SPYWARE-RU.COM

Созданные ответы форума

Просмотр 9 сообщений - с 1 по 9 (из 9 всего)

Автор

Сообщения
20 июня, 2010 в 2:50 пп в ответ на: Помогите удалить информер #29729
Osa
Participant
- Темы:3
- Сообщений:12
большое спасибо за Вашу помощь! Информер больше и не думает появляться.

ComboFix 10-06-19.03 — Admin 20.06.10 18:35:38.7.2 — x86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.1023.701 [GMT 4:00]
Running from: c:documents and settingsAdminРабочий столComboFix.exe
Command switches used :: c:documents and settingsAdminРабочий столWindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
AV: Антивирус Касперского *On-access scanning enabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:IE8-WI~1.EXE
c:windowsdel.bat
c:windowsDownloaded Program Filesf3initialsetup1.0.1.0.inf
c:windowssystem32Пузыри.scr
c:windowssystem32ssField Lines.scr
c:windowssystem32ssRibbons.scr
c:windowssystem32SYSINTERNALS_BLUESCREEN.SCR

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

Legacy_MYWEBSEARCHSERVICE

((((((((((((((((((((((((( Files Created from 2010-05-20 to 2010-06-20 )))))))))))))))))))))))))))))))
.

2010-06-18 21:12 . 2010-06-18 21:12

d

w- c:documents and settingsLocalServiceApplication Data{DCD48218-E972-4d0c-9E5F-43462BC13E3B}
2010-06-17 18:08 . 2010-06-17 18:08

d

w- C:_OTM
2010-06-15 15:22 . 2010-06-16 18:31

d

w- c:program filesCommon FilesOpera
2010-06-15 14:33 . 2010-06-15 14:33 133648 —-a-w- c:documents and settingsAll UsersApplication DataKaspersky LabAVP9DataUpdaterTemporary FilesrollbackpatchAutoPatcheskav9exec9.0.0.736mmpprtc.dll
2010-06-15 14:33 . 2010-06-15 14:33 133720 —-a-w- c:documents and settingsAll UsersApplication DataKaspersky LabAVP9DataUpdaterTemporary FilestemporaryFolderAutoPatcheskav9exec9.0.0.736mmpprtc.dll
2010-06-11 20:56 . 2010-06-12 08:31

d

w- c:program filesCommon FilesAgent
2010-06-06 18:36 . 2010-06-07 14:46

d

w- c:program filesCommon FilesFirefox
2010-06-01 20:36 . 2010-06-01 20:36

d

w- c:documents and settingsAdminApplication DataMalwarebytes
2010-06-01 20:36 . 2010-04-29 11:39 38224 —-a-w- c:windowssystem32driversmbamswissarmy.sys
2010-06-01 20:36 . 2010-06-01 20:36

d

w- c:documents and settingsAll UsersApplication DataMalwarebytes
2010-06-01 20:36 . 2010-04-29 11:39 20952 —-a-w- c:windowssystem32driversmbam.sys
2010-06-01 20:36 . 2010-06-01 20:36

d

w- c:program filesMalwarebytes’ Anti-Malware
2010-05-31 12:01 . 2010-05-31 12:02

d

w- C:rsit

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-20 14:44 . 2008-10-13 13:13

d

w- c:documents and settingsAll UsersApplication DataKaspersky Lab
2010-06-20 14:31 . 2008-08-31 09:11

d

w- c:documents and settingsAdminApplication DatauTorrent
2010-06-19 12:36 . 2008-08-31 09:32

d

w- c:program filesGoogle
2010-06-18 21:12 . 2009-07-02 19:52

d

w- c:program filesOpera
2010-06-18 21:12 . 2008-07-10 11:52

d

w- c:documents and settingsAdminApplication DataMra
2010-06-18 21:12 . 2008-07-10 11:52

d

w- c:program filesMail.Ru
2010-06-17 18:22 . 2009-07-03 11:50

d

w- c:program filestrend micro
2010-05-19 13:47 . 2009-02-27 15:35

d

w- c:program filesEA GAMES
2010-05-05 07:53 . 2010-03-15 08:29 97549 —-a-w- c:windowssystem32driversklick.dat
2010-05-05 07:53 . 2010-03-15 08:29 113933 —-a-w- c:windowssystem32driversklin.dat
2010-05-03 14:53 . 2010-05-03 14:53 58 —-a-w- c:windowssystem32DonationCoder_ScreenshotCaptor_InstallInfo.dat
2010-05-03 14:53 . 2010-05-03 14:53 58 —-a-w- c:documents and settingsAdminLocal SettingsApplication DataDonationCoder_ScreenshotCaptor_InstallInfo.dat
2010-05-03 14:53 . 2010-05-03 14:53

d

w- c:documents and settingsAdminApplication DataDonationCoder
2010-05-03 14:53 . 2010-05-03 14:53

d

w- c:documents and settingsAll UsersApplication DataDonationCoder
2010-03-28 09:12 . 2008-04-15 12:00 77736 —-a-w- c:windowssystem32perfc019.dat
2010-03-28 09:12 . 2008-04-15 12:00 451776 —-a-w- c:windowssystem32perfh019.dat
.

Sigcheck

[-] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:windowsSoftwareDistributionDownload8811f08beda44a8d3c249b9d00773202sp3qfetcpip.sys
[-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:windowsSoftwareDistributionDownload8811f08beda44a8d3c249b9d00773202sp3gdrtcpip.sys
[-] 2008-05-20 . 030DC4D48CC2B894FEE2F390D8E66AD5 . 361344 . . [5.1.2600.5512] . . c:windowssystem32driverstcpip.sys

[-] 2008-05-20 . 23B7D3F3F5EC8FEEA75EC381C71CBD5E . 579072 . . [5.1.2600.5512] . . c:windowssystem32user32.dll

[-] 2008-05-20 . DC5D73A9809B66026231A9D49DE6987F . 1721344 . . [6.00.2900.5512] . . c:windowsexplorer.exe

[-] 2008-05-20 . 46D60730EE2DF438750B38370425BC74 . 1571840 . . [5.1.2600.5512] . . c:windowssystem32sfcfiles.dll

[-] 2008-05-20 . AE0DB25EE10900C73D923AD5880564CF . 30208 . . [5.1.2600.5512] . . c:windowssystem32ctfmon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
«LClock»=»c:program filesLClockLClock.exe» [2007-12-14 86016]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2007-11-14 201728]
«uTorrent»=»d:графикаuTorrentutorrent.exe» [2009-03-15 270128]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«AmlMaple»=»c:program filesAmlMapleAmlMaple.exe» [2008-04-24 91648]
«SoundMAXPnP»=»c:program filesAnalog DevicesCoresmax4pnp.exe» [2006-05-01 843776]
«JMB36X Configure»=»c:windowssystem32JMRaidTool.exe» [2006-06-02 385024]
«ATICCC»=»c:program filesATI TechnologiesATI.ACEcli.exe» [2005-08-12 45056]
«Samsung Common SM»=»c:windowsSamsungComSMMgrssmmgr.exe» [2005-07-03 372736]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2006-01-12 155648]
«MAgent»=»c:для софтовmagent.exe» [2010-06-18 9422016]
«TkBellExe»=»c:program filesCommon FilesRealUpdate_OBrealsched.exe» [2010-03-05 202256]
«avp»=»c:program filesKaspersky LabKaspersky Anti-Virus 2010avp.exe» [2009-10-20 340456]
«Guard.Mail.ru.gui»=»c:program filesMail.RuGuardGuardMailRu.exe» [2010-06-18 563392]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-05-20 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» [2009-03-08 128512]
«IE7_012″=»advpack.dll» [2009-03-08 128512]

c:documents and settingsAll Usersѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
Adobe Reader Speed Launch.lnk — c:program filesAdobeAcrobat 7.0Readerreader_sl.exe [2004-12-14 29696]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusOverride»=dword:00000001

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringKasperskyAntiVirus]
«DisableMonitoring»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\Russian\setup.exe»=
«c:\Program Files\Total Commander\TOTALCMD.EXE»=
«c:\Program Files\Opera\opera.exe»=
«d:\графика\uTorrent\utorrent.exe»=
«c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 7.0.1.325\Russian\setup.exe»=
«c:\Program Files\Mail.Ru\Sputnik\SputnikFlashPlayer.exe»=
«c:\Program Files\Mail.Ru\Sputnik\SputnikHelper.exe»=

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«54505:TCP»= 54505:TCP:*:Disabled:ослик
«21028:UDP»= 21028:UDP:*:Disabled:ослик
«57153:UDP»= 57153:UDP:Торя
«57153:TCP»= 57153:TCP:торент
«4243:TCP»= 4243:TCP:http://callofthewind.net
«4243:UDP»= 4243:UDP:http://callofthewind.net
«16449:TCP»= 16449:TCP

R0 klbg;Kaspersky Lab Boot Guard Driver;c:windowssystem32driversklbg.sys [14.10.09 21:18 36880]
R0 sptd;sptd;c:windowssystem32driverssptd.sys [25.06.08 21:59 717296]
R2 Guard.Mail.ru;Guard.Mail.ru;c:program filesMail.RuGuardGuardMailRu.exe [19.06.10 1:12 563392]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:windowssystem32driversklim5.sys [14.09.09 14:42 32272]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:windowssystem32driversklmouflt.sys [02.10.09 19:39 19472]
.
.

Supplementary Scan

.
uStart Page = mail.ru
uInternet Connection Wizard,ShellNext = hxxp://www.kornet.ru/
uInternet Settings,ProxyOverride = *.local
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
IE: Crawler Search — tbr:iemenu
IE: Добавить в Rambler-Закладки — c:program filesRambler AssistantramblertoolbarU1.dll/zakladki.htm
IE: Найти с помощью Рамблера — c:program filesRambler AssistantramblertoolbarU1.dll/search.htm
IE: Перевести с помощью словарей Рамблера — c:program filesRambler AssistantramblertoolbarU1.dll/dic.htm
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:для софтовmagent.exe
TCP: {49D1CC09-93B8-441C-9124-06F88F91694A} = 87.237.112.10,77.241.40.178
Handler: tbr — {4D25FB7A-8902-4291-960E-9ADA051CFBBF} — c:progra~1Crawlerctbr.dll
.
— — — — ORPHANS REMOVED — — — —

BHO-{DFBA2295-8003-451E-B841-48C41484E20F} — (no file)
HKCU-Run-AdobeUpdater — c:program filesCommon FilesAdobeUpdater5AdobeUpdater.exe
HKCU-Run-ICQ — c:progra~1ICQ6ICQ.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-20 18:45
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spmh.sys >>UNKNOWN [0x86787938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
DriverDisk -> CLASSPNP.SYS @ 0xf7893f28
DriverACPI -> ACPI.sys @ 0xf76cecb8
Driveratapi -> atapi.sys @ 0xf7663b40
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805e66aa
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b9
DeviceHarddisk0DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805e66aa
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b9
NDIS: -> SendCompleteHandler -> 0x0
PacketIndicateHandler -> 0x0
SendHandler -> 0x0
user & kernel MBR OK

**************************************************************************
.

LOCKED REGISTRY KEYS

[HKEY_USERSS-1-5-21-1644491937-1844823847-1801674531-500SoftwareMicrosoftInternet ExplorerUser Preferences]
@Denied: (2) (Administrator)
«88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977″=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,67,ce,d3,38,2b,e7,1c,4e,9d,1d,3f,
«2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81″=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,cf,41,39,31,48,46,89,4d,a3,60,ad,
«6256FFB019F8FDFBD36745B06F4540E9AEAF222A25″=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,67,ce,d3,38,2b,e7,1c,4e,9d,1d,3f,
.

DLLs Loaded Under Running Processes

— — — — — — — > ‘winlogon.exe'(1316)
c:windowssystem32SETUPAPI.dll
c:windowssystem32Ati2evxx.dll
c:windowssystem32cscui.dll

— — — — — — — > ‘lsass.exe'(1380)
c:windowssystem32setupapi.dll

— — — — — — — > ‘explorer.exe'(960)
c:windowssystem32WININET.dll
c:program filesAmlMapleAmlMaple.dll
c:windowssystem32COMRes.dll
c:windowsSystem32cscui.dll
c:program filesPunto Switchercorrect.dll
c:windowssystem32msi.dll
c:program filesLClockLC.dll
c:windowssystem32wpdshserviceobj.dll
c:windowssystem32webcheck.dll
c:windowssystem32SETUPAPI.dll
c:windowssystem32portabledevicetypes.dll
c:windowssystem32portabledeviceapi.dll
c:windowssystem32NETSHELL.dll
.

Other Running Processes

.
c:windowssystem32Ati2evxx.exe
c:windowsATKKBService.exe
c:windowssystem32Ati2evxx.exe
.
**************************************************************************
.
Completion time: 2010-06-20 18:48:01 — machine was rebooted
ComboFix-quarantined-files.txt 2010-06-20 14:47

Pre-Run: 8 306 831 360 байт свободно
Post-Run: 8 273 879 040 байт свободно

— — End Of File — — A61BE3FBFAF724703F969D0941A83282
17 июня, 2010 в 6:22 пп в ответ на: Помогите удалить информер #29727
Osa
Participant
- Темы:3
- Сообщений:12
Logfile of random’s system information tool 1.07 (written by random/random)
Run by Admin at 2010-06-17 22:21:58
Microsoft Windows XP Professional Service Pack 3
System drive C: has 8 GB (32%) free of 25 GB
Total RAM: 1023 MB (44% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:22:14, on 17.06.10
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSATKKBService.exe
C:Program FilesKaspersky LabKaspersky Anti-Virus 2010avp.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:Program FilesAmlMapleAmlMaple.exe
C:Program FilesAnalog DevicesCoresmax4pnp.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:WINDOWSSamsungComSMMgrssmmgr.exe
C:Program FilesCommon FilesRealUpdate_OBrealsched.exe
C:Program FilesKaspersky LabKaspersky Anti-Virus 2010avp.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesVistaDriveIconVistaDrv.exe
C:Program FilesLClockLClock.exe
C:Program FilesPunto Switcherps.exe
D:графикаuTorrentutorrent.exe
C:WINDOWSsystem32wuauclt.exe
C:Program FilesAdobeAcrobat 7.0Readerreader_sl.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:WINDOWSsystem32wscntfy.exe
C:Program Filesinternet exploreriexplore.exe
C:Program Filesinternet exploreriexplore.exe
C:Documents and SettingsAdminРабочий столRSIT.exe
C:Program Filestrend microAdmin.exe

R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://home.mywebsearch.com/index.jhtml?n=77C09F4F&ptnrS=ZCman000&ptb=gj8ua39Oubb9yCCezo5B_w
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=66016
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66016
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKCUSoftwareMicrosoftInternet Connection Wizard,ShellNext = http://www.kornet.ru/
R1 — HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *.local
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: (no name) — {83821C2B-32A8-4DD7-B6D4-44309A78E668} — C:для софтовMradllnewmrasearch.dll
R3 — URLSearchHook: (no name) — {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} — C:PROGRA~1Crawlerctbr.dll
O2 — BHO: AcroIEHlprObj Class — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll
O2 — BHO: (no name) — {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} — C:PROGRA~1Crawlerctbr.dll
O2 — BHO: IEVkbdBHO — {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} — C:Program FilesKaspersky LabKaspersky Anti-Virus 2010ievkbd.dll
O2 — BHO: SSVHelper Class — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — C:Program FilesJavajre1.6.0_06binssv.dll
O2 — BHO: Спутник@Mail.Ru — {8984B388-A5BB-4DF7-B274-77B879E179DB} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O2 — BHO: xrhlibP — {DFBA2295-8003-451E-B841-48C41484E20F} — (no file)
O2 — BHO: link filter bho — {E33CF602-D945-461A-83F0-819F76A199F8} — C:Program FilesKaspersky LabKaspersky Anti-Virus 2010klwtbbho.dll
O3 — Toolbar: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O3 — Toolbar: &Crawler Toolbar — {4B3803EA-5230-4DC3-A7FC-33638F3D3542} — C:PROGRA~1Crawlerctbr.dll
O3 — Toolbar: Rambler-Ассистент — {468CD8A9-7C25-45FA-969E-3D925C689DC4} — C:Program FilesRambler AssistantramblertoolbarU1.dll
O4 — HKLM..Run: [AmlMaple] C:Program FilesAmlMapleAmlMaple.exe
O4 — HKLM..Run: [SoundMAXPnP] C:Program FilesAnalog DevicesCoresmax4pnp.exe
O4 — HKLM..Run: [JMB36X Configure] C:WINDOWSsystem32JMRaidTool.exe boot
O4 — HKLM..Run: [ATICCC] «C:Program FilesATI TechnologiesATI.ACEcli.exe» runtime -Delay
O4 — HKLM..Run: [Samsung Common SM] «C:WINDOWSSamsungComSMMgrssmmgr.exe» /autorun
O4 — HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 — HKLM..Run: [MAgent] C:для софтовMAgent.exe -LM
O4 — HKLM..Run: [TkBellExe] «C:Program FilesCommon FilesRealUpdate_OBrealsched.exe» -osboot
O4 — HKLM..Run: [avp] «C:Program FilesKaspersky LabKaspersky Anti-Virus 2010avp.exe»
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe
O4 — HKCU..Run: [LClock] C:Program FilesLClockLClock.exe
O4 — HKCU..Run: [Punto Switcher] C:Program FilesPunto Switcherps.exe
O4 — HKCU..Run: [AdobeUpdater] C:Program FilesCommon FilesAdobeUpdater5AdobeUpdater.exe
O4 — HKCU..Run: [ICQ] «C:PROGRA~1ICQ6ICQ.exe» silent
O4 — HKCU..Run: [uTorrent] «D:графикаuTorrentutorrent.exe»
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,NewUserFirstLogonInstall,0 (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — HKUS.DEFAULT..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,NewUserFirstLogonInstall,0 (User ‘Default user’)
O4 — Global Startup: Adobe Reader Speed Launch.lnk = C:Program FilesAdobeAcrobat 7.0Readerreader_sl.exe
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2Office12EXCEL.EXE/3000
O8 — Extra context menu item: Crawler Search — tbr:iemenu
O8 — Extra context menu item: Добавить в Rambler-Закладки — res://C:Program FilesRambler AssistantramblertoolbarU1.dll/zakladki.htm
O8 — Extra context menu item: Найти с помощью Рамблера — res://C:Program FilesRambler AssistantramblertoolbarU1.dll/search.htm
O8 — Extra context menu item: Перевести с помощью словарей Рамблера — res://C:Program FilesRambler AssistantramblertoolbarU1.dll/dic.htm
O8 — Extra context menu item: Поиск@Mail.Ru — res://C:Program FilesMail.RuSputnikMailRuSputnik.dll/SEARCH.HTM
O8 — Extra context menu item: Словари@Mail.Ru — res://C:Program FilesMail.RuSputnikMailRuSputnik.dll/TRANSLATE.HTM
O9 — Extra button: (no name) — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_06binssv.dll
O9 — Extra ‘Tools’ menuitem: Sun Java Console — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_06binssv.dll
O9 — Extra button: &Виртуальная клавиатура — {4248FE82-7FCB-46AC-B270-339F08212110} — C:Program FilesKaspersky LabKaspersky Anti-Virus 2010klwtbbho.dll
O9 — Extra button: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:для софтовmagent.exe
O9 — Extra ‘Tools’ menuitem: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:для софтовmagent.exe
O9 — Extra button: Research — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2Office12REFIEBAR.DLL
O9 — Extra button: Проверка ссы&лок — {CCF151D8-D089-449F-A5A4-D9909053F20F} — C:Program FilesKaspersky LabKaspersky Anti-Virus 2010klwtbbho.dll
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O12 — Plugin for .spop: C:Program FilesInternet ExplorerPluginsNPDocBox.dll
O17 — HKLMSystemCCSServicesTcpip..{49D1CC09-93B8-441C-9124-06F88F91694A}: NameServer = 87.237.112.10,77.241.40.178
O18 — Protocol: tbr — {4D25FB7A-8902-4291-960E-9ADA051CFBBF} — C:PROGRA~1Crawlerctbr.dll
O22 — SharedTaskScheduler: Предзагрузчик Browseui — {438755C2-A8BA-11D1-B96B-00A0C90312E1} — C:WINDOWSsystem32browseui.dll
O22 — SharedTaskScheduler: Демон кэша категорий компонентов — {8C7461EF-2B13-11d2-BE35-3078302C2030} — C:WINDOWSsystem32browseui.dll
O23 — Service: Adobe LM Service — Adobe Systems — C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe
O23 — Service: Ati HotKey Poller — ATI Technologies Inc. — C:WINDOWSsystem32Ati2evxx.exe
O23 — Service: ATK Keyboard Service (ATKKeyboardService) — ASUSTeK COMPUTER INC. — C:WINDOWSATKKBService.exe
O23 — Service: Kaspersky Anti-Virus (AVP) — Kaspersky Lab — C:Program FilesKaspersky LabKaspersky Anti-Virus 2010avp.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Служба Google Update (gupdate1cabc33e007412a) (gupdate1cabc33e007412a) — Google Inc. — C:Program FilesGoogleUpdateGoogleUpdate.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe

—
End of file — 10155 bytes

======Scheduled tasks folder======

C:WINDOWStasksGoogleUpdateTaskMachineCore.job
C:WINDOWStasksGoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class — C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}]
C:PROGRA~1Crawlerctbr.dll [2007-09-20 1133056]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class — C:Program FilesKaspersky LabKaspersky Anti-Virus 2010ievkbd.dll [2009-10-20 68112]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class — C:Program FilesJavajre1.6.0_06binssv.dll [2008-03-25 509328]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{8984B388-A5BB-4DF7-B274-77B879E179DB}]
MailRuBHO Class — C:Program FilesMail.RuSputnikMailRuSputnik.dll [2008-07-10 623304]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{DFBA2295-8003-451E-B841-48C41484E20F}]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{E33CF602-D945-461A-83F0-819F76A199F8}]
FilterBHO Class — C:Program FilesKaspersky LabKaspersky Anti-Virus 2010klwtbbho.dll [2009-10-20 268816]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{09900DE8-1DCA-443F-9243-26FF581438AF} — Спутник@Mail.Ru — C:Program FilesMail.RuSputnikMailRuSputnik.dll [2008-07-10 623304]
{4B3803EA-5230-4DC3-A7FC-33638F3D3542} — &Crawler Toolbar — C:PROGRA~1Crawlerctbr.dll [2007-09-20 1133056]
{468CD8A9-7C25-45FA-969E-3D925C689DC4} — Rambler-Ассистент — C:Program FilesRambler AssistantramblertoolbarU1.dll [2008-12-26 849392]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«AmlMaple»=C:Program FilesAmlMapleAmlMaple.exe [2008-04-25 91648]
«SoundMAXPnP»=C:Program FilesAnalog DevicesCoresmax4pnp.exe [2006-05-01 843776]
«JMB36X Configure»=C:WINDOWSsystem32JMRaidTool.exe [2006-06-02 385024]
«ATICCC»=C:Program FilesATI TechnologiesATI.ACEcli.exe [2005-08-12 45056]
«Samsung Common SM»=C:WINDOWSSamsungComSMMgrssmmgr.exe [2005-07-03 372736]
«NeroFilterCheck»=C:WINDOWSsystem32NeroCheck.exe [2006-01-12 155648]
«MAgent»=C:для софтовMAgent.exe [2008-07-10 3110392]
«TkBellExe»=C:Program FilesCommon FilesRealUpdate_OBrealsched.exe [2010-03-05 202256]
«avp»=C:Program FilesKaspersky LabKaspersky Anti-Virus 2010avp.exe [2009-10-20 340456]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=C:WINDOWSsystem32ctfmon.exe [2008-05-20 30208]
«VistaIcon»=C:Program FilesVistaDriveIconVistaDrv.exe [2008-01-02 132096]
«LClock»=C:Program FilesLClockLClock.exe [2007-12-14 86016]
«Punto Switcher»=C:Program FilesPunto Switcherps.exe [2007-11-14 201728]
«AdobeUpdater»=C:Program FilesCommon FilesAdobeUpdater5AdobeUpdater.exe []
«ICQ»=C:PROGRA~1ICQ6ICQ.exe silent []
«uTorrent»=D:графикаuTorrentutorrent.exe [2009-03-16 270128]

C:Documents and SettingsAll UsersГлавное менюПрограммыАвтозагрузка
Adobe Reader Speed Launch.lnk — C:Program FilesAdobeAcrobat 7.0Readerreader_sl.exe

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyAtiExtEvent]
C:WINDOWSsystem32Ati2evxx.dll [2005-12-12 47104]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyklogon]
C:WINDOWSsystem32klogon.dll [2009-10-20 219664]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32wpdshserviceobj.dll [2008-03-02 133632]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalPEVSystemStart]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalprocexp90.Sys]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkPEVSystemStart]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkprocexp90.Sys]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«DisableTaskMgr»=0

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=323
«NoSharedDocuments»=1
«NoSMConfigurePrograms»=1
«NoDriveAutoRun»=67108863
«NoDrives»=0

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveAutoRun»=
«NoDriveTypeAutoRun»=
«NoDrives»=

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Documents and SettingsAll UsersApplication DataKaspersky Lab Setup FilesKaspersky Anti-Virus 7.0.1.325Russiansetup.exe»=»C:Documents and SettingsAll UsersApplication DataKaspersky Lab Setup FilesKaspersky Anti-Virus 7.0.1.325Russiansetup.exe:*:Enabled:Программа установки Антивируса Касперского 7.0»
«C:Program FileseMuleemule.exe»=»C:Program FileseMuleemule.exe:*:Enabled:eMule»
«C:Program FilesKaspersky LabKaspersky Internet Security 7.0avp.exe»=»C:Program FilesKaspersky LabKaspersky Internet Security 7.0avp.exe:*:Enabled:Kaspersky Anti-Virus»
«C:Program FilesTotal CommanderTOTALCMD.EXE»=»C:Program FilesTotal CommanderTOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows»
«C:Program FilesOperaopera.exe»=»C:Program FilesOperaopera.exe:*:Enabled:Opera Internet Browser»
«D:графикаuTorrentutorrent.exe»=»D:графикаuTorrentutorrent.exe:*:Enabled:µTorrent»
«C:Documents and SettingsAll UsersApplication DataKaspersky Lab Setup FilesKaspersky Internet Security 7.0.1.325Russiansetup.exe»=»C:Documents and SettingsAll UsersApplication DataKaspersky Lab Setup FilesKaspersky Internet Security 7.0.1.325Russiansetup.exe:*:Enabled:Программа установки Kaspersky Internet Security 7.0»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»

======List of files/folders created in the last 1 months======

2010-06-17 22:08:58 —-D—- C:_OTM
2010-06-15 19:22:27 —-D—- C:Program FilesCommon FilesOpera
2010-06-12 00:56:46 —-D—- C:Program FilesCommon FilesAgent
2010-06-06 22:36:27 —-D—- C:Program FilesCommon FilesFirefox
2010-06-05 20:48:12 —-D—- C:WINDOWSsystem32PreInstall
2010-06-05 20:48:10 —-HDC—- C:WINDOWS$NtUninstallKB898461$
2010-06-05 20:43:18 —-D—- C:WINDOWSsystem32SoftwareDistribution
2010-06-02 00:36:55 —-D—- C:Documents and SettingsAdminApplication DataMalwarebytes
2010-06-02 00:36:44 —-D—- C:Documents and SettingsAll UsersApplication DataMalwarebytes
2010-06-02 00:36:43 —-D—- C:Program FilesMalwarebytes’ Anti-Malware
2010-05-31 16:01:30 —-D—- C:rsit

======List of files/folders modified in the last 1 months======

2010-06-17 22:22:04 —-D—- C:Program Filestrend micro
2010-06-17 22:19:54 —-D—- C:WINDOWStemp
2010-06-17 22:19:54 —-D—- C:Documents and SettingsAll UsersApplication DataKaspersky Lab
2010-06-17 22:19:38 —-D—- C:WINDOWS
2010-06-17 22:12:37 —-D—- C:WINDOWSsystem32
2010-06-17 22:06:15 —-D—- C:WINDOWSsystem32CatRoot2
2010-06-17 22:01:38 —-D—- C:Documents and SettingsAdminApplication DatauTorrent
2010-06-17 15:30:46 —-A—- C:WINDOWSSchedLgU.Txt
2010-06-17 11:54:12 —-A—- C:WINDOWSNeroDigital.ini
2010-06-16 22:30:59 —-HD—- C:WINDOWS$hf_mig$
2010-06-16 22:29:32 —-D—- C:WINDOWSsystem32Restore
2010-06-15 19:22:27 —-D—- C:Program FilesCommon Files
2010-06-13 11:58:18 —-HD—- C:WINDOWSinf
2010-06-13 11:55:43 —-D—- C:WINDOWSsystem32CatRoot
2010-06-07 18:58:14 —-D—- C:WINDOWSsystem32drivers
2010-06-07 18:58:14 —-D—- C:WINDOWSResources
2010-06-06 11:18:25 —-RSHDC—- C:WINDOWSsystem32dllcache
2010-06-05 20:43:20 —-D—- C:WINDOWSHelp
2010-06-02 00:54:45 —-RD—- C:Program Files
2010-06-02 00:54:45 —-D—- C:WINDOWStwain_32
2010-05-31 13:11:28 —-D—- C:WINDOWSNetwork Diagnostic
2010-05-31 00:55:21 —-SHD—- C:System Volume Information
2010-05-19 17:47:40 —-D—- C:Program FilesEA GAMES

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 asuskbnt;Enhanced Display Driver Helper Service; C:WINDOWSsystem32driversatkkbnt.sys [2005-10-18 11008]
R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2008-04-15 40704]
R1 kbdhid;Драйвер клавиатуры HID; C:WINDOWSsystem32DRIVERSkbdhid.sys [2008-04-15 14720]
R1 kl1;Kl1; ??C:WINDOWSsystem32driverskl1.sys []
R1 KLIF;Kaspersky Lab Driver; C:WINDOWSsystem32DRIVERSklif.sys [2010-03-15 315408]
R1 prodrv06;StarForce Protection Environment Driver v6; C:WINDOWSSystem32driversprodrv06.sys [2004-07-06 79232]
R1 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:WINDOWSSystem32driversws2ifsl.sys [2008-04-15 12032]
R2 DgiVecp;Team MFP Comm Driver; C:WINDOWSSystem32DriversDgiVecp.sys [2005-03-14 41984]
R2 EIO;EIO; ??C:WINDOWSsystem32driversEIO.sys []
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:WINDOWSsystem32driversADIHdAud.sys [2006-05-02 229376]
R3 AEAudio;AE Audio Service; C:WINDOWSsystem32driversAEAudio.sys [2006-04-27 93824]
R3 ati2mtag;ati2mtag; C:WINDOWSsystem32DRIVERSati2mtag.sys [2005-12-12 1414656]
R3 HDAudBus;Драйвер шины Microsoft UAA для High Definition Audio; C:WINDOWSsystem32DRIVERSHDAudBus.sys [2008-04-15 144384]
R3 hidusb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2008-04-15 10368]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:WINDOWSsystem32DRIVERSklim5.sys [2009-09-14 32272]
R3 klmouflt;Kaspersky Lab KLMOUFLT; C:WINDOWSsystem32DRIVERSklmouflt.sys [2009-10-02 19472]
R3 mouhid;Драйвер мыши HID; C:WINDOWSsystem32DRIVERSmouhid.sys [2008-04-15 12160]
R3 MTsensor;ATK0110 ACPI UTILITY; C:WINDOWSsystem32DRIVERSASACPI.sys [2004-08-13 5810]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:WINDOWSsystem32DRIVERSRtenicxp.sys [2006-07-27 83712]
R3 SenFiltService;SenFilt Service; C:WINDOWSsystem32driversSenfilt.sys [2006-03-17 392960]
R3 USB_RNDIS;Arris Remote NDIS Network Device Driver; C:WINDOWSsystem32DRIVERSusb8023.sys [2008-04-15 12800]
R3 usbccgp;Драйвер универсального родительского устройства USB (Microsoft); C:WINDOWSsystem32DRIVERSusbccgp.sys [2008-05-20 32384]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2008-05-20 30336]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2008-05-20 59520]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2008-05-20 20608]
S3 catchme;catchme; ??C:DOCUME~1AdminLOCALS~1Tempcatchme.sys []
S3 usbprint;Класс принтеров Microsoft USB; C:WINDOWSsystem32DRIVERSusbprint.sys [2008-05-20 25856]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2008-05-20 26368]
S3 WudfPf;Windows Driver Foundation — User-mode Driver Framework Platform Driver; C:WINDOWSsystem32DRIVERSWudfPf.sys [2008-03-02 77568]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2008-03-02 82944]
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:WINDOWSsystem32Ati2evxx.exe [2005-12-12 393216]
R2 ATKKeyboardService;ATK Keyboard Service; C:WINDOWSATKKBService.exe [2005-10-18 241152]
R2 AVP;Kaspersky Anti-Virus; C:Program FilesKaspersky LabKaspersky Anti-Virus 2010avp.exe [2009-10-20 340456]
S2 gupdate1cabc33e007412a;Служба Google Update (gupdate1cabc33e007412a); C:Program FilesGoogleUpdateGoogleUpdate.exe [2010-03-05 133104]
S3 Adobe LM Service;Adobe LM Service; C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe [2009-09-14 72704]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2007-10-24 70144]
S3 odserv;Microsoft Office Diagnostics Service; C:Program FilesCommon FilesMicrosoft SharedOFFICE12ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:Program FilesWindows Media Playerwmpnetwk.exe [2006-10-18 913408]
S3 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2008-04-15 14336]

EOF
17 июня, 2010 в 6:22 пп в ответ на: Помогите удалить информер #29726
Osa
Participant
- Темы:3
- Сообщений:12
Свежие логи

All processes killed
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{DFBA2295-8003-451E-B841-48C41484E20F} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{DFBA2295-8003-451E-B841-48C41484E20F} not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: Admin
->Temp folder emptied: 512915470 bytes
->Temporary Internet Files folder emptied: 145940740 bytes
->Java cache emptied: 38225 bytes
->FireFox cache emptied: 16358291 bytes
->Google Chrome cache emptied: 5876372 bytes
->Opera cache emptied: 159370695 bytes
->Flash cache emptied: 85779 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33392 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2339456 bytes
%systemroot%System32 .tmp files removed: 5709 bytes
%systemroot%System32dllcache .tmp files removed: 0 bytes
%systemroot%System32drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1253596880 bytes
%systemroot%system32configsystemprofileLocal SettingsTemp folder emptied: 0 bytes
%systemroot%system32configsystemprofileLocal SettingsTemporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 49196191 bytes

Total Files Cleaned = 2 046,00 mb

OTM by OldTimer — Version 3.1.12.2 log created on 06172010_220858
1 июня, 2010 в 9:02 пп в ответ на: Блокируются сайты #29590
Osa
Participant
- Темы:3
- Сообщений:12
пришлось разделить на 2 сообщения

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes74.54.130.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes74.54.139.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes74.54.46.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes74.55.40.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes74.55.74.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes74.86.125.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes74.86.232.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes75.125.185.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes75.125.189.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes75.125.212.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes75.125.29.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes75.125.43.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes75.125.82.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes78.108.86.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes78.137.164.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes78.47.87.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes79.125.5.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes80.153.193.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes80.190.130.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes80.190.154.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes80.237.132.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes80.86.107.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes81.176.66.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes81.176.67.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes81.177.31.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes81.24.35.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes82.117.238.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes82.151.107.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes82.165.103.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes82.98.86.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes83.102.130.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes83.202.175.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes83.222.23.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes83.222.31.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes83.223.117.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes84.40.30.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes85.12.57.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes85.17.210.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes85.214.106.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes85.255.19.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes85.31.222.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes87.106.242.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes87.106.254.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes87.230.79.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes87.238.48.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes87.242.72.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes87.242.74.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes87.242.75.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes87.242.79.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes88.221.119.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes89.108.66.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes89.111.176.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes89.202.149.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes89.202.157.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes90.156.159.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes90.183.101.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes91.121.97.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes91.199.212.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes91.209.196.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes92.123.155.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes92.53.106.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes93.184.71.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes93.191.13.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes94.23.206.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes94.236.0.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes95.140.225.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.

Объекты реестра заражены:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterUpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Зараженные папки:
C:Program FilesBitAccelerator (Trojan.BHO) -> Quarantined and deleted successfully.
C:Program FilesFunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesFunWebProductsScreenSaver (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesFunWebProductsScreenSaverImages (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearch (Adware.MyWebSearch) -> Delete on reboot.
C:Program FilesMyWebSearchbar (Adware.MyWebSearch) -> Delete on reboot.
C:Program FilesMyWebSearchbar1.bin (Adware.MyWebSearch) -> Delete on reboot.
C:Program FilesMyWebSearchbar1.binchrome (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbarAvatar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbarGame (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbaricons (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbarMessage (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbarNotifier (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbarSettings (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Documents and SettingsAll UsersГлавное менюПрограммыBitAccelerator (Trojan.BHO) -> Quarantined and deleted successfully.

Зараженные файлы:
C:Program FilesMyWebSearchbar1.binMWSOESTB.DLL (Adware.MyWebSearch) -> Delete on reboot.
C:Program FilesMyWebSearchbar1.binMWSOEMON.EXE (Adware.MyWebSearch) -> Delete on reboot.
C:Program FilesMyWebSearchbar1.binM3SRCHMN.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binF3DTACTL.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binF3HISTSW.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binF3HTMLMU.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binF3POPSWT.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binM3MSG.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binM3HTML.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binM3OUTLCN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binM3SKIN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binMWSBAR.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binF3SCRCTR.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binMWSSRCAS.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binF3CJPEG.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binF3HTTPCT.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binF3REPROX.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binMWSOEPLG.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMozilla FirefoxpluginsNPMyWebS.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:WINDOWSinnounp.exe (Malware.Packer) -> Quarantined and deleted successfully.
C:Program FilesBitAcceleratorBitAccelerator.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:Program FilesBitAcceleratorBitAccelerator.exe (Trojan.BHO) -> Quarantined and deleted successfully.
C:Program FilesBitAcceleratorUninstall.exe (Trojan.BHO) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binCHROME.MANIFEST (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binF3BKGERR.JPG (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binF3HKSTUB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binF3IMSTUB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binF3PSSAVR.SCR (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binF3REGHK.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binF3RESTUB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binF3SCHMON.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binF3SPACER.WMV (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binF3WALLPP.DAT (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binF3WPHOOK.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binFWPBUDDY.PNG (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binINSTALL.RDF (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binM3AUXSTB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binM3DLGHK.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binM3HIGHIN.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binM3IDLE.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binM3IMPIPE.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binM3MEDINT.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binM3PLUGIN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binM3SKPLAY.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binM3SLSRCH.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binMWSMLBTN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binMWSSVC.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binMWSUABTN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binNPMYWEBS.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbar1.binchromeM3FFXTBR.JAR (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbarAvatarCOMMON.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbarGameCHECKERS.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbarGameCHESS.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbarGameREVERSI.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbariconsCM.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbariconsMFC.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbariconsPSS.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbariconsSMILEY.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbariconsWB.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbariconsZWINKY.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbarMessageCOMMON.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbarNotifierCOMMON.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbarNotifierDOG.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbarNotifierFISH.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbarNotifierKUNGFU.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbarNotifierLIFEGARD.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbarNotifierMAID.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbarNotifierMAILBOX.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbarNotifierOPERA.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbarNotifierROBOT.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbarNotifierSEDUCT.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbarNotifierSURFER.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Program FilesMyWebSearchbarSettingss_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:Documents and SettingsAll UsersГлавное менюПрограммыBitAcceleratorBitAccelerator.lnk (Trojan.BHO) -> Quarantined and deleted successfully.
C:Documents and SettingsAll UsersГлавное менюПрограммыBitAcceleratorUninstall.lnk (Trojan.BHO) -> Quarantined and deleted successfully.
C:Program FilesCommon Fileskeylog.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:WINDOWSsystem32f3PSSavr.scr (Trojan.Agent) -> Quarantined and deleted successfully.
1 июня, 2010 в 9:01 пп в ответ на: Блокируются сайты #29589
Osa
Participant
- Темы:3
- Сообщений:12
Malwarebytes’ Anti-Malware 1.46
http://www.malwarebytes.org

Версия базы данных: 4161

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

02.06.10 0:52:48
mbam-log-2010-06-02 (00-52-48).txt

Тип сканирования: Быстрое сканирование
Просканированные объекты: 116456
Времени прошло: 9 минут, 51 секунд

Зараженные процессы в памяти: 0
Зараженные модули в памяти: 0
Зараженные ключи в реестре: 155
Зараженные параметры в реестре: 210
Объекты реестра заражены: 1
Зараженные папки: 15
Зараженные файлы: 77

Зараженные процессы в памяти:
(Вредоносных программ не обнаружено)

Зараженные модули в памяти:
(Вредоносных программ не обнаружено)

Зараженные ключи в реестре:
HKEY_CLASSES_ROOTbitaccelerator.bitaccelerator.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTfunwebproducts.datacontrol (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTTypeLib{c8cecde3-1ae1-4c4a-ad82-6d5b00212144} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{17de5e5e-bfe3-4e83-8e1f-8755795359ec} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{1f52a5fa-a705-4415-b975-88503b291728} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{a626cdbd-3d13-4f78-b819-440a28d7e8fc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExtPreApproved{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTfunwebproducts.datacontrol.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTfunwebproducts.historykillerscheduler (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTTypeLib{8ca01f0e-987c-49c3-b852-2f1ac4a7094c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{1093995a-ba37-41d2-836e-091067c4ad17} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{120927bf-1700-43bc-810f-fab92549b390} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{247a115f-06c2-4fb3-967d-2d62d3cf4f0a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{3e53e2cb-86db-4a4a-8bd9-ffeb7a64df82} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{90449521-d834-4703-bb4e-d3aa44042ff8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{991aac62-b100-47ce-8b75-253965244f69} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{bbabdc90-f3d5-4801-863a-ee6ae529862d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{d6ff3684-ad3b-48eb-bbb4-b9e6c5a355c1} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{eb9e5c1c-b1f9-4c2b-be8a-27d6446fdaf8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{0f8ecf4f-3646-4c3a-8881-8e138ffcaf70} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{b813095c-81c0-4e40-aa14-67520372b987} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{c9d7be3e-141a-4c85-8cd6-32461f3df2c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{cff4ce82-3aa2-451f-9b77-7165605fb835} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTfunwebproducts.historykillerscheduler.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTfunwebproducts.historyswattercontrolbar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTfunwebproducts.historyswattercontrolbar.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTfunwebproducts.htmlmenu (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTTypeLib{e47caee0-deea-464a-9326-3f2801535a4d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{3e1656ed-f60e-4597-b6aa-b6a58e171495} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExtPreApproved{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{98d9753d-d73b-42d5-8c85-4469cda897ab} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExtPreApproved{98d9753d-d73b-42d5-8c85-4469cda897ab} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTfunwebproducts.htmlmenu.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTfunwebproducts.htmlmenu.2 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTfunwebproducts.iecookiesmanager (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTfunwebproducts.iecookiesmanager.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTfunwebproducts.killerobjmanager (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTfunwebproducts.killerobjmanager.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTfunwebproducts.popswatterbarbutton (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTTypeLib{8e6f1830-9607-4440-8530-13be7c4b1d14} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{63d0ed2b-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{63d0ed2d-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExtPreApproved{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{8e6f1832-9607-4440-8530-13be7c4b1d14} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{a9571378-68a1-443d-b082-284f960c6d17} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTfunwebproducts.popswatterbarbutton.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTfunwebproducts.popswattersettingscontrol (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTfunwebproducts.popswattersettingscontrol.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTmywebsearch.chatsessionplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTTypeLib{e79dfbc0-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{72ee7f04-15bd-4845-a005-d6711144d86a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{e79dfbc9-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{e79dfbcb-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExtPreApproved{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTmywebsearch.chatsessionplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTmywebsearch.htmlpanel (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTTypeLib{3e720450-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{3e720451-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{3e720453-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{3e720452-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExtPreApproved{3e720452-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTmywebsearch.htmlpanel.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTmywebsearch.outlookaddin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{adb01e81-3c79-4272-a0f1-7b2be7a782dc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTmywebsearch.outlookaddin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTmywebsearch.pseudotransparentplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTTypeLib{7473d290-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{7473d291-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{7473d293-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{7473d295-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{7473d297-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{7473d292-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExtPreApproved{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{7473d296-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTmywebsearch.pseudotransparentplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTmywebsearchtoolbar.settingsplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTTypeLib{07b18ea0-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{07b18eaa-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{07b18eac-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{f87d7fb5-9dc5-4c8c-b998-d8dfe02e2978} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtSettings{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtSettings{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExtPreApproved{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{53ced2d0-5e9a-4761-9005-648404e6f7e5} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTmywebsearchtoolbar.settingsplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTmywebsearchtoolbar.toolbarplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTmywebsearchtoolbar.toolbarplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTscreensavercontrol.screensaverinstaller (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTTypeLib{29d67d3c-509a-4544-903f-c8c1b8236554} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{2e3537fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{938aa51a-996c-4884-98ce-80dd16a5c9da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExtPreApproved{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTscreensavercontrol.screensaverinstaller.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{6e74766c-4d93-4cc0-96d1-47b8e07ff9ca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{de38c398-b328-4f4c-a3ad-1b5e4ed93477} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{e342af55-b78a-4cd0-a2bb-da7f52d9d25e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{e342af55-b78a-4cd0-a2bb-da7f52d9d25f} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtSettings{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{00a6faf6-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{1e0de227-5ce4-4ea3-ab0c-8b03e1aa76bc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{84da4fdf-a1cf-4195-8688-3e961f505983} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{a4730ebe-43a6-443e-9776-36915d323ad3} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{d9fffb27-d62a-4d64-8cec-1ff006528805} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTTypeLib{0d26bc71-a633-4e71-ad31-eadc3a1b6a3a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTTypelib{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTTypelib{f42228fb-e84e-479e-b922-fbbd096e792c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USERSOFTWAREMicrosoftInternet ExplorerSearchScopes{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{072039ab-2117-4ed5-a85f-9b9eb903e021} (Adware.CWS) -> Quarantined and deleted successfully.
HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{1e0de227-5ce4-4ea3-ab0c-8b03e1aa76bc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerLow RightsElevationPolicy{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerLow RightsElevationPolicy{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerLow RightsElevationPolicy{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerLow RightsElevationPolicy{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerLow RightsElevationPolicy{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerLow RightsElevationPolicy{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerSearchScopes{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall{b87b54f6-7cd5-45b2-b873-3f95c558768a} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{799391d3-eb86-4bac-9bd3-cbfea58a0e15} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTCLSID{d858dafc-9573-4811-b323-7011a3aa7e61} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTmywebsearch.multiplebutton (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTmywebsearch.multiplebutton.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTmywebsearch.urlalertbutton (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTmywebsearch.urlalertbutton.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTxvideoplugin.jetmimefiltr.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTxvideoplugin.jetvideoplugin.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USERSOFTWAREBitAccelerator (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USERSOFTWAREFun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USERSOFTWAREMyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREFocusInteractive (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREFun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerLow RightsRunDll32Policyf3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftMultimediaWMPlayerSchemesf3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftOfficeOutlookAddinsMyWebSearch.OutlookAddin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftOfficeWordAddinsMyWebSearch.OutlookAddin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallMyWebSearch bar Uninstall (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMozillaPlugins@mywebsearch.com/Plugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesMyWebSearchService (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Зараженные параметры в реестре:
HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRunmywebsearch email plugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunmywebsearch email plugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunmy web search bar search scope monitor (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USERSOFTWAREMicrosoftInternet ExplorerURLSearchHooks{00a6faf6-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows MediaWMSDKSourcesf3popularscreensavers (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsUser AgentPost Platformfunwebproducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftoption_1 (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftoption_2 (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftoption_3 (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes128.111.48.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes128.130.56.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes128.130.60.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes139.91.222.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes141.202.248.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes149.101.225.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes150.70.93.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes155.35.248.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes162.40.10.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes165.160.15.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes166.70.98.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes174.120.184.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes174.120.185.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes174.120.186.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes174.133.38.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes18.85.2.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes188.40.74.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes188.93.8.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes192.150.94.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes193.0.6.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes193.1.193.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes193.110.109.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes193.17.85.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes193.193.194.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes193.24.237.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes193.66.251.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes193.69.114.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes193.71.68.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes194.0.200.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes194.109.142.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes194.112.106.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes194.206.126.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes194.33.180.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes195.137.160.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes195.146.235.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes195.2.240.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes195.210.42.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes195.55.72.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes195.64.225.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes195.70.37.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes198.6.49.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes199.203.243.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes203.160.188.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes204.14.90.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes205.178.145.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes205.227.136.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes206.204.52.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes207.44.154.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes207.44.254.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes207.46.18.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes207.46.20.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes207.46.232.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes207.66.0.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes208.43.44.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes208.43.71.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes208.79.250.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes209.124.55.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes209.157.69.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes209.160.22.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes209.216.46.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes209.51.167.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes209.62.112.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes209.62.68.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes209.87.209.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes212.47.219.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes212.67.88.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes212.72.62.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes212.8.79.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes213.133.34.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes213.171.218.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes213.198.89.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes213.220.100.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes213.31.172.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes216.10.192.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes216.12.145.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes216.239.122.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes216.246.90.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes216.49.88.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes216.49.94.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes216.55.183.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes216.99.133.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes217.106.234.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes217.16.16.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes217.170.21.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes217.174.103.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes38.113.1.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes62.14.249.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes62.146.210.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes62.146.66.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes62.189.194.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes62.213.110.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes62.75.163.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes62.75.216.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes63.85.36.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes64.128.133.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes64.13.134.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes64.202.189.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes64.246.4.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes64.41.142.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes64.41.151.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes64.66.190.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes64.78.182.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes65.175.38.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes65.55.184.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes65.55.240.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes66.223.50.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes66.249.17.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes66.77.70.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes67.134.208.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes67.15.103.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes67.15.231.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes67.19.34.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes67.192.135.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes67.225.206.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes67.227.172.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes68.177.102.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes69.162.79.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes69.18.148.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes69.20.104.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes69.57.142.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes69.93.226.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes70.84.211.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes72.232.246.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes72.3.254.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes72.32.125.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes72.32.149.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes72.32.70.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes74.125.77.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes74.208.158.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes74.208.20.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes74.50.0.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes74.52.233.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes74.53.201.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersPersistentRoutes74.53.70.0,255.255.255.0,77.241.36.0,1 (TCPRoute.Hijack) -> Quarantined and deleted successfully.
1 июня, 2010 в 9:00 пп в ответ на: Блокируются сайты #29586
Osa
Participant
- Темы:3
- Сообщений:12
Logfile of random’s system information tool 1.07 (written by random/random)
Run by Admin at 2010-06-02 00:58:39
Microsoft Windows XP Professional Service Pack 3
System drive C: has 11 GB (42%) free of 25 GB
Total RAM: 1023 MB (60% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0:59:37, on 02.06.10
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSATKKBService.exe
C:Program FilesKaspersky LabKaspersky Anti-Virus 2010avp.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:Program FilesAmlMapleAmlMaple.exe
C:Program FilesAnalog DevicesCoresmax4pnp.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:WINDOWSSamsungComSMMgrssmmgr.exe
C:Program FilesCommon FilesRealUpdate_OBrealsched.exe
C:Program FilesKaspersky LabKaspersky Anti-Virus 2010avp.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesVistaDriveIconVistaDrv.exe
C:Program FilesLClockLClock.exe
C:Program FilesPunto Switcherps.exe
D:графикаuTorrentutorrent.exe
C:Program FilesAdobeAcrobat 7.0Readerreader_sl.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:WINDOWSsystem32wuauclt.exe
C:WINDOWSsystem32wscntfy.exe
C:Program Filesinternet exploreriexplore.exe
C:Program Filesinternet exploreriexplore.exe
C:Documents and SettingsAdminРабочий столRSIT.exe
C:Program Filestrend microAdmin.exe

R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://home.mywebsearch.com/index.jhtml?n=77C09F4F&ptnrS=ZCman000&ptb=gj8ua39Oubb9yCCezo5B_w
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=66016
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66016
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKCUSoftwareMicrosoftInternet Connection Wizard,ShellNext = http://www.kornet.ru/
R1 — HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *.local
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: (no name) — {83821C2B-32A8-4DD7-B6D4-44309A78E668} — C:для софтовMradllnewmrasearch.dll
R3 — URLSearchHook: (no name) — {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} — C:PROGRA~1Crawlerctbr.dll
F2 — REG:system.ini: UserInit=C:WINDOWSsystem32userinit.exe,\?globalrootsystemrootsystem32vadRqAd.exe,\?globalrootsystemrootsystem3225cyBrV.exe,
O2 — BHO: AcroIEHlprObj Class — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll
O2 — BHO: (no name) — {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} — C:PROGRA~1Crawlerctbr.dll
O2 — BHO: IEVkbdBHO — {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} — C:Program FilesKaspersky LabKaspersky Anti-Virus 2010ievkbd.dll
O2 — BHO: SSVHelper Class — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — C:Program FilesJavajre1.6.0_06binssv.dll
O2 — BHO: Спутник@Mail.Ru — {8984B388-A5BB-4DF7-B274-77B879E179DB} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O2 — BHO: xrhlibP — {DFBA2295-8003-451E-B841-48C41484E20F} — (no file)
O2 — BHO: link filter bho — {E33CF602-D945-461A-83F0-819F76A199F8} — C:Program FilesKaspersky LabKaspersky Anti-Virus 2010klwtbbho.dll
O3 — Toolbar: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O3 — Toolbar: &Crawler Toolbar — {4B3803EA-5230-4DC3-A7FC-33638F3D3542} — C:PROGRA~1Crawlerctbr.dll
O3 — Toolbar: Rambler-Ассистент — {468CD8A9-7C25-45FA-969E-3D925C689DC4} — C:Program FilesRambler AssistantramblertoolbarU1.dll
O4 — HKLM..Run: [AmlMaple] C:Program FilesAmlMapleAmlMaple.exe
O4 — HKLM..Run: [SoundMAXPnP] C:Program FilesAnalog DevicesCoresmax4pnp.exe
O4 — HKLM..Run: [JMB36X Configure] C:WINDOWSsystem32JMRaidTool.exe boot
O4 — HKLM..Run: [ATICCC] «C:Program FilesATI TechnologiesATI.ACEcli.exe» runtime -Delay
O4 — HKLM..Run: [Samsung Common SM] «C:WINDOWSSamsungComSMMgrssmmgr.exe» /autorun
O4 — HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 — HKLM..Run: [MAgent] C:для софтовMAgent.exe -LM
O4 — HKLM..Run: [TkBellExe] «C:Program FilesCommon FilesRealUpdate_OBrealsched.exe» -osboot
O4 — HKLM..Run: [avp] «C:Program FilesKaspersky LabKaspersky Anti-Virus 2010avp.exe»
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe
O4 — HKCU..Run: [LClock] C:Program FilesLClockLClock.exe
O4 — HKCU..Run: [Punto Switcher] C:Program FilesPunto Switcherps.exe
O4 — HKCU..Run: [AdobeUpdater] C:Program FilesCommon FilesAdobeUpdater5AdobeUpdater.exe
O4 — HKCU..Run: [ICQ] «C:PROGRA~1ICQ6ICQ.exe» silent
O4 — HKCU..Run: [uTorrent] «D:графикаuTorrentutorrent.exe»
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,NewUserFirstLogonInstall,0 (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — HKUS.DEFAULT..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,NewUserFirstLogonInstall,0 (User ‘Default user’)
O4 — Global Startup: Adobe Reader Speed Launch.lnk = C:Program FilesAdobeAcrobat 7.0Readerreader_sl.exe
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2Office12EXCEL.EXE/3000
O8 — Extra context menu item: Crawler Search — tbr:iemenu
O8 — Extra context menu item: Добавить в Rambler-Закладки — res://C:Program FilesRambler AssistantramblertoolbarU1.dll/zakladki.htm
O8 — Extra context menu item: Найти с помощью Рамблера — res://C:Program FilesRambler AssistantramblertoolbarU1.dll/search.htm
O8 — Extra context menu item: Перевести с помощью словарей Рамблера — res://C:Program FilesRambler AssistantramblertoolbarU1.dll/dic.htm
O8 — Extra context menu item: Поиск@Mail.Ru — res://C:Program FilesMail.RuSputnikMailRuSputnik.dll/SEARCH.HTM
O8 — Extra context menu item: Словари@Mail.Ru — res://C:Program FilesMail.RuSputnikMailRuSputnik.dll/TRANSLATE.HTM
O9 — Extra button: (no name) — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_06binssv.dll
O9 — Extra ‘Tools’ menuitem: Sun Java Console — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_06binssv.dll
O9 — Extra button: &Виртуальная клавиатура — {4248FE82-7FCB-46AC-B270-339F08212110} — C:Program FilesKaspersky LabKaspersky Anti-Virus 2010klwtbbho.dll
O9 — Extra button: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:для софтовmagent.exe
O9 — Extra ‘Tools’ menuitem: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:для софтовmagent.exe
O9 — Extra button: Research — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2Office12REFIEBAR.DLL
O9 — Extra button: Проверка ссы&лок — {CCF151D8-D089-449F-A5A4-D9909053F20F} — C:Program FilesKaspersky LabKaspersky Anti-Virus 2010klwtbbho.dll
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O12 — Plugin for .spop: C:Program FilesInternet ExplorerPluginsNPDocBox.dll
O17 — HKLMSystemCCSServicesTcpip..{49D1CC09-93B8-441C-9124-06F88F91694A}: NameServer = 87.237.112.10,77.241.40.178
O18 — Protocol: tbr — {4D25FB7A-8902-4291-960E-9ADA051CFBBF} — C:PROGRA~1Crawlerctbr.dll
O23 — Service: Adobe LM Service — Adobe Systems — C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe
O23 — Service: Ati HotKey Poller — ATI Technologies Inc. — C:WINDOWSsystem32Ati2evxx.exe
O23 — Service: ATK Keyboard Service (ATKKeyboardService) — ASUSTeK COMPUTER INC. — C:WINDOWSATKKBService.exe
O23 — Service: Kaspersky Anti-Virus (AVP) — Kaspersky Lab — C:Program FilesKaspersky LabKaspersky Anti-Virus 2010avp.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Служба Google Update (gupdate1cabc33e007412a) (gupdate1cabc33e007412a) — Google Inc. — C:Program FilesGoogleUpdateGoogleUpdate.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe

—
End of file — 10049 bytes

======Scheduled tasks folder======

C:WINDOWStasksGoogleUpdateTaskMachineCore.job
C:WINDOWStasksGoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class — C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}]
C:PROGRA~1Crawlerctbr.dll [2007-09-20 1133056]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class — C:Program FilesKaspersky LabKaspersky Anti-Virus 2010ievkbd.dll [2009-10-20 68112]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class — C:Program FilesJavajre1.6.0_06binssv.dll [2008-03-25 509328]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{8984B388-A5BB-4DF7-B274-77B879E179DB}]
MailRuBHO Class — C:Program FilesMail.RuSputnikMailRuSputnik.dll [2008-07-10 623304]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{DFBA2295-8003-451E-B841-48C41484E20F}]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{E33CF602-D945-461A-83F0-819F76A199F8}]
FilterBHO Class — C:Program FilesKaspersky LabKaspersky Anti-Virus 2010klwtbbho.dll [2009-10-20 268816]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{09900DE8-1DCA-443F-9243-26FF581438AF} — Спутник@Mail.Ru — C:Program FilesMail.RuSputnikMailRuSputnik.dll [2008-07-10 623304]
{4B3803EA-5230-4DC3-A7FC-33638F3D3542} — &Crawler Toolbar — C:PROGRA~1Crawlerctbr.dll [2007-09-20 1133056]
{468CD8A9-7C25-45FA-969E-3D925C689DC4} — Rambler-Ассистент — C:Program FilesRambler AssistantramblertoolbarU1.dll [2008-12-26 849392]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«AmlMaple»=C:Program FilesAmlMapleAmlMaple.exe [2008-04-25 91648]
«SoundMAXPnP»=C:Program FilesAnalog DevicesCoresmax4pnp.exe [2006-05-01 843776]
«JMB36X Configure»=C:WINDOWSsystem32JMRaidTool.exe [2006-06-02 385024]
«ATICCC»=C:Program FilesATI TechnologiesATI.ACEcli.exe [2005-08-12 45056]
«Samsung Common SM»=C:WINDOWSSamsungComSMMgrssmmgr.exe [2005-07-03 372736]
«NeroFilterCheck»=C:WINDOWSsystem32NeroCheck.exe [2006-01-12 155648]
«MAgent»=C:для софтовMAgent.exe [2008-07-10 3110392]
«TkBellExe»=C:Program FilesCommon FilesRealUpdate_OBrealsched.exe [2010-03-05 202256]
«avp»=C:Program FilesKaspersky LabKaspersky Anti-Virus 2010avp.exe [2009-10-20 340456]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=C:WINDOWSsystem32ctfmon.exe [2008-05-20 30208]
«VistaIcon»=C:Program FilesVistaDriveIconVistaDrv.exe [2008-01-02 132096]
«LClock»=C:Program FilesLClockLClock.exe [2007-12-14 86016]
«Punto Switcher»=C:Program FilesPunto Switcherps.exe [2007-11-14 201728]
«AdobeUpdater»=C:Program FilesCommon FilesAdobeUpdater5AdobeUpdater.exe []
«ICQ»=C:PROGRA~1ICQ6ICQ.exe silent []
«uTorrent»=D:графикаuTorrentutorrent.exe [2009-03-16 270128]

C:Documents and SettingsAll UsersГлавное менюПрограммыАвтозагрузка
Adobe Reader Speed Launch.lnk — C:Program FilesAdobeAcrobat 7.0Readerreader_sl.exe

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyAtiExtEvent]
C:WINDOWSsystem32Ati2evxx.dll [2005-12-12 47104]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyklogon]
C:WINDOWSsystem32klogon.dll [2009-10-20 219664]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32wpdshserviceobj.dll [2008-03-02 133632]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalPEVSystemStart]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalprocexp90.Sys]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkPEVSystemStart]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkprocexp90.Sys]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«DisableTaskMgr»=0

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=323
«NoSharedDocuments»=1
«NoSMConfigurePrograms»=1
«NoDriveAutoRun»=67108863
«NoDrives»=0

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveAutoRun»=
«NoDriveTypeAutoRun»=
«NoDrives»=

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Documents and SettingsAll UsersApplication DataKaspersky Lab Setup FilesKaspersky Anti-Virus 7.0.1.325Russiansetup.exe»=»C:Documents and SettingsAll UsersApplication DataKaspersky Lab Setup FilesKaspersky Anti-Virus 7.0.1.325Russiansetup.exe:*:Enabled:Программа установки Антивируса Касперского 7.0»
«C:Program FileseMuleemule.exe»=»C:Program FileseMuleemule.exe:*:Enabled:eMule»
«C:Program FilesKaspersky LabKaspersky Internet Security 7.0avp.exe»=»C:Program FilesKaspersky LabKaspersky Internet Security 7.0avp.exe:*:Enabled:Kaspersky Anti-Virus»
«C:Program FilesTotal CommanderTOTALCMD.EXE»=»C:Program FilesTotal CommanderTOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows»
«C:Program FilesOperaopera.exe»=»C:Program FilesOperaopera.exe:*:Enabled:Opera Internet Browser»
«D:графикаuTorrentutorrent.exe»=»D:графикаuTorrentutorrent.exe:*:Enabled:µTorrent»
«C:Documents and SettingsAll UsersApplication DataKaspersky Lab Setup FilesKaspersky Internet Security 7.0.1.325Russiansetup.exe»=»C:Documents and SettingsAll UsersApplication DataKaspersky Lab Setup FilesKaspersky Internet Security 7.0.1.325Russiansetup.exe:*:Enabled:Программа установки Kaspersky Internet Security 7.0»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»

======List of files/folders created in the last 1 months======

2010-06-02 00:57:30 —-A—- C:Program FilesCommon Fileskeylog.txt
2010-06-02 00:56:47 —-A—- C:WINDOWSsystem32WZbVAQH.exe
2010-06-02 00:36:55 —-D—- C:Documents and SettingsAdminApplication DataMalwarebytes
2010-06-02 00:36:44 —-D—- C:Documents and SettingsAll UsersApplication DataMalwarebytes
2010-06-02 00:36:43 —-D—- C:Program FilesMalwarebytes’ Anti-Malware
2010-06-01 23:07:55 —-A—- C:WINDOWSsystem32rdRgZmk.exe
2010-06-01 22:43:39 —-A—- C:WINDOWSsystem32hQJsNui.exe
2010-06-01 13:03:09 —-A—- C:WINDOWSsystem32AhyVaPE.exe
2010-06-01 01:25:43 —-A—- C:WINDOWSsystem325obKvU0.exe
2010-05-31 16:01:30 —-D—- C:rsit
2010-05-31 13:08:05 —-A—- C:WINDOWSsystem32gGGdSNn.exe
2010-05-30 22:54:42 —-A—- C:WINDOWSsystem3225cyBrV.exe
2010-05-30 22:54:19 —-A—- C:WINDOWSsystem32vadRqAd.exe
2010-05-03 18:53:46 —-D—- C:Documents and SettingsAdminApplication DataDonationCoder
2010-05-03 18:53:15 —-D—- C:Documents and SettingsAll UsersApplication DataDonationCoder

======List of files/folders modified in the last 1 months======

2010-06-02 00:59:25 —-D—- C:Program Filestrend micro
2010-06-02 00:57:30 —-D—- C:Program FilesCommon Files
2010-06-02 00:56:47 —-D—- C:WINDOWSsystem32
2010-06-02 00:56:31 —-D—- C:WINDOWStemp
2010-06-02 00:56:26 —-D—- C:Documents and SettingsAll UsersApplication DataKaspersky Lab
2010-06-02 00:56:11 —-D—- C:WINDOWS
2010-06-02 00:54:45 —-RD—- C:Program Files
2010-06-02 00:54:45 —-D—- C:WINDOWSsystem32drivers
2010-06-02 00:54:13 —-A—- C:WINDOWSSchedLgU.Txt
2010-06-02 00:53:48 —-D—- C:Documents and SettingsAdminApplication DatauTorrent
2010-06-02 00:53:31 —-D—- C:WINDOWStwain_32
2010-06-01 18:57:14 —-A—- C:WINDOWSNeroDigital.ini
2010-06-01 15:35:41 —-D—- C:WINDOWSsystem32CatRoot2
2010-05-31 13:11:28 —-D—- C:WINDOWSNetwork Diagnostic
2010-05-31 00:55:21 —-SHD—- C:System Volume Information
2010-05-31 00:55:21 —-D—- C:WINDOWSsystem32Restore
2010-05-19 17:47:40 —-D—- C:Program FilesEA GAMES

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 asuskbnt;Enhanced Display Driver Helper Service; C:WINDOWSsystem32driversatkkbnt.sys [2005-10-18 11008]
R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2008-04-15 40704]
R1 kbdhid;Драйвер клавиатуры HID; C:WINDOWSsystem32DRIVERSkbdhid.sys [2008-04-15 14720]
R1 kl1;Kl1; ??C:WINDOWSsystem32driverskl1.sys []
R1 KLIF;Kaspersky Lab Driver; C:WINDOWSsystem32DRIVERSklif.sys [2010-03-15 315408]
R1 prodrv06;StarForce Protection Environment Driver v6; C:WINDOWSSystem32driversprodrv06.sys [2004-07-06 79232]
R1 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:WINDOWSSystem32driversws2ifsl.sys [2008-04-15 12032]
R2 DgiVecp;Team MFP Comm Driver; C:WINDOWSSystem32DriversDgiVecp.sys [2005-03-14 41984]
R2 EIO;EIO; ??C:WINDOWSsystem32driversEIO.sys []
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:WINDOWSsystem32driversADIHdAud.sys [2006-05-02 229376]
R3 AEAudio;AE Audio Service; C:WINDOWSsystem32driversAEAudio.sys [2006-04-27 93824]
R3 ati2mtag;ati2mtag; C:WINDOWSsystem32DRIVERSati2mtag.sys [2005-12-12 1414656]
R3 HDAudBus;Драйвер шины Microsoft UAA для High Definition Audio; C:WINDOWSsystem32DRIVERSHDAudBus.sys [2008-04-15 144384]
R3 hidusb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2008-04-15 10368]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:WINDOWSsystem32DRIVERSklim5.sys [2009-09-14 32272]
R3 klmouflt;Kaspersky Lab KLMOUFLT; C:WINDOWSsystem32DRIVERSklmouflt.sys [2009-10-02 19472]
R3 mouhid;Драйвер мыши HID; C:WINDOWSsystem32DRIVERSmouhid.sys [2008-04-15 12160]
R3 MTsensor;ATK0110 ACPI UTILITY; C:WINDOWSsystem32DRIVERSASACPI.sys [2004-08-13 5810]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:WINDOWSsystem32DRIVERSRtenicxp.sys [2006-07-27 83712]
R3 SenFiltService;SenFilt Service; C:WINDOWSsystem32driversSenfilt.sys [2006-03-17 392960]
R3 USB_RNDIS;Arris Remote NDIS Network Device Driver; C:WINDOWSsystem32DRIVERSusb8023.sys [2008-04-15 12800]
R3 usbccgp;Драйвер универсального родительского устройства USB (Microsoft); C:WINDOWSsystem32DRIVERSusbccgp.sys [2008-05-20 32384]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2008-05-20 30336]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2008-05-20 59520]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2008-05-20 20608]
S3 catchme;catchme; ??C:DOCUME~1AdminLOCALS~1Tempcatchme.sys []
S3 usbprint;Класс принтеров Microsoft USB; C:WINDOWSsystem32DRIVERSusbprint.sys [2008-05-20 25856]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2008-05-20 26368]
S3 WudfPf;Windows Driver Foundation — User-mode Driver Framework Platform Driver; C:WINDOWSsystem32DRIVERSWudfPf.sys [2008-03-02 77568]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2008-03-02 82944]
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:WINDOWSsystem32Ati2evxx.exe [2005-12-12 393216]
R2 ATKKeyboardService;ATK Keyboard Service; C:WINDOWSATKKBService.exe [2005-10-18 241152]
R2 AVP;Kaspersky Anti-Virus; C:Program FilesKaspersky LabKaspersky Anti-Virus 2010avp.exe [2009-10-20 340456]
S2 gupdate1cabc33e007412a;Служба Google Update (gupdate1cabc33e007412a); C:Program FilesGoogleUpdateGoogleUpdate.exe [2010-03-05 133104]
S3 Adobe LM Service;Adobe LM Service; C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe [2009-09-14 72704]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2007-10-24 70144]
S3 odserv;Microsoft Office Diagnostics Service; C:Program FilesCommon FilesMicrosoft SharedOFFICE12ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:Program FilesWindows Media Playerwmpnetwk.exe [2006-10-18 913408]
S3 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2008-04-15 14336]

EOF
31 мая, 2010 в 12:11 пп в ответ на: Блокируются сайты #29588
Osa
Participant
- Темы:3
- Сообщений:12
Logfile of random’s system information tool 1.07 (written by random/random)
Run by Admin at 2010-05-31 16:01:30
Microsoft Windows XP Professional Service Pack 3
System drive C: has 11 GB (42%) free of 25 GB
Total RAM: 1023 MB (54% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:02:36, on 31.05.10
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSATKKBService.exe
C:Program FilesKaspersky LabKaspersky Anti-Virus 2010avp.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:Program FilesAmlMapleAmlMaple.exe
C:Program FilesAnalog DevicesCoresmax4pnp.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:WINDOWSSamsungComSMMgrssmmgr.exe
C:Program FilesCommon FilesRealUpdate_OBrealsched.exe
C:Program FilesKaspersky LabKaspersky Anti-Virus 2010avp.exe
C:PROGRA~1MYWEBS~1bar1.binmwsoemon.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesVistaDriveIconVistaDrv.exe
C:Program FilesLClockLClock.exe
C:Program FilesPunto Switcherps.exe
D:графикаuTorrentutorrent.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:WINDOWSsystem32svchost.exe
C:Program Filesinternet exploreriexplore.exe
C:Program Filesinternet exploreriexplore.exe
C:Documents and SettingsAdminРабочий столRSIT.exe
C:Program Filestrend microAdmin.exe

R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://home.mywebsearch.com/index.jhtml?n=77C09F4F&ptnrS=ZCman000&ptb=gj8ua39Oubb9yCCezo5B_w
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=66016
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66016
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKCUSoftwareMicrosoftInternet Connection Wizard,ShellNext = http://www.kornet.ru/
R1 — HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *.local
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: (no name) — {83821C2B-32A8-4DD7-B6D4-44309A78E668} — C:для софтовMradllnewmrasearch.dll
R3 — URLSearchHook: (no name) — {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} — C:PROGRA~1Crawlerctbr.dll
R3 — URLSearchHook: (no name) — {00A6FAF6-072E-44cf-8957-5838F569A31D} — C:Program FilesMyWebSearchbar1.binMWSSRCAS.DLL
F2 — REG:system.ini: UserInit=C:WINDOWSsystem32userinit.exe,\?globalrootsystemrootsystem32vadRqAd.exe,\?globalrootsystemrootsystem3225cyBrV.exe,
O2 — BHO: MyWebSearch Search Assistant BHO — {00A6FAF1-072E-44cf-8957-5838F569A31D} — C:Program FilesMyWebSearchbar1.binMWSSRCAS.DLL
O2 — BHO: AcroIEHlprObj Class — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll
O2 — BHO: mwsBar BHO — {07B18EA1-A523-4961-B6BB-170DE4475CCA} — C:Program FilesMyWebSearchbar1.binMWSBAR.DLL
O2 — BHO: (no name) — {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} — C:PROGRA~1Crawlerctbr.dll
O2 — BHO: IEVkbdBHO — {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} — C:Program FilesKaspersky LabKaspersky Anti-Virus 2010ievkbd.dll
O2 — BHO: SSVHelper Class — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — C:Program FilesJavajre1.6.0_06binssv.dll
O2 — BHO: Спутник@Mail.Ru — {8984B388-A5BB-4DF7-B274-77B879E179DB} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O2 — BHO: xrhlibP — {DFBA2295-8003-451E-B841-48C41484E20F} — (no file)
O2 — BHO: link filter bho — {E33CF602-D945-461A-83F0-819F76A199F8} — C:Program FilesKaspersky LabKaspersky Anti-Virus 2010klwtbbho.dll
O3 — Toolbar: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O3 — Toolbar: &Crawler Toolbar — {4B3803EA-5230-4DC3-A7FC-33638F3D3542} — C:PROGRA~1Crawlerctbr.dll
O3 — Toolbar: Rambler-Ассистент — {468CD8A9-7C25-45FA-969E-3D925C689DC4} — C:Program FilesRambler AssistantramblertoolbarU1.dll
O3 — Toolbar: My Web Search — {07B18EA9-A523-4961-B6BB-170DE4475CCA} — C:Program FilesMyWebSearchbar1.binMWSBAR.DLL
O4 — HKLM..Run: [AmlMaple] C:Program FilesAmlMapleAmlMaple.exe
O4 — HKLM..Run: [SoundMAXPnP] C:Program FilesAnalog DevicesCoresmax4pnp.exe
O4 — HKLM..Run: [JMB36X Configure] C:WINDOWSsystem32JMRaidTool.exe boot
O4 — HKLM..Run: [ATICCC] «C:Program FilesATI TechnologiesATI.ACEcli.exe» runtime -Delay
O4 — HKLM..Run: [Samsung Common SM] «C:WINDOWSSamsungComSMMgrssmmgr.exe» /autorun
O4 — HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 — HKLM..Run: [MAgent] C:для софтовMAgent.exe -LM
O4 — HKLM..Run: [TkBellExe] «C:Program FilesCommon FilesRealUpdate_OBrealsched.exe» -osboot
O4 — HKLM..Run: [avp] «C:Program FilesKaspersky LabKaspersky Anti-Virus 2010avp.exe»
O4 — HKLM..Run: [My Web Search Bar Search Scope Monitor] «C:PROGRA~1MYWEBS~1bar1.binm3SrchMn.exe» /m=2 /w /h
O4 — HKLM..Run: [MyWebSearch Email Plugin] C:PROGRA~1MYWEBS~1bar1.binmwsoemon.exe
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe
O4 — HKCU..Run: [LClock] C:Program FilesLClockLClock.exe
O4 — HKCU..Run: [Punto Switcher] C:Program FilesPunto Switcherps.exe
O4 — HKCU..Run: [AdobeUpdater] C:Program FilesCommon FilesAdobeUpdater5AdobeUpdater.exe
O4 — HKCU..Run: [ICQ] «C:PROGRA~1ICQ6ICQ.exe» silent
O4 — HKCU..Run: [uTorrent] «D:графикаuTorrentutorrent.exe»
O4 — HKCU..Run: [MyWebSearch Email Plugin] C:PROGRA~1MYWEBS~1bar1.binmwsoemon.exe
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,NewUserFirstLogonInstall,0 (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — HKUS.DEFAULT..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,NewUserFirstLogonInstall,0 (User ‘Default user’)
O4 — Global Startup: Adobe Reader Speed Launch.lnk = C:Program FilesAdobeAcrobat 7.0Readerreader_sl.exe
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2Office12EXCEL.EXE/3000
O8 — Extra context menu item: Crawler Search — tbr:iemenu
O8 — Extra context menu item: Добавить в Rambler-Закладки — res://C:Program FilesRambler AssistantramblertoolbarU1.dll/zakladki.htm
O8 — Extra context menu item: Найти с помощью Рамблера — res://C:Program FilesRambler AssistantramblertoolbarU1.dll/search.htm
O8 — Extra context menu item: Перевести с помощью словарей Рамблера — res://C:Program FilesRambler AssistantramblertoolbarU1.dll/dic.htm
O8 — Extra context menu item: Поиск@Mail.Ru — res://C:Program FilesMail.RuSputnikMailRuSputnik.dll/SEARCH.HTM
O8 — Extra context menu item: Словари@Mail.Ru — res://C:Program FilesMail.RuSputnikMailRuSputnik.dll/TRANSLATE.HTM
O9 — Extra button: (no name) — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_06binssv.dll
O9 — Extra ‘Tools’ menuitem: Sun Java Console — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_06binssv.dll
O9 — Extra button: &Виртуальная клавиатура — {4248FE82-7FCB-46AC-B270-339F08212110} — C:Program FilesKaspersky LabKaspersky Anti-Virus 2010klwtbbho.dll
O9 — Extra button: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:для софтовmagent.exe
O9 — Extra ‘Tools’ menuitem: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:для софтовmagent.exe
O9 — Extra button: Research — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2Office12REFIEBAR.DLL
O9 — Extra button: Проверка ссы&лок — {CCF151D8-D089-449F-A5A4-D9909053F20F} — C:Program FilesKaspersky LabKaspersky Anti-Virus 2010klwtbbho.dll
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O12 — Plugin for .spop: C:Program FilesInternet ExplorerPluginsNPDocBox.dll
O17 — HKLMSystemCCSServicesTcpip..{49D1CC09-93B8-441C-9124-06F88F91694A}: NameServer = 87.237.112.10,77.241.40.178
O18 — Protocol: tbr — {4D25FB7A-8902-4291-960E-9ADA051CFBBF} — C:PROGRA~1Crawlerctbr.dll
O23 — Service: Adobe LM Service — Adobe Systems — C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe
O23 — Service: Ati HotKey Poller — ATI Technologies Inc. — C:WINDOWSsystem32Ati2evxx.exe
O23 — Service: ATK Keyboard Service (ATKKeyboardService) — ASUSTeK COMPUTER INC. — C:WINDOWSATKKBService.exe
O23 — Service: Kaspersky Anti-Virus (AVP) — Kaspersky Lab — C:Program FilesKaspersky LabKaspersky Anti-Virus 2010avp.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Служба Google Update (gupdate1cabc33e007412a) (gupdate1cabc33e007412a) — Google Inc. — C:Program FilesGoogleUpdateGoogleUpdate.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: My Web Search Service (MyWebSearchService) — MyWebSearch.com — C:PROGRA~1MYWEBS~1bar1.binmwssvc.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe

—
End of file — 10925 bytes

======Scheduled tasks folder======

C:WINDOWStasksGoogleUpdateTaskMachineCore.job
C:WINDOWStasksGoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{00A6FAF1-072E-44cf-8957-5838F569A31D}]
MyWebSearch Search Assistant BHO — C:Program FilesMyWebSearchbar1.binMWSSRCAS.DLL [2010-04-24 54680]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class — C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{07B18EA1-A523-4961-B6BB-170DE4475CCA}]
mwsBar BHO — C:Program FilesMyWebSearchbar1.binMWSBAR.DLL [2010-04-24 759288]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}]
C:PROGRA~1Crawlerctbr.dll [2007-09-20 1133056]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class — C:Program FilesKaspersky LabKaspersky Anti-Virus 2010ievkbd.dll [2009-10-20 68112]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class — C:Program FilesJavajre1.6.0_06binssv.dll [2008-03-25 509328]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{8984B388-A5BB-4DF7-B274-77B879E179DB}]
MailRuBHO Class — C:Program FilesMail.RuSputnikMailRuSputnik.dll [2008-07-10 623304]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{DFBA2295-8003-451E-B841-48C41484E20F}]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{E33CF602-D945-461A-83F0-819F76A199F8}]
FilterBHO Class — C:Program FilesKaspersky LabKaspersky Anti-Virus 2010klwtbbho.dll [2009-10-20 268816]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{09900DE8-1DCA-443F-9243-26FF581438AF} — Спутник@Mail.Ru — C:Program FilesMail.RuSputnikMailRuSputnik.dll [2008-07-10 623304]
{4B3803EA-5230-4DC3-A7FC-33638F3D3542} — &Crawler Toolbar — C:PROGRA~1Crawlerctbr.dll [2007-09-20 1133056]
{468CD8A9-7C25-45FA-969E-3D925C689DC4} — Rambler-Ассистент — C:Program FilesRambler AssistantramblertoolbarU1.dll [2008-12-26 849392]
{07B18EA9-A523-4961-B6BB-170DE4475CCA} — My Web Search — C:Program FilesMyWebSearchbar1.binMWSBAR.DLL [2010-04-24 759288]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«AmlMaple»=C:Program FilesAmlMapleAmlMaple.exe [2008-04-25 91648]
«SoundMAXPnP»=C:Program FilesAnalog DevicesCoresmax4pnp.exe [2006-05-01 843776]
«JMB36X Configure»=C:WINDOWSsystem32JMRaidTool.exe [2006-06-02 385024]
«ATICCC»=C:Program FilesATI TechnologiesATI.ACEcli.exe [2005-08-12 45056]
«Samsung Common SM»=C:WINDOWSSamsungComSMMgrssmmgr.exe [2005-07-03 372736]
«NeroFilterCheck»=C:WINDOWSsystem32NeroCheck.exe [2006-01-12 155648]
«MAgent»=C:для софтовMAgent.exe [2008-07-10 3110392]
«TkBellExe»=C:Program FilesCommon FilesRealUpdate_OBrealsched.exe [2010-03-05 202256]
«avp»=C:Program FilesKaspersky LabKaspersky Anti-Virus 2010avp.exe [2009-10-20 340456]
«My Web Search Bar Search Scope Monitor»=C:PROGRA~1MYWEBS~1bar1.binm3SrchMn.exe [2010-04-24 28783]
«MyWebSearch Email Plugin»=C:PROGRA~1MYWEBS~1bar1.binmwsoemon.exe [2010-04-24 32849]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=C:WINDOWSsystem32ctfmon.exe [2008-05-20 30208]
«VistaIcon»=C:Program FilesVistaDriveIconVistaDrv.exe [2008-01-02 132096]
«LClock»=C:Program FilesLClockLClock.exe [2007-12-14 86016]
«Punto Switcher»=C:Program FilesPunto Switcherps.exe [2007-11-14 201728]
«AdobeUpdater»=C:Program FilesCommon FilesAdobeUpdater5AdobeUpdater.exe []
«ICQ»=C:PROGRA~1ICQ6ICQ.exe silent []
«uTorrent»=D:графикаuTorrentutorrent.exe [2009-03-16 270128]
«MyWebSearch Email Plugin»=C:PROGRA~1MYWEBS~1bar1.binmwsoemon.exe [2010-04-24 32849]

C:Documents and SettingsAll UsersГлавное менюПрограммыАвтозагрузка
Adobe Reader Speed Launch.lnk — C:Program FilesAdobeAcrobat 7.0Readerreader_sl.exe

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyAtiExtEvent]
C:WINDOWSsystem32Ati2evxx.dll [2005-12-12 47104]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyklogon]
C:WINDOWSsystem32klogon.dll [2009-10-20 219664]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32wpdshserviceobj.dll [2008-03-02 133632]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalPEVSystemStart]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalprocexp90.Sys]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkPEVSystemStart]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkprocexp90.Sys]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«DisableTaskMgr»=0

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=323
«NoSharedDocuments»=1
«NoSMConfigurePrograms»=1
«NoDriveAutoRun»=67108863
«NoDrives»=0

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveAutoRun»=
«NoDriveTypeAutoRun»=
«NoDrives»=

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Documents and SettingsAll UsersApplication DataKaspersky Lab Setup FilesKaspersky Anti-Virus 7.0.1.325Russiansetup.exe»=»C:Documents and SettingsAll UsersApplication DataKaspersky Lab Setup FilesKaspersky Anti-Virus 7.0.1.325Russiansetup.exe:*:Enabled:Программа установки Антивируса Касперского 7.0»
«C:Program FileseMuleemule.exe»=»C:Program FileseMuleemule.exe:*:Enabled:eMule»
«C:Program FilesKaspersky LabKaspersky Internet Security 7.0avp.exe»=»C:Program FilesKaspersky LabKaspersky Internet Security 7.0avp.exe:*:Enabled:Kaspersky Anti-Virus»
«C:Program FilesTotal CommanderTOTALCMD.EXE»=»C:Program FilesTotal CommanderTOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows»
«C:Program FilesOperaopera.exe»=»C:Program FilesOperaopera.exe:*:Enabled:Opera Internet Browser»
«D:графикаuTorrentutorrent.exe»=»D:графикаuTorrentutorrent.exe:*:Enabled:µTorrent»
«C:Documents and SettingsAll UsersApplication DataKaspersky Lab Setup FilesKaspersky Internet Security 7.0.1.325Russiansetup.exe»=»C:Documents and SettingsAll UsersApplication DataKaspersky Lab Setup FilesKaspersky Internet Security 7.0.1.325Russiansetup.exe:*:Enabled:Программа установки Kaspersky Internet Security 7.0»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»

======List of files/folders created in the last 1 months======

2010-05-31 16:01:30 —-D—- C:rsit
2010-05-31 13:08:05 —-A—- C:WINDOWSsystem32gGGdSNn.exe
2010-05-30 22:56:04 —-A—- C:Program FilesCommon Fileskeylog.txt
2010-05-30 22:54:42 —-A—- C:WINDOWSsystem3225cyBrV.exe
2010-05-30 22:54:19 —-A—- C:WINDOWSsystem32vadRqAd.exe
2010-05-03 18:53:46 —-D—- C:Documents and SettingsAdminApplication DataDonationCoder
2010-05-03 18:53:15 —-D—- C:Documents and SettingsAll UsersApplication DataDonationCoder

======List of files/folders modified in the last 1 months======

2010-05-31 16:02:28 —-D—- C:Program Filestrend micro
2010-05-31 15:55:25 —-D—- C:Documents and SettingsAdminApplication DatauTorrent
2010-05-31 15:45:59 —-D—- C:WINDOWStemp
2010-05-31 13:11:28 —-D—- C:WINDOWSNetwork Diagnostic
2010-05-31 13:08:05 —-D—- C:WINDOWSsystem32
2010-05-31 13:05:46 —-D—- C:Documents and SettingsAll UsersApplication DataKaspersky Lab
2010-05-31 13:05:28 —-D—- C:WINDOWS
2010-05-31 01:59:40 —-A—- C:WINDOWSSchedLgU.Txt
2010-05-31 00:55:21 —-SHD—- C:System Volume Information
2010-05-31 00:55:21 —-D—- C:WINDOWSsystem32Restore
2010-05-31 00:55:05 —-D—- C:Program FilesCommon Files
2010-05-31 00:07:37 —-D—- C:WINDOWSsystem32CatRoot2
2010-05-30 23:19:58 —-A—- C:WINDOWSNeroDigital.ini
2010-05-19 17:47:40 —-D—- C:Program FilesEA GAMES
2010-05-05 11:53:42 —-D—- C:WINDOWSsystem32drivers

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 asuskbnt;Enhanced Display Driver Helper Service; C:WINDOWSsystem32driversatkkbnt.sys [2005-10-18 11008]
R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2008-04-15 40704]
R1 kbdhid;Драйвер клавиатуры HID; C:WINDOWSsystem32DRIVERSkbdhid.sys [2008-04-15 14720]
R1 kl1;Kl1; ??C:WINDOWSsystem32driverskl1.sys []
R1 KLIF;Kaspersky Lab Driver; C:WINDOWSsystem32DRIVERSklif.sys [2010-03-15 315408]
R1 prodrv06;StarForce Protection Environment Driver v6; C:WINDOWSSystem32driversprodrv06.sys [2004-07-06 79232]
R1 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:WINDOWSSystem32driversws2ifsl.sys [2008-04-15 12032]
R2 DgiVecp;Team MFP Comm Driver; C:WINDOWSSystem32DriversDgiVecp.sys [2005-03-14 41984]
R2 EIO;EIO; ??C:WINDOWSsystem32driversEIO.sys []
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:WINDOWSsystem32driversADIHdAud.sys [2006-05-02 229376]
R3 AEAudio;AE Audio Service; C:WINDOWSsystem32driversAEAudio.sys [2006-04-27 93824]
R3 ati2mtag;ati2mtag; C:WINDOWSsystem32DRIVERSati2mtag.sys [2005-12-12 1414656]
R3 HDAudBus;Драйвер шины Microsoft UAA для High Definition Audio; C:WINDOWSsystem32DRIVERSHDAudBus.sys [2008-04-15 144384]
R3 hidusb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2008-04-15 10368]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:WINDOWSsystem32DRIVERSklim5.sys [2009-09-14 32272]
R3 klmouflt;Kaspersky Lab KLMOUFLT; C:WINDOWSsystem32DRIVERSklmouflt.sys [2009-10-02 19472]
R3 mouhid;Драйвер мыши HID; C:WINDOWSsystem32DRIVERSmouhid.sys [2008-04-15 12160]
R3 MTsensor;ATK0110 ACPI UTILITY; C:WINDOWSsystem32DRIVERSASACPI.sys [2004-08-13 5810]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:WINDOWSsystem32DRIVERSRtenicxp.sys [2006-07-27 83712]
R3 SenFiltService;SenFilt Service; C:WINDOWSsystem32driversSenfilt.sys [2006-03-17 392960]
R3 USB_RNDIS;Arris Remote NDIS Network Device Driver; C:WINDOWSsystem32DRIVERSusb8023.sys [2008-04-15 12800]
R3 usbccgp;Драйвер универсального родительского устройства USB (Microsoft); C:WINDOWSsystem32DRIVERSusbccgp.sys [2008-05-20 32384]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2008-05-20 30336]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2008-05-20 59520]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2008-05-20 20608]
S3 catchme;catchme; ??C:DOCUME~1AdminLOCALS~1Tempcatchme.sys []
S3 usbprint;Класс принтеров Microsoft USB; C:WINDOWSsystem32DRIVERSusbprint.sys [2008-05-20 25856]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2008-05-20 26368]
S3 WudfPf;Windows Driver Foundation — User-mode Driver Framework Platform Driver; C:WINDOWSsystem32DRIVERSWudfPf.sys [2008-03-02 77568]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2008-03-02 82944]
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:WINDOWSsystem32Ati2evxx.exe [2005-12-12 393216]
R2 ATKKeyboardService;ATK Keyboard Service; C:WINDOWSATKKBService.exe [2005-10-18 241152]
R2 AVP;Kaspersky Anti-Virus; C:Program FilesKaspersky LabKaspersky Anti-Virus 2010avp.exe [2009-10-20 340456]
S2 gupdate1cabc33e007412a;Служба Google Update (gupdate1cabc33e007412a); C:Program FilesGoogleUpdateGoogleUpdate.exe [2010-03-05 133104]
S2 MyWebSearchService;My Web Search Service; C:PROGRA~1MYWEBS~1bar1.binmwssvc.exe [2010-04-24 28762]
S3 Adobe LM Service;Adobe LM Service; C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe [2009-09-14 72704]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2007-10-24 70144]
S3 odserv;Microsoft Office Diagnostics Service; C:Program FilesCommon FilesMicrosoft SharedOFFICE12ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:Program FilesWindows Media Playerwmpnetwk.exe [2006-10-18 913408]
S3 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2008-04-15 14336]

EOF
5 июля, 2009 в 4:11 пп в ответ на: Помогите удалить порно-баннер #24710
Osa
Participant
- Темы:3
- Сообщений:12
Спасибо большое! Баннеры пропали.

ComboFix 09-07-04.08 — Admin 05.07.09 19:29.4 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.1023.724 [GMT 4:00]
Running from: c:documents and settingsAdminРабочий столComboFix.exe
Command switches used :: c:documents and settingsAdminРабочий столCFScript.txt
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FILE ::
«c:program filesAdobeadrouter.dll»
«c:windowssystem32driversREMOVE.SYS»
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:program filesAdobeadrouter.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

Legacy_REMOVE

Service_REMOVE

((((((((((((((((((((((((( Files Created from 2009-06-05 to 2009-07-05 )))))))))))))))))))))))))))))))
.

2009-07-03 11:50 . 2009-07-03 11:51

d

w- c:program filestrend micro
2009-07-03 11:50 . 2009-07-03 11:51

d

w- C:rsit
2009-07-02 19:52 . 2009-07-02 19:52

d

w- c:documents and settingsAdminLocal SettingsApplication DataOpera
2009-07-02 19:52 . 2009-07-02 19:52

d

w- c:program filesOpera
2009-07-02 19:51 . 2009-07-02 19:51 8964736 —-a-w- C:Opera_964_int_Setup.exe
2009-07-02 14:44 . 2009-07-02 14:44

d-sh—w- c:documents and settingsAdminPrivacIE
2009-07-02 14:41 . 2009-07-02 14:41

d-sh—w- c:documents and settingsAdminIETldCache
2009-07-02 14:39 . 2009-07-02 14:39

d

w- c:windowsie8updates
2009-07-02 14:39 . 2009-07-02 14:39

d—h—w- c:windows$hf_mig$
2009-07-02 14:38 . 2009-01-07 14:21 26144 —-a-w- c:windowssystem32spupdsvc.exe
2009-07-02 14:37 . 2009-07-02 14:38

dc-h—w- c:windowsie8
2009-07-02 14:35 . 2009-06-02 10:12 102912 -c—-w- c:windowssystem32dllcacheiecompat.dll
2009-07-02 14:33 . 2009-04-30 21:16 12800 -c—-w- c:windowssystem32dllcachexpshims.dll
2009-07-02 14:33 . 2009-04-30 21:16 246272 -c—-w- c:windowssystem32dllcacheieproxy.dll
2009-07-02 14:33 . 2009-04-30 21:16 1985024 -c—-w- c:windowssystem32dllcacheiertutil.dll
2009-07-02 14:33 . 2009-04-30 21:16 11064832 -c—-w- c:windowssystem32dllcacheieframe.dll
2009-07-02 14:27 . 2009-07-02 14:27 17028448 —-a-w- C:IE8-WindowsXP-x86-RUS.exe
2009-07-02 13:41 . 2009-07-02 13:41

d—h—w- c:windowssystem32GroupPolicy
2009-07-02 13:26 . 2009-07-02 13:26

d

w- c:windowssystem32NtmsData

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-05 15:39 . 2009-04-23 13:20 38852384 —sha-w- c:windowssystem32driversfidbox.dat
2009-07-05 15:38 . 2009-04-23 13:20 1441056 —sha-w- c:windowssystem32driversfidbox2.dat
2009-07-05 15:37 . 2009-04-23 13:20 524480 —sha-w- c:windowssystem32driversfidbox.idx
2009-07-05 15:37 . 2009-04-23 13:20 137168 —sha-w- c:windowssystem32driversfidbox2.idx
2009-07-05 11:19 . 2008-10-13 13:13

d

w- c:documents and settingsAll UsersApplication DataKaspersky Lab
2009-07-02 14:47 . 2008-07-19 14:54

d

w- c:program filesCrawler
2009-07-02 14:41 . 2008-06-25 19:13

d

w- c:program filesVirtualNetwork
2009-05-20 14:36 . 2009-04-23 13:21 94643 —-a-w- c:windowssystem32driversklick.dat
2009-05-20 14:36 . 2009-04-23 13:21 105395 —-a-w- c:windowssystem32driversklin.dat
2009-05-13 05:05 . 2008-05-20 15:54 915456 —-a-w- c:windowssystem32wininet.dll
2009-04-23 13:34 . 2007-04-28 12:51 112144 —-a-w- c:windowssystem32driverskl1.sys
2009-04-23 13:34 . 2009-04-23 13:34 112144 —-a-w- c:documents and settingsAll UsersApplication DataKaspersky LabAVP7DataUpdaterTemporary FilestemporaryFolderAutoPatcheskav67.0.0.119X86kl1.sys
2009-04-23 13:34 . 2009-04-23 13:34 682512 —-a-w- c:documents and settingsAll UsersApplication DataKaspersky LabAVP7DataUpdaterTemporary FilestemporaryFolderAutoPatcheskav67.0.0.119updater.dll
2009-04-23 13:34 . 2009-04-23 13:34 194320 —-a-w- c:documents and settingsAll UsersApplication DataKaspersky LabAVP7DataUpdaterTemporary FilestemporaryFolderAutoPatcheskav67.0.0.119klif.sys
2009-04-23 13:34 . 2009-04-23 13:34 150032 —-a-w- c:documents and settingsAll UsersApplication DataKaspersky LabAVP7DataUpdaterTemporary FilestemporaryFolderAutoPatcheskav67.0.0.119diffs.dll
2009-04-23 13:34 . 2009-04-23 13:34 342544 —-a-w- c:documents and settingsAll UsersApplication DataKaspersky LabAVP7DataUpdaterTemporary FilestemporaryFolderAutoPatcheskav67.0.0.119ckahum.dll
2009-04-10 11:39 . 2009-04-10 11:39 0 —-a-w- c:windowsnsreg.dat
.

((((((((((((((((((((((((((((( SnapShot@2009-07-02_18.15.48 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-02 19:52 . 2009-07-02 19:52 1818112 c:windowsInstaller59ef45.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2008-05-20 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
«LClock»=»c:program filesLClockLClock.exe» [2007-12-14 86016]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2007-11-14 201728]
«AdobeUpdater»=»c:program filesCommon FilesAdobeUpdater5AdobeUpdater.exe» [2007-02-28 2321600]
«ICQ»=»c:progra~1ICQ6ICQ.exe» [2008-09-01 173304]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«AmlMaple»=»c:program filesAmlMapleAmlMaple.exe» [2008-04-24 91648]
«SoundMAXPnP»=»c:program filesAnalog DevicesCoresmax4pnp.exe» [2006-05-01 843776]
«JMB36X Configure»=»c:windowssystem32JMRaidTool.exe» [2006-06-02 385024]
«ATICCC»=»c:program filesATI TechnologiesATI.ACEcli.exe» [2005-08-12 45056]
«Samsung Common SM»=»c:windowsSamsungComSMMgrssmmgr.exe» [2005-07-03 372736]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2006-01-12 155648]
«MAgent»=»c:для софтовMAgent.exe» [2008-07-10 3110392]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-05-20 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» — c:windowssystem32advpack.dll [2009-03-08 128512]
«IE7_012″=»advpack.dll» — c:windowssystem32advpack.dll [2009-03-08 128512]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesDisableNotify»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusOverride»=dword:00000001

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringKasperskyAntiVirus]
«DisableMonitoring»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\uTorrent\uTorrent.exe»=
«c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\Russian\setup.exe»=
«c:\Program Files\ICQ6\ICQ.exe»=
«c:\Program Files\eMule\emule.exe»=
«c:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe»=
«c:\Program Files\Total Commander\TOTALCMD.EXE»=

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«56152:UDP»= 56152:UDP:Торя
«56152:TCP»= 56152:TCP:торент
«54505:TCP»= 54505:TCP:*:Disabled:ослик
«21028:UDP»= 21028:UDP:*:Disabled:ослик

R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:windowssystem32driversklim5.sys [04.04.07 14:58 24344]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled components>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
«c:windowssystem32rundll32.exe» «c:windowssystem32iedkcs32.dll»,BrandIEActiveSetup SIGNUP
.
— — — — ORPHANS REMOVED — — — —

BHO-{DFBA2295-8003-451E-B841-48C41484E20F} — (no file)

.

Supplementary Scan

.
uStart Page = hxxp://www.rambler.ru/
uInternet Connection Wizard,ShellNext = hxxp://www.kornet.ru/
uInternet Settings,ProxyOverride = *.local
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
IE: Crawler Search — tbr:iemenu
IE: Добавить в Rambler-Закладки — c:program filesRambler AssistantramblertoolbarU1.dll/zakladki.htm
IE: Найти с помощью Рамблера — c:program filesRambler AssistantramblertoolbarU1.dll/search.htm
IE: Перевести с помощью словарей Рамблера — c:program filesRambler AssistantramblertoolbarU1.dll/dic.htm
IE: Поиск@Mail.Ru — c:program filesMail.RuSputnikMailRuSputnik.dll/SEARCH.HTM
IE: Словари@Mail.Ru — c:program filesMail.RuSputnikMailRuSputnik.dll/TRANSLATE.HTM
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:для софтовmagent.exe
TCP: {49D1CC09-93B8-441C-9124-06F88F91694A} = 87.237.112.10,77.241.40.178
Handler: tbr — {4D25FB7A-8902-4291-960E-9ADA051CFBBF} — c:progra~1Crawlerctbr.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-05 19:39
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

DLLs Loaded Under Running Processes

— — — — — — — > ‘winlogon.exe'(1364)
c:windowssystem32SETUPAPI.dll
c:program filesKaspersky LabKaspersky Internet Security 7.0miscr3.dll
c:windowssystem32Ati2evxx.dll
c:windowssystem32klogon.dll
c:windowssystem32cscui.dll

— — — — — — — > ‘lsass.exe'(1420)
c:program filesKaspersky LabKaspersky Internet Security 7.0dnsq.dll
c:windowssystem32setupapi.dll
c:program filesKaspersky LabKaspersky Internet Security 7.0miscr3.dll

— — — — — — — > ‘explorer.exe'(500)
c:windowssystem32WININET.dll
c:program filesAmlMapleAmlMaple.dll
c:windowssystem32COMRes.dll
c:windowsSystem32cscui.dll
c:program filesKaspersky LabKaspersky Internet Security 7.0miscr3.dll
c:program filesPunto Switchercorrect.dll
c:program filesKaspersky LabKaspersky Internet Security 7.0scrchpg.dll
c:windowssystem32msi.dll
c:program filesLClockLC.dll
c:windowssystem32wpdshserviceobj.dll
c:windowssystem32webcheck.dll
c:windowssystem32SETUPAPI.dll
c:windowssystem32portabledevicetypes.dll
c:windowssystem32portabledeviceapi.dll
c:windowssystem32NETSHELL.dll
.

Other Running Processes

.
c:windowssystem32ati2evxx.exe
c:windowssystem32ati2evxx.exe
c:windowsATKKBService.exe
c:program filesKaspersky LabKaspersky Internet Security 7.0avp.exe
.
**************************************************************************
.
Completion time: 2009-07-05 19:42 — machine was rebooted
ComboFix-quarantined-files.txt 2009-07-05 15:42
ComboFix2.txt 2009-07-04 15:47
ComboFix3.txt 2009-07-02 18:18

Pre-Run: 9 900 695 552 байт свободно
Post-Run: 9 937 055 744 байт свободно

193
4 июля, 2009 в 3:53 пп в ответ на: Помогите удалить порно-баннер #24708
Osa
Participant
- Темы:3
- Сообщений:12
ComboFix 09-07-03.03 — Admin 04.07.09 19:36.3 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.1023.690 [GMT 4:00]
Running from: c:documents and settingsAdminРабочий столComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

((((((((((((((((((((((((( Files Created from 2009-06-04 to 2009-07-04 )))))))))))))))))))))))))))))))
.

2009-07-03 11:50 . 2009-07-03 11:51

d

w- c:program filestrend micro
2009-07-03 11:50 . 2009-07-03 11:51

d

w- C:rsit
2009-07-02 19:52 . 2009-07-02 19:52

d

w- c:documents and settingsAdminLocal SettingsApplication DataOpera
2009-07-02 19:52 . 2009-07-02 19:52

d

w- c:program filesOpera
2009-07-02 19:51 . 2009-07-02 19:51 8964736 —-a-w- C:Opera_964_int_Setup.exe
2009-07-02 14:44 . 2009-07-02 14:44

d-sh—w- c:documents and settingsAdminPrivacIE
2009-07-02 14:41 . 2009-07-02 14:41

d-sh—w- c:documents and settingsAdminIETldCache
2009-07-02 14:39 . 2009-07-02 14:39

d

w- c:windowsie8updates
2009-07-02 14:39 . 2009-07-02 14:39

d—h—w- c:windows$hf_mig$
2009-07-02 14:38 . 2009-01-07 14:21 26144 —-a-w- c:windowssystem32spupdsvc.exe
2009-07-02 14:37 . 2009-07-02 14:38

dc-h—w- c:windowsie8
2009-07-02 14:35 . 2009-06-02 10:12 102912 -c—-w- c:windowssystem32dllcacheiecompat.dll
2009-07-02 14:33 . 2009-04-30 21:16 12800 -c—-w- c:windowssystem32dllcachexpshims.dll
2009-07-02 14:33 . 2009-04-30 21:16 246272 -c—-w- c:windowssystem32dllcacheieproxy.dll
2009-07-02 14:33 . 2009-04-30 21:16 1985024 -c—-w- c:windowssystem32dllcacheiertutil.dll
2009-07-02 14:33 . 2009-04-30 21:16 11064832 -c—-w- c:windowssystem32dllcacheieframe.dll
2009-07-02 14:27 . 2009-07-02 14:27 17028448 —-a-w- C:IE8-WindowsXP-x86-RUS.exe
2009-07-02 13:41 . 2009-07-02 13:41

d—h—w- c:windowssystem32GroupPolicy
2009-07-02 13:26 . 2009-07-02 13:26

d

w- c:windowssystem32NtmsData

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-04 15:43 . 2009-04-23 13:20 1426208 —sha-w- c:windowssystem32driversfidbox2.dat
2009-07-04 15:33 . 2008-10-13 13:13

d

w- c:documents and settingsAll UsersApplication DataKaspersky Lab
2009-07-04 15:31 . 2009-04-23 13:20 135392 —sha-w- c:windowssystem32driversfidbox2.idx
2009-07-04 15:31 . 2009-04-23 13:20 518480 —sha-w- c:windowssystem32driversfidbox.idx
2009-07-04 15:31 . 2009-04-23 13:20 38474272 —sha-w- c:windowssystem32driversfidbox.dat
2009-07-02 14:47 . 2008-07-19 14:54

d

w- c:program filesCrawler
2009-07-02 14:41 . 2008-06-25 19:13

d

w- c:program filesVirtualNetwork
2009-05-20 14:36 . 2009-04-23 13:21 94643 —-a-w- c:windowssystem32driversklick.dat
2009-05-20 14:36 . 2009-04-23 13:21 105395 —-a-w- c:windowssystem32driversklin.dat
2009-05-13 05:05 . 2008-05-20 15:54 915456 —-a-w- c:windowssystem32wininet.dll
2009-04-23 13:34 . 2007-04-28 12:51 112144 —-a-w- c:windowssystem32driverskl1.sys
2009-04-23 13:34 . 2009-04-23 13:34 112144 —-a-w- c:documents and settingsAll UsersApplication DataKaspersky LabAVP7DataUpdaterTemporary FilestemporaryFolderAutoPatcheskav67.0.0.119X86kl1.sys
2009-04-23 13:34 . 2009-04-23 13:34 682512 —-a-w- c:documents and settingsAll UsersApplication DataKaspersky LabAVP7DataUpdaterTemporary FilestemporaryFolderAutoPatcheskav67.0.0.119updater.dll
2009-04-23 13:34 . 2009-04-23 13:34 194320 —-a-w- c:documents and settingsAll UsersApplication DataKaspersky LabAVP7DataUpdaterTemporary FilestemporaryFolderAutoPatcheskav67.0.0.119klif.sys
2009-04-23 13:34 . 2009-04-23 13:34 150032 —-a-w- c:documents and settingsAll UsersApplication DataKaspersky LabAVP7DataUpdaterTemporary FilestemporaryFolderAutoPatcheskav67.0.0.119diffs.dll
2009-04-23 13:34 . 2009-04-23 13:34 342544 —-a-w- c:documents and settingsAll UsersApplication DataKaspersky LabAVP7DataUpdaterTemporary FilestemporaryFolderAutoPatcheskav67.0.0.119ckahum.dll
2009-04-10 11:39 . 2009-04-10 11:39 0 —-a-w- c:windowsnsreg.dat
.

((((((((((((((((((((((((((((( SnapShot@2009-07-02_18.15.48 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-02 19:52 . 2009-07-02 19:52 1818112 c:windowsInstaller59ef45.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiersAdRouter]
@=»{E2085722-3AC0-4411-A14B-906AFE1A75C4}»
[HKEY_CLASSES_ROOTCLSID{E2085722-3AC0-4411-A14B-906AFE1A75C4}]
2009-07-01 16:07 98304 —-a-w- c:program filesAdobeadrouter.dll

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2008-05-20 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
«LClock»=»c:program filesLClockLClock.exe» [2007-12-14 86016]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2007-11-14 201728]
«AdobeUpdater»=»c:program filesCommon FilesAdobeUpdater5AdobeUpdater.exe» [2007-02-28 2321600]
«ICQ»=»c:progra~1ICQ6ICQ.exe» [2008-09-01 173304]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«AmlMaple»=»c:program filesAmlMapleAmlMaple.exe» [2008-04-24 91648]
«SoundMAXPnP»=»c:program filesAnalog DevicesCoresmax4pnp.exe» [2006-05-01 843776]
«JMB36X Configure»=»c:windowssystem32JMRaidTool.exe» [2006-06-02 385024]
«ATICCC»=»c:program filesATI TechnologiesATI.ACEcli.exe» [2005-08-12 45056]
«Samsung Common SM»=»c:windowsSamsungComSMMgrssmmgr.exe» [2005-07-03 372736]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2006-01-12 155648]
«MAgent»=»c:для софтовMAgent.exe» [2008-07-10 3110392]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-05-20 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» — c:windowssystem32advpack.dll [2009-03-08 128512]
«IE7_012″=»advpack.dll» — c:windowssystem32advpack.dll [2009-03-08 128512]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesDisableNotify»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusDisableNotify»=dword:00000001
«AntiVirusOverride»=dword:00000001

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringKasperskyAntiVirus]
«DisableMonitoring»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\uTorrent\uTorrent.exe»=
«c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\Russian\setup.exe»=
«c:\Program Files\ICQ6\ICQ.exe»=
«c:\Program Files\eMule\emule.exe»=
«c:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe»=
«c:\Program Files\Total Commander\TOTALCMD.EXE»=

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«56152:UDP»= 56152:UDP:Торя
«56152:TCP»= 56152:TCP:торент
«54505:TCP»= 54505:TCP:*:Disabled:ослик
«21028:UDP»= 21028:UDP:*:Disabled:ослик

R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:windowssystem32driversklim5.sys [04.04.07 14:58 24344]
S3 REMOVE;REMOVE;??c:windowssystem32driversREMOVE.SYS —> c:windowssystem32driversREMOVE.SYS [?]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled components>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
«c:windowssystem32rundll32.exe» «c:windowssystem32iedkcs32.dll»,BrandIEActiveSetup SIGNUP
.
— — — — ORPHANS REMOVED — — — —

BHO-{DFBA2295-8003-451E-B841-48C41484E20F} — (no file)

.

Supplementary Scan

.
uStart Page = hxxp://www.rambler.ru/
uInternet Connection Wizard,ShellNext = hxxp://www.kornet.ru/
uInternet Settings,ProxyOverride = *.local
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
IE: Crawler Search — tbr:iemenu
IE: Добавить в Rambler-Закладки — c:program filesRambler AssistantramblertoolbarU1.dll/zakladki.htm
IE: Найти с помощью Рамблера — c:program filesRambler AssistantramblertoolbarU1.dll/search.htm
IE: Перевести с помощью словарей Рамблера — c:program filesRambler AssistantramblertoolbarU1.dll/dic.htm
IE: Поиск@Mail.Ru — c:program filesMail.RuSputnikMailRuSputnik.dll/SEARCH.HTM
IE: Словари@Mail.Ru — c:program filesMail.RuSputnikMailRuSputnik.dll/TRANSLATE.HTM
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:для софтовmagent.exe
TCP: {49D1CC09-93B8-441C-9124-06F88F91694A} = 87.237.112.10,77.241.40.178
Handler: tbr — {4D25FB7A-8902-4291-960E-9ADA051CFBBF} — c:progra~1Crawlerctbr.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-04 19:44
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

LOCKED REGISTRY KEYS

[HKEY_USERSS-1-5-21-1644491937-1844823847-1801674531-500SoftwareMicrosoftInternet ExplorerUser Preferences]
@Denied: (2) (Administrator)
«88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977″=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,cf,41,39,31,48,46,89,4d,a3,60,ad,
«2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81″=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,cf,41,39,31,48,46,89,4d,a3,60,ad,
.

DLLs Loaded Under Running Processes

— — — — — — — > ‘winlogon.exe'(1352)
c:windowssystem32SETUPAPI.dll
c:program filesKaspersky LabKaspersky Internet Security 7.0miscr3.dll
c:windowssystem32Ati2evxx.dll
c:windowssystem32klogon.dll
c:windowssystem32cscui.dll

— — — — — — — > ‘lsass.exe'(1408)
c:program filesKaspersky LabKaspersky Internet Security 7.0dnsq.dll
c:windowssystem32setupapi.dll
c:program filesKaspersky LabKaspersky Internet Security 7.0miscr3.dll

— — — — — — — > ‘explorer.exe'(3052)
c:windowssystem32WININET.dll
c:program filesAmlMapleAmlMaple.dll
c:windowssystem32COMRes.dll
c:program filesAdobeadrouter.dll
c:windowsSystem32cscui.dll
c:program filesKaspersky LabKaspersky Internet Security 7.0miscr3.dll
c:program filesPunto Switchercorrect.dll
c:windowssystem32msi.dll
c:program filesKaspersky LabKaspersky Internet Security 7.0scrchpg.dll
c:program filesLClockLC.dll
c:windowssystem32wpdshserviceobj.dll
c:windowssystem32portabledevicetypes.dll
c:windowssystem32portabledeviceapi.dll
c:windowssystem32SETUPAPI.dll
c:windowssystem32webcheck.dll
c:program filesKaspersky LabKaspersky Internet Security 7.0adialhk.dll
c:windowssystem32DNSAPI.dll
c:program filesKaspersky LabKaspersky Internet Security 7.0dnsq.dll
c:windowssystem32NETSHELL.dll
c:windowssystem32mshtml.dll
c:windowssystem32msls31.dll
.
Completion time: 2009-07-04 19:47
ComboFix-quarantined-files.txt 2009-07-04 15:47
ComboFix2.txt 2009-07-02 18:18

Pre-Run: 9 990 221 824 байт свободно
Post-Run: 9 977 430 016 байт свободно

191
Автор

Сообщения

Просмотр 9 сообщений - с 1 по 9 (из 9 всего)

Osa

Созданные ответы форума

Добро пожаловать

Поиск

Важные инструкции

Удалить всплывающие окна, рекламу, уведомления в Chrome

Как запустить компьютер в безопасном режиме (Safe Mode)

Как сбросить настройки Firefox (Инструкция)

Убрать рекламу в браузере (Chrome, Firefox, Opera, Yandex)

Как удалить рекламный вирус в браузере (Chrome, Opera, Firefox, Internet Explorer, Edge)

СПАЙВАРЕ РУ

Нужна помощь?

Ссылки