Созданные ответы форума
-
Сообщения
-
Отдала в сервис, сказали что слетело ПО.
Восстанавливают. Жду свои «средства производства» домой =)))Пишу с другого ноута… т.к. мой вообще «сдвинулся» =((((((((((((
Сегодня всё еще хуже! Он перезагружается постоянно, даже не войдя в окно Виндовс.
Не реагирует на F8. Не могу зайти в безопасном режиме ❗
Максимум, при загрузке реагирует на Esc ➡ F12.
Что делать? Помогите!И еще вопрос:
На съемном жестком диске нашла не известную мне папку под названием «RECYCLER»
Удалила ее только после переименования.
Еще есть папка с названием «c2e72ee05a7cdcd3e95873» ее-то, и никак не могу удалить.Подскажите плиз, как произвести очистку/удаление?
У меня был тот же самый баннер! Да, его нельзя закрыть или сдвинуть… 😕
Пока к вам подойдет специалист, могу подсказать, что войти в комп вообще или для осуществления «первых шагов» можно через «безопасный режим» (читать здесь: http://www.spyware-ru.com/forums/forum/lechim-kompyutery/instruktsii-i-poleznaya-informatsiya/?&t=4159)
Обязательно сделать первые шаги! (читать здесь: http://www.spyware-ru.com/forums/forum/lechim-kompyutery/udalenie-virusov-troyanov-spajvare/?&t=2 )
Здравствуйте, Valeri !
Запустила комп в безопасном режиме и работала с Combofix.Проверьте лог, пожалуйста.
Получилось запустить RSIT только в безопасном режиме!
С нетерпением жду вашей помощи!Здравствуйте!
Посмотрите пожалуйста файлы: log.txt и info.txt
С нетерпением жду ваш «диагноз» 🙄Заранее спасибо!
Здравствуйте! Проблем с компом не наблюдается 😉 .
Спасибо за совет! Приму к сведению.Здравствуйте, Valeri !
Вот информация с C:_OTMoveItMovedFiles
Посмотрите этот лог пожалуйста и дайте свои рекомендации… нужно ли что-нибудь делать дальше?
И если возможно, ответьте на мой второй вопрос. Заранее спасибо.:========== PROCESSES ==========
Process explorer.exe killed successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{37D24D2C-060A-4F10-A69E-93DFCC20453E}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{4B7B8BCE-7E00-450D-BFBF-4F49F21BE610}\ deleted successfully.
========== FILES ==========
C:Documents and SettingsAll UsersApplication Dataucxvbqu.dll unregistered successfully.
C:Documents and SettingsAll UsersApplication Dataucxvbqu.dll moved successfully.
C:Documents and SettingsAll UsersApplication Databoitsqu.dll unregistered successfully.
C:Documents and SettingsAll UsersApplication Databoitsqu.dll moved successfully.
========== COMMANDS ==========
File delete failed. C:DOCUME~1DE29~1LOCALS~1TempRtkBtMnt.exe scheduled to be deleted on reboot.
User’s Temp folder emptied.
User’s Internet Explorer cache folder emptied.
File delete failed. C:Documents and SettingsЕленаLocal SettingsTemporary Internet FilesContent.IE5RRUYW1EUviewtopic[1].htm scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsЕленаLocal SettingsTemporary Internet FilesContent.IE5index.dat scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsЕленаLocal SettingsTemporary Internet FilesAntiPhishingB3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat scheduled to be deleted on reboot.
User’s Temporary Internet Files folder emptied.
File delete failed. C:Documents and SettingsLocalServiceLocal SettingsTempTemporary Internet FilesContent.IE5index.dat scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsLocalServiceLocal SettingsTempHistoryHistory.IE5index.dat scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsLocalServiceLocal SettingsTempCookiesindex.dat scheduled to be deleted on reboot.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:WINDOWStempmcafee_KobEAbvGQcaxMFf scheduled to be deleted on reboot.
File delete failed. C:WINDOWStempmcmsc_3rTNv8vknUmi1FM scheduled to be deleted on reboot.
File delete failed. C:WINDOWStempmcmsc_9Op8ab69ecDpkHE scheduled to be deleted on reboot.
File delete failed. C:WINDOWStempmcmsc_cFYoXB0lA6fZFNC scheduled to be deleted on reboot.
File delete failed. C:WINDOWStempsqlite_6L4ateakq3YILWp scheduled to be deleted on reboot.
File delete failed. C:WINDOWStempsqlite_DChwUDhCFsSv4j4 scheduled to be deleted on reboot.
File delete failed. C:WINDOWStempsqlite_htjPJKJhiQjRDfl scheduled to be deleted on reboot.
File delete failed. C:WINDOWStempsqlite_mKn8kSh0O45Et9E scheduled to be deleted on reboot.
File delete failed. C:WINDOWStempsqlite_QBJ8SVrfFSersLs scheduled to be deleted on reboot.
File delete failed. C:WINDOWStempsqlite_VXhwRQUdaUuLphi scheduled to be deleted on reboot.
File delete failed. C:WINDOWStempsqlite_Ww1WeCLgMM26Hlg scheduled to be deleted on reboot.
Windows Temp folder emptied.
Temp folders emptied.
Explorer started successfullyOTMoveIt3 by OldTimer — Version 1.0.11.0 log created on 04162009_001113
Files moved on Reboot…
C:DOCUME~1DE29~1LOCALS~1TempRtkBtMnt.exe moved successfully.
C:Documents and SettingsЕленаLocal SettingsTemporary Internet FilesContent.IE5RRUYW1EUviewtopic[1].htm moved successfully.
C:Documents and SettingsЕленаLocal SettingsTemporary Internet FilesAntiPhishingB3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat moved successfully.
File C:WINDOWStempmcafee_KobEAbvGQcaxMFf not found!
File C:WINDOWStempmcmsc_3rTNv8vknUmi1FM not found!
File C:WINDOWStempmcmsc_9Op8ab69ecDpkHE not found!
File C:WINDOWStempmcmsc_cFYoXB0lA6fZFNC not found!
File C:WINDOWStempsqlite_6L4ateakq3YILWp not found!
C:WINDOWStempsqlite_DChwUDhCFsSv4j4 moved successfully.
C:WINDOWStempsqlite_htjPJKJhiQjRDfl moved successfully.
File C:WINDOWStempsqlite_mKn8kSh0O45Et9E not found!
File C:WINDOWStempsqlite_QBJ8SVrfFSersLs not found!
File C:WINDOWStempsqlite_VXhwRQUdaUuLphi not found!
C:WINDOWStempsqlite_Ww1WeCLgMM26Hlg moved successfully.свежий RSIT лог
Logfile of random’s system information tool 1.06 (written by random/random)
Run by Елена at 2009-04-16 00:31:15
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 139 GB (94%) free of 148 GB
Total RAM: 1012 MB (58% free)Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0:31:17, on 16.04.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: NormalRunning processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:Program FilesCommon FilesInterVideoRegMgriviRegMgr.exe
C:Program FilesMcAfeeSiteAdvisorMcSACore.exe
C:PROGRA~1McAfeeMSCmcmscsvc.exe
c:PROGRA~1COMMON~1mcafeemnamcnasvc.exe
c:PROGRA~1COMMON~1mcafeemcproxymcproxy.exe
C:PROGRA~1McAfeeVIRUSS~1mcshield.exe
C:Program FilesMcAfeeMPFMPFSrv.exe
C:Program FilesMcAfeeMSKMskSrver.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
c:PROGRA~1mcafee.comagentmcagent.exe
C:WINDOWSsystem32igfxtray.exe
C:WINDOWSsystem32hkcmd.exe
C:WINDOWSsystem32igfxsrvc.exe
C:WINDOWSsystem32igfxpers.exe
C:WINDOWSRTHDCPL.EXE
C:AcerEmpowering TechnologyeRecoveryeRAgent.exe
C:Program FilesSynapticsSynTPSynTPEnh.exe
C:PROGRA~1LAUNCH~1QtZgAcer.EXE
C:Program Filesmail — агентMAgent.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesMessengermsmsgs.exe
C:Program FilesInterVideoCommonBinWinCinemaMgr.exe
C:WINDOWSsystem32igfxext.exe
C:Program FilesInternet Exploreriexplore.exe
C:PROGRA~1McAfeeVIRUSS~1mcsysmon.exe
C:WINDOWSsystem32NOTEPAD.EXE
C:Documents and SettingsЕленаРабочий столПРОТИВ ТРОЯНАRSIT.exe
C:Program Filestrend microЕлена.exeR0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.ya.ru/
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://global.acer.com
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0419&s=0&o=xph&d=0109&m=aoa150
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: (no name) — {83821C2B-32A8-4DD7-B6D4-44309A78E668} — C:Program Filesmail — агентMradllnewmrasearch.dll
O2 — BHO: AcroIEHelperStub — {18DF081C-E8AD-4283-A596-FA578C2EBDC3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelperShim.dll
O2 — BHO: McAfee Phishing Filter — {27B4851A-3207-45A2-B947-BE8AFE6163AB} — c:PROGRA~1mcafeemskmskapbho.dll
O2 — BHO: scriptproxy — {7DB2D5A0-7241-4E79-B68D-6309F01C5231} — c:PROGRA~1mcafeeVIRUSS~1scriptsn.dll
O2 — BHO: McAfee SiteAdvisor BHO — {B164E929-A1B6-4A06-B104-2CD0E90A88FF} — c:PROGRA~1mcafeeSITEAD~1mcieplg.dll
O3 — Toolbar: McAfee SiteAdvisor Toolbar — {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} — c:PROGRA~1mcafeeSITEAD~1mcieplg.dll
O4 — HKLM..Run: [LaunchApp] Alaunch
O4 — HKLM..Run: [IgfxTray] C:WINDOWSsystem32igfxtray.exe
O4 — HKLM..Run: [HotKeysCmds] C:WINDOWSsystem32hkcmd.exe
O4 — HKLM..Run: [Persistence] C:WINDOWSsystem32igfxpers.exe
O4 — HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 — HKLM..Run: [Alcmtr] ALCMTR.EXE
O4 — HKLM..Run: [AzMixerSel] C:Program FilesRealtekAudioInstallShieldAzMixerSel.exe
O4 — HKLM..Run: [SynTPEnh] C:Program FilesSynapticsSynTPSynTPEnh.exe
O4 — HKLM..Run: [Adobe Reader Speed Launcher] «C:Program FilesAdobeReader 9.0ReaderReader_sl.exe»
O4 — HKLM..Run: [IMJPMIG8.1] «C:WINDOWSIMEimjp8_1IMJPMIG.EXE» /Spoil /RemAdvDef /Migration32
O4 — HKLM..Run: [MSPY2002] C:WINDOWSsystem32IMEPINTLGNTImScInst.exe /SYNC
O4 — HKLM..Run: [PHIME2002ASync] C:WINDOWSsystem32IMETINTLGNTTINTSETP.EXE /SYNC
O4 — HKLM..Run: [PHIME2002A] C:WINDOWSsystem32IMETINTLGNTTINTSETP.EXE /IMEName
O4 — HKLM..Run: [mcagent_exe] «C:Program FilesMcAfee.comAgentmcagent.exe» /runkey
O4 — HKLM..Run: [M3000Mnt] Rundll32.exe M3000Rmv.dll ,WinMainRmv /StartStillMnt
O4 — HKLM..Run: [LManager] C:PROGRA~1LAUNCH~1QtZgAcer.EXE
O4 — HKLM..Run: [eRecoveryService] C:AcerEmpowering TechnologyeRecoveryeRAgent.exe
O4 — HKLM..Run: [SetDefPrt] C:Program FilesBrotherBrmfl04hBrStDvPt.exe
O4 — HKLM..Run: [MAgent] C:Program Filesmail — агентMAgent.exe -LM
O4 — HKLM..Run: [LangOver] C:Program FilesПеревод голоса в текстLangOver.exe
O4 — HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [MSMSGS] «C:Program FilesMessengermsmsgs.exe» /background
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — Global Startup: InterVideo WinCinema Manager.lnk = C:Program FilesInterVideoCommonBinWinCinemaMgr.exe
O4 — Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOffice10OSA.EXE
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2Office10EXCEL.EXE/3000
O9 — Extra button: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program Filesmail — агентmagent.exe
O9 — Extra ‘Tools’ menuitem: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program Filesmail — агентmagent.exe
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O17 — HKLMSystemCCSServicesTcpip..{5D3D6B20-D9AA-47E7-8064-42C71C49F0BD}: NameServer = 82.199.96.143 195.94.224.134
O18 — Protocol: sacore — {5513F07E-936B-4E52-9B00-067394E91CC5} — c:PROGRA~1mcafeeSITEAD~1mcieplg.dll
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: IviRegMgr — InterVideo — C:Program FilesCommon FilesInterVideoRegMgriviRegMgr.exe
O23 — Service: McAfee SiteAdvisor Service — Unknown owner — C:Program FilesMcAfeeSiteAdvisorMcSACore.exe
O23 — Service: McAfee Services (mcmscsvc) — McAfee, Inc. — C:PROGRA~1McAfeeMSCmcmscsvc.exe
O23 — Service: McAfee Network Agent (McNASvc) — McAfee, Inc. — c:PROGRA~1COMMON~1mcafeemnamcnasvc.exe
O23 — Service: McAfee Scanner (McODS) — McAfee, Inc. — C:PROGRA~1McAfeeVIRUSS~1mcods.exe
O23 — Service: McAfee Proxy Service (McProxy) — McAfee, Inc. — c:PROGRA~1COMMON~1mcafeemcproxymcproxy.exe
O23 — Service: McAfee Real-time Scanner (McShield) — McAfee, Inc. — C:PROGRA~1McAfeeVIRUSS~1mcshield.exe
O23 — Service: McAfee SystemGuards (McSysmon) — McAfee, Inc. — C:PROGRA~1McAfeeVIRUSS~1mcsysmon.exe
O23 — Service: NetMeeting Remote Desktop Sharing (mnmsrvc) — Корпорация Майкрософт — C:WINDOWSsystem32mnmsrvc.exe
O23 — Service: McAfee Personal Firewall Service (MpfService) — McAfee, Inc. — C:Program FilesMcAfeeMPFMPFSrv.exe
O23 — Service: McAfee Anti-Spam Service (MSK80Service) — McAfee, Inc. — C:Program FilesMcAfeeMSKMskSrver.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe—
End of file — 8304 bytes======Scheduled tasks folder======
C:WINDOWStasksMcDefragTask.job
C:WINDOWStasksMcQcTask.job======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelperShim.dll [2008-06-11 75128][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{27B4851A-3207-45A2-B947-BE8AFE6163AB}]
McAfee Phishing Filter — c:PROGRA~1mcafeemskmskapbho.dll [2009-01-09 246800][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
scriptproxy — c:PROGRA~1mcafeeVIRUSS~1scriptsn.dll [2009-01-16 58688][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{B164E929-A1B6-4A06-B104-2CD0E90A88FF}]
McAfee SiteAdvisor BHO — c:PROGRA~1mcafeeSITEAD~1mcieplg.dll [2009-02-13 150032][HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} — McAfee SiteAdvisor Toolbar — c:PROGRA~1mcafeeSITEAD~1mcieplg.dll [2009-02-13 150032][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«LaunchApp»=Alaunch []
«IgfxTray»=C:WINDOWSsystem32igfxtray.exe [2008-02-28 141848]
«HotKeysCmds»=C:WINDOWSsystem32hkcmd.exe [2008-02-28 166424]
«Persistence»=C:WINDOWSsystem32igfxpers.exe [2008-02-28 137752]
«RTHDCPL»=C:WINDOWSRTHDCPL.EXE [2008-05-16 16862720]
«Alcmtr»=C:WINDOWSALCMTR.EXE [2005-05-03 69632]
«AzMixerSel»=C:Program FilesRealtekAudioInstallShieldAzMixerSel.exe [2006-07-17 53248]
«SynTPEnh»=C:Program FilesSynapticsSynTPSynTPEnh.exe [2008-04-25 1044480]
«Adobe Reader Speed Launcher»=C:Program FilesAdobeReader 9.0ReaderReader_sl.exe [2008-06-12 34672]
«IMJPMIG8.1″=C:WINDOWSIMEimjp8_1IMJPMIG.EXE [2008-06-10 208952]
«MSPY2002″=C:WINDOWSsystem32IMEPINTLGNTImScInst.exe [2008-06-10 59392]
«PHIME2002ASync»=C:WINDOWSsystem32IMETINTLGNTTINTSETP.EXE [2008-06-10 455168]
«PHIME2002A»=C:WINDOWSsystem32IMETINTLGNTTINTSETP.EXE [2008-06-10 455168]
«mcagent_exe»=C:Program FilesMcAfee.comAgentmcagent.exe [2009-01-08 645328]
«M3000Mnt»=M3000Rmv.dll ,WinMainRmv /StartStillMnt []
«LManager»=C:PROGRA~1LAUNCH~1QtZgAcer.EXE [2008-05-14 821768]
«eRecoveryService»=C:AcerEmpowering TechnologyeRecoveryeRAgent.exe [2008-05-22 425984]
«SetDefPrt»=C:Program FilesBrotherBrmfl04hBrStDvPt.exe [2004-11-11 49152]
«MAgent»=C:Program Filesmail — агентMAgent.exe [2009-01-11 5598392]
«LangOver»=C:Program FilesПеревод голоса в текстLangOver.exe [][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«ctfmon.exe»=C:WINDOWSsystem32ctfmon.exe [2008-06-10 15360]
«MSMSGS»=C:Program FilesMessengermsmsgs.exe [2008-04-14 1695232]C:Documents and SettingsAll UsersГлавное менюПрограммыАвтозагрузка
InterVideo WinCinema Manager.lnk — C:Program FilesInterVideoCommonBinWinCinemaMgr.exe
Microsoft Office.lnk — C:Program FilesMicrosoft OfficeOffice10OSA.EXE[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyigfxcui]
C:WINDOWSsystem32igfxdev.dll [2008-02-15 208896][HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalmcmscsvc]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalMCODS]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkmcmscsvc]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkMCODS]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkMpfService]
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=145[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«HonorAutoRunSetting»=[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesCommon FilesMcAfeeMNAMcNASvc.exe»=»C:Program FilesCommon FilesMcAfeeMNAMcNASvc.exe:*:Enabled:McAfee Network Agent»
«C:WINDOWSsystem32dpvsetup.exe»=»C:WINDOWSsystem32dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test»
«C:WINDOWSsystem32rundll32.exe»=»C:WINDOWSsystem32rundll32.exe:*:Enabled:Запуск библиотеки DLL как приложения»[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»======List of files/folders created in the last 1 months======
2009-04-07 14:31:43 —-D—- C:_OTMoveIt
2009-04-07 13:39:13 —-D—- C:Program Filestrend micro
2009-04-07 13:39:12 —-D—- C:rsit
2009-04-06 22:16:26 —-D—- C:Program FilesCOOL Edit pro — программа для обработки звука
2009-04-06 22:16:25 —-D—- C:Program FilesCommon FilesVbox
2009-04-06 21:48:56 —-A—- C:Program FilesCOOL EDIT PRO.exe
2009-04-06 21:07:16 —-A—- C:wtemp01.tmp
2009-04-06 21:06:28 —-D—- C:WINDOWSMinidump
2009-04-06 21:05:54 —-D—- C:WINDOWSsystem32VMM32
2009-04-06 21:05:41 —-D—- C:Program FilesVOICE MANAGER — для диктофона 2 вариант
2009-04-06 21:05:14 —-A—- C:WINDOWSIsUninst.exe
2009-04-06 21:05:13 —-A—- C:WINDOWS_delis32.ini
2009-04-06 21:04:37 —-D—- C:Program FilesCommon FilesBorland Shared
2009-04-06 21:03:54 —-D—- C:Program Filesvoicemanager — для диктофона 1 вариант
2009-04-06 21:03:27 —-A—- C:WINDOWSuninst.exe
2009-04-04 01:07:02 —-D—- C:Program FilesIntelore
2009-04-04 01:04:07 —-A—- C:WINDOWSARCHPR.INI
2009-04-04 01:03:59 —-D—- C:Program FilesElcomSoft
2009-04-04 00:32:05 —-D—- C:Documents and SettingsЕленаApplication DataWinRAR
2009-04-04 00:31:44 —-D—- C:Program FilesWinRAR======List of files/folders modified in the last 1 months======
2009-04-16 00:31:16 —-D—- C:WINDOWSTemp
2009-04-16 00:17:55 —-AD—- C:WINDOWSsystem32
2009-04-16 00:17:55 —-A—- C:WINDOWSsystem32PerfStringBackup.INI
2009-04-16 00:14:55 —-D—- C:WINDOWSPrefetch
2009-04-16 00:13:55 —-D—- C:WINDOWS
2009-04-16 00:12:41 —-A—- C:WINDOWSSchedLgU.Txt
2009-04-09 11:48:48 —-D—- C:WINDOWSsystem32CatRoot2
2009-04-07 13:39:13 —-RD—- C:Program Files
2009-04-07 12:53:18 —-HD—- C:WINDOWSinf
2009-04-07 09:02:01 —-A—- C:WINDOWSbrwmark.ini
2009-04-06 22:16:42 —-SHD—- C:WINDOWSInstaller
2009-04-06 22:16:25 —-D—- C:Program FilesCommon Files
2009-04-06 21:05:56 —-AD—- C:WINDOWSsystem32drivers
2009-04-06 16:42:25 —-D—- C:WINDOWSNetwork Diagnostic
2009-04-06 14:15:49 —-D—- C:Program FilesMcAfee
2009-03-26 15:55:22 —-D—- C:Documents and SettingsЕленаApplication DataMra
2009-03-25 00:36:49 —-D—- C:Documents and SettingsAll UsersApplication DataMcAfee======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2008-06-10 40704]
R1 mfehidk;McAfee Inc. mfehidk; C:WINDOWSsystem32driversmfehidk.sys [2009-01-09 213640]
R1 MPFP;MPFP; C:WINDOWSSystem32DriversMpfp.sys [2008-10-23 120136]
R1 WmiAcpi;Интерфейс управления для ACPI Microsoft Windows; C:WINDOWSsystem32DRIVERSwmiacpi.sys [2008-04-14 8832]
R3 AR5416;Atheros AR5008 Wireless Network Adapter Service; C:WINDOWSsystem32DRIVERSathw.sys [2008-05-20 1312576]
R3 CmBatt;Драйвер батареи с ACPI-управлением (Майкрософт); C:WINDOWSsystem32DRIVERSCmBatt.sys [2008-04-14 13952]
R3 DKbFltr;Dritek Keyboard Filter Driver; C:WINDOWSsystem32DRIVERSDKbFltr.sys [2004-12-08 16896]
R3 HDAudBus;Драйвер шины Microsoft UAA для High Definition Audio; C:WINDOWSsystem32DRIVERSHDAudBus.sys [2008-06-10 144384]
R3 HidUsb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2008-06-10 10368]
R3 ialm;ialm; C:WINDOWSsystem32DRIVERSigxpmp32.sys [2008-02-15 5854752]
R3 int15.sys;int15.sys; ??C:AcerEmpowering TechnologyeRecoveryint15.sys []
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:WINDOWSsystem32driversRtkHDAud.sys [2008-05-20 4800000]
R3 JMCR;JMCR; C:WINDOWSsystem32DRIVERSjmcr.sys [2008-07-08 96856]
R3 M3000Srv;Acer Crystal Eye webcam Driver; C:WINDOWSSystem32DriversM3000KNT.sys [2008-05-05 254976]
R3 mfeavfk;McAfee Inc. mfeavfk; C:WINDOWSsystem32driversmfeavfk.sys [2009-01-09 79304]
R3 mfebopk;McAfee Inc. mfebopk; C:WINDOWSsystem32driversmfebopk.sys [2009-01-09 35272]
R3 mfesmfk;McAfee Inc. mfesmfk; C:WINDOWSsystem32driversmfesmfk.sys [2009-01-09 40552]
R3 mouhid;Драйвер мыши HID; C:WINDOWSsystem32DRIVERSmouhid.sys [2001-10-19 12160]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:WINDOWSsystem32DRIVERSRtenicxp.sys [2008-07-01 108800]
R3 SynTP;Synaptics TouchPad Driver; C:WINDOWSsystem32DRIVERSSynTP.sys [2008-04-25 225024]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2008-04-14 30208]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2008-04-14 59520]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2008-04-14 20608]
S2 WinDriver;WinDriver; C:WINDOWSSystem32driversWINDRVR.SYS [2000-08-28 162804]
S3 CCDECODE;Closed Caption декодер; C:WINDOWSsystem32DRIVERSCCDECODE.sys [2008-04-14 17024]
S3 mferkdk;McAfee Inc. mferkdk; C:WINDOWSsystem32driversmferkdk.sys [2009-01-09 34216]
S3 MSTEE;Преобразователь потоков Tee/Sink-to-Sink Microsoft; C:WINDOWSsystem32driversMSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI кодек; C:WINDOWSsystem32DRIVERSNABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft видео или ТВ подключение; C:WINDOWSsystem32DRIVERSNdisIP.sys [2008-04-14 10880]
S3 SLIP;BDA Slip De-Framer; C:WINDOWSsystem32DRIVERSSLIP.sys [2008-06-10 11136]
S3 streamip;BDA IPSink; C:WINDOWSsystem32DRIVERSStreamIP.sys [2008-06-10 15232]
S3 usbprint;Класс принтеров Microsoft USB; C:WINDOWSsystem32DRIVERSusbprint.sys [2008-04-14 25856]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2008-06-10 26368]
S3 WSTCODEC;World Standard Teletext кодек; C:WINDOWSsystem32DRIVERSWSTCODEC.SYS [2008-04-14 19200]======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 IviRegMgr;IviRegMgr; C:Program FilesCommon FilesInterVideoRegMgriviRegMgr.exe [2007-01-04 112152]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service; C:Program FilesMcAfeeSiteAdvisorMcSACore.exe [2009-03-11 210216]
R2 mcmscsvc;McAfee Services; C:PROGRA~1McAfeeMSCmcmscsvc.exe [2009-01-08 797864]
R2 McNASvc;McAfee Network Agent; c:PROGRA~1COMMON~1mcafeemnamcnasvc.exe [2009-01-09 2482848]
R2 McProxy;McAfee Proxy Service; c:PROGRA~1COMMON~1mcafeemcproxymcproxy.exe [2009-01-09 359952]
R2 McShield;McAfee Real-time Scanner; C:PROGRA~1McAfeeVIRUSS~1mcshield.exe [2009-01-16 144704]
R2 MpfService;McAfee Personal Firewall Service; C:Program FilesMcAfeeMPFMPFSrv.exe [2009-01-09 884360]
R2 MSK80Service;McAfee Anti-Spam Service; C:Program FilesMcAfeeMSKMskSrver.exe [2009-01-09 26640]
R3 McSysmon;McAfee SystemGuards; C:PROGRA~1McAfeeVIRUSS~1mcsysmon.exe [2009-01-16 606736]
S2 Fax;Fax; C:WINDOWSsystem32fxssvc.exe [2008-06-10 268288]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2005-09-23 66240]
S3 McODS;McAfee Scanner; C:PROGRA~1McAfeeVIRUSS~1mcods.exe [2009-01-17 365072]
EOF
