[AYuBelov]

В общем я грохнул винду (форматнул диск «С», D оставил)- думал может аппаратная ошибка.
В итоге не помогло. Так же начало вылетать.
После того как пропало подключение, начал завершать программы, запущенные от моего имени.
Вычленил падлюк — msvmiode.exe и cfdrive32.exe.
Поймал и поудалял паразитов, после чего появился доступ и в Инет и смог скачать Curelt и даже установил Malware.
Завтра поюзаю прогу — посмотрю чего переловит.

[AYuBelov]

Проверка:
— DreamFarm уже удалил;
— c:windowssystem32d3d9.dll:
http://www.virustotal.com/file-scan/report.html?id=4a7207cc8bcf398e8176

19c8d5ac78fe6d084380373afa77f7bd900b1f15a8fc-1282134365
— c:windowssystem32driversbmbemu.sys:
http://www.virustotal.com/file-scan/report.html?id=d987d5a1f51485b5e590

840aacc2c648483c7ffed8daeab1a6200beb0093be8e-1273780134
— c:windowssystem32driversnnkey.sys:
http://www.virustotal.com/file-scan/report.html?id=4dc17524804944702e22

cb70c6f10a81d77acca443682b296e6be25cb3e5cd5f-1274627297

Установочный диск есть.

[AYuBelov]

Сделал.
Результаты проверки для c:windowssystem32driversnnkey.sys:
http://www.virustotal.com/file-scan/report.html?id=4dc17524804944702e22cb70c6f10a81d77acca443682b296e6be25cb3e5cd5f-1274627297#
Результаты проверки для c:windowssystem32driversbmbemu.sys:
http://www.virustotal.com/file-scan/report.html?id=d987d5a1f51485b5e590840aacc2c648483c7ffed8daeab1a6200beb0093be8e-1273780134
Результаты проверки для c:windowssystem32qmgr.dll:
http://www.virustotal.com/file-scan/report.html?id=e4d0940b5cb6c8d6c035813ef1002030d700ca88328bf6d20d1572b3fbef12b0-1267685275
Результаты проверки для c:windowssystem32dllcacheportcls.sys:
http://www.virustotal.com/file-scan/report.html?id=3f92c465b7b3884e15d7b6db005693f8c3ce8a0d360570584d940f7cfdc18754-1256107131
Результаты проверки для c:windowssystem32WINLOGON.exe:
http://www.virustotal.com/file-scan/report.html?id=8ef31c4bdbdef86f33ec2b5fdf1bb46605dfdc4bcdfc89a25dd91ce5a44ef58a-1267685382
Результаты проверки для c:windowssystem32driversportcls.sys:
http://www.virustotal.com/file-scan/report.html?id=3f92c465b7b3884e15d7b6db005693f8c3ce8a0d360570584d940f7cfdc18754-1256107131
Результаты проверки для c:windowssystem32driversdrmk.sys:
http://www.virustotal.com/file-scan/report.html?id=9a458d2d234d14c0aa50ae09b56ef33ac09250381631e42680d6120c3303a09d-1243631214
Файл c:windowsSystem32DRIVERSgrdkey.sys не найден. Вчера обновлял драйверы Guardant. Видимо убил.
Результаты проверки для c:windowssystem32driversNVKEYNT.SYS:
http://www.virustotal.com/file-scan/report.html?id=54ad21a06748047f3a858a27c387ae6a3faf332c616ee061136c2a4c0e573363-1280496097
Результаты проверки для c:windowssystem32drivershddirect.sys:
http://www.virustotal.com/file-scan/report.html?id=d3ac725fb02b048b8dc7aef04ce6b1dde56bd9ddc24cd9d080270181844dd1ba-1282317643
Результаты проверки для c:windowsd3dx.dat:
http://www.virustotal.com/file-scan/report.html?id=bcfa98bbae692116be3144d6250580ad00994cca00b2adebfe303d9a8fe3babc-1281225532

[AYuBelov]

У меня основная проблема это — Интернет вылетает через 10 минут работы. Просто перестает коннектиться и все. Попытка закрыть соединения не удается, на полсекунды выскакивает свойства подключения и пропадает.
ComboFix 10-08-20.01 — Админ 21.08.2010 22:24:59.1.1 — x86
Microsoft Windows XP Home Edition 5.1.2600.0.1251.7.1049.18.1279.984 [GMT 6:00]
Running from: d:downloadsComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:program filesCommon Fileskeylog.txt
c:program filesCommon FilesWM
c:windowssystem32driverswdreg.exe
c:windowssystem32ReadMe.txt
c:windowssystem32winlogon.bak

c:windowssystem32qmgr.dll . . . is infected!!

c:windowssystem32WINLOGON.EXE . . . is infected!!

.
((((((((((((((((((((((((( Files Created from 2010-07-21 to 2010-08-21 )))))))))))))))))))))))))))))))
.

2010-08-21 16:28 . 2010-08-21 16:28

---

d

---

w- c:program filesCommon Fileswm
2010-08-21 12:48 . 2005-06-15 02:34 3072 —-a-w- c:windowssystem32driversnnkey.sys
2010-08-21 12:48 . 2010-08-21 13:57

---

d

---

w- c:program filesБазис 70
2010-08-21 12:48 . 2007-09-16 13:40 20992 —-a-w- c:windowssystem32driversbmbemu.sys
2010-08-21 05:18 . 2010-08-21 05:18

---

d

---

w- c:program filesOpera
2010-08-20 12:51 . 2010-08-20 12:51

---

d

---

w- c:program filestrend micro
2010-08-16 13:40 . 2001-08-18 00:24 135040 -c—a-w- c:windowssystem32dllcacheportcls.sys
2010-08-16 13:40 . 2001-08-18 00:24 135040 —-a-w- c:windowssystem32driversportcls.sys
2010-08-16 13:40 . 2001-08-17 16:01 57344 -c—a-w- c:windowssystem32dllcachedrmk.sys
2010-08-16 13:40 . 2001-08-17 16:01 57344 —-a-w- c:windowssystem32driversdrmk.sys
2010-08-16 13:40 . 2010-08-16 13:40

---

d

---

w- c:program filesRealtek AC97
2010-08-16 13:40 . 2006-12-08 09:20 10528768 —-a-w- c:windowssystem32RTLCPL.exe
2010-08-16 13:40 . 2007-04-16 09:28 577536 —-a-w- c:windowssoundman.exe
2010-08-16 13:40 . 2007-04-25 10:20 4030144 —-a-w- c:windowssystem32driversalcxwdm.sys
2010-08-16 13:40 . 2006-10-17 20:53 147456 —-a-w- c:windowssystem32RtlCPAPI.dll
2010-08-15 11:37 . 2006-07-31 05:27 217088 —-a-w- c:windowsAlcrmv.exe
2010-08-15 10:01 . 2010-08-18 15:25

---

d

---

w- c:program filesSpybot — Search & Destroy
2010-08-15 09:52 . 2010-08-15 09:52 12552 —-a-w- c:windowssystem32drivershddirect.sys
2010-08-15 06:50 . 2010-08-15 06:50

---

d

---

w- c:program filesNVIDIA Corporation
2010-08-15 06:50 . 2010-08-15 06:50

---

d

---

w- c:program filesCommon FilesWise Installation Wizard
2010-08-15 06:48 . 2010-08-15 06:54

---

d

---

w- c:windowsSxsCaPendDel
2010-08-13 16:10 . 2010-08-13 16:10 113664 —-a-w- c:windowssystem32loqyxd.exe
2010-08-13 12:44 . 2010-08-13 12:44 4096 —-a-w- c:windowsd3dx.dat
2010-08-13 12:43 . 2010-08-13 12:43

---

d

---

w- c:documents and settingsAll UsersApplication DataAlawarWrapper
2010-08-10 15:38 . 2010-08-10 15:39

---

d

---

w- c:program filesMacromedia
2010-08-10 15:38 . 2010-08-10 15:38

---

d

---

w- c:program filesCommon FilesMacromedia
2010-08-10 15:38 . 2010-08-10 15:38

---

d

---

w- c:windowsDownloaded Installations
2010-08-04 12:54 . 2010-08-04 12:54

---

d-s—w- c:windowssystem32Microsoft
2010-08-04 12:53 . 2010-08-15 07:03

---

d

---

w- c:documents and settingsAll UsersApplication DataKaspersky Lab
2010-08-04 12:52 . 2010-08-04 12:52

---

d

---

w- c:documents and settingsAll UsersApplication DataKaspersky Lab Setup Files
2010-08-01 13:21 . 2010-08-01 13:21 105472 —-a-w- c:windowssystem32jhseee.exe
2010-07-25 09:55 . 2010-07-25 09:55

---

d

---

w- c:documents and settingsАдминApplication DataGroove Games
2010-07-25 09:33 . 2008-03-05 09:56 3786760 —-a-w- c:windowssystem32d3dx9_37.dll
2010-07-25 08:01 . 2009-09-30 07:08 1892184 —-a-w- c:windowssystem32d3dx9_42.dll
2010-07-24 05:56 . 1999-10-10 18:09 307712 —-a-w- c:windowsIsUn0419.exe
2010-07-24 05:18 . 2010-07-24 05:19

---

d

---

w- c:windowsLogs
2010-07-23 12:09 . 2010-07-23 12:09 99328 —-a-w- c:windowssystem32dhmdlb.exe
2010-07-23 12:09 . 2010-07-23 12:09 44032 —-a-w- c:windowssystem32b70a0d63.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-21 16:29 . 2010-07-04 18:13

---

d

---

w- c:documents and settingsАдминApplication DatauTorrent
2010-08-18 15:25 . 2010-07-11 13:16

---

d

---

w- c:documents and settingsAll UsersApplication DataSpybot — Search & Destroy
2010-08-13 15:47 . 2010-07-04 18:16 17560 —-a-w- c:documents and settingsАдминLocal SettingsApplication DataGDIPFONTCACHEV1.DAT
2010-07-19 02:39 . 2010-07-19 02:39

---

d

---

w- c:program filesK-Lite Codec Pack
2010-07-07 17:35 . 2010-07-07 17:35

---

d

---

w- c:program filesWinamp
2010-07-07 14:24 . 2010-07-07 14:24

---

d

---

w- c:documents and settingsАдминApplication DataMSN6
2010-07-07 14:24 . 2010-07-07 14:24

---

d

---

w- c:documents and settingsAll UsersApplication DataMSN6
2010-07-06 12:51 . 2010-07-06 12:51

---

d

---

w- c:documents and settingsАдминистраторApplication DataYandex
2010-07-05 18:18 . 2010-07-05 18:18

---

d

---

w- c:program filesKeyboard
2010-07-05 12:56 . 2010-07-05 12:56

---

d

---

w- c:program filesPRO100
2010-07-04 18:25 . 2010-07-04 18:25

---

d

---

w- c:program filesRatioMaster-1.8.8
2010-07-04 18:25 . 2010-07-04 18:25

---

d

---

w- c:program filesRatioMaster-1.8.1
2010-07-04 18:16 . 2010-07-04 18:16

---

d

---

w- c:documents and settingsАдминApplication DataSuper-Cow
2010-07-04 18:16 . 2010-07-04 18:16

---

d

---

w- c:documents and settingsАдминApplication DataRiver Past G4
2010-07-04 18:16 . 2010-07-04 18:16

---

d

---

w- c:documents and settingsАдминApplication DataRigNRoll
2010-07-04 18:16 . 2010-07-04 18:16

---

d

---

w- c:documents and settingsАдминApplication DataOpenOffice.org2
2010-07-04 18:16 . 2010-07-04 18:16

---

d

---

w- c:documents and settingsАдминApplication DataNero
2010-07-04 18:16 . 2010-07-04 18:16

---

d

---

w- c:documents and settingsАдминApplication DataMra
2010-07-04 18:15 . 2010-07-04 18:15

---

d

---

w- c:documents and settingsАдминApplication DataITTerritory
2010-07-04 18:15 . 2010-07-04 18:15

---

d

---

w- c:documents and settingsАдминApplication DataDaimler
2010-07-04 18:15 . 2010-07-04 18:15

---

d

---

w- c:documents and settingsАдминApplication DataBuena Vista Games
2010-07-04 18:15 . 2010-07-04 16:04

---

d

---

w- c:documents and settingsАдминApplication DataCyberLink
2010-07-04 18:13 . 2010-07-04 18:13

---

d

---

w- c:program filesuTorrent [tfile.ru]
2010-07-04 17:00 . 2001-10-20 08:00 70134 —-a-w- c:windowssystem32perfc019.dat
2010-07-04 17:00 . 2001-10-20 08:00 432488 —-a-w- c:windowssystem32perfh019.dat
2010-07-04 16:48 . 2010-07-04 16:42

---

d

---

w- c:program filesSdelaiMebel.RU
2010-07-04 16:38 . 2010-07-04 16:37

---

d

---

w- c:program filestotalcmd
2010-07-04 16:36 . 2010-07-04 16:36

---

d

---

w- c:documents and settingsАдминApplication DataMedia Player Classic
2010-07-04 16:33 . 2010-07-04 16:33

---

d

---

w- c:program filesMicrosoft.NET
2010-07-04 16:28 . 2010-07-04 16:28

---

d

---

w- c:program filesCommon FilesAdobe
2010-07-04 16:18 . 2010-07-04 16:18

---

d

---

w- c:documents and settingsАдминApplication DataYandex
2010-07-04 16:18 . 2010-07-04 16:18 0 —-a-w- c:windowsnsreg.dat
2010-07-04 16:07 . 2010-07-04 16:06

---

d

---

w- c:program filesATI Technologies
2010-07-04 16:07 . 2010-07-04 15:36

---

d—h—w- c:program filesInstallShield Installation Information
2010-07-04 16:06 . 2010-07-04 15:35

---

d

---

w- c:program filesCommon FilesInstallShield
2010-07-04 16:04 . 2010-07-04 15:57

---

d

---

w- c:documents and settingsAll UsersApplication DataCyberLink
2010-07-04 16:01 . 2010-07-04 16:01

---

d

---

w- c:program filesAlcohol Soft
2010-07-04 15:58 . 2010-07-04 15:58 685816 —-a-w- c:windowssystem32driverssptd.sys
2010-07-04 15:57 . 2010-07-04 15:56

---

d

---

w- c:program filesCyberLink
2010-07-04 15:57 . 2010-07-04 15:57

---

d

---

w- c:program filesCommon FilesCyberLink
2010-07-04 15:56 . 2010-07-04 15:56

---

d

---

w- c:documents and settingsAll UsersApplication DataTemp
2010-07-04 15:56 . 2010-07-04 15:56 505128 —-a-w- c:windowssystem32msvcp71.dll
2010-07-04 15:56 . 2010-07-04 15:56 353576 —-a-w- c:windowssystem32msvcr71.dll
2010-07-04 15:56 . 2010-07-04 15:56 29480 —-a-w- c:windowssystem32msxml3a.dll
2010-07-04 15:56 . 2010-07-04 15:56 53319 —-a-w- c:documents and settingsAll UsersApplication DataTemp{8C20787A-7402-4FA7-BF25-6E5750930FDC}PostBuild.exe
2010-07-04 15:54 . 2010-07-04 15:54

---

d

---

w- c:program filesIVT Corporation
2010-07-04 15:41 . 2010-07-04 15:41

---

d

---

w- c:program filesC-Media
2010-07-04 15:36 . 2010-07-04 15:36

---

d

---

w- c:program filesVIA
2010-07-04 15:29 . 2010-07-04 15:29

---

d

---

w- c:program filesmicrosoft frontpage
2010-07-04 15:29 . 2010-07-04 15:28 70691 —-a-w- c:windowsPCHEALTHHELPCTROfflineCacheindex.dat
2010-07-04 15:27 . 2010-07-04 15:27 22564 —-a-w- c:windowssystem32emptyregdb.dat
.

---

Sigcheck

---

[-] 2001-10-20 . AFDB4F5B3966CF5B08EC0D307EA700E1 . 431616 . . [5.1.2600.0] . . c:windowssystem32WINLOGON.EXE

[-] 2004-07-08 22:27 . 0E51BD586D186F61A9E4453DB8AEC774 . 1703936 . . [5.3.0000001.0904 built by: private/Lab06_dev(DXBLD00)] . . c:windowsLastGoodSystem32d3d9.dll
[-] 2004-07-08 22:27 . 0E51BD586D186F61A9E4453DB8AEC774 . 1703936 . . [5.3.0000001.0904 built by: private/Lab06_dev(DXBLD00)] . . c:windowssystem32d3d9.dll

c:windowsSystem32wscntfy.exe … is missing !!
c:windowsSystem32xmlprov.dll … is missing !!
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«AlcoholAutomount»=»c:program filesAlcohol SoftAlcohol 120axcmd.exe» [2007-08-01 222592]
«µTorrent»=»c:program filesuTorrent [tfile.ru]uTorrent.exe» [2007-05-09 04:57 177152]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«BtTray»=»c:program filesIVT CorporationBlueSoleilBtTray.exe» [2009-02-27 278016]
«RemoteControl9″=»c:program filesCyberLinkPowerDVD9PDVD9Serv.exe» [2009-09-02 87336]
«BDRegion»=»c:program filesCyberlinkShared Filesbrs.exe» [2009-08-05 75048]
«ATIPTA»=»c:program filesATI TechnologiesATI Control Panelatiptaxx.exe» [2005-05-12 344064]
«Adobe Reader Speed Launcher»=»c:program filesAdobeReader 8.0ReaderReader_sl.exe» [2007-10-10 39792]
«iKeyWorks»=»c:progra~1KeyboardIkeymain.exe» [2002-11-22 73728]
«WinampAgent»=»c:program filesWinampwinampa.exe» [2003-12-13 33792]
«SoundMan»=»SOUNDMAN.EXE» [2007-04-16 577536]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowsSystem32CTFMON.EXE» [2001-10-20 13312]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogon]
«Userinit»=»c:windowssystem32userinit.exe,c:windowsSystem32b70a0d63.exe,c:windowsSystem32dhmdlb.exe,»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicestcpipparameterspersistentroutes]
«74.55.40.0,255.255.255.0,10.196.7.0,1»=»»
«78.137.164.0,255.255.255.0,10.196.7.0,1»=»»
«74.52.233.0,255.255.255.0,10.196.7.0,1»=»»
«78.47.87.0,255.255.255.0,10.196.7.0,1»=»»
«80.190.130.0,255.255.255.0,10.196.7.0,1»=»»
«80.237.132.0,255.255.255.0,10.196.7.0,1»=»»
«78.108.86.0,255.255.255.0,10.196.7.0,1»=»»
«84.40.30.0,255.255.255.0,10.196.7.0,1»=»»
«85.17.210.0,255.255.255.0,10.196.7.0,1»=»»
«85.255.19.0,255.255.255.0,10.196.7.0,1»=»»
«87.106.242.0,255.255.255.0,10.196.7.0,1»=»»
«75.125.29.0,255.255.255.0,10.196.7.0,1»=»»
«75.125.82.0,255.255.255.0,10.196.7.0,1»=»»
«85.31.222.0,255.255.255.0,10.196.7.0,1»=»»
«83.202.175.0,255.255.255.0,10.196.7.0,1»=»»
«80.190.154.0,255.255.255.0,10.196.7.0,1»=»»
«79.125.5.0,255.255.255.0,10.196.7.0,1»=»»
«80.86.107.0,255.255.255.0,10.196.7.0,1»=»»
«74.53.201.0,255.255.255.0,10.196.7.0,1»=»»
«87.106.254.0,255.255.255.0,10.196.7.0,1»=»»
«85.12.57.0,255.255.255.0,10.196.7.0,1»=»»
«80.153.193.0,255.255.255.0,10.196.7.0,1»=»»
«87.230.79.0,255.255.255.0,10.196.7.0,1»=»»
«81.176.66.0,255.255.255.0,10.196.7.0,1»=»»
«81.177.31.0,255.255.255.0,10.196.7.0,1»=»»
«81.24.35.0,255.255.255.0,10.196.7.0,1»=»»
«82.117.238.0,255.255.255.0,10.196.7.0,1»=»»
«82.151.107.0,255.255.255.0,10.196.7.0,1»=»»
«82.165.103.0,255.255.255.0,10.196.7.0,1»=»»
«82.98.86.0,255.255.255.0,10.196.7.0,1»=»»
«83.222.23.0,255.255.255.0,10.196.7.0,1»=»»
«83.223.117.0,255.255.255.0,10.196.7.0,1»=»»
«83.222.31.0,255.255.255.0,10.196.7.0,1»=»»
«85.214.106.0,255.255.255.0,10.196.7.0,1»=»»
«87.238.48.0,255.255.255.0,10.196.7.0,1»=»»
«87.242.72.0,255.255.255.0,10.196.7.0,1»=»»
«87.242.74.0,255.255.255.0,10.196.7.0,1»=»»
«87.242.79.0,255.255.255.0,10.196.7.0,1»=»»
«88.221.119.0,255.255.255.0,10.196.7.0,1»=»»
«89.111.176.0,255.255.255.0,10.196.7.0,1»=»»
«89.108.66.0,255.255.255.0,10.196.7.0,1»=»»
«89.202.149.0,255.255.255.0,10.196.7.0,1»=»»
«89.202.157.0,255.255.255.0,10.196.7.0,1»=»»
«90.156.159.0,255.255.255.0,10.196.7.0,1»=»»
«90.183.101.0,255.255.255.0,10.196.7.0,1»=»»
«91.121.97.0,255.255.255.0,10.196.7.0,1»=»»
«91.199.212.0,255.255.255.0,10.196.7.0,1»=»»
«91.209.196.0,255.255.255.0,10.196.7.0,1»=»»
«92.123.155.0,255.255.255.0,10.196.7.0,1»=»»
«92.53.106.0,255.255.255.0,10.196.7.0,1»=»»
«93.184.71.0,255.255.255.0,10.196.7.0,1»=»»
«93.191.13.0,255.255.255.0,10.196.7.0,1»=»»
«94.236.0.0,255.255.255.0,10.196.7.0,1»=»»
«94.23.206.0,255.255.255.0,10.196.7.0,1»=»»
«95.140.225.0,255.255.255.0,10.196.7.0,1»=»»
«75.125.185.0,255.255.255.0,10.196.7.0,1»=»»
«74.55.74.0,255.255.255.0,10.196.7.0,1»=»»
«174.120.186.0,255.255.255.0,10.196.7.0,1»=»»
«208.43.71.0,255.255.255.0,10.196.7.0,1»=»»
«74.53.70.0,255.255.255.0,10.196.7.0,1»=»»
«74.54.139.0,255.255.255.0,10.196.7.0,1»=»»
«74.86.232.0,255.255.255.0,10.196.7.0,1»=»»
«174.133.38.0,255.255.255.0,10.196.7.0,1»=»»
«174.120.185.0,255.255.255.0,10.196.7.0,1»=»»
«174.120.184.0,255.255.255.0,10.196.7.0,1»=»»
«74.54.130.0,255.255.255.0,10.196.7.0,1»=»»
«74.54.46.0,255.255.255.0,10.196.7.0,1»=»»
«75.125.189.0,255.255.255.0,10.196.7.0,1»=»»
«75.125.43.0,255.255.255.0,10.196.7.0,1»=»»
«74.86.125.0,255.255.255.0,10.196.7.0,1»=»»
«75.125.212.0,255.255.255.0,10.196.7.0,1»=»»
«207.44.254.0,255.255.255.0,10.196.7.0,1»=»»
«83.102.130.0,255.255.255.0,10.196.7.0,1»=»»
«87.242.75.0,255.255.255.0,10.196.7.0,1»=»»
«81.176.67.0,255.255.255.0,10.196.7.0,1»=»»
«212.59.118.0,255.255.255.0,10.196.7.0,1»=»»
«208.43.44.0,255.255.255.0,10.196.7.0,1»=»»
«188.40.74.0,255.255.255.0,10.196.7.0,1»=»»
«62.67.184.0,255.255.255.0,10.196.7.0,1»=»»
«74.55.143.0,255.255.255.0,10.196.7.0,1»=»»
«195.222.17.0,255.255.255.0,10.196.7.0,1»=»»

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalHDDirect.sys]
@=»Driver»

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«14373:TCP»= 14373:TCP

R0 BtHidBus;Bluetooth HID Bus Service;c:windowssystem32driversBtHidBus.sys [07.01.2009 23:39 20744]
R1 NVKEYNT;NVKEYNT;c:windowssystem32driversNVKEYNT.SYS [04.07.2010 22:53 71680]
R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2010/07/04 21:57];c:program filesCyberLinkPowerDVD900.fcl [02.09.2009 14:04 87536]
R2 bmbemu;bmbemu;c:windowssystem32driversbmbemu.sys [21.08.2010 18:48 20992]
R2 BsMobileCS;BsMobileCS;c:program filesIVT CorporationBlueSoleilBsMobileCS.exe [27.02.2009 16:40 143467]
R2 nnkey;nnkey;c:windowssystem32driversnnkey.sys [21.08.2010 18:48 3072]
R3 btnetBUs;Bluetooth PAN Bus Service;c:windowssystem32driversbtnetBus.sys [07.12.2008 12:44 30088]
R3 IvtBtBUs;IVT Bluetooth Bus Service;c:windowssystem32driversIvtBtBus.sys [02.07.2008 14:58 26248]
S3 GrdKey;Guardant LPT Dongle Service;c:windowsSystem32DRIVERSgrdkey.sys —> c:windowsSystem32DRIVERSgrdkey.sys [?]
S3 HDDirect;Hard Disk Direct Control;c:windowssystem32drivershddirect.sys [15.08.2010 15:52 12552]
S4 sptd;sptd;c:windowssystem32driverssptd.sys [04.07.2010 21:58 685816]

— Other Services/Drivers In Memory —

*NewlyCreated* — ALG
*NewlyCreated* — IPNAT
.
.

---

Supplementary Scan

---

.
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
IE: Send by Bluetooth — c:program filesIVT CorporationBlueSoleilTransSendIEtsinfo.htm
IE: Send via &Message… — c:program filesIVT CorporationBlueSoleilTransSendIEtssms.htm
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} — %SystemRoot%webrelated.htm
.
— — — — ORPHANS REMOVED — — — —

HKLM-Run-Cmaudio — cmicnfg.cpl
HKLM-Run-SpybotSnD — c:program filesSpybot — Search & DestroySpybotSD.exe
SafeBoot-HDDirect

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-21 22:29
Windows 5.1.2600 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINESystemControlSet001Services{B154377D-700F-42cc-9474-23858FBDF4BD}]
«ImagePath»=»??c:program filesCyberLinkPowerDVD900.fcl»
.

---

LOCKED REGISTRY KEYS

---

[HKEY_LOCAL_MACHINEsoftwareClassesCLSID{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@=»FlashBroker»
«LocalizedString»=»@c:\WINDOWS\System32\Macromed\Flash\FlashUtil10h_ActiveX.exe,-101»

[HKEY_LOCAL_MACHINEsoftwareClassesCLSID{A483C63A-CDBC-426E-BF93-872502E8144E}Elevation]
«Enabled»=dword:00000001

[HKEY_LOCAL_MACHINEsoftwareClassesCLSID{A483C63A-CDBC-426E-BF93-872502E8144E}LocalServer32]
@=»c:\WINDOWS\System32\Macromed\Flash\FlashUtil10h_ActiveX.exe»

[HKEY_LOCAL_MACHINEsoftwareClassesCLSID{A483C63A-CDBC-426E-BF93-872502E8144E}TypeLib]
@=»{FAB3E735-69C7-453B-A446-B6823C6DF1C9}»

[HKEY_LOCAL_MACHINEsoftwareClassesInterface{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@=»IFlashBroker4″

[HKEY_LOCAL_MACHINEsoftwareClassesInterface{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}ProxyStubClsid32]
@=»{00020424-0000-0000-C000-000000000046}»

[HKEY_LOCAL_MACHINEsoftwareClassesInterface{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}TypeLib]
@=»{FAB3E735-69C7-453B-A446-B6823C6DF1C9}»
«Version»=»1.0»
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘winlogon.exe'(620)
c:windowssystem32ODBC32.dll
c:windowssystem32Ati2evxx.dll

— — — — — — — > ‘lsass.exe'(676)
c:windowssystem32mswsock.dll
c:windowsSystem32dssenh.dll

— — — — — — — > ‘explorer.exe'(2560)
c:windowsSystem32msi.dll
c:windowsSystem32BsMobileSDK.dll
c:windowsSystem32BsLangInDepRes.dll
c:windowsSystem32Bs2Res.dll
.

---

Other Running Processes

---

.
c:windowsSystem32Ati2evxx.exe
c:windowssystem32Ati2evxx.exe
c:windowsSOUNDMAN.EXE
c:program filesuTorrent [tfile.ru]uTorrent.exe
c:program filesIVT CorporationBlueSoleilBlueSoleilCS.exe
c:program filesAlcohol SoftAlcohol 120StarWindStarWindServiceAE.exe
c:program filesIVT CorporationBlueSoleilBsHelpCS.exe
.
**************************************************************************
.
Completion time: 2010-08-21 22:31:06 — machine was rebooted
ComboFix-quarantined-files.txt 2010-08-21 16:31

Pre-Run: 194 596 864 байт свободно
Post-Run: 230 600 704 байт свободно

— — End Of File — — 8C08CA03BBB96A105E8612699EE711EC

[AYuBelov]

info.txt logfile of random’s system information tool 1.08 2010-08-20 18:51:29

======Uninstall list======

—>MsiExec /X{54194F60-988C-4D03-B922-C2B00EFDA39A}
—>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:WINDOWSINFPCHealth.inf
Adobe Flash Player 10 ActiveX—>C:WINDOWSSystem32MacromedFlashFlashUtil10h_ActiveX.exe -maintain activex
Adobe Flash Player 10 Plugin—>C:WINDOWSSystem32MacromedFlashFlashUtil10h_Plugin.exe -maintain plugin
Adobe Reader 8.1.1—>MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81100000003}
ATI — Утилита деинсталляции—>C:Program FilesATI TechnologiesUninstallAllAtiCimUn.exe
ATI Control Panel—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{0BEDBD4E-2D34-47B5-9973-57E62B29307C}setup.exe»
ATI Display Driver—>rundll32 C:WINDOWSSystem32atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
ATI HYDRAVISION—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{3EA9D975-BFDC-4E8E-B88B-0446FBC8CA66}setup.exe»
Bluesoleil 6.4.249.0—>MsiExec.exe /X{C0A871F9-D580-4404-9A69-A02CF3078C87}
C-Media WDM Audio Driver—>C:WINDOWSsystem32cmirmdrv.exe
CyberLink PowerDVD 9—>»C:Program FilesInstallShield Installation Information{8C20787A-7402-4FA7-BF25-6E5750930FDC}Setup.exe» /z-uninstall
Guardant driver—>»C:WINDOWSSystem32rundll32.exe» grddrv32.dll,GD_UninstallDriver 1
iKeyWorks 6.12—>C:Program FilesKeyboardUninst32.exe
K-Lite Codec Pack 5.6.1 (Full)—>»C:Program FilesK-Lite Codec Packunins000.exe»
Macromedia Dreamweaver 8—>MsiExec.exe /I{0837A661-FEC3-48B3-876C-91E7D32048A9}
Macromedia Extension Manager—>MsiExec.exe /I{5546CDB5-2CE2-498B-B059-5B3BF81FC41F}
Microsoft .NET Framework 2.0—>C:WINDOWSMicrosoft.NETFrameworkv2.0.50727Microsoft .NET Framework 2.0install.exe
Microsoft Office — профессиональный выпуск версии 2003—>MsiExec.exe /I{90110419-6000-11D3-8CFE-0150048383C9}
Microsoft Visual C++ 2005 Redistributable—>MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
NVIDIA PhysX—>MsiExec.exe /X{54194F60-988C-4D03-B922-C2B00EFDA39A}
Realtek AC’97 Audio—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime1150Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{FB08F381-6533-4108-B7DD-039E11FBC27E}setup.exe» -l0x19 -removeonly
Total Commander (Remove or Repair)—>C:Program Filestotalcmdtcuninst.exe
uTorrent [tfile.ru edition]—>C:Program FilesuTorrent [tfile.ru]uninstall.exe
VIA Rhine-Family Fast-Ethernet Adapter—>Rundll32.exe vuins32.dll,vuins32Ex $Rhine $VIA
VIA Диспетчер устройств платформы—>C:PROGRA~1COMMON~1INSTAL~1Driver7INTEL3~1IDriver.exe /M{20D4A895-748C-4D88-871C-FDB1695B0169}
Winamp (remove only)—>»C:Program FilesWinampUninstWA.exe»
Windows Installer 3.0 (KB884016)—>C:WINDOWS$MSI30UninstallMSI30-KB884016$spuninstspuninst.exe
Windows Installer 3.1 (KB893803)—>»C:WINDOWS$MSI31Uninstall_KB893803v2$spuninstspuninst.exe»
Архиватор WinRAR (только удаление)—>C:Program FilesWinRARuninstall.exe
Базис Мебельщик 70 (версия Проф.)—>»C:Program FilesБазис 70unins000.exe»

======Hosts File======

127.0.0.1 localhost

======System event log======

Computer Name: AYUBELOV
Event Code: 62486
Message: Invalid parameters

Record Number: 2188789
Source Name: ati2mtag
Time Written: 20100820083809.000000+360
Event Type: информация
User:

Computer Name: AYUBELOV
Event Code: 62486
Message: Invalid parameters

Record Number: 2188788
Source Name: ati2mtag
Time Written: 20100820083809.000000+360
Event Type: информация
User:

Computer Name: AYUBELOV
Event Code: 62486
Message: Invalid parameters

Record Number: 2188787
Source Name: ati2mtag
Time Written: 20100820083809.000000+360
Event Type: информация
User:

Computer Name: AYUBELOV
Event Code: 62486
Message: Invalid parameters

Record Number: 2188786
Source Name: ati2mtag
Time Written: 20100820083809.000000+360
Event Type: информация
User:

Computer Name: AYUBELOV
Event Code: 62486
Message: Invalid parameters

Record Number: 2188785
Source Name: ati2mtag
Time Written: 20100820083809.000000+360
Event Type: информация
User:

=====Application event log=====

Computer Name: AYUBELOV
Event Code: 1000
Message: Ошибка приложения explorer.exe, версия 6.0.2600.0, модуль dxdec.ax, версия 6.8.0.0, адрес 0x0005c010.

Record Number: 407
Source Name: Application Error
Time Written: 20100717114724.000000+360
Event Type: ошибка
User:

Computer Name: AYUBELOV
Event Code: 1002
Message: Оболочка неожиданно завершила работу, и программа «Explorer.exe» была перезапущена.

Record Number: 406
Source Name: Winlogon
Time Written: 20100717114715.000000+360
Event Type: информация
User:

Computer Name: AYUBELOV
Event Code: 4097
Message: Приложение C:WINDOWSexplorer.exe вызвало ошибку
Ошибка в 17/07/2010 @ 11:47:12.936
Вызвано исключение c0000005 по адресу 0474C010 (DXdec)

Record Number: 405
Source Name: DrWatson
Time Written: 20100717114713.000000+360
Event Type: информация
User:

Computer Name: AYUBELOV
Event Code: 1000
Message: Ошибка приложения explorer.exe, версия 6.0.2600.0, модуль dxdec.ax, версия 6.8.0.0, адрес 0x0005c010.

Record Number: 404
Source Name: Application Error
Time Written: 20100717111944.000000+360
Event Type: ошибка
User:

Computer Name: AYUBELOV
Event Code: 1002
Message: Оболочка неожиданно завершила работу, и программа «Explorer.exe» была перезапущена.

Record Number: 403
Source Name: Winlogon
Time Written: 20100717111932.000000+360
Event Type: информация
User:

======Environment variables======

«ComSpec»=%SystemRoot%system32cmd.exe
«Path»=C:Program FilesNVIDIA CorporationPhysXCommon;%SystemRoot%system32;%SystemRoot%;%SystemRoot%System32Wbem;C:Program FilesIVT CorporationBlueSoleilMobile;C:WINDOWSSystem32Wbem;C:Program FilesATI TechnologiesATI Control Panel
«windir»=%SystemRoot%
«OS»=Windows_NT
«PROCESSOR_ARCHITECTURE»=x86
«PROCESSOR_LEVEL»=6
«PROCESSOR_IDENTIFIER»=x86 Family 6 Model 8 Stepping 1, AuthenticAMD
«PROCESSOR_REVISION»=0801
«NUMBER_OF_PROCESSORS»=1
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP

---

EOF

---

Logfile of random’s system information tool 1.08 (written by random/random)
Run by Админ at 2010-08-20 18:51:00
Microsoft Windows XP Home Edition
System drive C: has 423 MB (5%) free of 9 GB
Total RAM: 1279 MB (69% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:51:28, on 20.08.2010
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSSystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:Program FilesIVT CorporationBlueSoleilBtTray.exe
C:Program FilesCyberLinkPowerDVD9PDVD9Serv.exe
C:Program FilesCyberlinkShared Filesbrs.exe
C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
C:Program FilesAdobeReader 8.0ReaderReader_sl.exe
C:PROGRA~1KeyboardIkeymain.exe
C:Program FilesWinampwinampa.exe
C:WINDOWSSOUNDMAN.EXE
C:WINDOWSSystem32ctfmon.exe
C:Program FilesIVT CorporationBlueSoleilBlueSoleilCS.exe
C:Program FilesIVT CorporationBlueSoleilBsMobileCS.exe
C:Program FilesAlcohol SoftAlcohol 120StarWindStarWindServiceAE.exe
C:Program FilesIVT CorporationBlueSoleilBsHelpCS.exe
C:WINDOWSSystem32CMMON32.EXE
C:Program FilestotalcmdTOTALCMD.EXE
C:Program FilesMozilla Firefoxfirefox.exe
D:DownloadsRSIT.exe
C:Program Filestrend microАдмин.exe

R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
F2 — REG:system.ini: UserInit=C:WINDOWSsystem32userinit.exe,C:WINDOWSSystem32b70a0d63.exe,C:WINDOWSSystem32dhmdlb.exe,
O2 — BHO: Adobe PDF Reader Link Helper — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O3 — Toolbar: &Радио — {8E718888-423F-11D2-876E-00A0C9082467} — C:WINDOWSSystem32msdxm.ocx
O4 — HKLM..Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 — HKLM..Run: [BtTray] «C:Program FilesIVT CorporationBlueSoleilBtTray.exe»
O4 — HKLM..Run: [RemoteControl9] «C:Program FilesCyberLinkPowerDVD9PDVD9Serv.exe»
O4 — HKLM..Run: [BDRegion] C:Program FilesCyberlinkShared Filesbrs.exe
O4 — HKLM..Run: [ATIPTA] C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
O4 — HKLM..Run: [Adobe Reader Speed Launcher] «C:Program FilesAdobeReader 8.0ReaderReader_sl.exe»
O4 — HKLM..Run: [iKeyWorks] C:PROGRA~1KeyboardIkeymain.exe
O4 — HKLM..Run: [WinampAgent] C:Program FilesWinampwinampa.exe
O4 — HKLM..Run: [SpybotSnD] «C:Program FilesSpybot — Search & DestroySpybotSD.exe» /autocheck
O4 — HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWSSystem32ctfmon.exe
O4 — HKCU..Run: [AlcoholAutomount] «C:Program FilesAlcohol SoftAlcohol 120axcmd.exe» /automount
O4 — HKCU..Run: [µTorrent] «C:Program FilesuTorrent [tfile.ru]uTorrent.exe»
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSSystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSSystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSSystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSSystem32CTFMON.EXE (User ‘Default user’)
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 — Extra context menu item: Send by Bluetooth — C:Program FilesIVT CorporationBlueSoleilTransSendIEtsinfo.htm
O8 — Extra context menu item: Send via &Message… — C:Program FilesIVT CorporationBlueSoleilTransSendIEtssms.htm
O9 — Extra button: Справочные материалы — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 — Extra button: Related — {c95fe080-8f5d-11d2-a20b-00aa003c157a} — C:WINDOWSwebrelated.htm
O9 — Extra ‘Tools’ menuitem: Show &Related Links — {c95fe080-8f5d-11d2-a20b-00aa003c157a} — C:WINDOWSwebrelated.htm
O17 — HKLMSystemCCSServicesTcpip..{227C4CA6-0FD9-41F4-A583-AAB34A929E40}: NameServer = 79.140.16.5 79.140.19.2
O18 — Protocol: skype4com — {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} — C:WINDOWSSystem32skype4com.dll
O22 — SharedTaskScheduler: Предзагрузчик Browseui — {438755C2-A8BA-11D1-B96B-00A0C90312E1} — C:WINDOWSSystem32browseui.dll
O22 — SharedTaskScheduler: Демон кэша категорий компонентов — {8C7461EF-2B13-11d2-BE35-3078302C2030} — C:WINDOWSSystem32browseui.dll
O23 — Service: Ati HotKey Poller — ATI Technologies Inc. — C:WINDOWSSystem32Ati2evxx.exe
O23 — Service: ATI Smart — Unknown owner — C:WINDOWSsystem32ati2sgag.exe
O23 — Service: BlueSoleilCS — Unknown owner — C:Program FilesIVT CorporationBlueSoleilBlueSoleilCS.exe
O23 — Service: BsHelpCS — Unknown owner — C:Program FilesIVT CorporationBlueSoleilBsHelpCS.exe
O23 — Service: BsMobileCS — Unknown owner — C:Program FilesIVT CorporationBlueSoleilBsMobileCS.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSSystem32imapi.exe
O23 — Service: NetMeeting Remote Desktop Sharing (mnmsrvc) — Корпорация Майкрософт — C:WINDOWSSystem32mnmsrvc.exe
O23 — Service: Служба сетевого DDE (NetDDE) — Корпорация Майкрософт — C:WINDOWSsystem32netdde.exe
O23 — Service: Диспетчер сетевого DDE (NetDDEdsdm) — Корпорация Майкрософт — C:WINDOWSsystem32netdde.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Модуль поддержки смарт-карт (SCardDrv) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: StarWind AE Service (StarWindServiceAE) — Rocket Division Software — C:Program FilesAlcohol SoftAlcohol 120StarWindStarWindServiceAE.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSSystem32wbemwmiapsrv.exe

—
End of file — 6460 bytes

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{8E718888-423F-11D2-876E-00A0C9082467} — &Радио — C:WINDOWSSystem32msdxm.ocx [2001-10-20 845340]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«Cmaudio»=RunDll32 cmicnfg.cpl,CMICtrlWnd []
«BtTray»=C:Program FilesIVT CorporationBlueSoleilBtTray.exe [2009-02-27 278016]
«RemoteControl9″=C:Program FilesCyberLinkPowerDVD9PDVD9Serv.exe [2009-09-02 87336]
«BDRegion»=C:Program FilesCyberlinkShared Filesbrs.exe [2009-08-06 75048]
«ATIPTA»=C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe [2005-05-12 344064]
«Adobe Reader Speed Launcher»=C:Program FilesAdobeReader 8.0ReaderReader_sl.exe [2007-10-10 39792]
«iKeyWorks»=C:PROGRA~1KeyboardIkeymain.exe [2002-11-22 73728]
«WinampAgent»=C:Program FilesWinampwinampa.exe [2003-12-13 33792]
«SpybotSnD»=C:Program FilesSpybot — Search & DestroySpybotSD.exe /autocheck []
«SoundMan»=C:WINDOWSSOUNDMAN.EXE [2007-04-16 577536]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=C:WINDOWSSystem32ctfmon.exe [2001-10-20 13312]
«AlcoholAutomount»=C:Program FilesAlcohol SoftAlcohol 120axcmd.exe [2007-08-02 222592]
«µTorrent»=C:Program FilesuTorrent [tfile.ru]uTorrent.exe [2007-05-09 177152]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyAtiExtEvent]
C:WINDOWSsystem32Ati2evxx.dll [2005-05-13 46080]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalHDDirect]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalHDDirect.sys]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkHDDirect]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkHDDirect.sys]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkUploadMgr]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=145

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]

======File associations======

.js — edit — «C:Program FilesMacromediaDreamweaver 8dreamweaver.exe» «%1»

======List of files/folders created in the last 1 months======

2010-08-20 18:51:00 —-D—- C:rsit
2010-08-20 18:51:00 —-D—- C:Program Filestrend micro
2010-08-16 19:40:57 —-A—- C:WINDOWSSystem32driversportcls.sys
2010-08-16 19:40:56 —-A—- C:WINDOWSSystem32driversdrmk.sys
2010-08-16 19:40:46 —-D—- C:Program FilesRealtek AC97
2010-08-16 19:40:41 —-A—- C:WINDOWSSystem32RTLCPL.exe
2010-08-16 19:40:36 —-A—- C:WINDOWSsoundman.exe
2010-08-16 19:40:34 —-A—- C:WINDOWSSystem32RtlCPAPI.dll
2010-08-16 19:40:34 —-A—- C:WINDOWSSystem32driversalcxwdm.sys
2010-08-15 17:37:44 —-A—- C:WINDOWSAlcrmv.exe
2010-08-15 16:01:07 —-D—- C:Program FilesSpybot — Search & Destroy
2010-08-15 15:52:27 —-A—- C:WINDOWSSystem32drivershddirect.sys
2010-08-15 13:03:24 —-SHD—- C:Config.Msi
2010-08-15 12:50:59 —-D—- C:Program FilesNVIDIA Corporation
2010-08-15 12:50:05 —-D—- C:Program FilesCommon FilesWise Installation Wizard
2010-08-15 12:48:08 —-D—- C:WINDOWSSxsCaPendDel
2010-08-13 22:10:51 —-A—- C:WINDOWSSystem32loqyxd.exe
2010-08-13 18:43:19 —-D—- C:Documents and SettingsAll UsersApplication DataAlawarWrapper
2010-08-10 21:39:09 —-D—- C:Documents and SettingsAll UsersApplication DataMacromedia
2010-08-10 21:38:53 —-D—- C:Program FilesMacromedia
2010-08-10 21:38:53 —-D—- C:Program FilesCommon FilesMacromedia
2010-08-10 21:38:21 —-A—- C:WINDOWSSystem32BASSMOD.dll
2010-08-10 21:38:08 —-D—- C:WINDOWSDownloaded Installations
2010-08-08 19:45:58 —-D—- C:WINDOWSMinidump
2010-08-08 19:33:29 —-D—- C:Program FilesБазис 70
2010-08-04 18:54:01 —-SD—- C:WINDOWSSystem32Microsoft
2010-08-04 18:53:24 —-D—- C:Documents and SettingsAll UsersApplication DataKaspersky Lab
2010-08-04 18:52:46 —-D—- C:Documents and SettingsAll UsersApplication DataKaspersky Lab Setup Files
2010-08-04 18:39:48 —-HDC—- C:WINDOWS$MSI31Uninstall_KB893803v2$
2010-08-01 19:21:35 —-A—- C:WINDOWSSystem32jhseee.exe
2010-07-25 15:55:20 —-D—- C:Documents and SettingsАдминApplication DataGroove Games
2010-07-25 15:33:52 —-A—- C:WINDOWSSystem32readme.txt
2010-07-25 15:33:52 —-A—- C:WINDOWSSystem32dll-download-system.com.URL
2010-07-25 15:33:52 —-A—- C:WINDOWSSystem32d3dx9_37.dll
2010-07-25 14:01:47 —-A—- C:WINDOWSSystem32d3dx9_42.dll
2010-07-24 12:08:10 —-A—- C:WINDOWSSystem32wmvdmod.dll
2010-07-24 12:08:10 —-A—- C:WINDOWSSystem32wmsdmod.dll
2010-07-24 12:08:10 —-A—- C:WINDOWSSystem32wmadmod.dll
2010-07-24 12:08:10 —-A—- C:WINDOWSSystem32mpg4dmod.dll
2010-07-24 12:08:10 —-A—- C:WINDOWSSystem32mp4sdmod.dll
2010-07-24 12:08:10 —-A—- C:WINDOWSSystem32mp43dmod.dll
2010-07-24 12:08:09 —-A—- C:WINDOWSSystem32wmvdmoe2.dll
2010-07-24 12:08:09 —-A—- C:WINDOWSSystem32wmspdmoe.dll
2010-07-24 12:08:09 —-A—- C:WINDOWSSystem32wmsdmoe2.dll
2010-07-24 12:08:09 —-A—- C:WINDOWSSystem32wmadmoe.dll
2010-07-24 12:08:09 —-A—- C:WINDOWSSystem32qasf.dll
2010-07-24 12:08:09 —-A—- C:WINDOWSSystem32logagent.exe
2010-07-24 12:08:09 —-A—- C:WINDOWSSystem32laprxy.dll
2010-07-24 12:08:08 —-A—- C:WINDOWSSystem32wmvcore.dll
2010-07-24 12:08:08 —-A—- C:WINDOWSSystem32wmnetmgr.dll
2010-07-24 12:08:08 —-A—- C:WINDOWSSystem32wmidx.dll
2010-07-24 12:08:08 —-A—- C:WINDOWSSystem32wmasf.dll
2010-07-24 12:08:07 —-A—- C:WINDOWSSystem32msnetobj.dll
2010-07-24 12:08:07 —-A—- C:WINDOWSSystem32blackbox.dll
2010-07-24 12:08:06 —-A—- C:WINDOWSSystem32drmv2clt.dll
2010-07-24 12:08:06 —-A—- C:WINDOWSSystem32drmstor.dll
2010-07-24 12:08:06 —-A—- C:WINDOWSSystem32drmclien.dll
2010-07-24 11:56:47 —-A—- C:WINDOWSIsUn0419.exe
2010-07-24 11:18:59 —-D—- C:WINDOWSLogs
2010-07-23 18:09:35 —-D—- C:Program FilesCommon Fileswm
2010-07-23 18:09:35 —-A—- C:Program FilesCommon Fileskeylog.txt
2010-07-23 18:09:30 —-A—- C:WINDOWSSystem32dhmdlb.exe
2010-07-23 18:09:27 —-A—- C:WINDOWSSystem32b70a0d63.exe

======List of files/folders modified in the last 1 months======

2010-08-20 18:51:00 —-RD—- C:Program Files
2010-08-20 18:48:41 —-D—- C:Program FilesMozilla Firefox
2010-08-20 18:48:29 —-A—- C:WINDOWSwincmd.ini
2010-08-20 18:47:33 —-D—- C:WINDOWSTemp
2010-08-20 18:47:25 —-D—- C:Documents and SettingsАдминApplication DatauTorrent
2010-08-20 18:47:00 —-D—- C:WINDOWSDebug
2010-08-20 18:47:00 —-A—- C:WINDOWSSystem32bscs.ini
2010-08-20 18:34:06 —-A—- C:WINDOWSSchedLgU.Txt
2010-08-18 21:25:47 —-D—- C:Documents and SettingsAll UsersApplication DataSpybot — Search & Destroy
2010-08-18 20:08:19 —-SHD—- C:System Volume Information
2010-08-18 20:08:17 —-D—- C:WINDOWSSystem32Restore
2010-08-18 20:06:33 —-D—- C:WINDOWSSystem32drivers
2010-08-18 20:05:30 —-A—- C:WINDOWSwinamp.ini
2010-08-17 19:07:22 —-D—- C:WINDOWSsystem32
2010-08-17 19:04:37 —-D—- C:WINDOWSSystem32CatRoot2
2010-08-16 19:41:20 —-HD—- C:WINDOWS
2010-08-16 19:41:02 —-RSHDC—- C:WINDOWSSystem32dllcache
2010-08-16 19:34:04 —-HD—- C:WINDOWSinf
2010-08-16 19:33:56 —-D—- C:WINDOWSSystem32ReinstallBackups
2010-08-15 16:37:47 —-D—- C:WINDOWSLastGood
2010-08-15 16:37:11 —-D—- C:WINDOWSSystem32DirectX
2010-08-15 15:12:37 —-A—- C:WINDOWSSystem32LOCALSERVICE.INI
2010-08-15 15:11:38 —-A—- C:WINDOWSSystem32LOCALDEVICE.INI
2010-08-15 13:04:15 —-SHD—- C:WINDOWSInstaller
2010-08-15 12:50:05 —-D—- C:Program FilesCommon Files
2010-08-15 12:48:28 —-D—- C:WINDOWSWinSxS
2010-08-15 12:48:15 —-D—- C:Program FilesCommon FilesMicrosoft Shared
2010-08-13 19:27:19 —-D—- C:WINDOWSPrefetch
2010-08-13 18:52:24 —-A—- C:WINDOWSSystem32REMOTEDEVICE.INI
2010-08-08 19:33:58 —-RSD—- C:WINDOWSFonts
2010-08-07 19:03:50 —-A—- C:WINDOWSSystem32SHORTCUT.INI
2010-07-25 13:56:22 —-RSD—- C:WINDOWSassembly
2010-07-24 12:08:06 —-D—- C:Program FilesWindows Media Player

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 BtHidBus;Bluetooth HID Bus Service; C:WINDOWSSystem32DriversBtHidBus.sys [2009-01-07 20744]
R0 PxHelp20;PxHelp20; C:WINDOWSSystem32DRIVERSPxHelp20.sys [2003-10-28 20016]
R0 sptd;sptd; C:WINDOWSSystem32Driverssptd.sys [2010-07-04 685816]
R0 viaagp1;VIA AGP Filter; C:WINDOWSSystem32DRIVERSviaagp1.sys [2003-07-02 27904]
R0 viamraid;viamraid; C:WINDOWSSystem32DRIVERSviamraid.sys [2008-01-22 117248]
R0 videX32;videX32; C:WINDOWSSystem32DRIVERSvideX32.sys [2007-09-21 9216]
R1 NVKEYNT;NVKEYNT; ??C:WINDOWSSystem32DRIVERSNVKEYNT.SYS []
R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2010/07/04 21:57:22]; ??C:Program FilesCyberLinkPowerDVD900.fcl []
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:WINDOWSsystem32driversALCXWDM.SYS [2007-04-25 4030144]
R3 ati2mtag;ati2mtag; C:WINDOWSSystem32DRIVERSati2mtag.sys [2005-05-13 1198080]
R3 Btcsrusb;Bluetooth USB For Bluetooth Service; C:WINDOWSSystem32Driversbtcusb.sys [2009-01-03 39304]
R3 btnetBUs;Bluetooth PAN Bus Service; C:WINDOWSSystem32DriversbtnetBus.sys [2008-12-07 30088]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service; C:WINDOWSSystem32DRIVERSfetnd5bv.sys [2007-04-17 42496]
R3 IvtBtBUs;IVT Bluetooth Bus Service; C:WINDOWSSystem32DriversIvtBtBus.sys [2008-07-02 26248]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSSystem32DRIVERSusbuhci.sys [2001-10-20 18944]
R3 VcommMgr;Bluetooth VComm Manager Service; C:WINDOWSSystem32DriversVcommMgr.sys [2009-01-08 31880]
S2 bmbemu;bmbemu; C:WINDOWSSystem32driversbmbemu.SYS []
S3 a3jgisg7;a3jgisg7; C:WINDOWSSystem32driversa3jgisg7.sys []
S3 BT;Bluetooth PAN Network Adapter; C:WINDOWSSystem32DRIVERSbtnetdrv.sys [2008-12-07 14088]
S3 BTNetFilter;Bluetooth Network Filter; ??C:Program FilesIVT CorporationBlueSoleilDeviceWin2kBTNetFilter.sys []
S3 cmuda;C-Media WDM Audio Interface; C:WINDOWSsystem32driverscmuda.sys [2004-04-23 818496]
S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet адаптер, драйвер для NT; C:WINDOWSSystem32DRIVERSfetnd5.sys [2001-08-17 27165]
S3 GrdKey;Guardant LPT Dongle Service; C:WINDOWSSystem32DRIVERSgrdkey.sys []
S3 HDDirect;Hard Disk Direct Control; ??C:WINDOWSsystem32drivershddirect.sys []
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSSystem32DRIVERSUSBSTOR.SYS [2001-08-17 21760]
S3 VComm;Virtual Serial port driver; C:WINDOWSSystem32DRIVERSVComm.sys [2008-01-21 14856]
S4 dwshd;dwshd; C:WINDOWSSystem32driversdwshd.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:WINDOWSSystem32Ati2evxx.exe [2005-05-13 368640]
R2 BlueSoleilCS;BlueSoleilCS; C:Program FilesIVT CorporationBlueSoleilBlueSoleilCS.exe [2009-02-27 850432]
R2 BsMobileCS;BsMobileCS; C:Program FilesIVT CorporationBlueSoleilBsMobileCS.exe [2009-02-27 143467]
R2 StarWindServiceAE;StarWind AE Service; C:Program FilesAlcohol SoftAlcohol 120StarWindStarWindServiceAE.exe [2007-05-28 275968]
R3 BsHelpCS;BsHelpCS; C:Program FilesIVT CorporationBlueSoleilBsHelpCS.exe [2009-02-27 98407]
S2 ATI Smart;ATI Smart; C:WINDOWSsystem32ati2sgag.exe [2005-05-12 516096]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2005-09-23 66240]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2003-07-29 89136]

---

EOF

---

[AYuBelov]

ап, хелп

[Автор]

Сообщения