• Инструкции
    • Как использовать
      • Программы
    • Как удалить
      • Шпионское и рекламное ПО (adware и spyware)
      • Поддельное антиспайваре
      • Руткиты
      • Трояны
      • Кейлоггеры
  • Скачать программы
  • Вопросы и Ответы
  • Форумы

SPYWARE-RU.COM
Меню
  • Инструкции
    • Как использовать
      • Программы
    • Как удалить
      • Шпионское и рекламное ПО (adware и spyware)
      • Поддельное антиспайваре
      • Руткиты
      • Трояны
      • Кейлоггеры
  • Скачать программы
  • Вопросы и Ответы
  • Форумы
В начало
Adguard
 

milky

  • Профиль
  • Начатые темы
  • Созданные ответы
  • Engagements
  • Избранное

Созданные ответы форума

Просмотр 4 сообщений - с 1 по 4 (из 4 всего)
  • Автор
    Сообщения
  • 13 октября, 2008 в 12:57 пп в ответ на: Internet Antivirus Pro, ничем не удаляется((( #19314
    milky
    Participant
    • Темы:1
    • Сообщений:5
    • ☆

    С моей обывательской точки зрения, компьютер поживает отлично 🙂 все работает, так что вроде бы вы меня спасли 🙂 Еще раз вам огромнейшее спасибо, теперь я знаю, куда обращаться за помощью, когда меня атакуют ❗ ❗ ❗

    12 октября, 2008 в 1:02 пп в ответ на: Internet Antivirus Pro, ничем не удаляется((( #19312
    milky
    Participant
    • Темы:1
    • Сообщений:5
    • ☆

    Здравствуйте!!
    О каким напряжением для моих юзерских мозгов явился поиск файла 😳 Но, как и в прошлый раз, безрезультатный 😡 Вставить в строку не получается, поиском не ищется…. Нашла вот только в карантине по адресу C:QooBoxQuarantineRegistry_backupsHKCU-Explorer_Run-pg32.exe.reg
    Не знаю, что это значит, но проверила на всякий случай 😕 вот что получилось:

    Файл HKCU-Explorer_Run-pg32.exe.reg.da получен 2008.10.12 14:48:48 (CET)
    Текущий статус: Загрузка … в очереди ожидание проверка закончено НЕ НАЙДЕНО ОСТАНОВЛЕНО
    Результат: 0/35 (0%)
    Загрузка информации…
    Ваш файл в очереди на позиции: 1.
    Ожидаемое время старта между 37 и 53 секунд.
    Не закрывайте окно до окончания проверки.
    Сканер, который обрабатывает Ваш файл, остановлен в данный момент. Производится попытка восстановить Ваши результаты, подождите несколько секунд.
    Если вы ждете более пяти минут, попробуйте прислать файл еще раз.
    Ваш файл проверяется VirusTotal в данный момент,
    результаты отображаются по мере генерации.
    Форматированные Форматированные
    Печать результатов Печать результатов
    Ваш файл просрочен или не существует.
    ервис остановлен в данный момент, Ваш файл ожидает проверки (позиция: ) через неопределенное время.

    Вы можете подождать ответа (страница автоматически перезагрузится) или написать ваш e-mail адрес ниже и нажать «запросить» для получения оповещения об окончании проверки.
    Email адрес:

    Антивирус Версия Обновление Результат
    AhnLab-V3 2008.10.10.1 2008.10.10 —
    AntiVir 7.8.1.34 2008.10.11 —
    Authentium 5.1.0.4 2008.10.11 —
    Avast 4.8.1248.0 2008.10.11 —
    AVG 8.0.0.161 2008.10.11 —
    BitDefender 7.2 2008.10.12 —
    CAT-QuickHeal 9.50 2008.10.11 —
    ClamAV 0.93.1 2008.10.12 —
    DrWeb 4.44.0.09170 2008.10.12 —
    eSafe 7.0.17.0 2008.10.08 —
    eTrust-Vet 31.6.6141 2008.10.10 —
    Ewido 4.0 2008.10.12 —
    F-Prot 4.4.4.56 2008.10.11 —
    Fortinet 3.113.0.0 2008.10.12 —
    GData 19 2008.10.12 —
    Ikarus T3.1.1.34.0 2008.10.12 —
    K7AntiVirus 7.10.491 2008.10.11 —
    Kaspersky 7.0.0.125 2008.10.12 —
    McAfee 5403 2008.10.11 —
    Microsoft 1.4005 2008.10.12 —
    NOD32 3515 2008.10.11 —
    Norman 5.80.02 2008.10.10 —
    Panda 9.0.0.4 2008.10.12 —
    PCTools 4.4.2.0 2008.10.12 —
    Prevx1 V2 2008.10.12 —
    Rising 20.65.42.00 2008.10.10 —
    SecureWeb-Gateway 6.7.6 2008.10.11 —
    Sophos 4.34.0 2008.10.12 —
    Sunbelt 3.1.1716.1 2008.10.12 —
    Symantec 10 2008.10.12 —
    TheHacker 6.3.1.0.108 2008.10.11 —
    TrendMicro 8.700.0.1004 2008.10.10 —
    VBA32 3.12.8.6 2008.10.12 —
    ViRobot 2008.10.10.1416 2008.10.10 —
    VirusBuster 4.5.11.0 2008.10.11 —
    Дополнительная информация
    File size: 217 bytes
    MD5…: fd6ccec9b365df88b57222f7c9be458a
    SHA1..: fd5cb3341b0e793663e0d0c446f5a9105bcca1e3
    SHA256: 98e2bc8ce6d068bf7ac3911727cfe1ae1f2d5cfbe23323e720321d8ce36f8fbf
    SHA512: 19dba7a3ab6784b138e32fc371c34316468d7094c9f7b13d20e501b2aaa33bd0
    8372cb9ae046d4c8e92129e5a977100cd0eb41d5edbf69e7dcedf1b8b12fe187
    PEiD..: —
    TrID..: File type identification
    Windows Registry Data (Ver. 4.0) (53.3%)
    Windows Registry Data (46.6%)
    PEInfo: —

    Жду ваши мысли по этому поводу 🙂 А это очередной лог:

    ComboFix 08-10-08.02 — ????????????? 2008-10-12 16:36:55.4 — NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1251.1.1049.18.675 [GMT 4:00]
    Running from: C:Documents and Settings???????????????????? ????ComboFix.exe
    Command switches used :: C:CFScript.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:WINNT?????????????.exe . . . . failed to delete

    .
    ((((((((((((((((((((((((( Files Created from 2008-09-12 to 2008-10-12 )))))))))))))))))))))))))))))))
    .

    2008-10-10 13:39 . 2008-10-10 13:39

    d

    C:Program FilesMSXML 4.0
    2008-10-10 10:57 . 2008-10-10 12:06     d

    C:WINNTsystem32CatRoot_bak
    2008-10-10 10:49 . 2008-06-14 21:59 272,512

    C:WINNTsystem32driversbthport.sys
    2008-10-10 10:49 . 2008-06-14 21:59 272,512

    c— C:WINNTsystem32dllcachebthport.sys
    2008-10-10 10:35 . 2008-10-12 10:36     d—h

    C:WINNT$hf_mig$
    2008-10-10 10:35 . 2008-10-10 13:42 1,393 —a

    C:WINNTimsins.BAK
    2008-10-09 02:39 . 2008-10-09 02:40 2,440 —a

    C:WINNTsystem32tmp.reg
    2008-10-08 00:41 . 2008-10-08 00:41     d

    C:Documents and SettingsAll UsersApplication DataMalwarebytes
    2008-09-27 14:13 . 2008-09-27 14:13 1,148 —a

    C:WINNTsystem32ezdigsgn.dat
    2008-09-27 14:05 . 2008-09-27 15:31     d

    C:Documents and SettingsAll UsersApplication DataMake A Voozie
    2008-09-23 22:13 . 2008-09-23 22:13     d—hs—- C:found.000
    2008-09-23 17:36 . 2008-09-23 17:36 48 —ah

    C:WINNTsystem32ezsidmv.dat
    2008-09-23 17:32 . 2008-09-23 17:32     d

    C:Program FilesSkype
    2008-09-23 17:32 . 2008-09-23 17:32     d

    C:Program FilesCommon FilesSkype
    2008-09-23 17:32 . 2008-09-23 17:32     d

    C:Documents and SettingsAll UsersApplication DataSkype
    2008-09-16 22:09 . 2008-09-19 11:49 0 —ah

    C:??????? ???? (F

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-10-12 12:39 546,080 —sha-w C:WINNTsystem32driversfidbox2.dat
    2008-10-12 12:39 15,411,232 —sha-w C:WINNTsystem32driversfidbox.dat
    2008-10-12 12:38 53,216 —sha-w C:WINNTsystem32driversfidbox2.idx
    2008-10-12 12:38 210,560 —sha-w C:WINNTsystem32driversfidbox.idx
    2008-10-12 12:26

    d

    w C:Documents and SettingsAll UsersApplication DataKaspersky Lab
    2008-10-07 18:07 12,800 —-a-w C:Program FilesПрезентация Microsoft PowerPoint.ppt
    2008-08-31 05:52

    d

    w C:Program FilesRMG Musical Player
    2008-08-31 05:52

    d

    w C:Program FilesCommon FilesARS Company
    2008-08-31 04:46

    d—h—w C:Program FilesInstallShield Installation Information
    2008-08-31 04:46

    d

    w C:Program FilesUbisoft
    2007-10-09 11:55 24,192 —-a-w C:Documents and Settings9335~1usbsermptxp.sys
    2007-10-09 11:55 22,768 —-a-w C:Documents and Settings9335~1usbsermpt.sys
    2007-09-30 11:49 56 —sh—r C:WINNTsystem326B26223307.sys
    .

    Sigcheck


    2008-04-14 20:11 509440 b3b5d5855127e240c88451030aaee76e C:WINNTSoftwareDistributionDownloadeced8b5ea8e636fb8bff2b719fa62647winlogon.exe
    2005-01-01 20:41 503808 a975a70fcefe2a224412214320c89ded C:WINNTsystem32winlogon.exe
    .
    ((((((((((((((((((((((((((((( snapshot@2008-10-09_ 2.51.25.64 )))))))))))))))))))))))))))))))))))))))))
    .
    — 2007-10-27 12:26:59 7,168 —-a-w C:WINNTassemblyGACIEExecRemote1.0.5000.0__b03f5f7f11d50a3aIEExecRemote.dll
    + 2008-10-10 09:40:06 8,192 —-a-w C:WINNTassemblyGACIEExecRemote1.0.5000.0__b03f5f7f11d50a3aIEExecRemote.dll
    — 2007-10-27 12:26:57 32,768 —-a-w C:WINNTassemblyGACIEHost1.0.5000.0__b03f5f7f11d50a3aIEHost.dll
    + 2008-10-10 09:40:07 32,768 —-a-w C:WINNTassemblyGACIEHost1.0.5000.0__b03f5f7f11d50a3aIEHost.dll
    — 2007-10-27 12:26:55 716,800 —-a-w C:WINNTassemblyGACMicrosoft.JScript7.0.5000.0__b03f5f7f11d50a3aMicrosoft.JScript.dll
    + 2008-10-10 09:40:12 720,896 —-a-w C:WINNTassemblyGACMicrosoft.JScript7.0.5000.0__b03f5f7f11d50a3aMicrosoft.JScript.dll
    — 2007-10-27 12:26:55 299,008 —-a-w C:WINNTassemblyGACMicrosoft.VisualBasic7.0.5000.0__b03f5f7f11d50a3aMicrosoft.VisualBasic.dll
    + 2008-10-10 09:40:07 299,008 —-a-w C:WINNTassemblyGACMicrosoft.VisualBasic7.0.5000.0__b03f5f7f11d50a3aMicrosoft.VisualBasic.dll
    — 2007-10-27 12:26:59 32,768 —-a-w C:WINNTassemblyGACRegcode1.0.5000.0__b03f5f7f11d50a3aRegCode.dll
    + 2008-10-10 09:40:10 32,768 —-a-w C:WINNTassemblyGACRegcode1.0.5000.0__b03f5f7f11d50a3aRegCode.dll
    — 2007-10-27 12:27:00 299,008 —-a-w C:WINNTassemblyGACSystem.Data.OracleClient1.0.5000.0__b77a5c561934e089System.Data.OracleClient.dll
    + 2008-10-10 09:40:09 303,104 —-a-w C:WINNTassemblyGACSystem.Data.OracleClient1.0.5000.0__b77a5c561934e089System.Data.OracleClient.dll
    — 2007-10-27 12:26:58 1,290,240 —-a-w C:WINNTassemblyGACSystem.Data1.0.5000.0__b77a5c561934e089System.Data.dll
    + 2008-10-10 09:40:10 1,294,336 —-a-w C:WINNTassemblyGACSystem.Data1.0.5000.0__b77a5c561934e089System.Data.dll
    — 2007-10-27 12:26:58 1,699,840 —-a-w C:WINNTassemblyGACSystem.Design1.0.5000.0__b03f5f7f11d50a3aSystem.Design.dll
    + 2008-10-10 09:40:06 1,703,936 —-a-w C:WINNTassemblyGACSystem.Design1.0.5000.0__b03f5f7f11d50a3aSystem.Design.dll
    — 2007-10-27 12:26:58 86,016 —-a-w C:WINNTassemblyGACSystem.DirectoryServices1.0.5000.0__b03f5f7f11d50a3aSystem.DirectoryServices.dll
    + 2008-10-10 09:40:11 90,112 —-a-w C:WINNTassemblyGACSystem.DirectoryServices1.0.5000.0__b03f5f7f11d50a3aSystem.DirectoryServices.dll
    — 2007-10-27 12:26:59 466,944 —-a-w C:WINNTassemblyGACSystem.Drawing1.0.5000.0__b03f5f7f11d50a3aSystem.Drawing.dll
    + 2008-10-10 09:40:09 466,944 —-a-w C:WINNTassemblyGACSystem.Drawing1.0.5000.0__b03f5f7f11d50a3aSystem.Drawing.dll
    — 2007-10-27 12:26:59 241,664 —-a-w C:WINNTassemblyGACSystem.EnterpriseServices1.0.5000.0__b03f5f7f11d50a3aSystem.EnterpriseServices.dll
    + 2008-10-10 09:40:07 241,664 —-a-w C:WINNTassemblyGACSystem.EnterpriseServices1.0.5000.0__b03f5f7f11d50a3aSystem.EnterpriseServices.dll
    — 2007-10-27 12:26:59 64,000 —-a-w C:WINNTassemblyGACSystem.EnterpriseServices1.0.5000.0__b03f5f7f11d50a3aSystem.EnterpriseServices.Thunk.dll
    + 2008-10-10 09:40:07 66,560 —-a-w C:WINNTassemblyGACSystem.EnterpriseServices1.0.5000.0__b03f5f7f11d50a3aSystem.EnterpriseServices.Thunk.dll
    — 2007-10-27 12:26:59 368,640 —-a-w C:WINNTassemblyGACSystem.Management1.0.5000.0__b03f5f7f11d50a3aSystem.Management.dll
    + 2008-10-10 09:40:10 372,736 —-a-w C:WINNTassemblyGACSystem.Management1.0.5000.0__b03f5f7f11d50a3aSystem.Management.dll
    — 2007-10-27 12:26:59 241,664 —-a-w C:WINNTassemblyGACSystem.Messaging1.0.5000.0__b03f5f7f11d50a3aSystem.Messaging.dll
    + 2008-10-10 09:40:12 241,664 —-a-w C:WINNTassemblyGACSystem.Messaging1.0.5000.0__b03f5f7f11d50a3aSystem.Messaging.dll
    — 2007-10-27 12:26:59 323,584 —-a-w C:WINNTassemblyGACSystem.Runtime.Remoting1.0.5000.0__b77a5c561934e089System.Runtime.Remoting.dll
    + 2008-10-10 09:40:09 323,584 —-a-w C:WINNTassemblyGACSystem.Runtime.Remoting1.0.5000.0__b77a5c561934e089System.Runtime.Remoting.dll
    — 2007-10-27 12:26:59 131,072 —-a-w C:WINNTassemblyGACSystem.Runtime.Serialization.Formatters.Soap1.0.5000.0__b03f5f7f11d50a3aSystem.Runtime.Serialization.Formatters.Soap.dll
    + 2008-10-10 09:40:08 131,072 —-a-w C:WINNTassemblyGACSystem.Runtime.Serialization.Formatters.Soap1.0.5000.0__b03f5f7f11d50a3aSystem.Runtime.Serialization.Formatters.Soap.dll
    — 2007-10-27 12:26:59 77,824 —-a-w C:WINNTassemblyGACSystem.Security1.0.5000.0__b03f5f7f11d50a3aSystem.Security.dll
    + 2008-10-10 09:40:09 77,824 —-a-w C:WINNTassemblyGACSystem.Security1.0.5000.0__b03f5f7f11d50a3aSystem.Security.dll
    — 2007-10-27 12:26:59 126,976 —-a-w C:WINNTassemblyGACSystem.ServiceProcess1.0.5000.0__b03f5f7f11d50a3aSystem.ServiceProcess.dll
    + 2008-10-10 09:40:11 126,976 —-a-w C:WINNTassemblyGACSystem.ServiceProcess1.0.5000.0__b03f5f7f11d50a3aSystem.ServiceProcess.dll
    — 2007-10-27 12:26:59 819,200 —-a-w C:WINNTassemblyGACSystem.Web.Mobile1.0.5000.0__b03f5f7f11d50a3aSystem.Web.Mobile.dll
    + 2008-10-10 09:40:05 819,200 —-a-w C:WINNTassemblyGACSystem.Web.Mobile1.0.5000.0__b03f5f7f11d50a3aSystem.Web.Mobile.dll
    — 2007-10-27 12:26:59 57,344 —-a-w C:WINNTassemblyGACSystem.Web.RegularExpressions1.0.5000.0__b03f5f7f11d50a3aSystem.Web.RegularExpressions.dll
    + 2008-10-10 09:40:07 57,344 —-a-w C:WINNTassemblyGACSystem.Web.RegularExpressions1.0.5000.0__b03f5f7f11d50a3aSystem.Web.RegularExpressions.dll
    — 2007-10-27 12:26:59 569,344 —-a-w C:WINNTassemblyGACSystem.Web.Services1.0.5000.0__b03f5f7f11d50a3aSystem.Web.Services.dll
    + 2008-10-10 09:40:06 573,440 —-a-w C:WINNTassemblyGACSystem.Web.Services1.0.5000.0__b03f5f7f11d50a3aSystem.Web.Services.dll
    — 2007-10-27 12:26:59 1,245,184 —-a-w C:WINNTassemblyGACSystem.Web1.0.5000.0__b03f5f7f11d50a3aSystem.Web.dll
    + 2008-10-10 09:40:11 1,257,472 —-a-w C:WINNTassemblyGACSystem.Web1.0.5000.0__b03f5f7f11d50a3aSystem.Web.dll
    — 2007-10-27 12:26:59 2,039,808 —-a-w C:WINNTassemblyGACSystem.Windows.Forms1.0.5000.0__b77a5c561934e089System.Windows.Forms.dll
    + 2008-10-10 09:40:08 2,052,096 —-a-w C:WINNTassemblyGACSystem.Windows.Forms1.0.5000.0__b77a5c561934e089System.Windows.Forms.dll
    — 2007-10-27 12:26:59 1,335,296 —-a-w C:WINNTassemblyGACSystem.Xml1.0.5000.0__b77a5c561934e089System.Xml.dll
    + 2008-10-10 09:40:10 1,339,392 —-a-w C:WINNTassemblyGACSystem.Xml1.0.5000.0__b77a5c561934e089System.XML.dll
    — 2007-10-27 12:26:59 1,216,512 —-a-w C:WINNTassemblyGACSystem1.0.5000.0__b77a5c561934e089System.dll
    + 2008-10-10 09:40:12 1,224,704 —-a-w C:WINNTassemblyGACSystem1.0.5000.0__b77a5c561934e089System.dll
    + 2008-10-10 09:41:55 118,784 —-a-w C:WINNTassemblyNativeImages1_v1.1.4322CustomMarshalers1.0.5000.0__b03f5f7f11d50a3a_658b19aaCustomMarshalers.dll
    + 2008-10-10 09:40:25 61,440 —-a-w C:WINNTassemblyNativeImages1_v1.1.4322CustomMarshalers1.0.5000.0__b03f5f7f11d50a3a_e8864362CustomMarshalers.dll
    + 2008-10-10 09:41:29 3,379,200 —-a-w C:WINNTassemblyNativeImages1_v1.1.4322mscorlib1.0.5000.0__b77a5c561934e089_26b786a7mscorlib.dll
    + 2008-10-10 09:42:25 8,880,128 —-a-w C:WINNTassemblyNativeImages1_v1.1.4322mscorlib1.0.5000.0__b77a5c561934e089_ad8b377cmscorlib.dll
    + 2008-10-10 09:41:17 1,466,368 —-a-w C:WINNTassemblyNativeImages1_v1.1.4322System.Design1.0.5000.0__b03f5f7f11d50a3a_0013ae0aSystem.Design.dll
    + 2008-10-10 09:42:16 3,395,584 —-a-w C:WINNTassemblyNativeImages1_v1.1.4322System.Design1.0.5000.0__b03f5f7f11d50a3a_c0abadf9System.Design.dll
    + 2008-10-10 09:41:55 192,512 —-a-w C:WINNTassemblyNativeImages1_v1.1.4322System.Drawing.Design1.0.5000.0__b03f5f7f11d50a3a_2ac85c4eSystem.Drawing.Design.dll
    + 2008-10-10 09:40:27 90,112 —-a-w C:WINNTassemblyNativeImages1_v1.1.4322System.Drawing.Design1.0.5000.0__b03f5f7f11d50a3a_35c0183fSystem.Drawing.Design.dll
    + 2008-10-10 09:42:20 2,244,608 —-a-w C:WINNTassemblyNativeImages1_v1.1.4322System.Drawing1.0.5000.0__b03f5f7f11d50a3a_28b7fa08System.Drawing.dll
    + 2008-10-10 09:41:20 835,584 —-a-w C:WINNTassemblyNativeImages1_v1.1.4322System.Drawing1.0.5000.0__b03f5f7f11d50a3a_b30a6d5cSystem.Drawing.dll
    + 2008-10-10 09:42:05 7,880,704 —-a-w C:WINNTassemblyNativeImages1_v1.1.4322System.Windows.Forms1.0.5000.0__b77a5c561934e089_85de451bSystem.Windows.Forms.dll
    + 2008-10-10 09:40:40 3,014,656 —-a-w C:WINNTassemblyNativeImages1_v1.1.4322System.Windows.Forms1.0.5000.0__b77a5c561934e089_b1fc5cf6System.Windows.Forms.dll
    + 2008-10-10 09:40:53 2,088,960 —-a-w C:WINNTassemblyNativeImages1_v1.1.4322System.Xml1.0.5000.0__b77a5c561934e089_b57bb64eSystem.Xml.dll
    + 2008-10-10 09:42:11 5,505,024 —-a-w C:WINNTassemblyNativeImages1_v1.1.4322System.Xml1.0.5000.0__b77a5c561934e089_fbf8d910System.Xml.dll
    + 2008-10-10 09:40:24 1,953,792 —-a-w C:WINNTassemblyNativeImages1_v1.1.4322System1.0.5000.0__b77a5c561934e089_2b009fcfSystem.dll
    + 2008-10-10 09:41:54 4,763,648 —-a-w C:WINNTassemblyNativeImages1_v1.1.4322System1.0.5000.0__b77a5c561934e089_2e0c9471System.dll
    + 2008-06-14 17:59:58 272,512

    w C:WINNTDriver Cachei386bthport.sys
    + 2008-10-10 09:39:20 32,768 —-a-r C:WINNTInstaller{C04E32E0-0416-434D-AFB9-6969D703A9EF}icon.exe
    — 2003-02-20 15:19:32 253,952 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322aspnet_isapi.dll
    + 2004-07-14 21:49:16 258,048 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322aspnet_isapi.dll
    — 2003-02-20 15:19:34 20,480 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322aspnet_regiis.exe
    + 2004-07-14 21:49:18 20,480 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322aspnet_regiis.exe
    — 2003-02-20 15:19:38 32,768 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322aspnet_state.exe
    + 2004-07-14 21:49:26 32,768 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322aspnet_state.exe
    — 2003-02-20 15:19:36 32,768 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322aspnet_wp.exe
    + 2004-07-14 21:49:22 32,768 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322aspnet_wp.exe
    — 2003-02-20 15:09:08 77,824 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322CORPerfMonExt.dll
    + 2004-07-14 20:32:22 81,920 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322CORPerfMonExt.dll
    — 2003-02-21 06:20:44 49,152 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322csc.exe
    + 2004-07-15 07:23:28 49,152 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322csc.exe
    — 2003-02-21 06:21:00 626,688 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322cscomp.dll
    + 2004-07-15 07:23:44 626,688 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322cscomp.dll
    — 2003-02-20 15:06:20 282,624 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322fusion.dll
    + 2004-07-14 20:24:30 282,624 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322fusion.dll
    + 2003-10-08 10:30:14 81,920 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322gacutil.exe
    — 2003-02-21 03:24:38 7,168 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322IEExecRemote.dll
    + 2004-07-15 10:31:00 8,192 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322IEExecRemote.dll
    — 2003-02-21 03:24:40 32,768 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322IEHost.dll
    + 2004-07-15 10:31:04 32,768 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322IEHost.dll
    — 2003-02-20 15:09:40 196,608 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322ilasm.exe
    + 2004-07-14 20:35:30 196,608 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322ilasm.exe
    — 2003-02-21 03:26:36 716,800 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322Microsoft.JScript.dll
    + 2004-07-15 10:28:58 720,896 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322Microsoft.JScript.dll
    — 2003-02-21 03:26:38 299,008 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322Microsoft.VisualBasic.dll
    + 2004-07-15 10:28:56 299,008 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322Microsoft.VisualBasic.dll
    — 2003-02-21 03:25:04 49,152 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322MigPol.exe
    + 2004-07-15 10:28:50 49,152 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322MigPol.exe
    — 2003-02-21 03:25:04 49,152 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322MigPolWin.exe
    + 2004-07-15 10:28:50 49,152 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322MigPolWin.exe
    — 2003-02-20 15:09:12 77,824 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322mscordbc.dll
    + 2004-07-14 20:32:44 86,016 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322mscordbc.dll
    — 2003-02-20 15:09:12 233,472 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322mscordbi.dll
    + 2004-07-14 20:32:46 233,472 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322mscordbi.dll
    — 2003-02-20 15:06:32 311,296 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322mscorjit.dll
    + 2004-07-14 20:25:06 315,392 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322mscorjit.dll
    — 2003-02-20 15:09:16 98,304 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322mscorld.dll
    + 2004-07-14 20:33:04 102,400 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322mscorld.dll
    — 2003-02-21 03:26:34 2,088,960 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322mscorlib.dll
    + 2004-07-15 10:29:02 2,138,112 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322mscorlib.dll
    — 2003-02-20 15:09:18 143,360 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322mscorrc.dll
    + 2004-07-14 20:33:22 143,360 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322mscorrc.dll
    — 2003-02-20 15:09:18 81,920 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322mscorsec.dll
    + 2004-07-14 20:33:24 81,920 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322mscorsec.dll
    — 2003-02-20 15:07:34 2,494,464 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322mscorsvr.dll
    + 2004-07-14 20:26:52 2,510,848 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322mscorsvr.dll
    — 2003-02-20 15:08:32 2,482,176 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322mscorwks.dll
    + 2004-07-14 20:28:34 2,502,656 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322mscorwks.dll
    + 2004-08-10 12:20:00 106,496 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322netfxupdate.exe
    — 2003-02-20 15:09:30 90,112 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322PerfCounter.dll
    + 2004-07-14 20:34:50 94,208 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322PerfCounter.dll
    — 2003-02-21 03:26:46 32,768 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322RegCode.dll
    + 2004-07-15 10:28:48 32,768 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322RegCode.dll
    — 2003-02-20 15:09:34 319,488 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322SOS.dll
    + 2004-07-14 20:35:04 319,488 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322SOS.dll
    — 2003-02-21 03:26:38 1,290,240 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.Data.dll
    + 2004-07-15 10:32:00 1,294,336 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.Data.dll
    — 2003-02-21 03:25:42 299,008 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.Data.OracleClient.dll
    + 2004-07-15 10:31:14 303,104 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.Data.OracleClient.dll
    — 2003-02-21 03:26:42 1,699,840 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.Design.dll
    + 2004-07-15 10:29:02 1,703,936 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.Design.dll
    — 2003-02-21 03:26:44 86,016 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.DirectoryServices.dll
    + 2004-07-15 10:28:54 90,112 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.DirectoryServices.dll
    — 2003-02-21 03:26:46 1,216,512 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.dll
    + 2004-07-15 10:31:16 1,224,704 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.dll
    — 2003-02-21 03:26:50 466,944 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.Drawing.dll
    + 2004-07-15 10:28:58 466,944 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.Drawing.dll
    — 2003-02-21 03:26:50 241,664 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.EnterpriseServices.dll
    + 2004-07-15 10:28:56 241,664 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.EnterpriseServices.dll
    — 2003-02-20 15:09:36 64,000 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.EnterpriseServices.Thunk.dll
    + 2004-07-14 20:35:12 66,560 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.EnterpriseServices.Thunk.dll
    — 2003-02-21 03:26:52 368,640 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.Management.dll
    + 2004-07-15 10:31:58 372,736 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.Management.dll
    — 2003-02-21 03:26:54 241,664 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.Messaging.dll
    + 2004-07-15 10:31:12 241,664 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.Messaging.dll
    — 2003-02-21 03:26:56 323,584 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.Runtime.Remoting.dll
    + 2004-07-15 10:28:58 323,584 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.Runtime.Remoting.dll
    — 2003-02-21 03:26:56 131,072 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.Runtime.Serialization.Formatters.Soap.dll
    + 2004-07-15 10:31:54 131,072 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.Runtime.Serialization.Formatters.Soap.dll
    — 2003-02-21 03:26:58 77,824 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.Security.dll
    + 2004-07-15 10:28:52 77,824 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.Security.dll
    — 2003-02-21 03:27:00 126,976 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.ServiceProcess.dll
    + 2004-07-15 10:28:54 126,976 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.ServiceProcess.dll
    — 2003-02-21 03:27:02 1,245,184 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.Web.dll
    + 2004-07-15 10:29:00 1,257,472 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.Web.dll
    — 2003-02-21 03:27:06 819,200 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.Web.Mobile.dll
    + 2004-07-15 10:28:58 819,200 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.Web.Mobile.dll
    — 2003-02-21 03:24:18 57,344 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.Web.RegularExpressions.dll
    + 2004-07-15 10:28:52 57,344 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.Web.RegularExpressions.dll
    — 2003-02-21 03:27:06 569,344 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.Web.Services.dll
    + 2004-07-15 10:31:16 573,440 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.Web.Services.dll
    — 2003-02-21 03:27:08 2,039,808 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.Windows.Forms.dll
    + 2004-07-15 10:32:02 2,052,096 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.Windows.Forms.dll
    — 2003-02-21 03:27:10 1,335,296 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.XML.dll
    + 2004-07-15 10:29:00 1,339,392 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322System.XML.dll
    + 2004-06-22 09:51:38 53,248 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322Updateshotfix.exe
    — 2003-02-21 06:20:38 737,280 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322vbc.exe
    + 2004-07-15 07:23:20 737,280 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322vbc.exe
    — 2003-02-21 01:04:18 1,032,192 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322VsaVb7rt.dll
    + 2004-07-15 04:15:14 1,032,192 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322VsaVb7rt.dll
    — 2003-02-20 16:10:40 31,744 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322WMINet_Utils.dll
    + 2004-07-14 22:11:56 31,744 —-a-w C:WINNTMicrosoft.NETFrameworkv1.1.4322WMINet_Utils.dll
    — 2004-08-17 12:04:10 100,352 —-a-w C:WINNTsystem326to4svc.dll
    + 2006-08-16 11:59:41 100,352 —-a-w C:WINNTsystem326to4svc.dll
    — 2004-08-17 12:04:12 1,017,344 —-a-w C:WINNTsystem32browseui.dll
    + 2008-06-23 15:41:36 1,023,488 —-a-w C:WINNTsystem32browseui.dll
    — 2004-08-17 12:04:12 151,040 —-a-w C:WINNTsystem32cdfview.dll
    + 2008-06-23 15:41:36 151,552 —-a-w C:WINNTsystem32cdfview.dll
    — 2004-08-17 12:04:12 66,560 —-a-w C:WINNTsystem32cdm.dll
    + 2008-07-18 18:10:48 94,920 —-a-w C:WINNTsystem32cdm.dll
    — 2004-08-17 12:04:12 1,054,720 —-a-w C:WINNTsystem32danim.dll
    + 2008-06-23 15:41:36 1,055,232 —-a-w C:WINNTsystem32danim.dll
    — 2004-08-17 12:04:10 100,352 -c—a-w C:WINNTsystem32dllcache6to4svc.dll
    + 2006-08-16 11:59:41 100,352 -c—a-w C:WINNTsystem32dllcache6to4svc.dll
    — 2004-08-03 19:14:16 138,496 -c—a-w C:WINNTsystem32dllcacheafd.sys
    + 2008-06-20 10:44:38 138,368 -c—a-w C:WINNTsystem32dllcacheafd.sys
    — 2004-08-17 12:04:12 1,017,344 -c—a-w C:WINNTsystem32dllcachebrowseui.dll
    + 2008-06-23 15:41:36 1,023,488 -c—a-w C:WINNTsystem32dllcachebrowseui.dll
    — 2004-08-17 12:04:12 151,040 -c—a-w C:WINNTsystem32dllcachecdfview.dll
    + 2008-06-23 15:41:36 151,552 -c—a-w C:WINNTsystem32dllcachecdfview.dll
    — 2004-08-17 12:04:12 66,560 -c—a-w C:WINNTsystem32dllcachecdm.dll
    + 2008-07-18 18:10:48 94,920 -c—a-w C:WINNTsystem32dllcachecdm.dll
    — 2004-08-17 12:04:12 1,054,720 -c—a-w C:WINNTsystem32dllcachedanim.dll
    + 2008-06-23 15:41:36 1,055,232 -c—a-w C:WINNTsystem32dllcachedanim.dll
    — 2004-08-17 12:04:14 561,179 -c—a-w C:WINNTsystem32dllcachedao360.dll
    + 2008-03-25 04:50:25 554,008 -c—a-w C:WINNTsystem32dllcachedao360.dll
    — 2004-08-17 12:04:14 148,480 -c—a-w C:WINNTsystem32dllcachednsapi.dll
    + 2008-06-20 17:42:17 148,992 -c—a-w C:WINNTsystem32dllcachednsapi.dll
    — 2004-08-17 12:04:14 357,888 -c—a-w C:WINNTsystem32dllcachedxtmsft.dll
    + 2008-06-23 15:41:37 357,888 -c—a-w C:WINNTsystem32dllcachedxtmsft.dll
    — 2004-08-17 12:04:14 201,728 -c—a-w C:WINNTsystem32dllcachedxtrans.dll
    + 2008-06-23 15:41:37 205,312 -c—a-w C:WINNTsystem32dllcachedxtrans.dll
    — 2004-08-17 12:04:16 243,200 -c—a-w C:WINNTsystem32dllcachees.dll
    + 2008-07-07 20:32:21 253,952 -c—a-w C:WINNTsystem32dllcachees.dll
    — 2004-08-17 12:04:16 55,808 -c—a-w C:WINNTsystem32dllcacheextmgr.dll
    + 2008-06-23 15:41:37 55,808 -c—a-w C:WINNTsystem32dllcacheextmgr.dll
    — 2004-08-17 12:04:50 18,432 -c—a-w C:WINNTsystem32dllcacheiedw.exe
    + 2008-06-23 09:49:29 18,432 -c—a-w C:WINNTsystem32dllcacheiedw.exe
    — 2004-08-17 12:04:16 249,344 -c—a-w C:WINNTsystem32dllcacheiepeers.dll
    + 2008-06-23 15:41:37 251,392 -c—a-w C:WINNTsystem32dllcacheiepeers.dll
    — 2004-08-17 12:04:18 678,400 -c—a-w C:WINNTsystem32dllcacheinetcomm.dll
    + 2008-04-11 18:51:35 683,520 -c—a-w C:WINNTsystem32dllcacheinetcomm.dll
    — 2004-08-17 12:04:20 96,256 -c—a-w C:WINNTsystem32dllcacheinseng.dll
    + 2008-06-23 15:41:37 96,256 -c—a-w C:WINNTsystem32dllcacheinseng.dll
    — 2004-08-17 12:04:20 450,560 -c—a-w C:WINNTsystem32dllcachejscript.dll
    + 2007-12-18 14:43:09 450,560 -c—a-w C:WINNTsystem32dllcachejscript.dll
    — 2004-08-17 12:04:20 15,872 -c—a-w C:WINNTsystem32dllcachejsproxy.dll
    + 2008-06-23 15:41:37 16,384 -c—a-w C:WINNTsystem32dllcachejsproxy.dll
    — 2004-08-17 12:04:22 331,776 -c—a-w C:WINNTsystem32dllcachemsadce.dll
    + 2008-05-01 14:33:02 331,776 -c—a-w C:WINNTsystem32dllcachemsadce.dll
    — 2004-08-17 12:04:22 73,728 -c—a-w C:WINNTsystem32dllcachemscms.dll
    + 2008-06-24 16:24:22 74,240 -c—a-w C:WINNTsystem32dllcachemscms.dll
    — 2004-08-17 12:04:22 512,029 -c—a-w C:WINNTsystem32dllcachemsexch40.dll
    + 2008-03-25 04:50:28 518,944 -c—a-w C:WINNTsystem32dllcachemsexch40.dll
    — 2004-08-17 12:04:22 319,517 -c—a-w C:WINNTsystem32dllcachemsexcl40.dll
    + 2008-03-25 04:50:30 326,432 -c—a-w C:WINNTsystem32dllcachemsexcl40.dll
    — 2004-08-17 12:04:22 3,003,392 -c—a-w C:WINNTsystem32dllcachemshtml.dll
    + 2008-06-23 15:41:39 3,080,704 -c—a-w C:WINNTsystem32dllcachemshtml.dll
    — 2004-08-17 12:04:22 448,512 -c—a-w C:WINNTsystem32dllcachemshtmled.dll
    + 2008-06-23 15:41:39 449,024 -c—a-w C:WINNTsystem32dllcachemshtmled.dll
    — 2004-08-17 12:04:24 1,507,356 -c—a-w C:WINNTsystem32dllcachemsjet40.dll
    + 2008-03-25 04:50:34 1,516,568 -c—a-w C:WINNTsystem32dllcachemsjet40.dll
    — 2004-07-17 07:34:48 358,976 -c—a-w C:WINNTsystem32dllcachemsjetol1.dll
    + 2008-03-25 04:50:40 355,112 -c—a-w C:WINNTsystem32dllcachemsjetol1.dll
    — 2004-08-17 12:04:24 163,871 -c—a-w C:WINNTsystem32dllcachemsjint40.dll
    + 2008-03-25 04:52:24 170,784 -c—a-w C:WINNTsystem32dllcachemsjint40.dll
    — 2004-08-17 12:04:24 53,279 -c—a-w C:WINNTsystem32dllcachemsjter40.dll
    + 2008-03-25 04:50:42 60,192 -c—a-w C:WINNTsystem32dllcachemsjter40.dll
    — 2004-08-17 12:04:24 241,693 -c—a-w C:WINNTsystem32dllcachemsjtes40.dll
    + 2008-03-25 04:50:42 248,608 -c—a-w C:WINNTsystem32dllcachemsjtes40.dll
    — 2004-08-17 12:04:24 213,023 -c—a-w C:WINNTsystem32dllcachemsltus40.dll
    + 2008-03-25 04:50:44 219,936 -c—a-w C:WINNTsystem32dllcachemsltus40.dll
    — 2004-08-17 12:04:24 348,189 -c—a-w C:WINNTsystem32dllcachemspbde40.dll
    + 2008-03-25 04:50:45 355,104 -c—a-w C:WINNTsystem32dllcachemspbde40.dll
    — 2004-08-17 12:04:24 146,432 -c—a-w C:WINNTsystem32dllcachemsrating.dll
    + 2008-06-23 15:41:39 146,432 -c—a-w C:WINNTsystem32dllcachemsrating.dll
    — 2004-08-17 12:04:24 421,919 -c—a-w C:WINNTsystem32dllcachemsrd2x40.dll
    + 2008-03-25 04:50:47 432,928 -c—a-w C:WINNTsystem32dllcachemsrd2x40.dll
    — 2004-08-17 12:04:24 315,423 -c—a-w C:WINNTsystem32dllcachemsrd3x40.dll
    + 2008-03-25 04:50:49 322,336 -c—a-w C:WINNTsystem32dllcachemsrd3x40.dll
    — 2004-08-17 12:04:24 552,989 -c—a-w C:WINNTsystem32dllcachemsrepl40.dll
    + 2008-03-25 04:50:52 559,904 -c—a-w C:WINNTsystem32dllcachemsrepl40.dll
    — 2004-08-17 12:04:24 258,077 -c—a-w C:WINNTsystem32dllcachemstext40.dll
    + 2008-03-25 04:50:55 264,992 -c—a-w C:WINNTsystem32dllcachemstext40.dll
    — 2004-08-17 12:04:24 530,432 -c—a-w C:WINNTsystem32dllcachemstime.dll
    + 2008-06-23 15:41:39 532,480 -c—a-w C:WINNTsystem32dllcachemstime.dll
    — 2004-08-17 12:04:26 831,519 -c—a-w C:WINNTsystem32dllcachemswdat10.dll
    + 2008-03-25 04:50:57 838,432 -c—a-w C:WINNTsystem32dllcachemswdat10.dll
    — 2004-08-17 12:04:26 247,296 -c—a-w C:WINNTsystem32dllcachemswsock.dll
    + 2008-06-20 17:42:17 247,296 -c—a-w C:WINNTsystem32dllcachemswsock.dll
    — 2004-08-17 12:04:26 614,429 -c—a-w C:WINNTsystem32dllcachemswstr10.dll
    + 2008-03-25 04:52:24 621,344 -c—a-w C:WINNTsystem32dllcachemswstr10.dll
    — 2004-08-17 12:04:26 348,189 -c—a-w C:WINNTsystem32dllcachemsxbde40.dll
    + 2008-03-25 04:50:58 355,104 -c—a-w C:WINNTsystem32dllcachemsxbde40.dll
    — 2004-08-17 12:04:28 39,424 -c—a-w C:WINNTsystem32dllcachepngfilt.dll
    + 2008-06-23 15:41:39 39,424 -c—a-w C:WINNTsystem32dllcachepngfilt.dll
    — 2004-08-17 12:04:28 1,289,216 -c—a-w C:WINNTsystem32dllcachequartz.dll
    + 2008-05-07 05:16:18 1,289,216 -c—a-w C:WINNTsystem32dllcachequartz.dll
    — 2003-05-29 12:00:00 200,064 -c—a-w C:WINNTsystem32dllcachermcast.sys
    + 2008-05-08 12:28:49 202,752 -c—a-w C:WINNTsystem32dllcachermcast.sys
    — 2004-08-17 12:04:30 1,483,264 -c—a-w C:WINNTsystem32dllcacheshdocvw.dll
    + 2008-06-23 15:41:40 1,494,528 -c—a-w C:WINNTsystem32dllcacheshdocvw.dll
    — 2004-08-17 12:04:30 473,600 -c—a-w C:WINNTsystem32dllcacheshlwapi.dll
    + 2008-06-23 15:41:40 474,112 -c—a-w C:WINNTsystem32dllcacheshlwapi.dll
    — 2004-08-03 19:14:42 359,040 -c—a-w C:WINNTsystem32dllcachetcpip.sys
    + 2008-06-20 10:45:13 360,320 -c—a-w C:WINNTsystem32dllcachetcpip.sys
    — 2004-08-03 19:07:46 223,616 -c—a-w C:WINNTsystem32dllcachetcpip6.sys
    + 2008-06-20 09:52:06 225,920 -c—a-w C:WINNTsystem32dllcachetcpip6.sys
    — 2004-08-17 12:04:34 600,576 -c—a-w C:WINNTsystem32dllcacheurlmon.dll
    + 2008-06-23 15:41:41 615,424 -c—a-w C:WINNTsystem32dllcacheurlmon.dll
    — 2004-08-17 12:04:34 417,792 -c—a-w C:WINNTsystem32dllcachevbscript.dll
    + 2007-12-18 14:43:09 417,792 -c—a-w C:WINNTsystem32dllcachevbscript.dll
    — 2004-08-17 12:04:36 656,896 -c—a-w C:WINNTsystem32dllcachewininet.dll
    + 2008-06-23 15:41:41 659,968 -c—a-w C:WINNTsystem32dllcachewininet.dll
    — 2004-08-10 20:41:00 229,376 -c—a-w C:WINNTsystem32dllcachewmasf.dll
    + 2007-10-20 02:01:32 227,328 -c—a-w C:WINNTsystem32dllcachewmasf.dll
    — 2004-08-10 20:41:20 5,550,080 -c—a-w C:WINNTsystem32dllcachewmp.dll
    + 2007-04-30 04:20:24 5,537,792 -c—a-w C:WINNTsystem32dllcachewmp.dll
    — 2004-08-10 21:39:08 2,362,104 -c—a-w C:WINNTsystem32dllcachewmvcore.dll
    + 2006-12-07 06:40:49 2,362,184 -c—a-w C:WINNTsystem32dllcachewmvcore.dll
    — 2004-08-17 12:04:36 431,104 -c—a-w C:WINNTsystem32dllcachewuapi.dll
    + 2008-07-18 18:09:44 563,912 -c—a-w C:WINNTsystem32dllcachewuapi.dll
    — 2004-08-17 12:05:12 111,616 -c—a-w C:WINNTsystem32dllcachewuauclt.exe
    + 2008-07-18 18:10:42 53,448 -c—a-w C:WINNTsystem32dllcachewuauclt.exe
    — 2004-08-17 12:04:38 1,134,592 -c—a-w C:WINNTsystem32dllcachewuaueng.dll
    + 2008-07-18 18:09:42 1,811,656 -c—a-w C:WINNTsystem32dllcachewuaueng.dll
    — 2004-08-17 12:04:38 113,152 -c—a-w C:WINNTsystem32dllcachewucltui.dll
    + 2008-07-18 18:09:46 325,832 -c—a-w C:WINNTsystem32dllcachewucltui.dll
    — 2004-08-17 12:04:38 36,864 -c—a-w C:WINNTsystem32dllcachewups.dll
    + 2008-07-18 18:10:20 36,552 -c—a-w C:WINNTsystem32dllcachewups.dll
    — 2004-08-17 12:04:38 120,320 -c—a-w C:WINNTsystem32dllcachewuweb.dll
    + 2008-07-18 18:09:44 205,000 -c—a-w C:WINNTsystem32dllcachewuweb.dll
    — 2004-08-17 12:04:14 148,480 —-a-w C:WINNTsystem32dnsapi.dll
    + 2008-06-20 17:42:17 148,992 —-a-w C:WINNTsystem32dnsapi.dll
    — 2004-08-03 19:14:16 138,496 —-a-w C:WINNTsystem32driversafd.sys
    + 2008-06-20 10:44:38 138,368 —-a-w C:WINNTsystem32driversafd.sys
    — 2003-05-29 12:00:00 200,064 —-a-w C:WINNTsystem32driversRMCast.sys
    + 2008-05-08 12:28:49 202,752 —-a-w C:WINNTsystem32driversrmcast.sys
    — 2004-08-03 19:14:42 359,040 —-a-w C:WINNTsystem32driverstcpip.sys
    + 2008-06-20 10:45:13 360,320 —-a-w C:WINNTsystem32driverstcpip.sys
    — 2004-08-03 19:07:46 223,616 —-a-w C:WINNTsystem32driverstcpip6.sys
    + 2008-06-20 09:52:06 225,920 —-a-w C:WINNTsystem32driverstcpip6.sys
    — 2004-08-17 12:04:14 357,888 —-a-w C:WINNTsystem32dxtmsft.dll
    + 2008-06-23 15:41:37 357,888 —-a-w C:WINNTsystem32dxtmsft.dll
    — 2004-08-17 12:04:14 201,728 —-a-w C:WINNTsystem32dxtrans.dll
    + 2008-06-23 15:41:37 205,312 —-a-w C:WINNTsystem32dxtrans.dll
    — 2004-08-17 12:04:16 243,200 —-a-w C:WINNTsystem32es.dll
    + 2008-07-07 20:32:21 253,952 —-a-w C:WINNTsystem32es.dll
    — 2004-08-17 12:04:16 55,808 —-a-w C:WINNTsystem32extmgr.dll
    + 2008-06-23 15:41:37 55,808 —-a-w C:WINNTsystem32extmgr.dll
    — 2004-08-17 12:04:16 249,344 —-a-w C:WINNTsystem32iepeers.dll
    + 2008-06-23 15:41:37 251,392 —-a-w C:WINNTsystem32iepeers.dll
    — 2004-08-17 12:04:18 678,400 —-a-w C:WINNTsystem32inetcomm.dll
    + 2008-04-11 18:51:35 683,520 —-a-w C:WINNTsystem32inetcomm.dll
    — 2004-08-17 12:04:20 96,256 —-a-w C:WINNTsystem32inseng.dll
    + 2008-06-23 15:41:37 96,256 —-a-w C:WINNTsystem32inseng.dll
    — 2004-08-17 12:04:20 450,560 —-a-w C:WINNTsystem32jscript.dll
    + 2007-12-18 14:43:09 450,560 —-a-w C:WINNTsystem32jscript.dll
    — 2004-08-17 12:04:20 15,872 —-a-w C:WINNTsystem32jsproxy.dll
    + 2008-06-23 15:41:37 16,384 —-a-w C:WINNTsystem32jsproxy.dll
    — 2008-10-07 10:39:05 12,210 —sha-w C:WINNTsystem32KGyGaAvL.sys
    + 2008-10-12 06:18:40 12,210 —sha-w C:WINNTsystem32KGyGaAvL.sys
    — 2004-08-17 12:04:22 73,728 —-a-w C:WINNTsystem32mscms.dll
    + 2008-06-24 16:24:22 74,240 —-a-w C:WINNTsystem32mscms.dll
    — 2004-08-17 12:04:22 512,029 —-a-w C:WINNTsystem32msexch40.dll
    + 2008-03-25 04:50:28 518,944 —-a-w C:WINNTsystem32msexch40.dll
    — 2004-08-17 12:04:22 319,517 —-a-w C:WINNTsystem32msexcl40.dll
    + 2008-03-25 04:50:30 326,432 —-a-w C:WINNTsystem32msexcl40.dll
    — 2004-08-17 12:04:22 3,003,392 —-a-w C:WINNTsystem32mshtml.dll
    + 2008-06-23 15:41:39 3,080,704 —-a-w C:WINNTsystem32mshtml.dll
    — 2004-08-17 12:04:22 448,512 —-a-w C:WINNTsystem32mshtmled.dll
    + 2008-06-23 15:41:39 449,024 —-a-w C:WINNTsystem32mshtmled.dll
    — 2004-08-17 12:04:24 1,507,356 —-a-w C:WINNTsystem32msjet40.dll
    + 2008-03-25 04:50:34 1,516,568 —-a-w C:WINNTsystem32msjet40.dll
    — 2004-07-17 07:34:48 358,976 —-a-w C:WINNTsystem32msjetoledb40.dll
    + 2008-03-25 04:50:40 355,112 —-a-w C:WINNTsystem32msjetoledb40.dll
    — 2004-08-17 12:04:24 163,871 —-a-w C:WINNTsystem32msjint40.dll
    + 2008-03-25 04:52:24 170,784 —-a-w C:WINNTsystem32msjint40.dll
    — 2004-08-17 12:04:24 53,279 —-a-w C:WINNTsystem32msjter40.dll
    + 2008-03-25 04:50:42 60,192 —-a-w C:WINNTsystem32msjter40.dll
    — 2004-08-17 12:04:24 241,693 —-a-w C:WINNTsystem32msjtes40.dll
    + 2008-03-25 04:50:42 248,608 —-a-w C:WINNTsystem32msjtes40.dll
    — 2004-08-17 12:04:24 213,023 —-a-w C:WINNTsystem32msltus40.dll
    + 2008-03-25 04:50:44 219,936 —-a-w C:WINNTsystem32msltus40.dll
    — 2004-08-17 12:04:24 348,189 —-a-w C:WINNTsystem32mspbde40.dll
    + 2008-03-25 04:50:45 355,104 —-a-w C:WINNTsystem32mspbde40.dll
    — 2004-08-17 12:04:24 146,432 —-a-w C:WINNTsystem32msrating.dll
    + 2008-06-23 15:41:39 146,432 —-a-w C:WINNTsystem32msrating.dll
    — 2004-08-17 12:04:24 421,919 —-a-w C:WINNTsystem32msrd2x40.dll
    + 2008-03-25 04:50:47 432,928 —-a-w C:WINNTsystem32msrd2x40.dll
    — 2004-08-17 12:04:24 315,423 —-a-w C:WINNTsystem32msrd3x40.dll
    + 2008-03-25 04:50:49 322,336 —-a-w C:WINNTsystem32msrd3x40.dll
    — 2004-08-17 12:04:24 552,989 —-a-w C:WINNTsystem32msrepl40.dll
    + 2008-03-25 04:50:52 559,904 —-a-w C:WINNTsystem32msrepl40.dll
    — 2004-08-17 12:04:24 258,077 —-a-w C:WINNTsystem32mstext40.dll
    + 2008-03-25 04:50:55 264,992 —-a-w C:WINNTsystem32mstext40.dll
    — 2004-08-17 12:04:24 530,432 —-a-w C:WINNTsystem32mstime.dll
    + 2008-06-23 15:41:39 532,480 —-a-w C:WINNTsystem32mstime.dll
    — 2004-08-17 12:04:26 831,519 —-a-w C:WINNTsystem32mswdat10.dll
    + 2008-03-25 04:50:57 838,432 —-a-w C:WINNTsystem32mswdat10.dll
    — 2004-08-17 12:04:26 247,296 —-a-w C:WINNTsystem32mswsock.dll
    + 2008-06-20 17:42:17 247,296 —-a-w C:WINNTsystem32mswsock.dll
    — 2004-08-17 12:04:26 614,429 —-a-w C:WINNTsystem32mswstr10.dll
    + 2008-03-25 04:52:24 621,344 —-a-w C:WINNTsystem32mswstr10.dll
    — 2004-08-17 12:04:26 348,189 —-a-w C:WINNTsystem32msxbde40.dll
    + 2008-03-25 04:50:58 355,104 —-a-w C:WINNTsystem32msxbde40.dll
    — 2002-02-03 22:52:54 1,230,336 —-a-w C:WINNTsystem32msxml4.dll
    + 2007-05-08 11:03:04 1,275,392 —-a-w C:WINNTsystem32msxml4.dll
    — 2008-03-30 09:18:13 62,422 —-a-w C:WINNTsystem32perfc009.dat
    + 2008-10-10 09:40:00 62,422 —-a-w C:WINNTsystem32perfc009.dat
    — 2008-03-30 09:18:13 74,762 —-a-w C:WINNTsystem32perfc019.dat
    + 2008-10-10 09:40:00 74,762 —-a-w C:WINNTsystem32perfc019.dat
    — 2008-03-30 09:18:13 400,760 —-a-w C:WINNTsystem32perfh009.dat
    + 2008-10-10 09:40:00 400,760 —-a-w C:WINNTsystem32perfh009.dat
    — 2008-03-30 09:18:13 441,552 —-a-w C:WINNTsystem32perfh019.dat
    + 2008-10-10 09:40:00 441,552 —-a-w C:WINNTsystem32perfh019.dat
    — 2004-08-17 12:04:28 39,424 —-a-w C:WINNTsystem32pngfilt.dll
    + 2008-06-23 15:41:39 39,424 —-a-w C:WINNTsystem32pngfilt.dll
    — 2004-08-17 12:04:28 1,289,216 —-a-w C:WINNTsystem32quartz.dll
    + 2008-05-07 05:16:18 1,289,216 —-a-w C:WINNTsystem32quartz.dll
    — 2004-08-17 12:04:30 1,483,264 —-a-w C:WINNTsystem32shdocvw.dll
    + 2008-06-23 15:41:40 1,494,528 —-a-w C:WINNTsystem32shdocvw.dll
    — 2004-08-17 12:04:30 473,600 —-a-w C:WINNTsystem32shlwapi.dll
    + 2008-06-23 15:41:40 474,112 —-a-w C:WINNTsystem32shlwapi.dll
    + 2008-07-18 18:10:20 36,552 —-a-w C:WINNTsystem32SoftwareDistributionSetupServiceStartupwups.dll7.2.6001.784wups.dll
    — 2005-05-04 10:45:28 14,048

    w C:WINNTsystem32spmsg.dll
    + 2007-11-30 11:21:39 17,784

    w C:WINNTsystem32spmsg.dll
    — 2004-03-17 10:36:52 15,872 —-a-w C:WINNTsystem32spupdsvc.exe
    + 2005-06-28 06:21:34 22,752 —-a-w C:WINNTsystem32spupdsvc.exe
    + 2008-07-14 11:09:18 62,976

    w C:WINNTsystem32tzchange.exe
    — 2004-08-17 12:04:34 600,576 —-a-w C:WINNTsystem32urlmon.dll
    + 2008-06-23 15:41:41 615,424 —-a-w C:WINNTsystem32urlmon.dll
    — 2004-08-17 12:04:34 417,792 —-a-w C:WINNTsystem32vbscript.dll
    + 2007-12-18 14:43:09 417,792 —-a-w C:WINNTsystem32vbscript.dll
    — 2004-08-17 12:04:36 656,896 —-a-w C:WINNTsystem32wininet.dll
    + 2008-06-23 15:41:41 659,968 —-a-w C:WINNTsystem32wininet.dll
    — 2004-08-10 20:41:00 229,376 —-a-w C:WINNTsystem32wmasf.dll
    + 2007-10-20 02:01:32 227,328 —-a-w C:WINNTsystem32wmasf.dll
    — 2004-08-10 20:41:20 5,550,080 —-a-w C:WINNTsystem32wmp.dll
    + 2007-04-30 04:20:24 5,537,792 —-a-w C:WINNTsystem32wmp.dll
    — 2004-08-10 21:39:08 2,362,104 —-a-w C:WINNTsystem32wmvcore.dll
    + 2006-12-07 06:40:49 2,362,184 —-a-w C:WINNTsystem32wmvcore.dll
    — 2004-08-17 12:04:36 431,104 —-a-w C:WINNTsystem32wuapi.dll
    + 2008-07-18 18:09:44 563,912 —-a-w C:WINNTsystem32wuapi.dll
    — 2004-08-17 12:05:12 111,616 —-a-w C:WINNTsystem32wuauclt.exe
    + 2008-07-18 18:10:42 53,448 —-a-w C:WINNTsystem32wuauclt.exe
    — 2004-08-17 12:04:38 1,134,592 —-a-w C:WINNTsystem32wuaueng.dll
    + 2008-07-18 18:09:42 1,811,656 —-a-w C:WINNTsystem32wuaueng.dll
    — 2004-08-17 12:04:38 113,152 —-a-w C:WINNTsystem32wucltui.dll
    + 2008-07-18 18:09:46 325,832 —-a-w C:WINNTsystem32wucltui.dll
    — 2004-08-17 12:04:38 36,864 —-a-w C:WINNTsystem32wups.dll
    + 2008-07-18 18:10:20 36,552 —-a-w C:WINNTsystem32wups.dll
    + 2008-07-18 18:10:40 45,768 —-a-w C:WINNTsystem32wups2.dll
    — 2004-08-17 12:04:38 120,320 —-a-w C:WINNTsystem32wuweb.dll
    + 2008-07-18 18:09:44 205,000 —-a-w C:WINNTsystem32wuweb.dll
    + 2008-07-03 09:42:52 360,448

    w C:WINNTsystem32xpsp3res.dll
    — 2008-10-08 22:50:04 53,248 —-a-w C:WINNTtempcatchme.dll
    + 2008-10-12 12:39:29 53,248 —-a-w C:WINNTtempcatchme.dll
    + 2007-05-08 11:06:44 1,275,392 —-a-w C:WINNTWinSxSx86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9848.0_x-ww_1b897e9amsxml4.dll
    + 2008-04-15 17:59:11 1,724,416 —-a-w C:WINNTWinSxSx86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88GdiPlus.dll
    .
    — Snapshot reset to current date —
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
    «{893AE660-AE80-4dd0-9959-24D2337C04E8}»= «C:Program FilesYandexOnlineyndminibar.dll» [2008-03-14 204800]
    «{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «C:Program FilesYandexYandexBarIEyndbar.dll» [2008-09-01 1561864]

    [HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
    «{893AE660-AE80-4DD0-9959-24D2337C04E8}»= «C:Program FilesYandexOnlineyndminibar.dll» [2008-03-14 204800]
    «{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «C:Program FilesYandexYandexBarIEyndbar.dll» [2008-09-01 1561864]

    [HKEY_CLASSES_ROOTclsid{893ae660-ae80-4dd0-9959-24d2337c04e8}]
    [HKEY_CLASSES_ROOTYandexSearch.Toolbar.1]
    [HKEY_CLASSES_ROOTTypeLib{893AE653-AE80-4dd0-9959-24D2337C04E8}]
    [HKEY_CLASSES_ROOTYandex.Search]

    [HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
    [HKEY_CLASSES_ROOTYandex.Toolbar.1]
    [HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
    [HKEY_CLASSES_ROOTYandex.Toolbar]

    [HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
    «CTFMON.EXE»=»C:WINNTsystem32ctfmon.exe» [2004-08-17 15360]
    «NBJ»=»C:PROGRA~1AheadNEROBA~1NBJ.exe» [2004-09-24 1916928]
    «Yupdate!»=»C:Program FilesCommon FilesYandexYupdateyupdate.exe» [2008-09-01 479496]
    «YandexOnline»=»C:Program FilesYandexOnlineonline.exe» [2008-04-14 2297640]
    «Yahoo! Pager»=»C:PROGRA~1Yahoo!MESSEN~1YAHOOM~1.EXE» [2007-08-30 4670704]
    «AMP Agent»=»C:Program FilesCommon FilesARS CompanyAgentAgent.exe» [2002-02-28 37888]
    «Skype»=»C:Program FilesSkypePhoneSkype.exe» [2008-08-11 21741864]

    [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
    «StartCCC»=»C:Program FilesATI TechnologiesATI.ACECore-StaticCLIStart.exe» [2006-11-10 90112]
    «SoundMAXPnP»=»C:Program FilesAnalog DevicesCoresmax4pnp.exe» [2006-12-18 868352]
    «QuickTime Task»=»C:Program FilesQuickTimeQTTask.exe» [2007-06-29 286720]
    «iTunesHelper»=»C:Program FilesiTunesiTunesHelper.exe» [2007-09-14 267064]
    «FineReader7NewsReaderPro»=»C:Program FilesABBYY FineReader 7.0 Professional EditionAbbyyNewsReader.exe» [2003-09-12 278528]
    «Make A Voozie»=»C:Documents and SettingsAll UsersApplication DataMake A VoozieVoozieMaker.exe» [2008-02-20 64000]
    «High Definition Audio Property Page Shortcut»=»HDAShCut.exe» [2004-10-27 C:WINNTsystem32HdAShCut.exe]

    [HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
    «CTFMON.EXE»=»C:WINNTsystem32CTFMON.EXE» [2004-08-17 15360]

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]
    «LogonType»= 0 (0x0)

    [HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
    «ForceClassicControlPanel»= 1 (0x1)
    «NoSMConfigurePrograms»= 1 (0x1)

    [HKLM~startupfolderC:^Documents and Settings^All Users^Главное меню^Программы^Автозагрузка^Ускоренный запуск Adobe Reader.lnk]
    path=C:Documents and SettingsAll UsersГлавное менюПрограммыАвтозагрузкаУскоренный запуск Adobe Reader.lnk
    backup=C:WINNTpssУскоренный запуск Adobe Reader.lnkCommon Startup

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregKernelFaultCheck]
    C:WINNTsystem32dumprep 0 -k [X]

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregOpwareSE4]
    —a

    2006-10-11 12:45 75304 C:Program FilesScanSoftOmniPageSE4.0OpWareSE4.exe

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregQuickTime Task]
    —a

    2007-06-29 07:24 286720 C:Program FilesQuickTimeQTTask.exe

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSSBkgdUpdate]
    —a

    2006-09-28 13:16 185896 C:Program FilesCommon FilesScanSoft SharedSSBkgdUpdateSSBkgdUpdate.exe

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringKasperskyAntiVirus]
    «DisableMonitoring»=dword:00000001

    [HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
    «%windir%\system32\sessmgr.exe»=
    «C:\WINNT\system32\svchost.exe»=
    «C:\Program Files\iTunes\iTunes.exe»=
    «C:\Program Files\QIP\qip.exe»=
    «C:\Program Files\FlylinkDC++\FlylinkDC.exe»=
    «C:\Program Files\Kaspersky Lab\Kaspersky AV for Yandex Online\avp.exe»=
    «C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe»=
    «C:\Program Files\Yahoo!\Messenger\YServer.exe»=
    «C:\Program Files\Skype\Phone\Skype.exe»=

    R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:WINNTsystem32DRIVERSklim5.sys [2007-12-13 24592]
    S3 SetupNTGLM7X;SetupNTGLM7X;E:NTGLM7X.sys [ ]
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-10-12 16:39:29
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes …

    scanning hidden autostart entries …

    scanning hidden files …

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .

    Other Running Processes

    .
    C:WINNTsystem32ati2evxx.exe
    C:WINNTsystem32ati2evxx.exe
    C:Program FilesCommon FilesAppleMobile Device SupportbinAppleMobileDeviceService.exe
    C:Program FilesATI TechnologiesATI.ACECore-StaticMOM.exe
    C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
    C:Program FilesYahoo!MessengerYmsgr_tray.exe
    C:WINNTsystem32wdfmgr.exe
    C:Program FilesATI TechnologiesATI.ACECore-StaticCCC.exe
    C:Program FilesKaspersky LabKaspersky AV for Yandex Onlineavp.exe
    C:Program FilesiPodbiniPodService.exe
    C:Program FilesKaspersky LabKaspersky AV for Yandex Onlineavp.exe
    C:Program FilesSkypePlugin ManagerskypePM.exe
    .
    **************************************************************************
    .
    Completion time: 2008-10-12 16:41:45 — machine was rebooted
    ComboFix-quarantined-files.txt 2008-10-12 12:41:39
    ComboFix2.txt 2008-10-09 16:12:52
    ComboFix3.txt 2008-10-09 08:16:31
    ComboFix4.txt 2008-10-08 22:52:02

    Pre-Run: 2 595 627 008 ???? ????????
    Post-Run: 2,572,705,792 ???? ????????

    587 — E O F — 2008-10-12 06:36:34

    9 октября, 2008 в 4:24 пп в ответ на: Internet Antivirus Pro, ничем не удаляется((( #19310
    milky
    Participant
    • Темы:1
    • Сообщений:5
    • ☆

    УРАААААААААААА!!! Кажется, с вашей помощью и ComboFix я победила этот кошмарный Internet Antivirus Pro!!!! 😀 😀 😀 Но я ко всему готова и не удивлюсь, если он выскочит откуда-нибудь 😈 Все сделала, как вы сказали, но не смогла проверить указанный вами файл, потому что не нашла его, и через поиск тоже. Может, он удалился в ходе чистки и все уже хорошо,а?? Тем не менее высылаю новый лог и ОГРОМНОЕ СПАСИБО за избавление ❗ ❗ ❗

    ComboFix 08-10-08.02 — ????????????? 2008-10-09 20:06:38.3 — NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1251.1.1049.18.687 [GMT 4:00]
    Running from: C:Documents and Settings???????????????????? ????ComboFix.exe
    Command switches used :: C:CFScript.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::
    C:Program FilesCommon Filesfile.exe
    C:Program FilesCommon FilesInternetAntivirusPro.exe
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:Program FilesCommon Filesfile.exe
    C:Program FilesCommon FilesInternetAntivirusPro.exe
    C:Program FilesInternet Antivirus Pro
    C:Program FilesInternet Antivirus Prodbconfig.cfg
    C:Program FilesInternet Antivirus ProIAPro.exe
    C:Program FilesInternet Antivirus Proworking.log
    C:WINNT?????????????.exe . . . . failed to delete

    .
    ((((((((((((((((((((((((( Files Created from 2008-09-09 to 2008-10-09 )))))))))))))))))))))))))))))))
    .

    2008-10-09 02:39 . 2008-10-09 02:40 2,440 —a

    C:WINNTsystem32tmp.reg
    2008-10-08 00:41 . 2008-10-08 00:41 d

    C:Documents and SettingsAll UsersApplication DataMalwarebytes
    2008-09-27 14:13 . 2008-09-27 14:13 1,148 —a

    C:WINNTsystem32ezdigsgn.dat
    2008-09-27 14:05 . 2008-09-27 15:31     d

    C:Documents and SettingsAll UsersApplication DataMake A Voozie
    2008-09-23 22:13 . 2008-09-23 22:13     d—hs—- C:found.000
    2008-09-23 17:36 . 2008-09-23 17:36 48 —ah

    C:WINNTsystem32ezsidmv.dat
    2008-09-23 17:32 . 2008-09-23 17:32     d

    C:Program FilesSkype
    2008-09-23 17:32 . 2008-09-23 17:32     d

    C:Program FilesCommon FilesSkype
    2008-09-23 17:32 . 2008-09-23 17:32     d

    C:Documents and SettingsAll UsersApplication DataSkype
    2008-09-16 22:09 . 2008-09-19 11:49 0 —ah

    C:??????? ???? (F

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-10-09 16:09 488,992 —sha-w C:WINNTsystem32driversfidbox2.dat
    2008-10-09 16:09 14,474,016 —sha-w C:WINNTsystem32driversfidbox.dat
    2008-10-09 16:08 47,888 —sha-w C:WINNTsystem32driversfidbox2.idx
    2008-10-09 16:08 198,008 —sha-w C:WINNTsystem32driversfidbox.idx
    2008-10-09 16:01

    d

    w C:Documents and SettingsAll UsersApplication DataKaspersky Lab
    2008-10-09 11:21 12,210 —sha-w C:WINNTsystem32KGyGaAvL.sys
    2008-10-07 18:07 12,800 —-a-w C:Program FilesПрезентация Microsoft PowerPoint.ppt
    2008-10-01 11:51 87,552 —-a-w C:WINNTsystem32VACFix.exe
    2008-09-19 08:26 82,944 —-a-w C:WINNTsystem32o4Patch.exe
    2008-09-19 08:26 82,944 —-a-w C:WINNTsystem32IEDFix.C.exe
    2008-09-08 19:38 88,576 —-a-w C:WINNTsystem32AntiXPVSTFix.exe
    2008-08-31 05:52

    d

    w C:Program FilesRMG Musical Player
    2008-08-31 05:52

    d

    w C:Program FilesCommon FilesARS Company
    2008-08-31 04:46

    d—h—w C:Program FilesInstallShield Installation Information
    2008-08-31 04:46

    d

    w C:Program FilesUbisoft
    2008-08-19 06:06 107,888 —-a-w C:WINNTsystem32CmdLineExt.dll
    2008-08-18 08:19 82,432 —-a-w C:WINNTsystem32404Fix.exe
    2008-07-18 18:10 94,920 —-a-w C:WINNTsystem32cdm.dll
    2008-07-18 18:10 53,448 —-a-w C:WINNTsystem32wuauclt.exe
    2008-07-18 18:10 45,768 —-a-w C:WINNTsystem32wups2.dll
    2008-07-18 18:10 36,552 —-a-w C:WINNTsystem32wups.dll
    2008-07-18 18:09 563,912 —-a-w C:WINNTsystem32wuapi.dll
    2008-07-18 18:09 325,832 —-a-w C:WINNTsystem32wucltui.dll
    2008-07-18 18:09 205,000 —-a-w C:WINNTsystem32wuweb.dll
    2008-07-18 18:09 1,811,656 —-a-w C:WINNTsystem32wuaueng.dll
    2007-10-09 11:55 24,192 —-a-w C:Documents and Settings9335~1usbsermptxp.sys
    2007-10-09 11:55 22,768 —-a-w C:Documents and Settings9335~1usbsermpt.sys
    2007-09-30 11:49 56 —sh—r C:WINNTsystem326B26223307.sys
    .

    Sigcheck


    2005-01-01 20:41 503808 a975a70fcefe2a224412214320c89ded C:WINNTsystem32winlogon.exe
    .
    ((((((((((((((((((((((((((((( snapshot@2008-10-09_ 2.51.25.64 )))))))))))))))))))))))))))))))))))))))))
    .
    — 2004-08-17 12:04:12 66,560 -c—a-w C:WINNTsystem32dllcachecdm.dll
    + 2008-07-18 18:10:48 94,920 -c—a-w C:WINNTsystem32dllcachecdm.dll
    — 2004-08-17 12:04:36 431,104 -c—a-w C:WINNTsystem32dllcachewuapi.dll
    + 2008-07-18 18:09:44 563,912 -c—a-w C:WINNTsystem32dllcachewuapi.dll
    — 2004-08-17 12:05:12 111,616 -c—a-w C:WINNTsystem32dllcachewuauclt.exe
    + 2008-07-18 18:10:42 53,448 -c—a-w C:WINNTsystem32dllcachewuauclt.exe
    — 2004-08-17 12:04:38 1,134,592 -c—a-w C:WINNTsystem32dllcachewuaueng.dll
    + 2008-07-18 18:09:42 1,811,656 -c—a-w C:WINNTsystem32dllcachewuaueng.dll
    — 2004-08-17 12:04:38 113,152 -c—a-w C:WINNTsystem32dllcachewucltui.dll
    + 2008-07-18 18:09:46 325,832 -c—a-w C:WINNTsystem32dllcachewucltui.dll
    — 2004-08-17 12:04:38 36,864 -c—a-w C:WINNTsystem32dllcachewups.dll
    + 2008-07-18 18:10:20 36,552 -c—a-w C:WINNTsystem32dllcachewups.dll
    — 2004-08-17 12:04:38 120,320 -c—a-w C:WINNTsystem32dllcachewuweb.dll
    + 2008-07-18 18:09:44 205,000 -c—a-w C:WINNTsystem32dllcachewuweb.dll
    + 2008-07-18 18:10:20 36,552 —-a-w C:WINNTsystem32SoftwareDistributionSetupServiceStartupwups.dll7.2.6001.784wups.dll
    — 2008-10-08 22:50:04 53,248 —-a-w C:WINNTtempcatchme.dll
    + 2008-10-09 16:09:14 53,248 —-a-w C:WINNTtempcatchme.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
    «{893AE660-AE80-4dd0-9959-24D2337C04E8}»= «C:Program FilesYandexOnlineyndminibar.dll» [2008-03-14 204800]
    «{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «C:Program FilesYandexYandexBarIEyndbar.dll» [2008-09-01 1561864]

    [HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
    «{893AE660-AE80-4DD0-9959-24D2337C04E8}»= «C:Program FilesYandexOnlineyndminibar.dll» [2008-03-14 204800]
    «{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «C:Program FilesYandexYandexBarIEyndbar.dll» [2008-09-01 1561864]

    [HKEY_CLASSES_ROOTclsid{893ae660-ae80-4dd0-9959-24d2337c04e8}]
    [HKEY_CLASSES_ROOTYandexSearch.Toolbar.1]
    [HKEY_CLASSES_ROOTTypeLib{893AE653-AE80-4dd0-9959-24D2337C04E8}]
    [HKEY_CLASSES_ROOTYandex.Search]

    [HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
    [HKEY_CLASSES_ROOTYandex.Toolbar.1]
    [HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
    [HKEY_CLASSES_ROOTYandex.Toolbar]

    [HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
    «CTFMON.EXE»=»C:WINNTsystem32ctfmon.exe» [2004-08-17 15360]
    «NBJ»=»C:PROGRA~1AheadNEROBA~1NBJ.exe» [2004-09-24 1916928]
    «Yupdate!»=»C:Program FilesCommon FilesYandexYupdateyupdate.exe» [2008-09-01 479496]
    «YandexOnline»=»C:Program FilesYandexOnlineonline.exe» [2008-04-14 2297640]
    «Yahoo! Pager»=»C:PROGRA~1Yahoo!MESSEN~1YAHOOM~1.EXE» [2007-08-30 4670704]
    «AMP Agent»=»C:Program FilesCommon FilesARS CompanyAgentAgent.exe» [2002-02-28 37888]
    «Skype»=»C:Program FilesSkypePhoneSkype.exe» [2008-08-11 21741864]

    [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
    «StartCCC»=»C:Program FilesATI TechnologiesATI.ACECore-StaticCLIStart.exe» [2006-11-10 90112]
    «SoundMAXPnP»=»C:Program FilesAnalog DevicesCoresmax4pnp.exe» [2006-12-18 868352]
    «QuickTime Task»=»C:Program FilesQuickTimeQTTask.exe» [2007-06-29 286720]
    «iTunesHelper»=»C:Program FilesiTunesiTunesHelper.exe» [2007-09-14 267064]
    «FineReader7NewsReaderPro»=»C:Program FilesABBYY FineReader 7.0 Professional EditionAbbyyNewsReader.exe» [2003-09-12 278528]
    «Make A Voozie»=»C:Documents and SettingsAll UsersApplication DataMake A VoozieVoozieMaker.exe» [2008-02-20 64000]
    «High Definition Audio Property Page Shortcut»=»HDAShCut.exe» [2004-10-27 C:WINNTsystem32HdAShCut.exe]

    [HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
    «CTFMON.EXE»=»C:WINNTsystem32CTFMON.EXE» [2004-08-17 15360]

    [HKEY_CURRENT_USERsoftwaremicrosoftwindowsCurrentversionpoliciesexplorerRun]
    «pg32.exe»=»C:Documents and SettingsАдминистраторLocal SettingsApplication DataMicrosoftWindowspg32.exe» [BU]

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]
    «LogonType»= 0 (0x0)

    [HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
    «ForceClassicControlPanel»= 1 (0x1)
    «NoSMConfigurePrograms»= 1 (0x1)

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]
    «msacm.l3codec»= l3codecp.acm

    [HKLM~startupfolderC:^Documents and Settings^All Users^Главное меню^Программы^Автозагрузка^Ускоренный запуск Adobe Reader.lnk]
    path=C:Documents and SettingsAll UsersГлавное менюПрограммыАвтозагрузкаУскоренный запуск Adobe Reader.lnk
    backup=C:WINNTpssУскоренный запуск Adobe Reader.lnkCommon Startup

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregKernelFaultCheck]
    C:WINNTsystem32dumprep 0 -k [X]

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregOpwareSE4]
    —a

    2006-10-11 12:45 75304 C:Program FilesScanSoftOmniPageSE4.0OpWareSE4.exe

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregQuickTime Task]
    —a

    2007-06-29 07:24 286720 C:Program FilesQuickTimeQTTask.exe

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSSBkgdUpdate]
    —a

    2006-09-28 13:16 185896 C:Program FilesCommon FilesScanSoft SharedSSBkgdUpdateSSBkgdUpdate.exe

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringKasperskyAntiVirus]
    «DisableMonitoring»=dword:00000001

    [HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
    «%windir%\system32\sessmgr.exe»=
    «C:\WINNT\system32\svchost.exe»=
    «C:\Program Files\iTunes\iTunes.exe»=
    «C:\Program Files\QIP\qip.exe»=
    «C:\Program Files\FlylinkDC++\FlylinkDC.exe»=
    «C:\Program Files\Kaspersky Lab\Kaspersky AV for Yandex Online\avp.exe»=
    «C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe»=
    «C:\Program Files\Yahoo!\Messenger\YServer.exe»=
    «C:\Program Files\Skype\Phone\Skype.exe»=

    R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:WINNTsystem32DRIVERSklim5.sys [2007-12-13 24592]
    S3 SetupNTGLM7X;SetupNTGLM7X;E:NTGLM7X.sys [ ]
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-10-09 20:09:15
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes …

    scanning hidden autostart entries …

    scanning hidden files …

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .

    Other Running Processes

    .
    C:WINNTsystem32ati2evxx.exe
    C:WINNTsystem32ati2evxx.exe
    C:Program FilesATI TechnologiesATI.ACECore-StaticMOM.exe
    C:Documents and SettingsC:Program FilesCommon FilesAppleMobile Device SupportbinAppleMobileDeviceService.exe
    C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
    C:Program FilesATI TechnologiesATI.ACECore-StaticCCC.exe
    C:Program FilesYahoo!MessengerYmsgr_tray.exe
    C:WINNTsystem32wdfmgr.exe
    C:Program FilesKaspersky LabKaspersky AV for Yandex Onlineavp.exe
    C:Program FilesiPodbiniPodService.exe
    C:Program FilesKaspersky LabKaspersky AV for Yandex Onlineavp.exe
    C:Program FilesSkypePlugin ManagerskypePM.exe
    C:WINNTsystem32imapi.exe
    .
    **************************************************************************
    .
    Completion time: 2008-10-09 20:11:29 — machine was rebooted
    ComboFix-quarantined-files.txt 2008-10-09 16:11:14
    ComboFix2.txt 2008-10-09 08:16:31
    ComboFix3.txt 2008-10-08 22:52:02

    Pre-Run: 3 590 668 288 ???? ????????
    Post-Run: 3,564,838,912 ???? ????????

    194

    9 октября, 2008 в 8:17 дп в ответ на: Internet Antivirus Pro, ничем не удаляется((( #19308
    milky
    Participant
    • Темы:1
    • Сообщений:5
    • ☆

    Здравствуйте, спасибо, что быстро ответили!! вот результаты:

    ComboFix 08-10-08.02 — ????????????? 2008-10-09 12:12:02.2 — NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1251.1.1049.18.592 [GMT 4:00]
    Running from: C:Documents and Settings???????????????????? ????ComboFix.exe

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:WINNT?????????????.exe . . . . failed to delete

    .
    ((((((((((((((((((((((((( Files Created from 2008-09-09 to 2008-10-09 )))))))))))))))))))))))))))))))
    .

    2008-10-09 02:39 . 2008-10-09 02:40 2,440 —a

    C:WINNTsystem32tmp.reg
    2008-10-08 00:41 . 2008-10-08 00:41 d

    C:Documents and SettingsAll UsersApplication DataMalwarebytes
    2008-10-07 16:14 . 2008-10-08 13:25     d

    C:Program FilesInternet Antivirus Pro
    2008-10-07 16:12 . 2008-10-07 16:13 2,719 —a

    C:Program FilesCommon Filesfile.exe
    2008-10-03 17:31 . 2008-10-07 16:14 2,681,934 —a

    C:Program FilesCommon FilesInternetAntivirusPro.exe
    2008-09-27 14:13 . 2008-09-27 14:13 1,148 —a

    C:WINNTsystem32ezdigsgn.dat
    2008-09-27 14:05 . 2008-09-27 15:31     d

    C:Documents and SettingsAll UsersApplication DataMake A Voozie
    2008-09-23 22:13 . 2008-09-23 22:13     d—hs—- C:found.000
    2008-09-23 17:36 . 2008-09-23 17:36 48 —ah

    C:WINNTsystem32ezsidmv.dat
    2008-09-23 17:32 . 2008-09-23 17:32     d

    C:Program FilesSkype
    2008-09-23 17:32 . 2008-09-23 17:32     d

    C:Program FilesCommon FilesSkype
    2008-09-23 17:32 . 2008-09-23 17:32     d

    C:Documents and SettingsAll UsersApplication DataSkype
    2008-09-16 22:09 . 2008-09-19 11:49 0 —ah

    C:??????? ???? (F

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-10-09 08:15 481,056 —sha-w C:WINNTsystem32driversfidbox2.dat
    2008-10-09 08:15 14,361,120 —sha-w C:WINNTsystem32driversfidbox.dat
    2008-10-09 08:13 47,120 —sha-w C:WINNTsystem32driversfidbox2.idx
    2008-10-09 08:13 196,496 —sha-w C:WINNTsystem32driversfidbox.idx
    2008-10-09 06:59

    d

    w C:Documents and SettingsAll UsersApplication DataKaspersky Lab
    2008-10-07 18:07 12,800 —-a-w C:Program FilesПрезентация Microsoft PowerPoint.ppt
    2008-08-31 05:52

    d

    w C:Program FilesRMG Musical Player
    2008-08-31 05:52

    d

    w C:Program FilesCommon FilesARS Company
    2008-08-31 04:46

    d—h—w C:Program FilesInstallShield Installation Information
    2008-08-31 04:46

    d

    w C:Program FilesUbisoft
    2007-10-09 11:55 24,192 —-a-w C:Documents and Settings9335~1usbsermptxp.sys
    2007-10-09 11:55 22,768 —-a-w C:Documents and Settings9335~1usbsermpt.sys
    2007-09-30 11:49 56 —sh—r C:WINNTsystem326B26223307.sys
    .

    Sigcheck


    2005-01-01 20:41 503808 a975a70fcefe2a224412214320c89ded C:WINNTsystem32winlogon.exe
    .
    ((((((((((((((((((((((((((((( snapshot@2008-10-09_ 2.51.25.64 )))))))))))))))))))))))))))))))))))))))))
    .
    — 2008-10-07 10:39:05 12,210 —sha-w C:WINNTsystem32KGyGaAvL.sys
    + 2008-10-08 23:13:12 12,210 —sha-w C:WINNTsystem32KGyGaAvL.sys
    — 2008-10-08 22:50:04 53,248 —-a-w C:WINNTtempcatchme.dll
    + 2008-10-09 08:14:45 53,248 —-a-w C:WINNTtempcatchme.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
    «{893AE660-AE80-4dd0-9959-24D2337C04E8}»= «C:Program FilesYandexOnlineyndminibar.dll» [2008-03-14 204800]
    «{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «C:Program FilesYandexYandexBarIEyndbar.dll» [2008-09-01 1561864]

    [HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
    «{893AE660-AE80-4DD0-9959-24D2337C04E8}»= «C:Program FilesYandexOnlineyndminibar.dll» [2008-03-14 204800]
    «{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «C:Program FilesYandexYandexBarIEyndbar.dll» [2008-09-01 1561864]

    [HKEY_CLASSES_ROOTclsid{893ae660-ae80-4dd0-9959-24d2337c04e8}]
    [HKEY_CLASSES_ROOTYandexSearch.Toolbar.1]
    [HKEY_CLASSES_ROOTTypeLib{893AE653-AE80-4dd0-9959-24D2337C04E8}]
    [HKEY_CLASSES_ROOTYandex.Search]

    [HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
    [HKEY_CLASSES_ROOTYandex.Toolbar.1]
    [HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
    [HKEY_CLASSES_ROOTYandex.Toolbar]

    [HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
    «CTFMON.EXE»=»C:WINNTsystem32ctfmon.exe» [2004-08-17 15360]
    «NBJ»=»C:PROGRA~1AheadNEROBA~1NBJ.exe» [2004-09-24 1916928]
    «Yupdate!»=»C:Program FilesCommon FilesYandexYupdateyupdate.exe» [2008-09-01 479496]
    «YandexOnline»=»C:Program FilesYandexOnlineonline.exe» [2008-04-14 2297640]
    «Yahoo! Pager»=»C:PROGRA~1Yahoo!MESSEN~1YAHOOM~1.EXE» [2007-08-30 4670704]
    «AMP Agent»=»C:Program FilesCommon FilesARS CompanyAgentAgent.exe» [2002-02-28 37888]
    «Skype»=»C:Program FilesSkypePhoneSkype.exe» [2008-08-11 21741864]
    «Internet Antivirus Pro»=»C:program filesInternet Antivirus ProIAPro.exe» [2008-10-03 1325056]

    [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
    «StartCCC»=»C:Program FilesATI TechnologiesATI.ACECore-StaticCLIStart.exe» [2006-11-10 90112]
    «SoundMAXPnP»=»C:Program FilesAnalog DevicesCoresmax4pnp.exe» [2006-12-18 868352]
    «QuickTime Task»=»C:Program FilesQuickTimeQTTask.exe» [2007-06-29 286720]
    «iTunesHelper»=»C:Program FilesiTunesiTunesHelper.exe» [2007-09-14 267064]
    «FineReader7NewsReaderPro»=»C:Program FilesABBYY FineReader 7.0 Professional EditionAbbyyNewsReader.exe» [2003-09-12 278528]
    «Make A Voozie»=»C:Documents and SettingsAll UsersApplication DataMake A VoozieVoozieMaker.exe» [2008-02-20 64000]
    «High Definition Audio Property Page Shortcut»=»HDAShCut.exe» [2004-10-27 C:WINNTsystem32HdAShCut.exe]

    [HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
    «CTFMON.EXE»=»C:WINNTsystem32CTFMON.EXE» [2004-08-17 15360]

    [HKEY_CURRENT_USERsoftwaremicrosoftwindowsCurrentversionpoliciesexplorerRun]
    «pg32.exe»=»C:Documents and SettingsАдминистраторLocal SettingsApplication DataMicrosoftWindowspg32.exe» [BU]

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]
    «LogonType»= 0 (0x0)

    [HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
    «ForceClassicControlPanel»= 1 (0x1)
    «NoSMConfigurePrograms»= 1 (0x1)

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]
    «msacm.l3codec»= l3codecp.acm

    [HKLM~startupfolderC:^Documents and Settings^All Users^Главное меню^Программы^Автозагрузка^Ускоренный запуск Adobe Reader.lnk]
    path=C:Documents and SettingsAll UsersГлавное менюПрограммыАвтозагрузкаУскоренный запуск Adobe Reader.lnk
    backup=C:WINNTpssУскоренный запуск Adobe Reader.lnkCommon Startup

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregKernelFaultCheck]
    C:WINNTsystem32dumprep 0 -k [X]

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregOpwareSE4]
    —a

    2006-10-11 12:45 75304 C:Program FilesScanSoftOmniPageSE4.0OpWareSE4.exe

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregQuickTime Task]
    —a

    2007-06-29 07:24 286720 C:Program FilesQuickTimeQTTask.exe

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSSBkgdUpdate]
    —a

    2006-09-28 13:16 185896 C:Program FilesCommon FilesScanSoft SharedSSBkgdUpdateSSBkgdUpdate.exe

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringKasperskyAntiVirus]
    «DisableMonitoring»=dword:00000001

    [HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
    «%windir%\system32\sessmgr.exe»=
    «C:\WINNT\system32\svchost.exe»=
    «C:\Program Files\iTunes\iTunes.exe»=
    «C:\Program Files\QIP\qip.exe»=
    «C:\Program Files\FlylinkDC++\FlylinkDC.exe»=
    «C:\Program Files\Kaspersky Lab\Kaspersky AV for Yandex Online\avp.exe»=
    «C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe»=
    «C:\Program Files\Yahoo!\Messenger\YServer.exe»=
    «C:\Program Files\Skype\Phone\Skype.exe»=

    R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:WINNTsystem32DRIVERSklim5.sys [2007-12-13 24592]
    S3 SetupNTGLM7X;SetupNTGLM7X;E:NTGLM7X.sys [ ]

    [HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{02c557b0-711d-11dc-aea7-001bfc8d7cf4}]
    ShellAutoRuncommand — t0k3c.cmd
    ShellexploreCommand — t0k3c.cmd
    ShellopenCommand — t0k3c.cmd
    .
    .

    Supplementary Scan

    .
    R0 -: HKCU-Main,Start Page = hxxp://www.yahoo.com/
    R0 -: HKLM-Main,Start Page = hxxp://www.yahoo.com/
    R0 -: HKLM-Main,Search Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
    R1 -: HKCU-SearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
    O8 -: &Экспорт в Microsoft Excel — C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
    O8 -: Высокоскоростная печать Easy-WebPrint — C:Program FilesCanonEasy-WebPrintToolband.dll/RC_HSPrint.html
    O8 -: Добавление в список для печати Easy-WebPrint — C:Program FilesCanonEasy-WebPrintToolband.dll/RC_AddToList.html
    O8 -: Печать Easy-WebPrint — C:Program FilesCanonEasy-WebPrintToolband.dll/RC_Print.html
    O8 -: Поиск@Mail.Ru — C:Program FilesMail.RuSputnikMailRuSputnik.dll/SEARCH.HTM
    O8 -: Предварительный просмотр Easy-WebPrint — C:Program FilesCanonEasy-WebPrintToolband.dll/RC_Preview.html
    O8 -: Словари@Mail.Ru — C:Program FilesMail.RuSputnikMailRuSputnik.dll/TRANSLATE.HTM
    O17 -: HKLMCCSInterface{24628569-5B74-4765-B17D-A7AC3D7AB660}: NameServer = 195.34.224.1,195.34.224.2
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-10-09 12:14:45
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes …

    scanning hidden autostart entries …

    scanning hidden files …

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .

    Other Running Processes

    .
    C:WINNTsystem32ati2evxx.exe
    C:WINNTsystem32ati2evxx.exe
    C:Documents and SettingsC:WINNTsystem32ctfmon.exe
    C:Program FilesCommon FilesAppleMobile Device SupportbinAppleMobileDeviceService.exe
    C:Program FilesATI TechnologiesATI.ACECore-StaticMOM.exe
    C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
    C:Program FilesYahoo!MessengerYmsgr_tray.exe
    C:Program FilesATI TechnologiesATI.ACECore-StaticCCC.exe
    C:WINNTsystem32wdfmgr.exe
    C:Program FilesiPodbiniPodService.exe
    C:WINNTsystem32wscntfy.exe
    C:Program FilesSkypePlugin ManagerskypePM.exe
    .
    **************************************************************************
    .
    Completion time: 2008-10-09 12:16:30 — machine was rebooted
    ComboFix-quarantined-files.txt 2008-10-09 08:16:24
    ComboFix2.txt 2008-10-08 22:52:02

    Pre-Run: 3 626 250 240 ???? ????????
    Post-Run: 3,605,766,144 ???? ????????

    177

  • Автор
    Сообщения
Просмотр 4 сообщений - с 1 по 4 (из 4 всего)

Добро пожаловать

На нашем сайте размещены инструкции и программы, которые помогут вам абсолютно бесплатно и самостоятельно удалить навязчивую рекламу, вирусы и трояны.

Поиск

Важные инструкции

Нет доступа в интернет после удаления вируса — Как восстановить
Как удалить всплывающие окна
Удалить всплывающие окна, рекламу, уведомления в Chrome
Удалить вирус, всплывающие окна и рекламу в Mac OS X
Установлено в соответствии с корпоративным правилом (Удалить из Хрома)

СПАЙВАРЕ РУ

  • О Спайваре Ру
  • Контакты
  • Реклама на сайте
  • Политика конфиденциальности
  • Правила использования

Нужна помощь?

Задайте свой вопрос прямо сейчас кликнув по следующей ссылке Задать вопрос.

Или обратитесь на наш форум, где команда Spyware-ru поможет вам. Узнайте, как попросить о помощи здесь.

Ссылки

  • Инструкции
  • Скачать программы
  • Помощь в удалении вирусов
  • Как вылечить компьютер
Copyright © 2008 - 2024 Spyware-RU.com (en)