SPYWARE-RU.COM

Созданные ответы форума

Просмотр 8 сообщений - с 1 по 8 (из 8 всего)

Автор

Сообщения
10 февраля, 2009 в 5:21 пп в ответ на: как удалить spyware protect 2009 #21774
stealth5
Participant
- Темы:2
- Сообщений:10
Здрвствуйте Valeri! вот то что вы просили.

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:Avenger

*******************

Beginning to process script file:

Rootkit scan active.

Hidden driver «TDSSserv.sys» found!
ImagePath: systemrootsystem32driversTDSSigab.sys
Start Type: 1 (System)

Rootkit scan completed.

Completed script processing.

*******************

Finished! Terminate.

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows NT 6.0 (build 6000)
Sat Feb 07 21:10:44 2009

21:10:44: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!

//////////////////////////////////////////

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows NT 6.0 (build 6000)
Sat Feb 07 21:10:55 2009

21:10:55: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!

//////////////////////////////////////////

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows NT 6.0 (build 6000)
Sat Feb 07 21:11:01 2009

21:11:01: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!

//////////////////////////////////////////

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows NT 6.0 (build 6000)
Sat Feb 07 21:11:31 2009

21:11:31: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!

//////////////////////////////////////////

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows NT 6.0 (build 6000)
Sat Feb 07 21:12:17 2009

21:12:17: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!

//////////////////////////////////////////

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:Avenger

*******************

Beginning to process script file:

Rootkit scan active.

Hidden driver «TDSSserv.sys» found!
ImagePath: systemrootsystem32driversTDSSigab.sys
Start Type: 1 (System)

Rootkit scan completed.

Completed script processing.

*******************

Finished! Terminate.
8 февраля, 2009 в 9:11 пп в ответ на: как удалить spyware protect 2009 #21772
stealth5
Participant
- Темы:2
- Сообщений:10
Здравствуйте Valeri!
Я удалил spyware protect 2009 программу при помощи программы Avenger которую я скачал у вас на сайте, но осталось то что я также не могу не скачать не установить Malwarebytes Anti-malware и обновить антивирусную программу
При нажатии на ссылку нет ни какой реакции ни чего не загружает, я скачал эту программу на другом компьютере и попытался установить но программа не открывается именно на этом компьютере. Уже не знаю что делать 👿
Если можете помогите, заранее спасибо.
24 ноября, 2008 в 4:05 пп в ответ на: помогите удалить Internet Antivirus Pro #19937
stealth5
Participant
- Темы:2
- Сообщений:10
Комп. стал лучше работать! 😛
24 ноября, 2008 в 4:03 пп в ответ на: помогите удалить Internet Antivirus Pro #19936
stealth5
Participant
- Темы:2
- Сообщений:10
вот:
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Error: registry key «RegistryMachineSystemCurrentControlSetServicesashuolkf» not found!
Deletion of driver «ashuolkf» failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
—> the object does not exist

Completed script processing.

*******************

Finished! Terminate.

Logfile of random’s system information tool 1.04 (written by random/random)
Run by User at 2008-11-24 18:05:59
Microsoft Windows XP Professional Service Pack 2
System drive C: has 17 GB (22%) free of 76 GB
Total RAM: 511 MB (25% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:06:04, on 24.11.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesLavasoftAd-Aware 2007aawservice.exe
C:Program FilesBonjourmDNSResponder.exe
C:Program FilesESETESET NOD32 Antivirusekrn.exe
C:Documents and SettingsUserLocal SettingsApplication DataMicrosoftWindowsservices.exe
C:Program FilesJavajre6binjqs.exe
C:Program FilesCommon FilesMicrosoft SharedVS7Debugmdm.exe
C:Program FilesCyberLinkShared FilesRichVideo.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32NOTEPAD.EXE
C:Program FilesCyberLinkPowerDVDPDVDServ.exe
C:WINDOWSSOUNDMAN.EXE
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:Program FilesESETESET NOD32 Antivirusegui.exe
C:Program FilesRapidshare DownloaderRD.exe
C:Program FilesJavajre6binjusched.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesCommon FilesAheadLibNMBgMonitor.exe
C:Program FilesDAEMON Tools Litedaemon.exe
C:Program FilesCommon FilesAheadLibNMIndexingService.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesCommon FilesAheadLibNMIndexStoreSvr.exe
C:WINDOWSsystem32wuauclt.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:Documents and SettingsUserDesktopRSIT.exe
C:Program FilesTrend MicroHijackThisUser.exe

R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.daemon-search.com/startpage

R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *.local
R3 — URLSearchHook: The Pirate Bay Toolbar — {a33fa729-d155-4b23-842b-2c665ecabdb6} — C:Program FilesThe_Pirate_BaytbThe_.dll
O2 — BHO: Adobe PDF Reader Link Helper — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 — BHO: flashget urlcatch — {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} — C:Program FilesRapidshare Downloaderjccatch.dll
O2 — BHO: Java(tm) Plug-In SSV Helper — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — C:Program FilesJavajre6binssv.dll
O2 — BHO: The Pirate Bay Toolbar — {a33fa729-d155-4b23-842b-2c665ecabdb6} — C:Program FilesThe_Pirate_BaytbThe_.dll
O2 — BHO: Java(tm) Plug-In 2 SSV Helper — {DBC80044-A445-435b-BC74-9C25C1C588A9} — C:Program FilesJavajre6binjp2ssv.dll
O2 — BHO: JQSIEStartDetectorImpl — {E7E6F031-17CE-4C07-BC86-EABFE594F69C} — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll
O3 — Toolbar: The Pirate Bay Toolbar — {a33fa729-d155-4b23-842b-2c665ecabdb6} — C:Program FilesThe_Pirate_BaytbThe_.dll
O4 — HKLM..Run: [Adobe Reader Speed Launcher] «C:Program FilesAdobeReader 8.0ReaderReader_sl.exe»
O4 — HKLM..Run: [RemoteControl] «C:Program FilesCyberLinkPowerDVDPDVDServ.exe»
O4 — HKLM..Run: [LanguageShortcut] «C:Program FilesCyberLinkPowerDVDLanguageLanguage.exe»
O4 — HKLM..Run: [NeroFilterCheck] C:Program FilesCommon FilesAheadLibNeroCheck.exe
O4 — HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 — HKLM..Run: [ATICCC] «C:Program FilesATI TechnologiesATI.ACEcli.exe» runtime -Delay
O4 — HKLM..Run: [egui] «C:Program FilesESETESET NOD32 Antivirusegui.exe» /hide /waitservice
O4 — HKLM..Run: [Flashget] C:Program FilesRapidshare DownloaderRD.exe /min
O4 — HKLM..Run: [SunJavaUpdateSched] «C:Program FilesJavajre6binjusched.exe»
O4 — HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] «C:Program FilesCommon FilesAheadLibNMBgMonitor.exe»
O4 — HKCU..Run: [DAEMON Tools Lite] «C:Program FilesDAEMON Tools Litedaemon.exe»
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOfficeOSA9.EXE
O8 — Extra context menu item: &Download All with Rapidshare Downloader — C:Program FilesRapidshare Downloaderjc_all.htm
O8 — Extra context menu item: &Download with Rapidshare Downloader — C:Program FilesRapidshare Downloaderjc_link.htm
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2Office10EXCEL.EXE/3000
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O16 — DPF: {31150A86-0BBA-409F-BEB4-F3922D10BF34} (Gif89 Class) — file://C:Program FilesWindows SidebarGadgetsxplugCam.gadgeten-USxplug.ocx
O16 — DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) — http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 — HKLMSystemCCSServicesTcpip..{049BBB46-3CC6-47DF-AC3B-FAC485223C61}: NameServer = 192.168.0.20
O17 — HKLMSystemCS1ServicesTcpip..{049BBB46-3CC6-47DF-AC3B-FAC485223C61}: NameServer = 192.168.0.20
O17 — HKLMSystemCS2ServicesTcpip..{049BBB46-3CC6-47DF-AC3B-FAC485223C61}: NameServer = 192.168.0.20
O23 — Service: Ad-Aware 2007 Service (aawservice) — Lavasoft AB — C:Program FilesLavasoftAd-Aware 2007aawservice.exe
O23 — Service: Ati HotKey Poller — ATI Technologies Inc. — C:WINDOWSsystem32Ati2evxx.exe
O23 — Service: ATI Smart — Unknown owner — C:WINDOWSsystem32ati2sgag.exe
O23 — Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) — Apple Computer, Inc. — C:Program FilesBonjourmDNSResponder.exe
O23 — Service: Eset HTTP Server (EhttpSrv) — ESET — C:Program FilesESETESET NOD32 AntivirusEHttpSrv.exe
O23 — Service: Eset Service (ekrn) — ESET — C:Program FilesESETESET NOD32 Antivirusekrn.exe
O23 — Service: FLEXnet Licensing Service — Macrovision Europe Ltd. — C:Program FilesCommon FilesMacrovision SharedFLEXnet PublisherFNPLicensingService.exe
O23 — Service: Guard Service (ITGrdEngine) — Unknown owner — C:Documents and SettingsUserLocal SettingsApplication DataMicrosoftWindowsservices.exe
O23 — Service: Java Quick Starter (JavaQuickStarterService) — Sun Microsystems, Inc. — C:Program FilesJavajre6binjqs.exe
O23 — Service: NBService — Nero AG — C:Program FilesNeroNero 7Nero BackItUpNBService.exe
O23 — Service: NMIndexingService — Nero AG — C:Program FilesCommon FilesAheadLibNMIndexingService.exe
O23 — Service: Cyberlink RichVideo Service(CRVS) (RichVideo) — Unknown owner — C:Program FilesCyberLinkShared FilesRichVideo.exe

—
End of file — 7448 bytes

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}]
FGCatchUrl — C:Program FilesRapidshare Downloaderjccatch.dll [2007-03-27 75528]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper — C:Program FilesJavajre6binssv.dll [2008-11-23 320920]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{a33fa729-d155-4b23-842b-2c665ecabdb6}]
The Pirate Bay Toolbar — C:Program FilesThe_Pirate_BaytbThe_.dll [2008-06-03 1542168]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper — C:Program FilesJavajre6binjp2ssv.dll [2008-11-23 34816]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll [2008-11-23 73728]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{a33fa729-d155-4b23-842b-2c665ecabdb6} — The Pirate Bay Toolbar — C:Program FilesThe_Pirate_BaytbThe_.dll [2008-06-03 1542168]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«Adobe Reader Speed Launcher»=C:Program FilesAdobeReader 8.0ReaderReader_sl.exe [2007-05-11 40048]
«RemoteControl»=C:Program FilesCyberLinkPowerDVDPDVDServ.exe [2007-01-08 68640]
«LanguageShortcut»=C:Program FilesCyberLinkPowerDVDLanguageLanguage.exe [2007-01-08 52256]
«NeroFilterCheck»=C:Program FilesCommon FilesAheadLibNeroCheck.exe [2007-03-01 153136]
«SoundMan»=C:WINDOWSSOUNDMAN.EXE [2004-02-26 65024]
«ATICCC»=C:Program FilesATI TechnologiesATI.ACEcli.exe [2006-01-02 45056]
«egui»=C:Program FilesESETESET NOD32 Antivirusegui.exe [2007-12-21 1443072]
«Flashget»=C:Program FilesRapidshare DownloaderRD.exe [2007-03-27 1708032]
«SunJavaUpdateSched»=C:Program FilesJavajre6binjusched.exe [2008-11-23 136600]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«ctfmon.exe»=C:WINDOWSsystem32ctfmon.exe [2004-08-03 15360]
«BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=C:Program FilesCommon FilesAheadLibNMBgMonitor.exe [2007-05-16 153136]
«DAEMON Tools Lite»=C:Program FilesDAEMON Tools Litedaemon.exe [2007-12-29 486856]

C:Documents and SettingsAll UsersStart MenuProgramsStartup
Microsoft Office.lnk — C:Program FilesMicrosoft OfficeOfficeOSA9.EXE

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyAtiExtEvent]
C:WINDOWSsystem32Ati2evxx.dll [2006-03-21 61440]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalaawservice]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkaawservice]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkclient32]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkvsmon]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDrives»=0

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=
«NoDrives»=
«NoDriveAutoRun»=

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesBonjourmDNSResponder.exe»=»C:Program FilesBonjourmDNSResponder.exe:*:Enabled:Bonjour»
«C:Program FilesNeroNero 7Nero ShowTimeShowTime.exe»=»C:Program FilesNeroNero 7Nero ShowTimeShowTime.exe:*:Enabled:Nero ShowTime»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{7344381a-210d-11dd-87fc-000c76334b75}]
shellAutoRuncommand — F:intro.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{b0518c03-236e-11dc-ac82-806d6172696f}]
shellAutoRuncommand — D:setup.exe

======List of files/folders created in the last 1 months======

2008-11-24 17:59:37 —-D—- C:Avenger
2008-11-24 17:59:37 —-A—- C:avenger.txt
2008-11-24 15:41:20 —-D—- C:Documents and SettingsUserApplication DataMalwarebytes
2008-11-24 15:41:13 —-D—- C:Documents and SettingsAll UsersApplication DataMalwarebytes
2008-11-24 15:41:12 —-D—- C:Program FilesMalwarebytes’ Anti-Malware
2008-11-23 23:52:21 —-SHD—- C:RECYCLER
2008-11-23 23:03:05 —-D—- C:ComboFix
2008-11-23 22:55:19 —-A—- C:ComboFix.txt
2008-11-23 17:49:38 —-D—- C:rsit
2008-11-23 16:55:12 —-A—- C:WINDOWSsystem32javaws.exe
2008-11-23 16:55:12 —-A—- C:WINDOWSsystem32javaw.exe
2008-11-23 16:55:12 —-A—- C:WINDOWSsystem32java.exe
2008-11-23 16:55:12 —-A—- C:WINDOWSsystem32deploytk.dll
2008-11-23 16:54:51 —-D—- C:Program FilesJava
2008-11-23 16:51:21 —-D—- C:Documents and SettingsUserApplication DataSun
2008-11-23 16:23:13 —-D—- C:Program FilesTrend Micro
2008-11-23 14:48:57 —-D—- C:WINDOWStemp
2008-11-23 14:43:54 —-D—- C:WINDOWSERDNT
2008-11-22 19:36:40 —-A—- C:WINDOWSsystem32log.txt
2008-10-28 21:15:14 —-A—- C:WINDOWSWar3Unin.exe
2008-10-28 21:11:53 —-D—- C:Program FilesWarcraft III

======List of files/folders modified in the last 1 months======

2008-11-24 18:02:35 —-D—- C:Program FilesMozilla Firefox
2008-11-24 18:01:34 —-D—- C:WINDOWS
2008-11-24 17:59:37 —-D—- C:WINDOWSsystem32drivers
2008-11-24 17:58:24 —-A—- C:WINDOWSSchedLgU.Txt
2008-11-24 17:57:54 —-D—- C:Program FilesRapidshare Downloader
2008-11-24 17:56:55 —-D—- C:WINDOWSPrefetch
2008-11-24 15:49:27 —-RD—- C:Program Files
2008-11-24 15:49:26 —-D—- C:WINDOWSsystem32
2008-11-24 15:49:26 —-D—- C:Program FilesCommon Files
2008-11-24 13:42:16 —-D—- C:WINDOWSsystem32CatRoot2
2008-11-24 13:34:58 —-D—- C:Downloads
2008-11-24 12:50:58 —-A—- C:WINDOWSNeroDigital.ini
2008-11-23 23:03:27 —-SHD—- C:System Volume Information
2008-11-23 23:03:27 —-D—- C:WINDOWSsystem32Restore
2008-11-23 22:54:14 —-A—- C:WINDOWSsystem.ini
2008-11-23 22:53:14 —-D—- C:WINDOWSAppPatch
2008-11-23 16:56:11 —-SHD—- C:WINDOWSInstaller
2008-11-23 14:57:17 —-A—- C:WINDOWSsystem32PerfStringBackup.INI
2008-11-17 03:10:38 —-D—- C:Documents and SettingsUserApplication DatauTorrent
2008-11-09 22:29:56 —-D—- C:Program Filesloads
2008-11-07 20:42:33 —-D—- C:Documents and SettingsAll UsersApplication DataDVD Shrink
2008-10-29 09:51:19 —-SHD—- C:WINDOWSCSC
2008-10-28 18:29:23 —-D—- C:Program FilesWarcraft 3 — Frozen Throne

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK7;AMD K7 Processor Driver; C:WINDOWSsystem32DRIVERSamdk7.sys [2004-08-03 37376]
R1 easdrv;easdrv; C:WINDOWSsystem32DRIVERSeasdrv.sys [2007-12-21 30216]
R1 epfwtdir;epfwtdir; C:WINDOWSsystem32DRIVERSepfwtdir.sys [2007-12-21 33800]
R1 PCISys;PCISys; C:WINDOWSsystem32driverspcisys.sys [2007-08-28 39520]
R2 eamon;EAMON; C:WINDOWSsystem32DRIVERSeamon.sys [2007-12-21 39944]
R3 ALCXSENS;Service for WDM 3D Audio Driver; C:WINDOWSsystem32driversALCXSENS.SYS [2004-02-23 400384]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:WINDOWSsystem32driversALCXWDM.SYS [2004-02-26 611820]
R3 ati2mtag;ati2mtag; C:WINDOWSsystem32DRIVERSati2mtag.sys [2006-03-21 1522688]
R3 gdihook5;gdihook5; C:WINDOWSsystem32DRIVERSgdihook5.sys [2007-07-20 31328]
R3 NVENET;NVIDIA nForce MCP Networking Controller Driver; C:WINDOWSsystem32DRIVERSNVENET.sys [2002-11-27 80896]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:WINDOWSsystem32DRIVERSusbehci.sys [2004-08-03 26624]
R3 usbhub;USB2 Enabled Hub; C:WINDOWSsystem32DRIVERSusbhub.sys [2004-08-03 57600]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:WINDOWSsystem32DRIVERSusbohci.sys [2004-08-03 17024]
S3 a56ztnka;a56ztnka; C:WINDOWSsystem32driversa56ztnka.sys []
S3 ASPI;Advanced SCSI Programming Interface Driver; ??C:WINDOWSSystem32DRIVERSASPI32.sys []
S3 GMSIPCI;GMSIPCI; C:WINDOWSsystem32driversGMSIPCI.sys []
S3 HidUsb;Microsoft HID Class Driver; C:WINDOWSsystem32DRIVERShidusb.sys [2001-08-17 9600]
S3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:WINDOWSsystem32driversmsmpu401.sys [2001-08-17 2944]
S3 NTACCESS;NTACCESS; C:WINDOWSsystem32driversNTACCESS.sys []
S3 pcouffin;VSO Software pcouffin; C:WINDOWSSystem32Driverspcouffin.sys [2007-12-27 47360]
S3 Profos;Profos; C:WINDOWSsystem32driversProfos.sys []
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:WINDOWSsystem32DRIVERSRTL8139.SYS [2004-08-03 20992]
S3 SE27bus;Sony Ericsson Device 039 Driver driver (WDM); C:WINDOWSsystem32DRIVERSSE27bus.sys [2006-04-28 61600]
S3 SE27mdfl;Sony Ericsson Device 039 USB WMC Modem Filter; C:WINDOWSsystem32DRIVERSSE27mdfl.sys [2006-04-28 9360]
S3 SE27mdm;Sony Ericsson Device 039 USB WMC Modem Driver; C:WINDOWSsystem32DRIVERSSE27mdm.sys [2006-04-28 97184]
S3 SE27mgmt;Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM); C:WINDOWSsystem32DRIVERSSE27mgmt.sys [2006-04-28 88688]
S3 se27nd5;Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (NDIS); C:WINDOWSsystem32DRIVERSse27nd5.sys [2006-04-28 18704]
S3 SE27obex;Sony Ericsson Device 039 USB WMC OBEX Interface; C:WINDOWSsystem32DRIVERSSE27obex.sys [2006-04-28 86560]
S3 se27unic;Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (WDM); C:WINDOWSsystem32DRIVERSse27unic.sys [2006-04-28 90800]
S3 sermouse;Serial Mouse Driver; C:WINDOWSsystem32DRIVERSsermouse.sys [2001-08-17 17664]
S3 SetupNTGLM7X;SetupNTGLM7X; C:WINDOWSsystem32driversSetupNTGLM7X.sys []
S3 Trufos;Trufos; C:WINDOWSsystem32driversTrufos.sys []
S3 USB_RNDIS;USB Remote NDIS Network Device Driver; C:WINDOWSsystem32DRIVERSusb8023.sys [2004-08-03 12672]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:WINDOWSsystem32DRIVERSusbccgp.sys [2004-08-03 31616]
S3 usbscan;USB Scanner Driver; C:WINDOWSsystem32DRIVERSusbscan.sys [2004-08-03 15104]
S3 USBSTOR;USB Mass Storage Driver; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2004-08-03 26496]
S3 WpdUsb;WpdUsb; C:WINDOWSSystem32Driverswpdusb.sys [2004-08-11 18944]
S3 ZDCndis5;ZDCndis5 Protocol Driver; C:WINDOWSsystem32driversZDCndis5.sys []
S3 ZDPSp50;ZDPSp50 NDIS Protocol Driver; C:WINDOWSSystem32DriversZDPSp50.sys []
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []
S4 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:WINDOWSSystem32driversws2ifsl.sys [2001-08-23 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Ad-Aware 2007 Service; C:Program FilesLavasoftAd-Aware 2007aawservice.exe [2007-06-07 561152]
R2 Ati HotKey Poller;Ati HotKey Poller; C:WINDOWSsystem32Ati2evxx.exe [2006-03-21 405504]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:Program FilesBonjourmDNSResponder.exe [2006-02-28 229376]
R2 ekrn;Eset Service; C:Program FilesESETESET NOD32 Antivirusekrn.exe [2007-12-21 468224]
R2 ITGrdEngine;Guard Service; C:Documents and SettingsUserLocal SettingsApplication DataMicrosoftWindowsservices.exe [2008-11-22 202240]
R2 JavaQuickStarterService;Java Quick Starter; C:Program FilesJavajre6binjqs.exe [2008-11-23 152984]
R2 MDM;Machine Debug Manager; C:Program FilesCommon FilesMicrosoft SharedVS7Debugmdm.exe [2001-02-23 270336]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:Program FilesCyberLinkShared FilesRichVideo.exe [2007-01-08 171040]
R2 UMWdf;Windows User Mode Driver Framework; C:WINDOWSsystem32wdfmgr.exe [2004-08-11 38912]
R3 NMIndexingService;NMIndexingService; C:Program FilesCommon FilesAheadLibNMIndexingService.exe [2007-05-16 271920]
S2 ATI Smart;ATI Smart; C:WINDOWSsystem32ati2sgag.exe [2006-03-17 520192]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv1.1.4322aspnet_state.exe [2003-02-20 32768]
S3 EhttpSrv;Eset HTTP Server; C:Program FilesESETESET NOD32 AntivirusEHttpSrv.exe [2007-12-21 19200]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:Program FilesCommon FilesMacrovision SharedFLEXnet PublisherFNPLicensingService.exe [2007-09-14 654848]
S3 NBService;NBService; C:Program FilesNeroNero 7Nero BackItUpNBService.exe [2007-04-13 792112]

EOF

И еще раз большое спасибо!
24 ноября, 2008 в 2:12 пп в ответ на: помогите удалить Internet Antivirus Pro #19934
stealth5
Participant
- Темы:2
- Сообщений:10
сделал перезагрузку, все исправилось проблем больше нет! 😛 Спасибо большое.
А с программами которые я устанавливал для этого, оставить или можно удалять?
Еще раз спасибо большое!
24 ноября, 2008 в 1:52 пп в ответ на: помогите удалить Internet Antivirus Pro #19933
stealth5
Participant
- Темы:2
- Сообщений:10
Здравствуйте Valeri! Все сделал как вы сказали, нашло 30 заражений, но значки не исчезли (перезагрузку я не делал)
вот то что вы просили

Malwarebytes’ Anti-Malware 1.30
Версия базы данных: 1419
Windows 5.1.2600 Service Pack 2

24.11.2008 15:49:27
mbam-log-2008-11-24 (15-49-27).txt

Тип проверки: Быстрая
Проверено объектов: 47654
Прошло времени: 3 minute(s), 42 second(s)

Заражено процессов в памяти: 1
Заражено модулей в памяти: 0
Заражено ключей реестра: 9
Заражено значений реестра: 1
Заражено параметров реестра: 0
Заражено папок: 5
Заражено файлов: 14

Заражено процессов в памяти:
c:program filesInternet Antivirus ProIAPro.exe (Rogue.InternetAntivirus) -> Unloaded process successfully.

Заражено модулей в памяти:
(Вредоносные программы не обнаружены)

Заражено ключей реестра:
HKEY_CLASSES_ROOTbho.bho (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTbitaccelerator.bitaccelerator.1 (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTInterface{37fb07d0-16b8-4975-a848-1db62fee0048} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTTypelib{76bfb9cf-a8ab-4826-b2ab-02e04a202c73} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTAppID{f38636ed-e66e-4a37-822e-0c01f64d6605} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall{6d7b211a-88ea-490c-bab9-3600d8d7c503} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallInternet Antivirus Pro_is1 (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTAppIDwindivx.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOTwindivx.Video (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Заражено значений реестра:
HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRuninternet antivirus pro (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.

Заражено параметров реестра:
(Вредоносные программы не обнаружены)

Заражено папок:
C:Program FilesInternet Antivirus Pro (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:Program FilesInternet Antivirus Prodb (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:Program FilesConnectionServices (Adware.BHO) -> Quarantined and deleted successfully.
C:Documents and SettingsUserApplication DataInternet Antivirus Pro (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:Documents and SettingsUserApplication DataInternet Antivirus Prodb (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.

Заражено файлов:
C:Program FilesInternet Antivirus ProIAPro.exe (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:Program FilesInternet Antivirus Proworking.log (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:Program FilesConnectionServicesUninstall.exe (Adware.BHO) -> Quarantined and deleted successfully.
C:Documents and SettingsUserApplication DataInternet Antivirus Prosettings.ini (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:Documents and SettingsUserApplication DataInternet Antivirus Prouill.ini (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:Documents and SettingsUserApplication DataInternet Antivirus Prounins000.exe (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:Documents and SettingsUserApplication DataInternet Antivirus ProUninstall Internet Antivirus Pro.lnk (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:Documents and SettingsUserApplication DataInternet Antivirus Prodbconfig.cfg (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:Documents and SettingsUserApplication DataInternet Antivirus ProdbUrls.inf (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:Program FilesCommon FilesInternetAntivirusPro.exe (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:WINDOWSsystem32dllsys.dll (Stolen.Data) -> Quarantined and deleted successfully.
C:Program FilesCommon Filesfile.exe (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:Documents and SettingsUserLocal SettingsApplication DataMicrosoftWindowspguard.ini (Rogue.InternetAntivirus) -> Quarantined and deleted successfully.
C:Documents and SettingsUserApplication DataMicrosoftWindowswinlogon.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Logfile of random’s system information tool 1.04 (written by random/random)
Run by User at 2008-11-24 15:50:12
Microsoft Windows XP Professional Service Pack 2
System drive C: has 17 GB (22%) free of 76 GB
Total RAM: 511 MB (60% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:50:16, on 24.11.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSsystem32Ati2evxx.exe
C:Program FilesLavasoftAd-Aware 2007aawservice.exe
C:Program FilesBonjourmDNSResponder.exe
C:Program FilesESETESET NOD32 Antivirusekrn.exe
C:Documents and SettingsUserLocal SettingsApplication DataMicrosoftWindowsservices.exe
C:Program FilesJavajre6binjqs.exe
C:Program FilesCommon FilesMicrosoft SharedVS7Debugmdm.exe
C:Program FilesCyberLinkShared FilesRichVideo.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesCyberLinkPowerDVDPDVDServ.exe
C:WINDOWSSOUNDMAN.EXE
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:Program FilesESETESET NOD32 Antivirusegui.exe
C:Program FilesRapidshare DownloaderRD.exe
C:Program FilesJavajre6binjusched.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesCommon FilesAheadLibNMBgMonitor.exe
C:Program FilesCommon FilesAheadLibNMIndexingService.exe
C:Program FilesCommon FilesAheadLibNMIndexStoreSvr.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:WINDOWSexplorer.exe
C:WINDOWSsystem32NOTEPAD.EXE
C:Documents and SettingsUserDesktopRSIT.exe
C:Program FilesTrend MicroHijackThisUser.exe

R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.daemon-search.com/startpage

R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *.local
R3 — URLSearchHook: The Pirate Bay Toolbar — {a33fa729-d155-4b23-842b-2c665ecabdb6} — C:Program FilesThe_Pirate_BaytbThe_.dll
O2 — BHO: Adobe PDF Reader Link Helper — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 — BHO: flashget urlcatch — {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} — C:Program FilesRapidshare Downloaderjccatch.dll
O2 — BHO: Java(tm) Plug-In SSV Helper — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — C:Program FilesJavajre6binssv.dll
O2 — BHO: The Pirate Bay Toolbar — {a33fa729-d155-4b23-842b-2c665ecabdb6} — C:Program FilesThe_Pirate_BaytbThe_.dll
O2 — BHO: Java(tm) Plug-In 2 SSV Helper — {DBC80044-A445-435b-BC74-9C25C1C588A9} — C:Program FilesJavajre6binjp2ssv.dll
O2 — BHO: JQSIEStartDetectorImpl — {E7E6F031-17CE-4C07-BC86-EABFE594F69C} — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll
O3 — Toolbar: The Pirate Bay Toolbar — {a33fa729-d155-4b23-842b-2c665ecabdb6} — C:Program FilesThe_Pirate_BaytbThe_.dll
O4 — HKLM..Run: [Adobe Reader Speed Launcher] «C:Program FilesAdobeReader 8.0ReaderReader_sl.exe»
O4 — HKLM..Run: [RemoteControl] «C:Program FilesCyberLinkPowerDVDPDVDServ.exe»
O4 — HKLM..Run: [LanguageShortcut] «C:Program FilesCyberLinkPowerDVDLanguageLanguage.exe»
O4 — HKLM..Run: [NeroFilterCheck] C:Program FilesCommon FilesAheadLibNeroCheck.exe
O4 — HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 — HKLM..Run: [ATICCC] «C:Program FilesATI TechnologiesATI.ACEcli.exe» runtime -Delay
O4 — HKLM..Run: [egui] «C:Program FilesESETESET NOD32 Antivirusegui.exe» /hide /waitservice
O4 — HKLM..Run: [Flashget] C:Program FilesRapidshare DownloaderRD.exe /min
O4 — HKLM..Run: [SunJavaUpdateSched] «C:Program FilesJavajre6binjusched.exe»
O4 — HKLM..RunOnce: [Malwarebytes’ Anti-Malware] C:Program FilesMalwarebytes’ Anti-Malwarembamgui.exe /install /silent
O4 — HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] «C:Program FilesCommon FilesAheadLibNMBgMonitor.exe»
O4 — HKCU..Run: [DAEMON Tools Lite] «C:Program FilesDAEMON Tools Litedaemon.exe»
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOfficeOSA9.EXE
O8 — Extra context menu item: &Download All with Rapidshare Downloader — C:Program FilesRapidshare Downloaderjc_all.htm
O8 — Extra context menu item: &Download with Rapidshare Downloader — C:Program FilesRapidshare Downloaderjc_link.htm
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2Office10EXCEL.EXE/3000
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O16 — DPF: {31150A86-0BBA-409F-BEB4-F3922D10BF34} (Gif89 Class) — file://C:Program FilesWindows SidebarGadgetsxplugCam.gadgeten-USxplug.ocx
O16 — DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) — http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 — HKLMSystemCCSServicesTcpip..{049BBB46-3CC6-47DF-AC3B-FAC485223C61}: NameServer = 192.168.0.20
O17 — HKLMSystemCS1ServicesTcpip..{049BBB46-3CC6-47DF-AC3B-FAC485223C61}: NameServer = 192.168.0.20
O17 — HKLMSystemCS2ServicesTcpip..{049BBB46-3CC6-47DF-AC3B-FAC485223C61}: NameServer = 192.168.0.20
O23 — Service: Ad-Aware 2007 Service (aawservice) — Lavasoft AB — C:Program FilesLavasoftAd-Aware 2007aawservice.exe
O23 — Service: Ati HotKey Poller — ATI Technologies Inc. — C:WINDOWSsystem32Ati2evxx.exe
O23 — Service: ATI Smart — Unknown owner — C:WINDOWSsystem32ati2sgag.exe
O23 — Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) — Apple Computer, Inc. — C:Program FilesBonjourmDNSResponder.exe
O23 — Service: Eset HTTP Server (EhttpSrv) — ESET — C:Program FilesESETESET NOD32 AntivirusEHttpSrv.exe
O23 — Service: Eset Service (ekrn) — ESET — C:Program FilesESETESET NOD32 Antivirusekrn.exe
O23 — Service: FLEXnet Licensing Service — Macrovision Europe Ltd. — C:Program FilesCommon FilesMacrovision SharedFLEXnet PublisherFNPLicensingService.exe
O23 — Service: Guard Service (ITGrdEngine) — Unknown owner — C:Documents and SettingsUserLocal SettingsApplication DataMicrosoftWindowsservices.exe
O23 — Service: Java Quick Starter (JavaQuickStarterService) — Sun Microsystems, Inc. — C:Program FilesJavajre6binjqs.exe
O23 — Service: NBService — Nero AG — C:Program FilesNeroNero 7Nero BackItUpNBService.exe
O23 — Service: NMIndexingService — Nero AG — C:Program FilesCommon FilesAheadLibNMIndexingService.exe
O23 — Service: Cyberlink RichVideo Service(CRVS) (RichVideo) — Unknown owner — C:Program FilesCyberLinkShared FilesRichVideo.exe

—
End of file — 7447 bytes

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}]
FGCatchUrl — C:Program FilesRapidshare Downloaderjccatch.dll [2007-03-27 75528]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper — C:Program FilesJavajre6binssv.dll [2008-11-23 320920]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{a33fa729-d155-4b23-842b-2c665ecabdb6}]
The Pirate Bay Toolbar — C:Program FilesThe_Pirate_BaytbThe_.dll [2008-06-03 1542168]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper — C:Program FilesJavajre6binjp2ssv.dll [2008-11-23 34816]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll [2008-11-23 73728]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{a33fa729-d155-4b23-842b-2c665ecabdb6} — The Pirate Bay Toolbar — C:Program FilesThe_Pirate_BaytbThe_.dll [2008-06-03 1542168]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«Adobe Reader Speed Launcher»=C:Program FilesAdobeReader 8.0ReaderReader_sl.exe [2007-05-11 40048]
«RemoteControl»=C:Program FilesCyberLinkPowerDVDPDVDServ.exe [2007-01-08 68640]
«LanguageShortcut»=C:Program FilesCyberLinkPowerDVDLanguageLanguage.exe [2007-01-08 52256]
«NeroFilterCheck»=C:Program FilesCommon FilesAheadLibNeroCheck.exe [2007-03-01 153136]
«SoundMan»=C:WINDOWSSOUNDMAN.EXE [2004-02-26 65024]
«ATICCC»=C:Program FilesATI TechnologiesATI.ACEcli.exe [2006-01-02 45056]
«egui»=C:Program FilesESETESET NOD32 Antivirusegui.exe [2007-12-21 1443072]
«Flashget»=C:Program FilesRapidshare DownloaderRD.exe [2007-03-27 1708032]
«SunJavaUpdateSched»=C:Program FilesJavajre6binjusched.exe [2008-11-23 136600]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnce]
«Malwarebytes’ Anti-Malware»=C:Program FilesMalwarebytes’ Anti-Malwarembamgui.exe [2008-10-22 399504]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«ctfmon.exe»=C:WINDOWSsystem32ctfmon.exe [2004-08-03 15360]
«BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=C:Program FilesCommon FilesAheadLibNMBgMonitor.exe [2007-05-16 153136]
«DAEMON Tools Lite»=C:Program FilesDAEMON Tools Litedaemon.exe [2007-12-29 486856]

C:Documents and SettingsAll UsersStart MenuProgramsStartup
Microsoft Office.lnk — C:Program FilesMicrosoft OfficeOfficeOSA9.EXE

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyAtiExtEvent]
C:WINDOWSsystem32Ati2evxx.dll [2006-03-21 61440]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalaawservice]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkaawservice]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkclient32]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkvsmon]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDrives»=0

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=
«NoDrives»=
«NoDriveAutoRun»=

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesBonjourmDNSResponder.exe»=»C:Program FilesBonjourmDNSResponder.exe:*:Enabled:Bonjour»
«C:Program FilesNeroNero 7Nero ShowTimeShowTime.exe»=»C:Program FilesNeroNero 7Nero ShowTimeShowTime.exe:*:Enabled:Nero ShowTime»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{7344381a-210d-11dd-87fc-000c76334b75}]
shellAutoRuncommand — F:intro.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{b0518c03-236e-11dc-ac82-806d6172696f}]
shellAutoRuncommand — D:setup.exe

======List of files/folders created in the last 1 months======

2008-11-24 15:41:20 —-D—- C:Documents and SettingsUserApplication DataMalwarebytes
2008-11-24 15:41:13 —-D—- C:Documents and SettingsAll UsersApplication DataMalwarebytes
2008-11-24 15:41:12 —-D—- C:Program FilesMalwarebytes’ Anti-Malware
2008-11-23 23:52:21 —-SHD—- C:RECYCLER
2008-11-23 23:03:05 —-D—- C:ComboFix
2008-11-23 22:55:19 —-A—- C:ComboFix.txt
2008-11-23 17:49:38 —-D—- C:rsit
2008-11-23 16:55:12 —-A—- C:WINDOWSsystem32javaws.exe
2008-11-23 16:55:12 —-A—- C:WINDOWSsystem32javaw.exe
2008-11-23 16:55:12 —-A—- C:WINDOWSsystem32java.exe
2008-11-23 16:55:12 —-A—- C:WINDOWSsystem32deploytk.dll
2008-11-23 16:54:51 —-D—- C:Program FilesJava
2008-11-23 16:51:21 —-D—- C:Documents and SettingsUserApplication DataSun
2008-11-23 16:23:13 —-D—- C:Program FilesTrend Micro
2008-11-23 14:48:57 —-D—- C:WINDOWStemp
2008-11-23 14:43:54 —-D—- C:WINDOWSERDNT
2008-11-22 19:36:40 —-A—- C:WINDOWSsystem32log.txt
2008-10-28 21:15:14 —-A—- C:WINDOWSWar3Unin.exe
2008-10-28 21:11:53 —-D—- C:Program FilesWarcraft III

======List of files/folders modified in the last 1 months======

2008-11-24 15:49:27 —-RD—- C:Program Files
2008-11-24 15:49:26 —-D—- C:WINDOWSsystem32
2008-11-24 15:49:26 —-D—- C:Program FilesCommon Files
2008-11-24 15:45:21 —-D—- C:Program FilesRapidshare Downloader
2008-11-24 15:44:35 —-D—- C:Program FilesMozilla Firefox
2008-11-24 15:41:20 —-D—- C:WINDOWSPrefetch
2008-11-24 15:41:17 —-D—- C:WINDOWSsystem32drivers
2008-11-24 13:42:16 —-D—- C:WINDOWSsystem32CatRoot2
2008-11-24 13:34:58 —-D—- C:Downloads
2008-11-24 12:50:58 —-A—- C:WINDOWSNeroDigital.ini
2008-11-24 11:09:43 —-D—- C:WINDOWS
2008-11-24 03:32:07 —-A—- C:WINDOWSSchedLgU.Txt
2008-11-23 23:03:27 —-SHD—- C:System Volume Information
2008-11-23 23:03:27 —-D—- C:WINDOWSsystem32Restore
2008-11-23 22:54:14 —-A—- C:WINDOWSsystem.ini
2008-11-23 22:53:14 —-D—- C:WINDOWSAppPatch
2008-11-23 16:56:11 —-SHD—- C:WINDOWSInstaller
2008-11-23 14:57:17 —-A—- C:WINDOWSsystem32PerfStringBackup.INI
2008-11-17 03:10:38 —-D—- C:Documents and SettingsUserApplication DatauTorrent
2008-11-09 22:29:56 —-D—- C:Program Filesloads
2008-11-07 20:42:33 —-D—- C:Documents and SettingsAll UsersApplication DataDVD Shrink
2008-10-29 09:51:19 —-SHD—- C:WINDOWSCSC
2008-10-28 18:29:23 —-D—- C:Program FilesWarcraft 3 — Frozen Throne

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK7;AMD K7 Processor Driver; C:WINDOWSsystem32DRIVERSamdk7.sys [2004-08-03 37376]
R1 easdrv;easdrv; C:WINDOWSsystem32DRIVERSeasdrv.sys [2007-12-21 30216]
R1 epfwtdir;epfwtdir; C:WINDOWSsystem32DRIVERSepfwtdir.sys [2007-12-21 33800]
R1 PCISys;PCISys; C:WINDOWSsystem32driverspcisys.sys [2007-08-28 39520]
R2 eamon;EAMON; C:WINDOWSsystem32DRIVERSeamon.sys [2007-12-21 39944]
R3 ALCXSENS;Service for WDM 3D Audio Driver; C:WINDOWSsystem32driversALCXSENS.SYS [2004-02-23 400384]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:WINDOWSsystem32driversALCXWDM.SYS [2004-02-26 611820]
R3 ati2mtag;ati2mtag; C:WINDOWSsystem32DRIVERSati2mtag.sys [2006-03-21 1522688]
R3 gdihook5;gdihook5; C:WINDOWSsystem32DRIVERSgdihook5.sys [2007-07-20 31328]
R3 NVENET;NVIDIA nForce MCP Networking Controller Driver; C:WINDOWSsystem32DRIVERSNVENET.sys [2002-11-27 80896]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:WINDOWSsystem32DRIVERSusbehci.sys [2004-08-03 26624]
R3 usbhub;USB2 Enabled Hub; C:WINDOWSsystem32DRIVERSusbhub.sys [2004-08-03 57600]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:WINDOWSsystem32DRIVERSusbohci.sys [2004-08-03 17024]
S3 ashuolkf;ashuolkf; C:WINDOWSsystem32driversashuolkf.sys []
S3 ASPI;Advanced SCSI Programming Interface Driver; ??C:WINDOWSSystem32DRIVERSASPI32.sys []
S3 GMSIPCI;GMSIPCI; C:WINDOWSsystem32driversGMSIPCI.sys []
S3 HidUsb;Microsoft HID Class Driver; C:WINDOWSsystem32DRIVERShidusb.sys [2001-08-17 9600]
S3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:WINDOWSsystem32driversmsmpu401.sys [2001-08-17 2944]
S3 NTACCESS;NTACCESS; C:WINDOWSsystem32driversNTACCESS.sys []
S3 pcouffin;VSO Software pcouffin; C:WINDOWSSystem32Driverspcouffin.sys [2007-12-27 47360]
S3 Profos;Profos; C:WINDOWSsystem32driversProfos.sys []
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:WINDOWSsystem32DRIVERSRTL8139.SYS [2004-08-03 20992]
S3 SE27bus;Sony Ericsson Device 039 Driver driver (WDM); C:WINDOWSsystem32DRIVERSSE27bus.sys [2006-04-28 61600]
S3 SE27mdfl;Sony Ericsson Device 039 USB WMC Modem Filter; C:WINDOWSsystem32DRIVERSSE27mdfl.sys [2006-04-28 9360]
S3 SE27mdm;Sony Ericsson Device 039 USB WMC Modem Driver; C:WINDOWSsystem32DRIVERSSE27mdm.sys [2006-04-28 97184]
S3 SE27mgmt;Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM); C:WINDOWSsystem32DRIVERSSE27mgmt.sys [2006-04-28 88688]
S3 se27nd5;Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (NDIS); C:WINDOWSsystem32DRIVERSse27nd5.sys [2006-04-28 18704]
S3 SE27obex;Sony Ericsson Device 039 USB WMC OBEX Interface; C:WINDOWSsystem32DRIVERSSE27obex.sys [2006-04-28 86560]
S3 se27unic;Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (WDM); C:WINDOWSsystem32DRIVERSse27unic.sys [2006-04-28 90800]
S3 sermouse;Serial Mouse Driver; C:WINDOWSsystem32DRIVERSsermouse.sys [2001-08-17 17664]
S3 SetupNTGLM7X;SetupNTGLM7X; C:WINDOWSsystem32driversSetupNTGLM7X.sys []
S3 Trufos;Trufos; C:WINDOWSsystem32driversTrufos.sys []
S3 USB_RNDIS;USB Remote NDIS Network Device Driver; C:WINDOWSsystem32DRIVERSusb8023.sys [2004-08-03 12672]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:WINDOWSsystem32DRIVERSusbccgp.sys [2004-08-03 31616]
S3 usbscan;USB Scanner Driver; C:WINDOWSsystem32DRIVERSusbscan.sys [2004-08-03 15104]
S3 USBSTOR;USB Mass Storage Driver; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2004-08-03 26496]
S3 WpdUsb;WpdUsb; C:WINDOWSSystem32Driverswpdusb.sys [2004-08-11 18944]
S3 ZDCndis5;ZDCndis5 Protocol Driver; C:WINDOWSsystem32driversZDCndis5.sys []
S3 ZDPSp50;ZDPSp50 NDIS Protocol Driver; C:WINDOWSSystem32DriversZDPSp50.sys []
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []
S4 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:WINDOWSSystem32driversws2ifsl.sys [2001-08-23 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Ad-Aware 2007 Service; C:Program FilesLavasoftAd-Aware 2007aawservice.exe [2007-06-07 561152]
R2 Ati HotKey Poller;Ati HotKey Poller; C:WINDOWSsystem32Ati2evxx.exe [2006-03-21 405504]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:Program FilesBonjourmDNSResponder.exe [2006-02-28 229376]
R2 ekrn;Eset Service; C:Program FilesESETESET NOD32 Antivirusekrn.exe [2007-12-21 468224]
R2 ITGrdEngine;Guard Service; C:Documents and SettingsUserLocal SettingsApplication DataMicrosoftWindowsservices.exe [2008-11-22 202240]
R2 JavaQuickStarterService;Java Quick Starter; C:Program FilesJavajre6binjqs.exe [2008-11-23 152984]
R2 MDM;Machine Debug Manager; C:Program FilesCommon FilesMicrosoft SharedVS7Debugmdm.exe [2001-02-23 270336]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:Program FilesCyberLinkShared FilesRichVideo.exe [2007-01-08 171040]
R2 UMWdf;Windows User Mode Driver Framework; C:WINDOWSsystem32wdfmgr.exe [2004-08-11 38912]
R3 NMIndexingService;NMIndexingService; C:Program FilesCommon FilesAheadLibNMIndexingService.exe [2007-05-16 271920]
S2 ATI Smart;ATI Smart; C:WINDOWSsystem32ati2sgag.exe [2006-03-17 520192]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv1.1.4322aspnet_state.exe [2003-02-20 32768]
S3 EhttpSrv;Eset HTTP Server; C:Program FilesESETESET NOD32 AntivirusEHttpSrv.exe [2007-12-21 19200]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:Program FilesCommon FilesMacrovision SharedFLEXnet PublisherFNPLicensingService.exe [2007-09-14 654848]
S3 NBService;NBService; C:Program FilesNeroNero 7Nero BackItUpNBService.exe [2007-04-13 792112]

EOF
23 ноября, 2008 в 3:52 пп в ответ на: помогите удалить Internet Antivirus Pro #19931
stealth5
Participant
- Темы:2
- Сообщений:10
я перезапустил компютер после этой процедуры но значки не исчезли все продолжается так же как и было.
Если это важно.
Вот то что вы просили.

info.txt logfile of random’s system information tool 1.04 2008-11-23 17:49:52

======Uninstall list======

—>C:Program FilesNeroNero 7\nerouninstallUNNERO.exe /UNINSTALL
—>C:Program FilesWeflirt/uninstall.exe
—>C:WINDOWSUNNeroBackItUp.exe /UNINSTALL
—>C:WINDOWSUNNeroMediaHome.exe /UNINSTALL
—>C:WINDOWSUNNeroShowTime.exe /UNINSTALL
—>C:WINDOWSUNNeroVision.exe /UNINSTALL
—>C:WINDOWSUNRecode.exe /UNINSTALL
—>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:WINDOWSINFPCHealth.inf
4Musics Multiformat Converter 2.2—>»C:Program Files4Musics Multiformat Converterunins000.exe»
4U WMA MP3 Converter 5.9.3—>»C:Program Files4U ComputingWMA MP3 Converterunins000.exe»
Ad-Aware 2007—>MsiExec.exe /X{0E6AB9FC-76C2-431B-9C06-6C1CFFFEA8EB}
Adobe Anchor Service CS3—>MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}
Adobe Asset Services CS3—>MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}
Adobe Bridge CS3—>MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}
Adobe Bridge Start Meeting—>MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}
Adobe Camera Raw 4.0—>MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}
Adobe CMaps—>MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}
Adobe Color — Photoshop Specific—>MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E}
Adobe Color Common Settings—>MsiExec.exe /I{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}
Adobe Color EU Extra Settings—>MsiExec.exe /I{51846830-E7B2-4218-8968-B77F0FF475B8}
Adobe Color EU Recommended Settings—>MsiExec.exe /I{BD087F50-46B2-43E4-BD73-5DB3DC20B47C}
Adobe Color JA Extra Settings—>MsiExec.exe /I{D92B72E2-C854-4738-8ED6-4C3661CC17AE}
Adobe Color NA Extra Settings—>MsiExec.exe /I{6179A7D2-A668-4F1D-BC9A-DCC6A10C7871}
Adobe Color NA Recommended Settings—>MsiExec.exe /I{95655ED4-7CA5-46DF-907F-7144877A32E5}
Adobe Default Language CS3—>MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}
Adobe Device Central CS3—>MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}
Adobe ExtendScript Toolkit 2—>C:Program FilesCommon FilesAdobeInstallers5bc0f8414ec36c555a3e7e5ec2e225eSetup.exe
Adobe ExtendScript Toolkit 2—>MsiExec.exe /I{1BCEA516-B4C5-4B2D-BFA0-AB7910BAD862}
Adobe Flash Player Plugin—>C:WINDOWSsystem32MacromedFlashuninstall_plugin.exe
Adobe Fonts All—>MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B}
Adobe Help Viewer CS3—>MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245}
Adobe Linguistics CS3—>MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078}
Adobe PDF Library Files—>MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}
Adobe Photoshop CS3—>C:Program FilesCommon FilesAdobeInstallers719d6f144d0c086a0dfa7ff76bb9ac1Setup.exe
Adobe Photoshop CS3—>MsiExec.exe /I{3D7E3EC9-46CF-4359-9289-39CE01DFB82F}
Adobe Photoshop CS3—>MsiExec.exe /I{FD0399AC-A38B-4D4B-8164-D7B73AC24030}
Adobe Reader 8.1.0—>MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81000000003}
Adobe Setup—>MsiExec.exe /I{D504303A-717D-414C-BA9F-FE01093E2EF8}
Adobe Setup—>MsiExec.exe /I{FF11004C-F42A-4A31-9BCF-7F5C8FDBE53C}
Adobe Stock Photos CS3—>MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183}
Adobe Type Support—>MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}
Adobe Update Manager CS3—>MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}
Adobe Version Cue CS3 Client—>MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}
Adobe WinSoft Linguistics Plugin—>MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}
Adobe XMP Panels CS3—>MsiExec.exe /I{802771A9-A856-4A41-ACF7-1450E523C923}
Alky for Applications (Windows XP)—>MsiExec.exe /X{BB05D173-9681-4812-A7FA-BD4042A3DA00}
ATI — Утилита деинсталляции—>C:Program FilesATI TechnologiesUninstallAllAtiCimUn.exe
ATI Catalyst Control Center—>MsiExec.exe /I{E74138F2-5F04-4E4F-8389-419E012C9B4C}
ATI Display Driver—>rundll32 C:WINDOWSsystem32atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
ATI HYDRAVISION—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{083F79E4-6FE9-46FB-A6C6-4F8862742947}setup.exe»
ATI Parental Control & Encoder—>MsiExec.exe /I{8D70145A-3BD3-4DBF-9CBF-223EF4A43257}
ConnectionServices—>»C:Program FilesConnectionServicesUninstall.exe»
DivX Content Uploader—>C:Program FilesDivXDivXContentUploaderUninstall.exe /CUPLOADER
DivX Web Player—>C:Program FilesDivXDivXWebPlayerUninstall.exe /PLUGIN
Do You Like Horny Bunnies 2—>C:WINDOWSIsUn0419.exe -f»C:GAMESTRIADADo You Like Horny Bunnies 2Uninst.isu»
DVD Shrink 3.2—>»C:Program FilesDVD Shrinkunins000.exe»
ESET NOD32 Antivirus—>MsiExec.exe /I{57ECFB4D-FE11-491A-9AA0-0AF7C3ABC51D}
F-Strippoker—>C:Program FilesF-Strippokeruninstall.exe
HijackThis 2.0.2—>»C:Program FilesTrend MicroHijackThisHijackThis.exe» /uninstall
Java(TM) 6 Update 10—>MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216010FF}
K-Lite Codec Pack 3.5.3 Standard—>»C:Program FilesK-Lite Codec Packunins000.exe»
Media Project —>C:Program FilesNetProjectuninst.exe
Microsoft .NET Framework 1.1—>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft National Language Support Downlevel APIs—>»C:WINDOWS$NtServicePackUninstallNLSDownlevelMapping$spuninstspuninst.exe»
Microsoft Visual C++ 2005 Redistributable—>MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mozilla Firefox (3.0.4)—>C:Program FilesMozilla Firefoxuninstallhelper.exe
Nero 7 Ultra Edition—>MsiExec.exe /X{A20A58C4-6784-4B4B-86CC-94E2E3671049}
neroxml—>MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
Online Sercive Tool —>C:Program FilesWeb Technologiesuninst.exe
OpenSSL 0.9.6m—>C:OpenSSLunins000.exe
Panda ActiveScan—>C:WINDOWSsystem32ASUninst.exe Panda ActiveScan
PDF Settings—>MsiExec.exe /I{293D5729-7C01-4FA4-A4DE-BB6A1587BBB9}
PhotoKit Color 2 Plug-In Module—>C:WINDOWSunvise32.exe C:Program FilesPixelGenius Toolbox Plug-In Modulepkc2_uninstal.log
PowerDVD—>»C:Program FilesInstallShield Installation Information{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}Setup.exe» -l0x000409 /z-uninstall
Product Key Explorer 1.3—>»C:Program FilesNsasoftProductKeyExplorerunins000.exe»
Project64 1.6—>MsiExec.exe /X{9559F7CA-5E34-4237-A2D9-D856464AD727}
Rapidshare Downloader. Premium Master 1.8—>»C:Program FilesRapidshare Downloaderunins000.exe»
Realtek AC’97 Audio—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{FB08F381-6533-4108-B7DD-039E11FBC27E}setup.exe» REMOVE
Siemens ADSL Router USB Driver—>C:Program FilesInstallShield Installation Information{4D72C47A-8A8C-49C4-BFAC-34EC5D65183B}setup.exe -runfromtemp -l0x0009 -removeonly FORCE_UNINSTALL
TM FilePacker—>C:Program FilesTM FilePackerUninstall.exe
uTorrent [tfile.ru edition]—>C:Program FilesuTorrent [tfile.ru]uninstall.exe
VirtualNetwork—>»C:Program FilesVirtualNetworkUninstall.exe»
Windows Installer 3.1 (KB893803)—>»C:WINDOWS$MSI31Uninstall_KB893803v2$spuninstspuninst.exe»
Windows Media Format Runtime—>»C:Program FilesWindows Media Playerwmsetsdk.exe» /UninstallAll
Архиватор WinRAR—>C:Program FilesWinRARuninstall.exe
Говорит и показывает Фотошоп 1.0—>»C:PhotoshopTVunins000.exe»
Птички на проводе—>C:Program FilesReadMe.ruПтички на проводеuninstal.exe
Расширенный выпуск Microsoft Office 2000—>MsiExec.exe /I{00000419-78E1-11D2-B60F-006097C998E7}
Страна пазлов—>C:Program FilesAlawar.ruСтрана пазловUninstall.exe

=====HijackThis Backups=====

O4 — HKCU..Run: [Internet Antivirus Pro] «C:program filesInternet Antivirus ProIAPro.exe» /s
O4 — HKCU..Run: [Microsoft Windows logon process] C:Documents and SettingsUserApplication DataMicrosoftWindowswinlogon.exe

======Security center information======

AV: ESET NOD32 Antivirus 3.0

======Environment variables======

«ComSpec»=%SystemRoot%system32cmd.exe
«Path»=%systemroot%system32;%systemroot%;%systemroot%system32wbem;C:Program FilesAlky for ApplicationsLibraries
«windir»=%SystemRoot%
«FP_NO_HOST_CHECK»=NO
«OS»=Windows_NT
«PROCESSOR_ARCHITECTURE»=x86
«PROCESSOR_LEVEL»=6
«PROCESSOR_IDENTIFIER»=x86 Family 6 Model 10 Stepping 0, AuthenticAMD
«PROCESSOR_REVISION»=0a00
«NUMBER_OF_PROCESSORS»=1
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP
«OPENSSL_CONF»=C:OpenSSLbinopenssl.cnf

EOF

Logfile of random’s system information tool 1.04 (written by random/random)
Run by User at 2008-11-23 17:49:38
Microsoft Windows XP Professional Service Pack 2
System drive C: has 20 GB (27%) free of 76 GB
Total RAM: 511 MB (19% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:49:50, on 23.11.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesLavasoftAd-Aware 2007aawservice.exe
C:Program FilesBonjourmDNSResponder.exe
C:WINDOWSsystem32Ati2evxx.exe
C:Program FilesESETESET NOD32 Antivirusekrn.exe
C:Documents and SettingsUserLocal SettingsApplication DataMicrosoftWindowsservices.exe
C:WINDOWSExplorer.EXE
C:Program FilesJavajre6binjqs.exe
C:Program FilesCommon FilesMicrosoft SharedVS7Debugmdm.exe
c:program filesInternet Antivirus ProIAPro.exe
C:Program FilesCyberLinkShared FilesRichVideo.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesAdobeReader 8.0ReaderReader_sl.exe
C:Program FilesCyberLinkPowerDVDPDVDServ.exe
C:WINDOWSSOUNDMAN.EXE
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:Program FilesESETESET NOD32 Antivirusegui.exe
C:Program FilesRapidshare DownloaderRD.exe
C:Program FilesJavajre6binjusched.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesCommon FilesAheadLibNMBgMonitor.exe
C:Program FilesDAEMON Tools Litedaemon.exe
C:Program FilesCommon FilesAheadLibNMIndexingService.exe
C:Program FilesCommon FilesAheadLibNMIndexStoreSvr.exe
C:WINDOWSsystem32wuauclt.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:Documents and SettingsUserDesktopRSIT.exe
C:Program FilesTrend MicroHijackThisUser.exe

R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.daemon-search.com/startpage

R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *.local
R3 — URLSearchHook: The Pirate Bay Toolbar — {a33fa729-d155-4b23-842b-2c665ecabdb6} — C:Program FilesThe_Pirate_BaytbThe_.dll
O2 — BHO: Adobe PDF Reader Link Helper — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 — BHO: flashget urlcatch — {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} — C:Program FilesRapidshare Downloaderjccatch.dll
O2 — BHO: Java(tm) Plug-In SSV Helper — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — C:Program FilesJavajre6binssv.dll
O2 — BHO: The Pirate Bay Toolbar — {a33fa729-d155-4b23-842b-2c665ecabdb6} — C:Program FilesThe_Pirate_BaytbThe_.dll
O2 — BHO: Java(tm) Plug-In 2 SSV Helper — {DBC80044-A445-435b-BC74-9C25C1C588A9} — C:Program FilesJavajre6binjp2ssv.dll
O2 — BHO: JQSIEStartDetectorImpl — {E7E6F031-17CE-4C07-BC86-EABFE594F69C} — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll
O3 — Toolbar: The Pirate Bay Toolbar — {a33fa729-d155-4b23-842b-2c665ecabdb6} — C:Program FilesThe_Pirate_BaytbThe_.dll
O4 — HKLM..Run: [Adobe Reader Speed Launcher] «C:Program FilesAdobeReader 8.0ReaderReader_sl.exe»
O4 — HKLM..Run: [RemoteControl] «C:Program FilesCyberLinkPowerDVDPDVDServ.exe»
O4 — HKLM..Run: [LanguageShortcut] «C:Program FilesCyberLinkPowerDVDLanguageLanguage.exe»
O4 — HKLM..Run: [NeroFilterCheck] C:Program FilesCommon FilesAheadLibNeroCheck.exe
O4 — HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 — HKLM..Run: [ATICCC] «C:Program FilesATI TechnologiesATI.ACEcli.exe» runtime -Delay
O4 — HKLM..Run: [egui] «C:Program FilesESETESET NOD32 Antivirusegui.exe» /hide /waitservice
O4 — HKLM..Run: [Flashget] C:Program FilesRapidshare DownloaderRD.exe /min
O4 — HKLM..Run: [SunJavaUpdateSched] «C:Program FilesJavajre6binjusched.exe»
O4 — HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] «C:Program FilesCommon FilesAheadLibNMBgMonitor.exe»
O4 — HKCU..Run: [DAEMON Tools Lite] «C:Program FilesDAEMON Tools Litedaemon.exe»
O4 — HKCU..Run: [Internet Antivirus Pro] «c:program filesInternet Antivirus ProIAPro.exe» /s
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOfficeOSA9.EXE
O8 — Extra context menu item: &Download All with Rapidshare Downloader — C:Program FilesRapidshare Downloaderjc_all.htm
O8 — Extra context menu item: &Download with Rapidshare Downloader — C:Program FilesRapidshare Downloaderjc_link.htm
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2Office10EXCEL.EXE/3000
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O16 — DPF: {31150A86-0BBA-409F-BEB4-F3922D10BF34} (Gif89 Class) — file://C:Program FilesWindows SidebarGadgetsxplugCam.gadgeten-USxplug.ocx
O16 — DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) — http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 — HKLMSystemCCSServicesTcpip..{049BBB46-3CC6-47DF-AC3B-FAC485223C61}: NameServer = 192.168.0.20
O17 — HKLMSystemCS1ServicesTcpip..{049BBB46-3CC6-47DF-AC3B-FAC485223C61}: NameServer = 192.168.0.20
O17 — HKLMSystemCS2ServicesTcpip..{049BBB46-3CC6-47DF-AC3B-FAC485223C61}: NameServer = 192.168.0.20
O23 — Service: Ad-Aware 2007 Service (aawservice) — Lavasoft AB — C:Program FilesLavasoftAd-Aware 2007aawservice.exe
O23 — Service: Ati HotKey Poller — ATI Technologies Inc. — C:WINDOWSsystem32Ati2evxx.exe
O23 — Service: ATI Smart — Unknown owner — C:WINDOWSsystem32ati2sgag.exe
O23 — Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) — Apple Computer, Inc. — C:Program FilesBonjourmDNSResponder.exe
O23 — Service: Eset HTTP Server (EhttpSrv) — ESET — C:Program FilesESETESET NOD32 AntivirusEHttpSrv.exe
O23 — Service: Eset Service (ekrn) — ESET — C:Program FilesESETESET NOD32 Antivirusekrn.exe
O23 — Service: FLEXnet Licensing Service — Macrovision Europe Ltd. — C:Program FilesCommon FilesMacrovision SharedFLEXnet PublisherFNPLicensingService.exe
O23 — Service: Guard Service (ITGrdEngine) — Unknown owner — C:Documents and SettingsUserLocal SettingsApplication DataMicrosoftWindowsservices.exe
O23 — Service: Java Quick Starter (JavaQuickStarterService) — Sun Microsystems, Inc. — C:Program FilesJavajre6binjqs.exe
O23 — Service: NBService — Nero AG — C:Program FilesNeroNero 7Nero BackItUpNBService.exe
O23 — Service: NMIndexingService — Nero AG — C:Program FilesCommon FilesAheadLibNMIndexingService.exe
O23 — Service: Cyberlink RichVideo Service(CRVS) (RichVideo) — Unknown owner — C:Program FilesCyberLinkShared FilesRichVideo.exe

—
End of file — 7589 bytes

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}]
FGCatchUrl — C:Program FilesRapidshare Downloaderjccatch.dll [2007-03-27 75528]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper — C:Program FilesJavajre6binssv.dll [2008-11-23 320920]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{a33fa729-d155-4b23-842b-2c665ecabdb6}]
The Pirate Bay Toolbar — C:Program FilesThe_Pirate_BaytbThe_.dll [2008-06-03 1542168]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper — C:Program FilesJavajre6binjp2ssv.dll [2008-11-23 34816]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll [2008-11-23 73728]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{a33fa729-d155-4b23-842b-2c665ecabdb6} — The Pirate Bay Toolbar — C:Program FilesThe_Pirate_BaytbThe_.dll [2008-06-03 1542168]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«Adobe Reader Speed Launcher»=C:Program FilesAdobeReader 8.0ReaderReader_sl.exe [2007-05-11 40048]
«RemoteControl»=C:Program FilesCyberLinkPowerDVDPDVDServ.exe [2007-01-08 68640]
«LanguageShortcut»=C:Program FilesCyberLinkPowerDVDLanguageLanguage.exe [2007-01-08 52256]
«NeroFilterCheck»=C:Program FilesCommon FilesAheadLibNeroCheck.exe [2007-03-01 153136]
«SoundMan»=C:WINDOWSSOUNDMAN.EXE [2004-02-26 65024]
«ATICCC»=C:Program FilesATI TechnologiesATI.ACEcli.exe [2006-01-02 45056]
«egui»=C:Program FilesESETESET NOD32 Antivirusegui.exe [2007-12-21 1443072]
«Flashget»=C:Program FilesRapidshare DownloaderRD.exe [2007-03-27 1708032]
«SunJavaUpdateSched»=C:Program FilesJavajre6binjusched.exe [2008-11-23 136600]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«ctfmon.exe»=C:WINDOWSsystem32ctfmon.exe [2004-08-03 15360]
«BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=C:Program FilesCommon FilesAheadLibNMBgMonitor.exe [2007-05-16 153136]
«DAEMON Tools Lite»=C:Program FilesDAEMON Tools Litedaemon.exe [2007-12-29 486856]
«Internet Antivirus Pro»=c:program filesInternet Antivirus ProIAPro.exe [2008-11-22 1373696]

C:Documents and SettingsAll UsersStart MenuProgramsStartup
Microsoft Office.lnk — C:Program FilesMicrosoft OfficeOfficeOSA9.EXE

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyAtiExtEvent]
C:WINDOWSsystem32Ati2evxx.dll [2006-03-21 61440]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalaawservice]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkaawservice]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkclient32]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkvsmon]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDrives»=0

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=
«NoDrives»=
«NoDriveAutoRun»=

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesBonjourmDNSResponder.exe»=»C:Program FilesBonjourmDNSResponder.exe:*:Enabled:Bonjour»
«C:Program FilesNeroNero 7Nero ShowTimeShowTime.exe»=»C:Program FilesNeroNero 7Nero ShowTimeShowTime.exe:*:Enabled:Nero ShowTime»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{7344381a-210d-11dd-87fc-000c76334b75}]
shellAutoRuncommand — F:intro.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{b0518c03-236e-11dc-ac82-806d6172696f}]
shellAutoRuncommand — D:setup.exe

======List of files/folders created in the last 1 months======

2008-11-23 17:49:38 —-D—- C:rsit
2008-11-23 16:55:12 —-A—- C:WINDOWSsystem32javaws.exe
2008-11-23 16:55:12 —-A—- C:WINDOWSsystem32javaw.exe
2008-11-23 16:55:12 —-A—- C:WINDOWSsystem32java.exe
2008-11-23 16:55:12 —-A—- C:WINDOWSsystem32deploytk.dll
2008-11-23 16:54:51 —-D—- C:Program FilesJava
2008-11-23 16:51:21 —-D—- C:Documents and SettingsUserApplication DataSun
2008-11-23 16:23:13 —-D—- C:Program FilesTrend Micro
2008-11-23 14:58:08 —-SHD—- C:RECYCLER
2008-11-23 14:48:57 —-D—- C:WINDOWStemp
2008-11-23 14:43:54 —-D—- C:WINDOWSERDNT
2008-11-22 19:36:40 —-A—- C:WINDOWSsystem32log.txt
2008-11-22 19:36:21 —-D—- C:Documents and SettingsUserApplication DataInternet Antivirus Pro
2008-11-22 19:36:06 —-D—- C:Program FilesInternet Antivirus Pro
2008-11-21 15:47:17 —-A—- C:Program FilesCommon Filesfile.exe
2008-11-21 15:02:34 —-A—- C:Program FilesCommon FilesInternetAntivirusPro.exe
2008-10-28 21:15:14 —-A—- C:WINDOWSWar3Unin.exe
2008-10-28 21:11:53 —-D—- C:Program FilesWarcraft III

======List of files/folders modified in the last 1 months======

2008-11-23 17:49:43 —-D—- C:WINDOWSPrefetch
2008-11-23 17:48:14 —-D—- C:Program FilesMozilla Firefox
2008-11-23 17:48:07 —-D—- C:WINDOWS
2008-11-23 17:45:28 —-A—- C:WINDOWSSchedLgU.Txt
2008-11-23 17:44:51 —-D—- C:Program FilesRapidshare Downloader
2008-11-23 16:56:11 —-SHD—- C:WINDOWSInstaller
2008-11-23 16:55:12 —-D—- C:WINDOWSsystem32
2008-11-23 16:54:51 —-RD—- C:Program Files
2008-11-23 14:57:38 —-SHD—- C:System Volume Information
2008-11-23 14:57:38 —-D—- C:WINDOWSsystem32Restore
2008-11-23 14:57:17 —-A—- C:WINDOWSsystem32PerfStringBackup.INI
2008-11-23 14:47:44 —-A—- C:WINDOWSsystem.ini
2008-11-23 14:46:09 —-D—- C:WINDOWSsystem32drivers
2008-11-23 14:46:07 —-D—- C:WINDOWSAppPatch
2008-11-23 14:46:07 —-D—- C:Program FilesCommon Files
2008-11-23 03:34:38 —-D—- C:Downloads
2008-11-22 00:35:40 —-D—- C:WINDOWSsystem32CatRoot2
2008-11-17 22:26:53 —-A—- C:WINDOWSNeroDigital.ini
2008-11-17 03:10:38 —-D—- C:Documents and SettingsUserApplication DatauTorrent
2008-11-09 22:29:56 —-D—- C:Program Filesloads
2008-11-07 20:42:33 —-D—- C:Documents and SettingsAll UsersApplication DataDVD Shrink
2008-10-29 09:51:19 —-SHD—- C:WINDOWSCSC
2008-10-28 18:29:23 —-D—- C:Program FilesWarcraft 3 — Frozen Throne

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK7;AMD K7 Processor Driver; C:WINDOWSsystem32DRIVERSamdk7.sys [2004-08-03 37376]
R1 easdrv;easdrv; C:WINDOWSsystem32DRIVERSeasdrv.sys [2007-12-21 30216]
R1 epfwtdir;epfwtdir; C:WINDOWSsystem32DRIVERSepfwtdir.sys [2007-12-21 33800]
R1 PCISys;PCISys; C:WINDOWSsystem32driverspcisys.sys [2007-08-28 39520]
R2 eamon;EAMON; C:WINDOWSsystem32DRIVERSeamon.sys [2007-12-21 39944]
R3 ALCXSENS;Service for WDM 3D Audio Driver; C:WINDOWSsystem32driversALCXSENS.SYS [2004-02-23 400384]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:WINDOWSsystem32driversALCXWDM.SYS [2004-02-26 611820]
R3 ati2mtag;ati2mtag; C:WINDOWSsystem32DRIVERSati2mtag.sys [2006-03-21 1522688]
R3 gdihook5;gdihook5; C:WINDOWSsystem32DRIVERSgdihook5.sys [2007-07-20 31328]
R3 NVENET;NVIDIA nForce MCP Networking Controller Driver; C:WINDOWSsystem32DRIVERSNVENET.sys [2002-11-27 80896]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:WINDOWSsystem32DRIVERSusbehci.sys [2004-08-03 26624]
R3 usbhub;USB2 Enabled Hub; C:WINDOWSsystem32DRIVERSusbhub.sys [2004-08-03 57600]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:WINDOWSsystem32DRIVERSusbohci.sys [2004-08-03 17024]
S3 a5r3vr87;a5r3vr87; C:WINDOWSsystem32driversa5r3vr87.sys []
S3 ASPI;Advanced SCSI Programming Interface Driver; ??C:WINDOWSSystem32DRIVERSASPI32.sys []
S3 catchme;catchme; ??C:DOCUME~1UserLOCALS~1Tempcatchme.sys []
S3 GMSIPCI;GMSIPCI; C:WINDOWSsystem32driversGMSIPCI.sys []
S3 HidUsb;Microsoft HID Class Driver; C:WINDOWSsystem32DRIVERShidusb.sys [2001-08-17 9600]
S3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:WINDOWSsystem32driversmsmpu401.sys [2001-08-17 2944]
S3 NTACCESS;NTACCESS; C:WINDOWSsystem32driversNTACCESS.sys []
S3 pcouffin;VSO Software pcouffin; C:WINDOWSSystem32Driverspcouffin.sys [2007-12-27 47360]
S3 Profos;Profos; C:WINDOWSsystem32driversProfos.sys []
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:WINDOWSsystem32DRIVERSRTL8139.SYS [2004-08-03 20992]
S3 SE27bus;Sony Ericsson Device 039 Driver driver (WDM); C:WINDOWSsystem32DRIVERSSE27bus.sys [2006-04-28 61600]
S3 SE27mdfl;Sony Ericsson Device 039 USB WMC Modem Filter; C:WINDOWSsystem32DRIVERSSE27mdfl.sys [2006-04-28 9360]
S3 SE27mdm;Sony Ericsson Device 039 USB WMC Modem Driver; C:WINDOWSsystem32DRIVERSSE27mdm.sys [2006-04-28 97184]
S3 SE27mgmt;Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM); C:WINDOWSsystem32DRIVERSSE27mgmt.sys [2006-04-28 88688]
S3 se27nd5;Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (NDIS); C:WINDOWSsystem32DRIVERSse27nd5.sys [2006-04-28 18704]
S3 SE27obex;Sony Ericsson Device 039 USB WMC OBEX Interface; C:WINDOWSsystem32DRIVERSSE27obex.sys [2006-04-28 86560]
S3 se27unic;Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (WDM); C:WINDOWSsystem32DRIVERSse27unic.sys [2006-04-28 90800]
S3 sermouse;Serial Mouse Driver; C:WINDOWSsystem32DRIVERSsermouse.sys [2001-08-17 17664]
S3 SetupNTGLM7X;SetupNTGLM7X; C:WINDOWSsystem32driversSetupNTGLM7X.sys []
S3 Trufos;Trufos; C:WINDOWSsystem32driversTrufos.sys []
S3 USB_RNDIS;USB Remote NDIS Network Device Driver; C:WINDOWSsystem32DRIVERSusb8023.sys [2004-08-03 12672]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:WINDOWSsystem32DRIVERSusbccgp.sys [2004-08-03 31616]
S3 usbscan;USB Scanner Driver; C:WINDOWSsystem32DRIVERSusbscan.sys [2004-08-03 15104]
S3 USBSTOR;USB Mass Storage Driver; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2004-08-03 26496]
S3 WpdUsb;WpdUsb; C:WINDOWSSystem32Driverswpdusb.sys [2004-08-11 18944]
S3 ZDCndis5;ZDCndis5 Protocol Driver; C:WINDOWSsystem32driversZDCndis5.sys []
S3 ZDPSp50;ZDPSp50 NDIS Protocol Driver; C:WINDOWSSystem32DriversZDPSp50.sys []
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []
S4 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:WINDOWSSystem32driversws2ifsl.sys [2001-08-23 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Ad-Aware 2007 Service; C:Program FilesLavasoftAd-Aware 2007aawservice.exe [2007-06-07 561152]
R2 Ati HotKey Poller;Ati HotKey Poller; C:WINDOWSsystem32Ati2evxx.exe [2006-03-21 405504]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:Program FilesBonjourmDNSResponder.exe [2006-02-28 229376]
R2 ekrn;Eset Service; C:Program FilesESETESET NOD32 Antivirusekrn.exe [2007-12-21 468224]
R2 ITGrdEngine;Guard Service; C:Documents and SettingsUserLocal SettingsApplication DataMicrosoftWindowsservices.exe [2008-11-22 202240]
R2 JavaQuickStarterService;Java Quick Starter; C:Program FilesJavajre6binjqs.exe [2008-11-23 152984]
R2 MDM;Machine Debug Manager; C:Program FilesCommon FilesMicrosoft SharedVS7Debugmdm.exe [2001-02-23 270336]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:Program FilesCyberLinkShared FilesRichVideo.exe [2007-01-08 171040]
R2 UMWdf;Windows User Mode Driver Framework; C:WINDOWSsystem32wdfmgr.exe [2004-08-11 38912]
R3 NMIndexingService;NMIndexingService; C:Program FilesCommon FilesAheadLibNMIndexingService.exe [2007-05-16 271920]
S2 ATI Smart;ATI Smart; C:WINDOWSsystem32ati2sgag.exe [2006-03-17 520192]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv1.1.4322aspnet_state.exe [2003-02-20 32768]
S3 EhttpSrv;Eset HTTP Server; C:Program FilesESETESET NOD32 AntivirusEHttpSrv.exe [2007-12-21 19200]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:Program FilesCommon FilesMacrovision SharedFLEXnet PublisherFNPLicensingService.exe [2007-09-14 654848]
S3 NBService;NBService; C:Program FilesNeroNero 7Nero BackItUpNBService.exe [2007-04-13 792112]

EOF
23 ноября, 2008 в 3:02 пп в ответ на: помогите удалить Internet Antivirus Pro #19929
stealth5
Participant
- Темы:2
- Сообщений:10
спасибо что ответили Valeri

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:05:07, on 23.11.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesLavasoftAd-Aware 2007aawservice.exe
C:Program FilesBonjourmDNSResponder.exe
C:Program FilesESETESET NOD32 Antivirusekrn.exe
C:Documents and SettingsUserLocal SettingsApplication DataMicrosoftWindowsservices.exe
C:Program FilesCommon FilesMicrosoft SharedVS7Debugmdm.exe
C:Program FilesCyberLinkShared FilesRichVideo.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:Program FilesCyberLinkPowerDVDPDVDServ.exe
C:WINDOWSSOUNDMAN.EXE
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:Program FilesESETESET NOD32 Antivirusegui.exe
C:Program FilesRapidshare DownloaderRD.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesCommon FilesAheadLibNMBgMonitor.exe
C:Program FilesDAEMON Tools Litedaemon.exe
C:Documents and SettingsUserApplication DataMicrosoftWindowswinlogon.exe
C:program filesInternet Antivirus ProIAPro.exe
C:Program FilesCommon FilesAheadLibNMIndexingService.exe
C:Program FilesCommon FilesAheadLibNMIndexStoreSvr.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:WINDOWSsystem32msiexec.exe
C:Program FilesJavajre6binjqs.exe
C:Program FilesTrend MicroHijackThisHijackThis.exe

R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.daemon-search.com/startpage

R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *.local
R3 — URLSearchHook: The Pirate Bay Toolbar — {a33fa729-d155-4b23-842b-2c665ecabdb6} — C:Program FilesThe_Pirate_BaytbThe_.dll
O2 — BHO: Adobe PDF Reader Link Helper — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 — BHO: flashget urlcatch — {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} — C:Program FilesRapidshare Downloaderjccatch.dll
O2 — BHO: Java(tm) Plug-In SSV Helper — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — C:Program FilesJavajre6binssv.dll
O2 — BHO: The Pirate Bay Toolbar — {a33fa729-d155-4b23-842b-2c665ecabdb6} — C:Program FilesThe_Pirate_BaytbThe_.dll
O2 — BHO: Java(tm) Plug-In 2 SSV Helper — {DBC80044-A445-435b-BC74-9C25C1C588A9} — C:Program FilesJavajre6binjp2ssv.dll
O2 — BHO: JQSIEStartDetectorImpl — {E7E6F031-17CE-4C07-BC86-EABFE594F69C} — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll
O3 — Toolbar: The Pirate Bay Toolbar — {a33fa729-d155-4b23-842b-2c665ecabdb6} — C:Program FilesThe_Pirate_BaytbThe_.dll
O4 — HKLM..Run: [Adobe Reader Speed Launcher] «C:Program FilesAdobeReader 8.0ReaderReader_sl.exe»
O4 — HKLM..Run: [RemoteControl] «C:Program FilesCyberLinkPowerDVDPDVDServ.exe»
O4 — HKLM..Run: [LanguageShortcut] «C:Program FilesCyberLinkPowerDVDLanguageLanguage.exe»
O4 — HKLM..Run: [NeroFilterCheck] C:Program FilesCommon FilesAheadLibNeroCheck.exe
O4 — HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 — HKLM..Run: [ATICCC] «C:Program FilesATI TechnologiesATI.ACEcli.exe» runtime -Delay
O4 — HKLM..Run: [egui] «C:Program FilesESETESET NOD32 Antivirusegui.exe» /hide /waitservice
O4 — HKLM..Run: [Flashget] C:Program FilesRapidshare DownloaderRD.exe /min
O4 — HKLM..Run: [SunJavaUpdateSched] «C:Program FilesJavajre6binjusched.exe»
O4 — HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] «C:Program FilesCommon FilesAheadLibNMBgMonitor.exe»
O4 — HKCU..Run: [DAEMON Tools Lite] «C:Program FilesDAEMON Tools Litedaemon.exe»
O4 — HKCU..Run: [Microsoft Windows logon process] C:Documents and SettingsUserApplication DataMicrosoftWindowswinlogon.exe
O4 — HKCU..Run: [Internet Antivirus Pro] «C:program filesInternet Antivirus ProIAPro.exe» /s
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOfficeOSA9.EXE
O8 — Extra context menu item: &Download All with Rapidshare Downloader — C:Program FilesRapidshare Downloaderjc_all.htm
O8 — Extra context menu item: &Download with Rapidshare Downloader — C:Program FilesRapidshare Downloaderjc_link.htm
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2Office10EXCEL.EXE/3000
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O16 — DPF: {31150A86-0BBA-409F-BEB4-F3922D10BF34} (Gif89 Class) — file://C:Program FilesWindows SidebarGadgetsxplugCam.gadgeten-USxplug.ocx
O16 — DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) — http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 — HKLMSystemCCSServicesTcpip..{049BBB46-3CC6-47DF-AC3B-FAC485223C61}: NameServer = 192.168.0.20
O17 — HKLMSystemCS1ServicesTcpip..{049BBB46-3CC6-47DF-AC3B-FAC485223C61}: NameServer = 192.168.0.20
O17 — HKLMSystemCS2ServicesTcpip..{049BBB46-3CC6-47DF-AC3B-FAC485223C61}: NameServer = 192.168.0.20
O23 — Service: Ad-Aware 2007 Service (aawservice) — Lavasoft AB — C:Program FilesLavasoftAd-Aware 2007aawservice.exe
O23 — Service: Ati HotKey Poller — ATI Technologies Inc. — C:WINDOWSsystem32Ati2evxx.exe
O23 — Service: ATI Smart — Unknown owner — C:WINDOWSsystem32ati2sgag.exe
O23 — Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) — Apple Computer, Inc. — C:Program FilesBonjourmDNSResponder.exe
O23 — Service: Eset HTTP Server (EhttpSrv) — ESET — C:Program FilesESETESET NOD32 AntivirusEHttpSrv.exe
O23 — Service: Eset Service (ekrn) — ESET — C:Program FilesESETESET NOD32 Antivirusekrn.exe
O23 — Service: FLEXnet Licensing Service — Macrovision Europe Ltd. — C:Program FilesCommon FilesMacrovision SharedFLEXnet PublisherFNPLicensingService.exe
O23 — Service: Guard Service (ITGrdEngine) — Unknown owner — C:Documents and SettingsUserLocal SettingsApplication DataMicrosoftWindowsservices.exe
O23 — Service: Java Quick Starter (JavaQuickStarterService) — Sun Microsystems, Inc. — C:Program FilesJavajre6binjqs.exe
O23 — Service: NBService — Nero AG — C:Program FilesNeroNero 7Nero BackItUpNBService.exe
O23 — Service: NMIndexingService — Nero AG — C:Program FilesCommon FilesAheadLibNMIndexingService.exe
O23 — Service: Cyberlink RichVideo Service(CRVS) (RichVideo) — Unknown owner — C:Program FilesCyberLinkShared FilesRichVideo.exe

—
End of file — 7658 bytes

вот
Автор

Сообщения