Созданные ответы форума
-
Сообщения
-
не могу найти эту ветку в реестре HKLM~startupfolderC:^Documents and Settings^Администратор^Главное меню^Программы^Автозагрузка^monoca32.exe что делать?? в программах я не вижу доктора веба.
ComboFix 10-08-26.04 — Администратор 27.08.2010 18:39:54.2.1 — x86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.255.115 [GMT 4:00]
Running from: c:documents and settingsАдминистраторМои документыComboFix.exe
Command switches used :: c:documents and settingsАдминистраторРабочий столCFScript .txt
AV: ESET Smart Security 3.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: Персональный файервол ESET *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Resident AV is activeFILE ::
«c:windowssystem32iJGvnQ3.exe»
«c:windowssystem32nV7DO00.exe»
«c:windowssystem32OePWEWN.exe»
«c:windowssystem32oKuGAS8.exe»
.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.c:docume~19335~1LOCALS~1Temp
c:docume~19335~1LOCALS~1Temp~DF48A4.tmp
c:docume~19335~1LOCALS~1TempIMT13.xml
c:docume~19335~1LOCALS~1TempIMT14.xml
c:docume~19335~1LOCALS~1TempIMT15.xml
c:docume~19335~1LOCALS~1Tempsputnik_1282919242.log
c:docume~19335~1LOCALS~1Tempsputnik_1282919316.log
c:docume~19335~1LOCALS~1Tempsputnik_1282919345.log
c:windowssystem32iJGvnQ3.exe
c:windowssystem32nV7DO00.exe
c:windowssystem32OePWEWN.exe
c:windowssystem32oKuGAS8.exe.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
Legacy_ITZTEHHACK
Service_itztehhack((((((((((((((((((((((((( Files Created from 2010-07-27 to 2010-08-27 )))))))))))))))))))))))))))))))
.2010-08-25 15:07 . 2010-08-25 15:08
d
w- C:rsit
2010-07-31 05:09 . 2010-07-31 05:09
d
w- c:documents and settingsNetworkServiceLocal SettingsApplication DataESET.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-27 14:42 . 2010-02-24 03:18
d
w- c:program filesuTorrent[tfile.ru]
2010-08-27 14:24 . 2010-03-08 09:06 63592 —-a-w- c:documents and settingsАдминистраторLocal SettingsApplication DataGDIPFONTCACHEV1.DAT
2010-08-25 15:53 . 2010-04-14 16:35
d
w- c:program filesTrend Micro
2010-08-22 14:39 . 2010-03-06 18:50
d
w- c:documents and settingsАдминистраторApplication DataMedia Player Classic
2010-08-22 10:36 . 2010-03-07 12:10
d
w- c:documents and settingsАдминистраторApplication DataSkype
2010-08-22 06:23 . 2010-03-07 12:11
d
w- c:documents and settingsАдминистраторApplication DataskypePM
2010-08-21 18:16 . 2010-08-24 15:24 190174 —-a-w- c:windowspchealthhelpctrConfigCacheProfessional_32_1049.dat
2010-08-17 16:00 . 2010-02-24 05:18
d
w- c:program filesSMSDV
2010-08-09 08:23 . 2010-03-07 11:26
d
w- c:program filesKMPlayer
2010-07-28 04:06 . 2008-04-15 12:00 65818 —-a-w- c:windowssystem32perfc019.dat
2010-07-28 04:06 . 2008-04-15 12:00 424538 —-a-w- c:windowssystem32perfh019.dat
2010-07-04 11:53 . 2010-03-06 15:25
d
w- c:program filesPCI Audio Applications
2010-07-01 18:48 . 2010-06-29 18:50
d
w- c:program filesSpeedFan
2010-07-01 15:35 . 2010-07-01 15:32
d
w- c:program filesBeholdTV
.(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.— c:program filesnew_hittbnew_.dll —
Company: Conduit Ltd.
File Description: Conduit Toolbar
File Version: 5, 5, 0, 10
Product Name: Conduit Toolbar
Copyright: Copyright © Conduit Ltd. 2008
Original Filename:
File size: 2515552
Created time: 2010-04-25 00:01
Modified time: 2010-04-15 08:33
MD5: 2833A262CA362EE3695CACD0580AA707
SHA1: 297834C3BA7DDC4ED4662C56468655B25C7B0D62—- Directory of c:program filesnew_hit —-
2010-04-25 00:01 . 2010-04-15 08:33 2515552 —-a-w- c:program filesnew_hittbnew_.dll
2010-03-09 20:57 . 2010-04-25 00:01 16977 —-a-w- c:program filesnew_hitINSTALL.LOG
2010-03-09 20:56 . 2010-03-25 09:37 38496 —-a-w- c:program filesnew_hitnew_hitToolbarHelper.exe
2010-03-09 20:56 . 2009-05-20 19:30 19 —-a-w- c:program filesnew_hittoolbar.cfg
2010-03-09 20:56 . 2002-07-26 13:02 153088 —-a-w- c:program filesnew_hitUNWISE.EXE
Sigcheck
[-] 2008-04-23 . EAEC6EA32BDABD7622371C10B8D68A17 . 361344 . . [5.1.2600.5512] . . c:windowssystem32driverstcpip.sys[-] 2008-04-25 . 7477564EC8AA190D95A7F3FBB6471F4F . 123904 . . [5.4.3790.5512] . . c:windowssystem32wuauclt.exe
[-] 2008-04-25 . E506465BFB0821DC33077E29FD184E31 . 691200 . . [5.82] . . c:windowssystem32comctl32.dll
[-] 2008-04-25 . 11E710C0612A63C6CE5B3D6534030285 . 3242496 . . [6.00.2900.5512] . . c:windowsie7mshtml.dll
[-] 2008-01-16 . B33628B9937221045A78230130A685C5 . 3593728 . . [7.00.6000.20753] . . c:windowssystem32mshtml.dll[-] 2008-04-23 . F5FA9EDB2813B207E142F15955783974 . 2330240 . . [5.1.2600.5512] . . c:windowssystem32ntoskrnl.exe
[-] 2008-04-25 . 371C41F777924F3EA3BFAD18C6A04502 . 584192 . . [5.1.2600.5512] . . c:windowssystem32user32.dll
[-] 2008-04-25 . A0F98BB46BEEAF2A94593FF9AB856A80 . 1597952 . . [6.00.2900.5512] . . c:windowsexplorer.exe
[-] 2008-04-25 . 1C079017E180FB9AB4B56AA8F896F708 . 1571840 . . [5.1.2600.5512] . . c:windowssystem32sfcfiles.dll
[-] 2008-04-25 . 0CE07543B08FD1E209D99D504076102B . 17408 . . [5.1.2600.5512] . . c:windowssystem32ctfmon.exe
[-] 2008-04-25 . 19980958D2BBB447653207A9841FC5A1 . 2207104 . . [5.1.2600.5512] . . c:windowssystem32ntkrnlpa.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]
«{89ee7477-62a4-4710-bf62-89a50744cdd1}»= «c:program filesnew_hittbnew_.dll» [2010-04-15 2515552][HKEY_CLASSES_ROOTclsid{89ee7477-62a4-4710-bf62-89a50744cdd1}]
[HKEY_LOCAL_MACHINE~Browser Helper Objects{89ee7477-62a4-4710-bf62-89a50744cdd1}]
2010-04-15 08:33 2515552 —-a-w- c:program filesnew_hittbnew_.dll[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{89ee7477-62a4-4710-bf62-89a50744cdd1}»= «c:program filesnew_hittbnew_.dll» [2010-04-15 2515552][HKEY_CLASSES_ROOTclsid{89ee7477-62a4-4710-bf62-89a50744cdd1}]
[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{89EE7477-62A4-4710-BF62-89A50744CDD1}»= «c:program filesnew_hittbnew_.dll» [2010-04-15 2515552][HKEY_CLASSES_ROOTclsid{89ee7477-62a4-4710-bf62-89a50744cdd1}]
[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-25 17408]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-03-23 132096][HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]
«SynchronousMachineGroupPolicy»= 0 (0x0)
«SynchronousUserGroupPolicy»= 0 (0x0)[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoThumbnailCache»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoThumbnailCache»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)
«NoSMHelp»= 1 (0x1)[HKLM~startupfolderC:^Documents and Settings^All Users^Главное меню^Программы^Автозагрузка^gwum.lnk]
path=c:documents and settingsAll UsersГлавное менюПрограммыАвтозагрузкаgwum.lnk
backup=c:windowspssgwum.lnkCommon Startup[HKLM~startupfolderC:^Documents and Settings^Администратор^Главное меню^Программы^Автозагрузка^monoca32.exe]
path=c:documents and settingsАдминистраторГлавное менюПрограммыАвтозагрузкаmonoca32.exe
backup=c:windowspssmonoca32.exeStartup[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregKernelFaultCheck]
c:windowssystem32dumprep 0 -k [X][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe Reader Speed Launcher]
2009-02-27 14:10 35696 —-a-w- c:program filesAdobeReader 9.0Readerreader_sl.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregC-Media Echo Control]
2001-12-05 12:47 147456 —-a-w- c:program filesPCI Audio ApplicationsBinEchoCtrl.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregC-Media Mixer]
2009-11-23 08:57 1228800 —-a-w- c:windowsmixer.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregccleaner]
2010-05-25 16:08 1694520 —-a-w- c:program filesCCleanerCCleaner.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregCTFMON.EXE]
2008-04-25 14:41 17408 —-a-w- c:windowssystem32ctfmon.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2008-02-28 13:07 1828136 —-a-w- c:program filesCommon FilesNeroLibNMIndexStoreSvr.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregMAgent]
2010-02-24 05:17 8746680 —-a-w- c:program filesMail.RuAgentmagent.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNeroFilterCheck]
2008-02-28 05:59 570664 —-a-w- c:program filesCommon FilesNeroLibNeroCheck.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSkype]
2010-02-22 09:42 26101032 —-a-r- c:program filesSkypePhoneSkype.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSoundMan]
2003-08-15 07:34 57344 —-a-w- c:windowsSOUNDMAN.EXE[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupreguTorrent]
2010-03-10 11:43 319792 —-a-w- c:program filesuTorrent[tfile.ru]uTorrent.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregVistaIcon]
2008-03-23 13:18 132096 —-a-w- c:program filesVistaDriveIconVistaDrv.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregWinampAgent]
2009-12-16 23:02 39424 —-a-w- c:program filesWinampwinampa.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusOverride»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)
«DisableNotifications»= 1 (0x1)[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\uTorrent[tfile.ru]\uTorrent.exe»=
«c:\Program Files\Skype\Plugin Manager\skypePM.exe»=
«c:\Program Files\Skype\Phone\Skype.exe»=R2 ekrn;Eset Service;c:program filesESETESET Smart Securityekrn.exe [07.10.2009 9:16 472280]
S2 DrWebEngine;Dr.Web Scanning Engine (DrWebEngine);»c:program filesCommon FilesDoctor WebScanning Enginedwengine.exe» —> c:program filesCommon FilesDoctor WebScanning Enginedwengine.exe [?]
S3 DLKRTS;D-Link DFE-530TX+ PCI Adapter;c:windowssystem32driversDLKRTS.SYS [24.02.2010 6:31 45568]
S3 MarkFun_NT;MarkFun_NT;c:program filesGigabyteGigabyte Windows Utility ManagerMARKFUN.W32 [06.03.2010 20:34 8236]
S3 PortTalk;PortTalk;c:windowssystem32driversPortTalk.sys [27.06.2010 22:55 3567]
S4 sptd;sptd;c:windowssystem32driverssptd.sys [24.02.2010 6:25 717296]
.
.
Supplementary Scan
.
uStart Page = about:blank
mStart Page = about:blank
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
IE: Поиск@Mail.Ru — c:program filesmail.rusputnikMailRuSputnik.dll/282
IE: Словари@Mail.Ru — c:program filesmail.rusputnikMailRuSputnik.dll/283
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:program filesMail.RuAgentmagent.exe
TCP: {B36D430F-FB79-48B7-B0AF-74499120D95A} = 217.20.80.40 212.96.192.1
.**************************************************************************
catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-27 18:48
Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(996)
c:windowssystem32Ati2evxx.dll
c:windowssystem32cscui.dll
c:windowssystem32COMRes.dll— — — — — — — > ‘explorer.exe'(772)
c:windowssystem32SHDOCVW.dll
c:windowssystem32COMRes.dll
c:windowsSystem32cscui.dll
c:windowssystem32msi.dll
c:windowssystem32NETSHELL.dll
c:windowssystem32credui.dll
c:windowssystem32MSVCP60.dll
c:windowssystem32WPDShServiceObj.dll
c:windowssystem32PortableDeviceTypes.dll
c:windowssystem32PortableDeviceApi.dll
.
Other Running Processes
.
c:windowssystem32Ati2evxx.exe
.
**************************************************************************
.
Completion time: 2010-08-27 18:52:35 — machine was rebootedСделал лог файл в комбофикс посмотрите!!
ComboFix 10-08-25.01 — Администратор 26.08.2010 18:57:13.1.1 — x86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.255.93 [GMT 4:00]
Running from: c:documents and settingsАдминистраторМои документыComboFix.exe
AV: ESET Smart Security 3.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: Персональный файервол ESET *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Resident AV is activeWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.c:documents and settingsАдминистраторГлавное менюПрограммыАвтозагрузкаmonoca32.exe
c:documents and settingsАдминистраторApplication Dataavdrn.dat
c:program filesCommon Fileskeylog.txt
c:program filesMail.RuAgentMradllnewmrasearch.dll
c:windowssystem327DSmDTU.exe
c:windowssystem32a2F9dgC.exe
c:windowssystem32driversetclmhosts
c:windowssystem32rX5WO87.exe
c:windowssystem32ssRibbons.scr
c:windowssystem32W1EapxW.exe
c:windowssystem32Y4BtRG3.exe.
((((((((((((((((((((((((( Files Created from 2010-07-26 to 2010-08-26 )))))))))))))))))))))))))))))))
.2010-08-25 15:07 . 2010-08-25 15:08
d
w- C:rsit
2010-07-31 05:09 . 2010-07-31 05:09
d
w- c:documents and settingsNetworkServiceLocal SettingsApplication DataESET
2010-07-28 09:02 . 2010-07-28 09:02 17208 —-a-w- c:windowssystem32iJGvnQ3.exe.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-26 09:19 . 2010-02-24 03:18
d
w- c:program filesuTorrent[tfile.ru]
2010-08-25 15:53 . 2010-04-14 16:35
d
w- c:program filesTrend Micro
2010-08-22 14:39 . 2010-03-06 18:50
d
w- c:documents and settingsАдминистраторApplication DataMedia Player Classic
2010-08-22 10:36 . 2010-03-07 12:10
d
w- c:documents and settingsАдминистраторApplication DataSkype
2010-08-22 06:23 . 2010-03-07 12:11
d
w- c:documents and settingsАдминистраторApplication DataskypePM
2010-08-21 18:16 . 2010-08-24 15:24 190174 —-a-w- c:windowspchealthhelpctrConfigCacheProfessional_32_1049.dat
2010-08-17 16:00 . 2010-02-24 05:18
d
w- c:program filesSMSDV
2010-08-09 08:23 . 2010-03-07 11:26
d
w- c:program filesKMPlayer
2010-07-28 04:06 . 2008-04-15 12:00 65818 —-a-w- c:windowssystem32perfc019.dat
2010-07-28 04:06 . 2008-04-15 12:00 424538 —-a-w- c:windowssystem32perfh019.dat
2010-07-25 10:49 . 2010-07-25 10:49 107008 —-a-w- c:windowssystem32oKuGAS8.exe
2010-07-19 17:48 . 2010-07-19 17:48 57144 —-a-w- c:windowssystem32nV7DO00.exe
2010-07-19 14:30 . 2010-07-19 14:30 52240 —-a-w- c:windowssystem32OePWEWN.exe
2010-07-04 11:53 . 2010-03-06 15:25
d
w- c:program filesPCI Audio Applications
2010-07-01 18:48 . 2010-06-29 18:50
d
w- c:program filesSpeedFan
2010-07-01 15:35 . 2010-07-01 15:32
d
w- c:program filesBeholdTV
.
Sigcheck
[-] 2008-04-23 . EAEC6EA32BDABD7622371C10B8D68A17 . 361344 . . [5.1.2600.5512] . . c:windowssystem32driverstcpip.sys[-] 2008-04-25 . 7477564EC8AA190D95A7F3FBB6471F4F . 123904 . . [5.4.3790.5512] . . c:windowssystem32wuauclt.exe
[-] 2008-04-25 . E506465BFB0821DC33077E29FD184E31 . 691200 . . [5.82] . . c:windowssystem32comctl32.dll
[-] 2008-04-25 . 11E710C0612A63C6CE5B3D6534030285 . 3242496 . . [6.00.2900.5512] . . c:windowsie7mshtml.dll
[-] 2008-01-16 . B33628B9937221045A78230130A685C5 . 3593728 . . [7.00.6000.20753] . . c:windowssystem32mshtml.dll[-] 2008-04-23 . F5FA9EDB2813B207E142F15955783974 . 2330240 . . [5.1.2600.5512] . . c:windowssystem32ntoskrnl.exe
[-] 2008-04-25 . 371C41F777924F3EA3BFAD18C6A04502 . 584192 . . [5.1.2600.5512] . . c:windowssystem32user32.dll
[-] 2008-04-25 . A0F98BB46BEEAF2A94593FF9AB856A80 . 1597952 . . [6.00.2900.5512] . . c:windowsexplorer.exe
[-] 2008-04-25 . 1C079017E180FB9AB4B56AA8F896F708 . 1571840 . . [5.1.2600.5512] . . c:windowssystem32sfcfiles.dll
[-] 2008-04-25 . 0CE07543B08FD1E209D99D504076102B . 17408 . . [5.1.2600.5512] . . c:windowssystem32ctfmon.exe
[-] 2008-04-25 . 19980958D2BBB447653207A9841FC5A1 . 2207104 . . [5.1.2600.5512] . . c:windowssystem32ntkrnlpa.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]
«{89ee7477-62a4-4710-bf62-89a50744cdd1}»= «c:program filesnew_hittbnew_.dll» [2010-04-15 2515552][HKEY_CLASSES_ROOTclsid{89ee7477-62a4-4710-bf62-89a50744cdd1}]
[HKEY_LOCAL_MACHINE~Browser Helper Objects{89ee7477-62a4-4710-bf62-89a50744cdd1}]
2010-04-15 08:33 2515552 —-a-w- c:program filesnew_hittbnew_.dll[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{89ee7477-62a4-4710-bf62-89a50744cdd1}»= «c:program filesnew_hittbnew_.dll» [2010-04-15 2515552][HKEY_CLASSES_ROOTclsid{89ee7477-62a4-4710-bf62-89a50744cdd1}]
[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{89EE7477-62A4-4710-BF62-89A50744CDD1}»= «c:program filesnew_hittbnew_.dll» [2010-04-15 2515552][HKEY_CLASSES_ROOTclsid{89ee7477-62a4-4710-bf62-89a50744cdd1}]
[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-25 17408]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-03-23 132096][HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]
«SynchronousMachineGroupPolicy»= 0 (0x0)
«SynchronousUserGroupPolicy»= 0 (0x0)[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoThumbnailCache»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoThumbnailCache»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)
«NoSMHelp»= 1 (0x1)[HKLM~startupfolderC:^Documents and Settings^All Users^Главное меню^Программы^Автозагрузка^gwum.lnk]
path=c:documents and settingsAll UsersГлавное менюПрограммыАвтозагрузкаgwum.lnk
backup=c:windowspssgwum.lnkCommon Startup[HKLM~startupfolderC:^Documents and Settings^Администратор^Главное меню^Программы^Автозагрузка^monoca32.exe]
path=c:documents and settingsАдминистраторГлавное менюПрограммыАвтозагрузкаmonoca32.exe
backup=c:windowspssmonoca32.exeStartup[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregKernelFaultCheck]
c:windowssystem32dumprep 0 -k [X][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe Reader Speed Launcher]
2009-02-27 14:10 35696 —-a-w- c:program filesAdobeReader 9.0Readerreader_sl.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregC-Media Echo Control]
2001-12-05 12:47 147456 —-a-w- c:program filesPCI Audio ApplicationsBinEchoCtrl.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregC-Media Mixer]
2009-11-23 08:57 1228800 —-a-w- c:windowsmixer.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregccleaner]
2010-05-25 16:08 1694520 —-a-w- c:program filesCCleanerCCleaner.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregCTFMON.EXE]
2008-04-25 14:41 17408 —-a-w- c:windowssystem32ctfmon.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2008-02-28 13:07 1828136 —-a-w- c:program filesCommon FilesNeroLibNMIndexStoreSvr.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregMAgent]
2010-02-24 05:17 8746680 —-a-w- c:program filesMail.RuAgentmagent.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNeroFilterCheck]
2008-02-28 05:59 570664 —-a-w- c:program filesCommon FilesNeroLibNeroCheck.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSkype]
2010-02-22 09:42 26101032 —-a-r- c:program filesSkypePhoneSkype.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSoundMan]
2003-08-15 07:34 57344 —-a-w- c:windowsSOUNDMAN.EXE[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupreguTorrent]
2010-03-10 11:43 319792 —-a-w- c:program filesuTorrent[tfile.ru]uTorrent.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregVistaIcon]
2008-03-23 13:18 132096 —-a-w- c:program filesVistaDriveIconVistaDrv.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregWinampAgent]
2009-12-16 23:02 39424 —-a-w- c:program filesWinampwinampa.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigservices]
«Browser»=2 (0x2)[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusOverride»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)
«DisableNotifications»= 1 (0x1)[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\uTorrent[tfile.ru]\uTorrent.exe»=
«c:\Program Files\Skype\Plugin Manager\skypePM.exe»=
«c:\Program Files\Skype\Phone\Skype.exe»=[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«14368:TCP»= 14368:TCPR2 ekrn;Eset Service;c:program filesESETESET Smart Securityekrn.exe [07.10.2009 9:16 472280]
S2 DrWebEngine;Dr.Web Scanning Engine (DrWebEngine);»c:program filesCommon FilesDoctor WebScanning Enginedwengine.exe» —> c:program filesCommon FilesDoctor WebScanning Enginedwengine.exe [?]
S3 DLKRTS;D-Link DFE-530TX+ PCI Adapter;c:windowssystem32driversDLKRTS.SYS [24.02.2010 6:31 45568]
S3 itztehhack;itztehhack;??c:docume~19335~1LOCALS~1TempRar$EX02.875itztehhack.sys —> c:docume~19335~1LOCALS~1TempRar$EX02.875itztehhack.sys [?]
S3 MarkFun_NT;MarkFun_NT;c:program filesGigabyteGigabyte Windows Utility ManagerMARKFUN.W32 [06.03.2010 20:34 8236]
S3 PortTalk;PortTalk;c:windowssystem32driversPortTalk.sys [27.06.2010 22:55 3567]
S4 sptd;sptd;c:windowssystem32driverssptd.sys [24.02.2010 6:25 717296]
.
.
Supplementary Scan
.
uStart Page = about:blank
mStart Page = about:blank
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
IE: Поиск@Mail.Ru — c:program filesmail.rusputnikMailRuSputnik.dll/282
IE: Словари@Mail.Ru — c:program filesmail.rusputnikMailRuSputnik.dll/283
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:program filesMail.RuAgentmagent.exe
.
— — — — ORPHANS REMOVED — — — —MSConfigStartUp-AdVantage — c:program filesAdVantageAdVantage.exe
MSConfigStartUp-Sony Ericsson PC Suite — c:program filesSony EricssonMobile2Application LauncherApplication Launcher.exe**************************************************************************
catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-26 19:02
Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(1000)
c:windowssystem32Ati2evxx.dll
c:windowssystem32cscui.dll
c:windowssystem32COMRes.dll
.
Completion time: 2010-08-26 19:04:48
ComboFix-quarantined-files.txt 2010-08-26 15:04Pre-Run: 4 963 397 632 байт свободно
Post-Run: 4 944 179 200 байт свободно— — End Of File — — 3F128CFC7D87614964BB88F25BAB5048
Ну что поможет кто нибудь или нет???? Есть ли здесь специалисты то?? всё молчат хором!!
похоже всё в дело в monoca exe. он сидит в автозагрузке при каждом запуске вылазиет ошибка и комп начинает жутко тормозить, удалению не поддаёться!! что делать????
System drive C: has 5 GB (47%) free of 10 GB
Total RAM: 255 MB (20% free)Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:51:10, on 25.08.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: NormalRunning processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32csrss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32svchost.exe
C:Program FilesuTorrent[tfile.ru]uTorrent.exe
C:Program FilesESETESET Smart Securityekrn.exe
C:Program FilesESETESET Smart Securityegui.exe
C:Program FilesMail.RuAgentmagent.exe
C:Program FilesInternet Exploreriexplore.exe
D:RSIT.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:Program Filestrend microАдминистратор.exe
C:Program FilesSkypeToolbarsSharedSkypeNames2.exeR1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = about:blank
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = about:blank
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — c:program filesmail.rusputnikMailRuSputnik.dll
R3 — URLSearchHook: NEW HIT Toolbar — {89ee7477-62a4-4710-bf62-89a50744cdd1} — C:Program Filesnew_hittbnew_.dll
F2 — REG:system.ini: UserInit=C:WINDOWSsystem32userinit.exe,C:DOCUME~19335~1LOCALS~1Tempbldjad.exe,C:WINDOWSsystem32ba63c477.exe,\?globalrootsystemrootsystem32JzULIw0.exe,
O2 — BHO: AcroIEHelperStub — {18DF081C-E8AD-4283-A596-FA578C2EBDC3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelperShim.dll
O2 — BHO: SSVHelper Class — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — C:Program FilesJavajre1.6.0_06binssv.dll
O2 — BHO: Спутник@Mail.Ru — {8984B388-A5BB-4DF7-B274-77B879E179DB} — c:program filesmail.rusputnikMailRuSputnik.dll
O2 — BHO: NEW HIT Toolbar — {89ee7477-62a4-4710-bf62-89a50744cdd1} — C:Program Filesnew_hittbnew_.dll
O2 — BHO: SkypeIEPluginBHO — {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} — C:Program FilesSkypeToolbarsInternet Explorerskypeieplugin.dll
O3 — Toolbar: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — c:program filesmail.rusputnikMailRuSputnik.dll
O3 — Toolbar: NEW HIT Toolbar — {89ee7477-62a4-4710-bf62-89a50744cdd1} — C:Program Filesnew_hittbnew_.dll
O4 — HKCU..Run: [ccleaner] «C:Program FilesCCleanerCCleaner.exe» /AUTO
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-20..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — Startup: monoca32.exe
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 — Extra context menu item: Поиск@Mail.Ru — res://c:program filesmail.rusputnikMailRuSputnik.dll/282
O8 — Extra context menu item: Словари@Mail.Ru — res://c:program filesmail.rusputnikMailRuSputnik.dll/283
O9 — Extra button: (no name) — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_06binssv.dll
O9 — Extra ‘Tools’ menuitem: Sun Java Console — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_06binssv.dll
O9 — Extra button: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra ‘Tools’ menuitem: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra button: Skype add-on for Internet Explorer — {898EA8C8-E7FF-479B-8935-AEC46303B9E5} — C:Program FilesSkypeToolbarsInternet Explorerskypeieplugin.dll
O9 — Extra ‘Tools’ menuitem: Skype add-on for Internet Explorer — {898EA8C8-E7FF-479B-8935-AEC46303B9E5} — C:Program FilesSkypeToolbarsInternet Explorerskypeieplugin.dll
O9 — Extra button: Справочные материалы — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O10 — Unknown file in Winsock LSP: c:windowssystem32nwprovau.dll
O16 — DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) — http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 — HKLMSystemCCSServicesTcpip..{B36D430F-FB79-48B7-B0AF-74499120D95A}: NameServer = 217.20.80.40 212.96.192.1
O18 — Protocol: skype-ie-addon-data — {91774881-D725-4E58-B298-07617B9B86A8} — C:Program FilesSkypeToolbarsInternet Explorerskypeieplugin.dll
O18 — Protocol: skype4com — {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} — C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O22 — SharedTaskScheduler: Предзагрузчик Browseui — {438755C2-A8BA-11D1-B96B-00A0C90312E1} — C:WINDOWSsystem32browseui.dll
O22 — SharedTaskScheduler: Демон кэша категорий компонентов — {8C7461EF-2B13-11d2-BE35-3078302C2030} — C:WINDOWSsystem32browseui.dll
O23 — Service: Ati HotKey Poller — ATI Technologies Inc. — C:WINDOWSsystem32Ati2evxx.exe
O23 — Service: Dr.Web Scanning Engine (DrWebEngine) (DrWebEngine) — Unknown owner — C:Program FilesCommon FilesDoctor WebScanning Enginedwengine.exe (file missing)
O23 — Service: Eset HTTP Server (EhttpSrv) — ESET — C:Program FilesESETESET Smart SecurityEHttpSrv.exe
O23 — Service: Eset Service (ekrn) — ESET — C:Program FilesESETESET Smart Securityekrn.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: Nero BackItUp Scheduler 3 — Nero AG — C:Program FilesNeroNero8Nero BackItUpNBService.exe
O23 — Service: NMIndexingService — Nero AG — C:Program FilesCommon FilesNeroLibNMIndexingService.exe
O23 — Service: PLFlash DeviceIoControl Service — Prolific Technology Inc. — C:WINDOWSsystem32IoctlSvc.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe—
End of file — 7541 bytes======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelperShim.dll [2009-02-27 75128][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class — C:Program FilesJavajre1.6.0_06binssv.dll [2008-03-25 509328][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{8984B388-A5BB-4DF7-B274-77B879E179DB}]
MailRuBHO Class — c:program filesmail.rusputnikMailRuSputnik.dll [2010-02-24 1029296][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{89ee7477-62a4-4710-bf62-89a50744cdd1}]
NEW HIT Toolbar — C:Program Filesnew_hittbnew_.dll [2010-04-15 2515552][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype add-on for Internet Explorer — C:Program FilesSkypeToolbarsInternet Explorerskypeieplugin.dll [2010-02-08 804136][HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{09900DE8-1DCA-443F-9243-26FF581438AF} — Спутник@Mail.Ru — c:program filesmail.rusputnikMailRuSputnik.dll [2010-02-24 1029296]
{89ee7477-62a4-4710-bf62-89a50744cdd1} — NEW HIT Toolbar — C:Program Filesnew_hittbnew_.dll [2010-04-15 2515552][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«ccleaner»=C:Program FilesCCleanerCCleaner.exe [2010-05-25 1694520][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe Reader Speed Launcher]
C:Program FilesAdobeReader 9.0ReaderReader_sl.exe [2009-02-27 35696][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdVantage]
C:Program FilesAdVantageAdVantage.exe [][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregC-Media Echo Control]
C:Program FilesPCI Audio ApplicationsBinEchoCtrl.exe [2001-12-05 147456][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregC-Media Mixer]
Mixer.exe /startup [][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregccleaner]
C:Program FilesCCleanerccleaner.exe [2010-05-25 1694520][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregCTFMON.EXE]
C:WINDOWSsystem32ctfmon.exe [2008-04-25 17408][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:Program FilesCommon FilesNeroLibNMIndexStoreSvr.exe [2008-02-28 1828136][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregKernelFaultCheck]
C:WINDOWSsystem32dumprep 0 -k [][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregMAgent]
C:Program FilesMail.RuAgentMAgent.exe [2010-02-24 8746680][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNeroFilterCheck]
C:Program FilesCommon FilesNeroLibNeroCheck.exe [2008-02-28 570664][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSkype]
C:Program FilesSkypePhoneSkype.exe [2010-02-22 26101032][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSony Ericsson PC Suite]
C:Program FilesSony EricssonMobile2Application LauncherApplication Launcher.exe /startoptions [][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSoundMan]
C:WINDOWSSOUNDMAN.EXE [2003-08-15 57344][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupreguTorrent]
C:Program FilesuTorrent[tfile.ru]uTorrent.exe [2010-03-10 319792][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregVistaIcon]
C:Program FilesVistaDriveIconVistaDrv.exe [2008-03-23 132096][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregWinampAgent]
C:Program FilesWinampwinampa.exe [2009-12-17 39424][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupfolderC:^Documents and Settings^All Users^Главное меню^Программы^Автозагрузка^gwum.lnk]
C:PROGRA~1GigabyteGIGABY~1gwum.exe [2003-08-07 471040][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigservices]
«Browser»=2C:Documents and SettingsАдминистраторГлавное менюПрограммыАвтозагрузка
monoca32.exe[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyAtiExtEvent]
C:WINDOWSsystem32Ati2evxx.dll [2008-01-23 122880][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32WPDShServiceObj.dll [2008-03-21 133632][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1
«SynchronousMachineGroupPolicy»=0
«SynchronousUserGroupPolicy»=0[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=145
«NoThumbnailCache»=1
«NoSMConfigurePrograms»=1[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=28[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesuTorrent[tfile.ru]uTorrent.exe»=»C:Program FilesuTorrent[tfile.ru]uTorrent.exe:*:Enabled:µTorrent»
«C:Program FilesSkypePlugin ManagerskypePM.exe»=»C:Program FilesSkypePlugin ManagerskypePM.exe:*:Enabled:Skype Extras Manager»
«C:Program FilesSkypePhoneSkype.exe»=»C:Program FilesSkypePhoneSkype.exe:*:Enabled:Skype»[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»======List of files/folders created in the last 1 months======
2010-08-25 19:07:52 —-D—- C:rsit
2010-08-14 18:44:11 —-N—- C:WINDOWSSchedLgU.Txt
2010-08-12 20:20:23 —-A—- C:WINDOWSsystem327DSmDTU.exe
2010-08-11 19:19:35 —-A—- C:WINDOWSsystem32a2F9dgC.exe
2010-08-10 20:53:49 —-A—- C:WINDOWSsystem32Y4BtRG3.exe
2010-08-10 16:44:07 —-A—- C:WINDOWSsystem32rX5WO87.exe
2010-08-09 12:38:21 —-A—- C:WINDOWSsystem32W1EapxW.exe
2010-07-28 13:02:17 —-A—- C:WINDOWSsystem32iJGvnQ3.exe======List of files/folders modified in the last 1 months======
2010-08-25 19:50:30 —-D—- C:Program FilesTrend Micro
2010-08-25 19:43:52 —-D—- C:Program FilesuTorrent[tfile.ru]
2010-08-25 19:30:10 —-D—- C:WINDOWSTemp
2010-08-25 13:19:47 —-D—- C:WINDOWSPrefetch
2010-08-25 12:21:43 —-D—- C:WINDOWS
2010-08-24 19:25:18 —-D—- C:WINDOWSsystem32
2010-08-23 12:42:08 —-A—- C:WINDOWSNeroDigital.ini
2010-08-23 12:39:35 —-D—- C:WINDOWSsystem32CatRoot2
2010-08-22 18:39:28 —-D—- C:Documents and SettingsАдминистраторApplication DataMedia Player Classic
2010-08-22 14:36:39 —-D—- C:Documents and SettingsАдминистраторApplication DataSkype
2010-08-22 10:23:49 —-D—- C:Documents and SettingsАдминистраторApplication DataskypePM
2010-08-21 22:15:01 —-A—- C:WINDOWSsystem.ini
2010-08-17 20:00:20 —-D—- C:Program FilesSMSDV
2010-08-15 20:59:45 —-SH—- C:boot.ini
2010-08-15 20:59:45 —-A—- C:WINDOWSwin.ini
2010-08-13 22:48:52 —-A—- C:Program FilesCommon Fileskeylog.txt
2010-08-13 19:17:19 —-D—- C:WINDOWSMinidump
2010-08-09 12:23:03 —-D—- C:Program FilesKMPlayer
2010-07-28 08:06:06 —-A—- C:WINDOWSsystem32PerfStringBackup.INI======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 PxHelp20;PxHelp20; C:WINDOWSSystem32DriversPxHelp20.sys [2009-04-29 44944]
R0 sptd;sptd; C:WINDOWSSystem32Driverssptd.sys [2010-02-24 717296]
R0 viaagp1;VIA AGP Filter; C:WINDOWSsystem32DRIVERSviaagp1.sys [2003-07-02 27904]
R0 VIDEX32;VIDEX32; C:WINDOWSsystem32driversVIDEX32.sys [2008-04-25 9216]
R1 AmdK7;Драйвер AMD K7 процессора; C:WINDOWSsystem32DRIVERSamdk7.sys [2008-04-25 41984]
R1 easdrv;easdrv; C:WINDOWSsystem32DRIVERSeasdrv.sys [2009-10-07 54184]
R1 epfwtdi;epfwtdi; C:WINDOWSsystem32DRIVERSepfwtdi.sys [2009-10-07 55256]
R2 eamon;EAMON; C:WINDOWSsystem32DRIVERSeamon.sys [2009-10-07 40824]
R2 epfw;epfw; C:WINDOWSsystem32DRIVERSepfw.sys [2009-10-07 73760]
R2 NwlnkIpx;NWLink IPX/SPX/NetBIOS-совместимый транспортный протокол; C:WINDOWSsystem32DRIVERSnwlnkipx.sys [2008-04-15 88320]
R2 NwlnkNb;NWLink NetBIOS; C:WINDOWSsystem32DRIVERSnwlnknb.sys [2008-04-15 63232]
R2 NwlnkSpx;Протокол NWLink SPX/SPXII; C:WINDOWSsystem32DRIVERSnwlnkspx.sys [2008-04-15 55936]
R3 ALCXSENS;Service for WDM 3D Audio Driver; C:WINDOWSsystem32driversALCXSENS.SYS [2003-08-14 404736]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:WINDOWSsystem32driversALCXWDM.SYS [2003-08-15 462684]
R3 ati2mtag;ati2mtag; C:WINDOWSsystem32DRIVERSati2mtag.sys [2008-01-23 2845696]
R3 Cap7134;Behold TV WDM Capture; C:WINDOWSsystem32DRIVERScap7134.sys [2005-04-07 305536]
R3 cmpci;C-Media PCI Audio Driver (WDM); C:WINDOWSsystem32driverscmaudio.sys [2009-11-23 370382]
R3 Epfwndis;Eset Personal Firewall; C:WINDOWSsystem32DRIVERSEpfwndis.sys [2009-10-07 32072]
R3 nvmpu401;Service for NVIDIA(R) nForce(TM) MIDI UART; C:WINDOWSsystem32driversnvmpu401.sys [2006-02-26 10240]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet адаптер, драйвер для NT; C:WINDOWSsystem32DRIVERSRTL8139.SYS [2008-04-25 20992]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2008-04-15 20608]
S3 CCDECODE;Closed Caption декодер; C:WINDOWSsystem32DRIVERSCCDECODE.sys [2008-04-25 17024]
S3 cmuda3;C-Media PCI Audio Interface; C:WINDOWSsystem32driverscmudax3.sys []
S3 DLKRTS;D-Link DFE-530TX+ PCI Adapter; C:WINDOWSsystem32DRIVERSDLKRTS.SYS [2006-03-28 45568]
S3 HidUsb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2008-04-25 10368]
S3 itztehhack;itztehhack; ??C:DOCUME~19335~1LOCALS~1TempRar$EX02.875itztehhack.sys []
S3 MarkFun_NT;MarkFun_NT; ??C:Program FilesGigabyteGigabyte Windows Utility Managermarkfun.w32 []
S3 mouhid;Драйвер мыши HID; C:WINDOWSsystem32DRIVERSmouhid.sys [2001-10-19 12160]
S3 msloop;Драйвер адаптера Microsoft замыкания на себя; C:WINDOWSsystem32DRIVERSloop.sys [2001-08-17 4992]
S3 MSTEE;Преобразователь потоков Tee/Sink-to-Sink Microsoft; C:WINDOWSsystem32driversMSTEE.sys [2008-04-25 5504]
S3 NABTSFEC;NABTS/FEC VBI кодек; C:WINDOWSsystem32DRIVERSNABTSFEC.sys [2008-04-25 85248]
S3 NdisIP;Microsoft видео или ТВ подключение; C:WINDOWSsystem32DRIVERSNdisIP.sys [2008-04-25 10880]
S3 PortTalk;PortTalk; C:WINDOWSSystem32DriversPortTalk.sys [2002-01-12 3567]
S3 RTL8023;corega PCI-GT NT Driver; C:WINDOWSsystem32DRIVERScorega5.sys [2006-02-26 65280]
S3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver; C:WINDOWSsystem32DRIVERSRtnicxp.sys [2007-07-12 96384]
S3 SLIP;BDA Slip De-Framer; C:WINDOWSsystem32DRIVERSSLIP.sys [2008-04-25 11136]
S3 streamip;BDA IPSink; C:WINDOWSsystem32DRIVERSStreamIP.sys [2008-04-25 15232]
S3 usbscan;Драйвер USB-сканера; C:WINDOWSsystem32DRIVERSusbscan.sys [2008-04-25 15104]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2008-04-25 26368]
S3 VIAudio;Vinyl AC’97 Audio Controller (WDM); C:WINDOWSsystem32driversvinyl97.sys [2007-09-20 207488]
S3 WSTCODEC;World Standard Teletext кодек; C:WINDOWSsystem32DRIVERSWSTCODEC.SYS [2008-04-25 19200]
S3 WudfPf;Windows Driver Foundation — User-mode Driver Framework Platform Driver; C:WINDOWSsystem32DRIVERSWudfPf.sys [2008-03-21 77568]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2008-03-21 82944]
S4 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:WINDOWSSystem32driversws2ifsl.sys [2008-04-15 12032]======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 Ati HotKey Poller;Ati HotKey Poller; C:WINDOWSsystem32Ati2evxx.exe [2008-01-23 512000]
R2 ekrn;Eset Service; C:Program FilesESETESET Smart Securityekrn.exe [2009-10-07 472280]
R2 NwSapAgent;Агент SAP; C:WINDOWSsystem32svchost.exe [2008-04-15 14336]
S2 DrWebEngine;Dr.Web Scanning Engine (DrWebEngine); C:Program FilesCommon FilesDoctor WebScanning Enginedwengine.exe []
S2 MDM;Machine Debug Manager; C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE [2003-06-20 322120]
S2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:Program FilesNeroNero8Nero BackItUpNBService.exe [2008-02-18 877864]
S2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:WINDOWSsystem32IoctlSvc.exe [2006-12-19 81920]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv1.1.4322aspnet_state.exe [2004-07-15 32768]
S3 EhttpSrv;Eset HTTP Server; C:Program FilesESETESET Smart SecurityEHttpSrv.exe [2009-10-07 20680]
S3 NMIndexingService;NMIndexingService; C:Program FilesCommon FilesNeroLibNMIndexingService.exe [2008-02-28 529704]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2003-07-28 89136]
S3 WMPNetworkSvc;Служба общих сетевых ресурсов проигрывателя Windows Media; C:Program FilesWindows Media PlayerWMPNetwk.exe [2008-03-21 914944]
S3 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2008-04-15 14336]
EOF
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:02:56, on 25.08.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: NormalRunning processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32csrss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32svchost.exe
C:Program FilesuTorrent[tfile.ru]uTorrent.exe
C:Program FilesESETESET Smart Securityekrn.exe
C:Program FilesESETESET Smart Securityegui.exe
C:Program FilesMail.RuAgentmagent.exe
C:Program FilesInternet ExplorerIEXPLORE.EXE
C:Program FilesTrend MicroHijackThisHijackThis.exeR1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = about:blank
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = about:blank
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — c:program filesmail.rusputnikMailRuSputnik.dll
R3 — URLSearchHook: NEW HIT Toolbar — {89ee7477-62a4-4710-bf62-89a50744cdd1} — C:Program Filesnew_hittbnew_.dll
F2 — REG:system.ini: UserInit=C:WINDOWSsystem32userinit.exe,C:DOCUME~19335~1LOCALS~1Tempbldjad.exe,C:WINDOWSsystem32ba63c477.exe,\?globalrootsystemrootsystem32JzULIw0.exe,
O2 — BHO: AcroIEHelperStub — {18DF081C-E8AD-4283-A596-FA578C2EBDC3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelperShim.dll
O2 — BHO: SSVHelper Class — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — C:Program FilesJavajre1.6.0_06binssv.dll
O2 — BHO: Спутник@Mail.Ru — {8984B388-A5BB-4DF7-B274-77B879E179DB} — c:program filesmail.rusputnikMailRuSputnik.dll
O2 — BHO: NEW HIT Toolbar — {89ee7477-62a4-4710-bf62-89a50744cdd1} — C:Program Filesnew_hittbnew_.dll
O2 — BHO: SkypeIEPluginBHO — {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} — C:Program FilesSkypeToolbarsInternet Explorerskypeieplugin.dll
O3 — Toolbar: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — c:program filesmail.rusputnikMailRuSputnik.dll
O3 — Toolbar: NEW HIT Toolbar — {89ee7477-62a4-4710-bf62-89a50744cdd1} — C:Program Filesnew_hittbnew_.dll
O4 — HKCU..Run: [ccleaner] «C:Program FilesCCleanerCCleaner.exe» /AUTO
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-20..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — Startup: monoca32.exe
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 — Extra context menu item: Поиск@Mail.Ru — res://c:program filesmail.rusputnikMailRuSputnik.dll/282
O8 — Extra context menu item: Словари@Mail.Ru — res://c:program filesmail.rusputnikMailRuSputnik.dll/283
O9 — Extra button: (no name) — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_06binssv.dll
O9 — Extra ‘Tools’ menuitem: Sun Java Console — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_06binssv.dll
O9 — Extra button: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra ‘Tools’ menuitem: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra button: Skype add-on for Internet Explorer — {898EA8C8-E7FF-479B-8935-AEC46303B9E5} — C:Program FilesSkypeToolbarsInternet Explorerskypeieplugin.dll
O9 — Extra ‘Tools’ menuitem: Skype add-on for Internet Explorer — {898EA8C8-E7FF-479B-8935-AEC46303B9E5} — C:Program FilesSkypeToolbarsInternet Explorerskypeieplugin.dll
O9 — Extra button: Справочные материалы — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O10 — Unknown file in Winsock LSP: c:windowssystem32nwprovau.dll
O16 — DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) — http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 — HKLMSystemCCSServicesTcpip..{B36D430F-FB79-48B7-B0AF-74499120D95A}: NameServer = 217.20.80.40 212.96.192.1
O18 — Protocol: skype-ie-addon-data — {91774881-D725-4E58-B298-07617B9B86A8} — C:Program FilesSkypeToolbarsInternet Explorerskypeieplugin.dll
O18 — Protocol: skype4com — {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} — C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O23 — Service: Ati HotKey Poller — ATI Technologies Inc. — C:WINDOWSsystem32Ati2evxx.exe
O23 — Service: Dr.Web Scanning Engine (DrWebEngine) (DrWebEngine) — Unknown owner — C:Program FilesCommon FilesDoctor WebScanning Enginedwengine.exe (file missing)
O23 — Service: Eset HTTP Server (EhttpSrv) — ESET — C:Program FilesESETESET Smart SecurityEHttpSrv.exe
O23 — Service: Eset Service (ekrn) — ESET — C:Program FilesESETESET Smart Securityekrn.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: Nero BackItUp Scheduler 3 — Nero AG — C:Program FilesNeroNero8Nero BackItUpNBService.exe
O23 — Service: NMIndexingService — Nero AG — C:Program FilesCommon FilesNeroLibNMIndexingService.exe
O23 — Service: PLFlash DeviceIoControl Service — Prolific Technology Inc. — C:WINDOWSsystem32IoctlSvc.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe—
End of file — 7177 bytes
