTROL AttachedDevice DriverTcpip DeviceTcp IRP_MJ_FILE_SYSTEM_CONTROL AttachedDevice DriverTcpip DeviceTcp IRP_MJ_DEVICE_CONTROL AttachedDevice DriverTcpip DeviceTcp IRP_MJ_INTERNAL_DEVICE_CONTROL AttachedDevice DriverTcpip DeviceTcp IRP_MJ_SHUTDOWN AttachedDevice DriverTcpip DeviceTcp IRP_MJ_LOCK_CONTROL AttachedDevice DriverTcpip DeviceTcp IRP_MJ_CLEANUP AttachedDevice DriverTcpip DeviceTcp IRP_MJ_CREATE_MAILSLOT AttachedDevice DriverTcpip DeviceTcp IRP_MJ_QUERY_SECURITY AttachedDevice DriverTcpip DeviceTcp IRP_MJ_SET_SECURITY AttachedDevice DriverTcpip DeviceTcp IRP_MJ_POWER AttachedDevice DriverTcpip DeviceTcp IRP_MJ_SYSTEM_CONTROL AttachedDevice DriverTcpip DeviceTcp IRP_MJ_DEVICE_CHANGE AttachedDevice DriverTcpip DeviceTcp IRP_MJ_QUERY_QUOTA AttachedDevice DriverTcpip DeviceTcp IRP_MJ_SET_QUOTA AttachedDevice DriverTcpip DeviceUdp IRP_MJ_CREATE AttachedDevice DriverTcpip DeviceUdp IRP_MJ_CREATE_NAMED_PIPE AttachedDevice DriverTcpip DeviceUdp IRP_MJ_CLOSE AttachedDevice DriverTcpip DeviceUdp IRP_MJ_READ AttachedDevice DriverTcpip DeviceUdp IRP_MJ_WRITE AttachedDevice DriverTcpip DeviceUdp IRP_MJ_QUERY_INFORMATION AttachedDevice DriverTcpip DeviceUdp IRP_MJ_SET_INFORMATION AttachedDevice DriverTcpip DeviceUdp IRP_MJ_QUERY_EA AttachedDevice DriverTcpip DeviceUdp IRP_MJ_SET_EA AttachedDevice DriverTcpip DeviceUdp IRP_MJ_FLUSH_BUFFERS AttachedDevice DriverTcpip DeviceUdp IRP_MJ_QUERY_VOLUME_INFORMATION AttachedDevice DriverTcpip DeviceUdp IRP_MJ_SET_VOLUME_INFORMATION AttachedDevice DriverTcpip DeviceUdp IRP_MJ_DIRECTORY_CONTROL AttachedDevice DriverTcpip DeviceUdp IRP_MJ_FILE_SYSTEM_CONTROL AttachedDevice DriverTcpip DeviceUdp IRP_MJ_DEVICE_CONTROL AttachedDevice DriverTcpip DeviceUdp IRP_MJ_INTERNAL_DEVICE_CONTROL AttachedDevice DriverTcpip DeviceUdp IRP_MJ_SHUTDOWN AttachedDevice DriverTcpip DeviceUdp IRP_MJ_LOCK_CONTROL AttachedDevice DriverTcpip DeviceUdp IRP_MJ_CLEANUP AttachedDevice DriverTcpip DeviceUdp IRP_MJ_CREATE_MAILSLOT AttachedDevice DriverTcpip DeviceUdp IRP_MJ_QUERY_SECURITY AttachedDevice DriverTcpip DeviceUdp IRP_MJ_SET_SECURITY AttachedDevice DriverTcpip DeviceUdp IRP_MJ_POWER AttachedDevice DriverTcpip DeviceUdp IRP_MJ_SYSTEM_CONTROL AttachedDevice DriverTcpip DeviceUdp IRP_MJ_DEVICE_CHANGE AttachedDevice DriverTcpip DeviceUdp IRP_MJ_QUERY_QUOTA AttachedDevice DriverTcpip DeviceUdp IRP_MJ_SET_QUOTA AttachedDevice DriverTcpip DeviceUdp IRP_MJ_CREATE AttachedDevice DriverTcpip DeviceUdp IRP_MJ_CREATE_NAMED_PIPE AttachedDevice DriverTcpip DeviceUdp IRP_MJ_CLOSE AttachedDevice DriverTcpip DeviceUdp IRP_MJ_READ AttachedDevice DriverTcpip DeviceUdp IRP_MJ_WRITE AttachedDevice DriverTcpip DeviceUdp IRP_MJ_QUERY_INFORMATION AttachedDevice DriverTcpip DeviceUdp IRP_MJ_SET_INFORMATION AttachedDevice DriverTcpip DeviceUdp IRP_MJ_QUERY_EA AttachedDevice DriverTcpip DeviceUdp IRP_MJ_SET_EA AttachedDevice DriverTcpip DeviceUdp IRP_MJ_FLUSH_BUFFERS AttachedDevice DriverTcpip DeviceUdp IRP_MJ_QUERY_VOLUME_INFORMATION AttachedDevice DriverTcpip DeviceUdp IRP_MJ_SET_VOLUME_INFORMATION AttachedDevice DriverTcpip DeviceUdp IRP_MJ_DIRECTORY_CONTROL AttachedDevice DriverTcpip DeviceUdp IRP_MJ_FILE_SYSTEM_CONTROL AttachedDevice DriverTcpip DeviceUdp IRP_MJ_DEVICE_CONTROL AttachedDevice DriverTcpip DeviceUdp IRP_MJ_INTERNAL_DEVICE_CONTROL AttachedDevice DriverTcpip DeviceUdp IRP_MJ_SHUTDOWN AttachedDevice DriverTcpip DeviceUdp IRP_MJ_LOCK_CONTROL AttachedDevice DriverTcpip DeviceUdp IRP_MJ_CLEANUP AttachedDevice DriverTcpip DeviceUdp IRP_MJ_CREATE_MAILSLOT AttachedDevice DriverTcpip DeviceUdp IRP_MJ_QUERY_SECURITY AttachedDevice DriverTcpip DeviceUdp IRP_MJ_SET_SECURITY AttachedDevice DriverTcpip DeviceUdp IRP_MJ_POWER AttachedDevice DriverTcpip DeviceUdp IRP_MJ_SYSTEM_CONTROL AttachedDevice DriverTcpip DeviceUdp IRP_MJ_DEVICE_CHANGE AttachedDevice DriverTcpip DeviceUdp IRP_MJ_QUERY_QUOTA AttachedDevice DriverTcpip DeviceUdp IRP_MJ_SET_QUOTA AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_CREATE AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_CREATE_NAMED_PIPE AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_CLOSE AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_READ AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_WRITE AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_QUERY_INFORMATION AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_SET_INFORMATION AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_QUERY_EA AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_SET_EA AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_FLUSH_BUFFERS AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_QUERY_VOLU AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_SET_VOLUME_INFORMATION AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_DIRECTORY_CONTROL AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_FILE_SYSTEM_CONTROL AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_DEVICE_CONTROL AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_INTERNAL_DEVICE_CONTROL AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_SHUTDOWN AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_LOCK_CONTROL AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_CLEANUP AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_CREATE_MAILSLOT AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_QUERY_SECURITY AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_SET_SECURITY AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_POWER AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_SYSTEM_CONTROL AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_DEVICE_CHANGE AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_QUERY_QUOTA AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_SET_QUOTA AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_CREATE AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_CREATE_NAMED_PIPE AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_CLOSE AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_READ AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_WRITE AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_QUERY_INFORMATION AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_SET_INFORMATION AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_QUERY_EA AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_SET_EA AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_FLUSH_BUFFERS AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_QUERY_VOLU AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_SET_VOLUME_INFORMATION AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_DIRECTORY_CONTROL AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_FILE_SYSTEM_CONTROL AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_DEVICE_CONTROL AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_INTERNAL_DEVICE_CONTROL AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_SHUTDOWN AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_LOCK_CONTROL AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_CLEANUP AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_CREATE_MAILSLOT AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_QUERY_SECURITY AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_SET_SECURITY AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_POWER AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_SYSTEM_CONTROL AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_DEVICE_CHANGE AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_QUERY_QUOTA AttachedDevice DriverTcpip DeviceRawIp IRP_MJ_SET_QUOTA [BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
ME_INFORMATION [BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[BA6C0552] dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
ME_INFORMATION [B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
[B6D78D80] spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)

—- EOF — GMER 1.0.15 —-
8 октября, 2009 в 4:14 пп #26215
Admin
Keymaster
- Темы:40
- Сообщений:5676
Здравствуйте, добро пожаловать на Spyware-ru форум.

Скачайте сканер RSIT кликнув по этой ссылке и сохраните файл на вашем рабочем столе.

* Дважды кликните по скачанному файлу.
* Если у вас есть файрвал (firewall) и он покажет, что программа RSIT пытается выйти в Интернет, то разрешите ей.
* Кликните по кнопке Continue.
* Когда программа закончит работу, будут показаны два лога (log.txt и info.txt).

Вставьте оба RSIT лога в ваш ответ. Каждый лог в отдельное сообщение.
12 октября, 2009 в 7:14 пп #26216
Ma3e6ka
Participant
- Темы:7
- Сообщений:22
RSIT после сканирования создала почему-то только один файл.
14 октября, 2009 в 4:12 пп #26217
Admin
Keymaster
- Темы:40
- Сообщений:5676
Проверим ещё одной программой.
Скачайте программу Combofix. Закройте все открытые окна и запустите эту программу.
После выполнения будет создан лог файл, пожалуйста вставьте его в ваш ответ.

Примечание: перед использованием Combofix обязательно установите Recovery console. Как это сделать будет описано на странице, ссылку на которую я привёл выше.
14 октября, 2009 в 11:32 пп #26218
Ma3e6ka
Participant
- Темы:7
- Сообщений:22
На днях сменила антивирус — с DrWeb на ESETNOD32. DrWeb деинсталировала с помощью drweb/remover. Из папки Programme Files тоже удалила (Unlocker). И все равно при запуске Combofix она утверждает, что DrWeb не отключен. Пугает, что в такой ситуации сканирование может нанести вред компьютеру. Как быть?

Я просканировала реестр утилитой CCleaner — она удалила «мусор», кроме одной ссылки:
«Файл, на который указывает ссылка: C:32788R22FWJFWNirCmdC.cfxxe отсутствует. Это обычно происходит после удаления программ. «
Что это за файл? К какой программе он мог относиться? Какое-то странное расширение.

Еще подскажите, как все-таки удалить два файла библиотеки Spybot — Unlocker не может их разблокировать.
18 октября, 2009 в 5:17 пп #26219
Admin
Keymaster
- Темы:40
- Сообщений:5676
«Файл, на который указывает ссылка: C:32788R22FWJFWNirCmdC.cfxxe отсутствует. Это обычно происходит после удаления программ. «
Что это за файл? К какой программе он мог относиться? Какое-то странное расширение.

Этот файл относится к программе Combofix.

Еще подскажите, как все-таки удалить два файла библиотеки Spybot — Unlocker не может их разблокировать.

Вы выполнили деинсталляцию программы ?

На днях сменила антивирус — с DrWeb на ESETNOD32. DrWeb деинсталировала с помощью drweb/remover. Из папки Programme Files тоже удалила (Unlocker). И все равно при запуске Combofix она утверждает, что DrWeb не отключен. Пугает, что в такой ситуации сканирование может нанести вред компьютеру. Как быть?

Запускайте и игнорируйте предупреждение.
23 октября, 2009 в 8:27 дп #26220
Ma3e6ka
Participant
- Темы:7
- Сообщений:22
Добрый день,
просканировала диск с помощью ComboFix, высылаю отчет.
Кстати, WinPatrol предупредил о «прописке» новой программы — нужно ли теперь ее деинсталировать?
26 октября, 2009 в 3:29 пп #26221
Admin
Keymaster
- Темы:40
- Сообщений:5676
Откройте блокнот (Кликните Пуск, Выполнить, в строке ввода введите notepad и нажмите Enter) и вставьте в него следующий текст:
```
Driver::

4AEBF67C



File::

c:windowssystem324AEBF67C.exe
```
Запишите получившийся файл на ваш рабочий стол под именем CFScript
Далее перетащите получившийся файл на иконку Combofix, как показано на картинке ниже.

Сombofix запуститься и выполнит процедуры описанные в созданном нами файле.
По результатам работы Combofix будет создан новый лог, его и вставьте в свой следующий ответ.

WinPatrol предупредил о «прописке» новой программы — нужно ли теперь ее деинсталировать?

Само сообщение и название программы подскажите.
26 октября, 2009 в 11:37 пп #26222
Ma3e6ka
Participant
- Темы:7
- Сообщений:22
Добрый вечер,
спасибо за реальную помощь.

Прежде, чем выполнить ваши указания, решила просканировать, отключив брандмауэр. Получила два файла: ComboFix2 ComboFix-quarantined-files.
Потом сделала, как велели, и получила еще один — ComboFix3.
Второй раз брандмауэр не отключала — получила предупреждение (вышлю фото — PrintScreen не работает).
Высылаю все, что получилось.
27 октября, 2009 в 12:10 дп #26223
Ma3e6ka
Participant
- Темы:7
- Сообщений:22
Извините, самый главный забыла — исправляюсь.
1 ноября, 2009 в 5:26 пп #26224
Admin
Keymaster
- Темы:40
- Сообщений:5676
Как сейчас работает компьютер ?
2 ноября, 2009 в 1:25 дп #26225
Ma3e6ka
Participant
- Темы:7
- Сообщений:22
Спасибо, слава Богу. Если не обращать внимания, что не работают наушники, микрофон, Insert, PrintScreen… Кажется, все (из того, чем пользуюсь). Но работает хорошо, особенно после того, как сменила DrWeb на ESET SmartSecurity. Теперь «летает», как птичка (нашлись вирусы, о которых я и не подозревала. Правда, куда-то делась программа OmniPage — насколько я помню, я ее не удаляла. Не важно, я спокойно обхожусь без нее).

Если я правильно поняла, Вы ничего страшного не увидели, так? Ну, и ладненько. Спасибо Вам огромное (Как-то спокойнее живется, когда знаешь, что Вы «на посту»). Удачи Вам.
7 ноября, 2009 в 5:17 пп #26226
Admin
Keymaster
- Темы:40
- Сообщений:5676
не работают наушники, микрофон

Попробуйте переустановить драйвера для звуковой карты.

уда-то делась программа OmniPage — насколько я помню, я ее не удаляла.

проверьте в панели Добавления/Удаления программ, в слчае чего, переустановите программу.
7 ноября, 2009 в 7:25 пп #26227
Ma3e6ka
Participant
- Темы:7
- Сообщений:22
добрый вечер,
спасибо, так и сделаю.
И отдельное спасибо за Malware: установила, просканировала — и обнаружились еще четыре файла с Трояном, один — в папке system32.
Всех благ вам.
Автор

Сообщения