Созданные ответы форума
-
Сообщения
-
Уважаемый Валери,спасибо за терпение.
Проблемы восновном с IE: периодически «зависает», в нем же не могу переключаться с одного алфавита на другой с клавиатуры.
Перестали «запускаться» диски и флешка (теперь только через «мой компьютер»).
При запуске AutoCAD выдает сообщение: диск отсутствует — вставьте диск I, но программа, вроде, работает.
Вот лог:ComboFix 08-11-29.03 — Admin 2008-11-30 6:04:30.7 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1251.1.1049.18.480 [GMT 3:00]
Running from: c:documents and settingsAdminРабочий столComboFix.exe
Command switches used :: c:documents and settingsAdminРабочий столCFScript.txt
* Created a new restore pointWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
..
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
Legacy_FXDRV32
Service_FXDrv32((((((((((((((((((((((((( Files Created from 2008-10-28 to 2008-11-30 )))))))))))))))))))))))))))))))
.2008-11-29 20:10 . 2008-11-29 20:10
d
c:program filesAutodesk
2008-11-29 17:45 . 2008-11-29 17:45d
C:rsit
2008-11-29 05:30 . 2008-11-29 05:30d
c:program filesTrend Micro
2008-11-25 04:03 . 2008-11-25 04:05d
c:program filesVista Start Menu
2008-11-25 04:03 . 2008-11-29 21:31d
c:documents and settingsAdminApplication DataVista Start Menu
2008-11-25 03:09 . 2008-11-25 03:47d
c:program filesTuneUp Utilities 2007
2008-11-25 03:09 . 2008-11-25 03:09d
c:documents and settingsAll UsersApplication DataTuneUp Software
2008-11-25 03:09 . 2008-11-25 03:09d
c:documents and settingsAdminApplication DataTuneUp Software
2008-11-25 03:09 . 2007-05-16 09:41 29,704 —a
c:windowssystem32uxtuneup.dll
2008-11-25 03:08 . 2008-11-25 03:08d
c:program filesCommon FilesWise Installation Wizard
2008-11-25 01:50 . 2008-11-25 01:50 314,880 —a
c:windowssystem32lgllib.dll
2008-11-19 00:56 . 2008-11-19 00:56d
C:82e5ea2e39883a4ad234b8
2008-11-19 00:55 . 2008-11-19 00:56d
C:3def84c8e5498f8d9ae3910224fa
2008-11-15 03:55 . 2008-11-15 03:55d
c:program filesMicrosoft Silverlight
2008-11-14 22:42 . 2008-11-14 22:42d
c:program filesAshampoo
2008-11-13 17:12 . 2008-11-18 02:12d
c:program filesYandexBarIE
2008-11-13 12:38 . 2008-11-18 00:08d
C:unzipped
2008-11-12 13:28 . 2008-11-12 13:28d
c:program filesMSXML 4.0
2008-11-12 13:16 . 2008-10-24 14:25 455,936
c— c:windowssystem32dllcachemrxsmb.sys
2008-11-12 13:15 . 2008-11-12 13:15d
c:program filesMSXML 6.0
2008-11-12 12:58 . 2008-09-04 19:45 1,106,944
c— c:windowssystem32dllcachemsxml3.dll
2008-11-12 10:44 . 2008-11-30 04:27d
c:program filesAKVIS
2008-11-12 01:39 . 2008-11-12 01:39d
c:program filesCommon FilesAdobe AIR
2008-11-12 01:16 . 2008-11-12 01:16d
c:documents and settingsAdminApplication Datacom.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2008-11-11 19:53 . 2008-11-11 19:55d
C:Max 2008
2008-11-11 16:07 . 2008-11-11 16:07d
c:windowssystem32configsystemprofileApplication DataPC Suite
2008-11-10 22:53 . 2008-11-11 00:11d
c:documents and settingsAdminApplication DataApple Computer
2008-11-10 22:51 . 2008-11-10 22:51d
c:program filesApple Software Update
2008-11-10 22:51 . 2008-11-11 16:48d
c:documents and settingsAll UsersApplication DataApple Computer
2008-11-10 22:50 . 2008-11-11 16:19d
c:program filesCommon FilesApple
2008-11-10 22:50 . 2008-11-10 22:50d
c:documents and settingsAll UsersApplication DataApple
2008-11-08 07:56 . 2008-11-08 07:56d
c:documents and settingsAdminApplication DataPROject MT
2008-11-08 07:47 . 2008-11-08 07:47d
c:program filesYandex
2008-11-08 07:47 . 2008-11-08 07:47d
c:program filesCommon FilesYandex
2008-11-08 07:47 . 2008-11-08 07:47d
c:documents and settingsAdminApplication DataYandex
2008-11-08 07:46 . 2008-11-08 07:46d
c:windowsspeech
2008-11-08 07:45 . 2008-11-08 09:00d
c:windowsLhsp
2008-11-08 07:45 . 2008-11-08 07:45d
c:documents and settingsAll UsersApplication DataPRMT
2008-11-08 07:41 . 2008-11-08 07:41d
c:program filesRedist
2008-11-04 22:49 . 2008-11-06 20:37 754 —a
c:windowsWORDPAD.INI
2008-11-04 19:58 . 2008-11-04 19:58d
c:windowssystem32user_unlock
2008-11-04 19:58 . 2008-11-04 19:58d
c:windowssystem32user_timeleft
2008-11-04 19:58 . 2008-11-04 19:58d
c:windowssystem32user_timecount
2008-11-04 19:58 . 2008-11-04 19:58d
c:windowssystem32user_time
2008-11-04 19:58 . 2008-11-04 19:58d
c:windowssystem32user_regedit
2008-11-04 19:58 . 2008-11-04 19:58d
c:windowssystem32user_patch
2008-11-04 19:58 . 2008-11-04 19:58d
c:windowssystem32user_lock
2008-11-04 19:58 . 2008-11-04 19:58d
c:windowssystem32user_id
2008-11-04 19:58 . 2008-11-04 19:58d
c:windowssystem32user_hardlock
2008-11-04 19:58 . 2008-11-18 02:12d
c:program filesVray Batch Render
2008-11-04 13:25 . 2008-11-04 13:25d
c:program filesTC
2008-11-04 13:22 . 2008-11-04 13:22d
c:program files3ddragon
2008-11-04 11:33 . 2008-11-04 23:41d
c:program filesCommon FilesChaosGroup
2008-11-04 11:17 . 2008-11-04 11:17d
c:program filesChaos Group
2008-11-03 06:49 . 2008-11-03 06:50d
c:program filesuTorrent
2008-11-03 06:13 . 2008-11-03 06:13 2,560 —a
c:windows_MSRSTRT.EXE
2008-11-03 05:26 . 2008-11-30 06:06d
c:documents and settingsAdminApplication DatauTorrent
2008-11-03 04:43 . 2004-08-25 11:33 1,056,768 —a
c:windowssystem32roboex32.dll
2008-11-03 04:43 . 2004-08-25 11:33 49,152 —a
c:windowssystem32inetwh32.dll
2008-11-03 04:30 . 2004-08-25 11:33 208,896 —a
c:windowssystem32wgsrvins.dll
2008-11-03 04:30 . 2004-08-25 11:33 11,264 —a
c:windowssystem32sporder.dll
2008-11-01 10:02 . 2008-11-01 10:02d
c:program files3Com
2008-11-01 02:54 . 2008-11-01 02:54d
c:program filesParagon Software
2008-11-01 02:54 . 2008-11-01 02:54d
c:program filesCommon FilesParagon Software
2008-10-23 09:32 . 2008-10-23 09:32d
c:program filesGLOBEtrotter Software Inc
2008-10-23 09:31 . 2008-10-23 09:31d
c:documents and settingsAdminWINDOWS
2008-10-23 09:31 . 1998-07-30 12:51 305,152 —a
c:windowsIsUninst.exe
2008-10-23 03:43 . 2008-08-14 16:40 2,187,776
c— c:windowssystem32dllcachentoskrnl.exe
2008-10-23 03:43 . 2008-08-14 16:40 2,144,768
c— c:windowssystem32dllcachentkrnlmp.exe
2008-10-23 03:43 . 2008-08-14 16:40 2,064,768
c— c:windowssystem32dllcachentkrnlpa.exe
2008-10-23 03:43 . 2008-08-14 16:40 2,022,912
c— c:windowssystem32dllcachentkrpamp.exe
2008-10-15 04:14 . 2008-11-01 03:14d
c:documents and settingsAdminApplication DataOfficeUpdate12
2008-10-15 04:03 . 2008-10-15 04:03d
c:documents and settingsAll UsersApplication DataOffice Genuine Advantage
2008-10-13 03:29 . 2008-10-13 03:29d—hs—- c:documents and settingsAdminPrivacIE
2008-10-13 02:10 . 2008-10-13 02:11d—h-c— c:windowsie8
2008-10-12 15:01 . 2004-06-28 11:08 42,752
c:windowssystem32driversser2pl.sys
2008-10-12 13:30 . 2008-11-29 00:08d
c:program filesPhone Suite
2008-10-12 02:12 . 2008-11-01 02:07 518 —a
c:windowssystem32wul.cfg
2008-10-11 01:19 . 2008-10-11 01:19d
C:shibnev.n@mail.ru
2008-10-11 00:22 . 2008-10-31 09:53d
c:documents and settingsAdminApplication DataMra
2008-10-11 00:21 . 2008-10-11 00:22d
c:program filesMail.Ru
2008-10-10 23:10 . 2008-06-14 20:59 272,512
c:windowssystem32driversbthport.sys
2008-10-10 23:10 . 2008-06-14 20:59 272,512
c— c:windowssystem32dllcachebthport.sys
2008-10-09 03:39 . 2008-10-16 14:06 268,648 —a
c:windowssystem32mucltui.dll
2008-10-09 03:39 . 2008-10-16 14:06 27,496 —a
c:windowssystem32mucltui.dll.mui
2008-10-08 00:16 . 2008-10-08 00:16d
c:documents and settingsAdminApplication DataWindows Search
2008-10-08 00:09 . 2008-10-08 00:09d
c:documents and settingsAdminApplication DataWindows Desktop Search
2008-10-08 00:06 . 2008-10-08 00:06d
c:windowssystem32GroupPolicy
2008-10-08 00:06 . 2008-11-12 13:28d—h
c:windows$hf_mig$
2008-10-08 00:06 . 2008-10-08 00:06d
c:program filesWindows Desktop Search.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-30 01:24
d
w c:program filesCyberPower PowerPanel Personal Edition
2008-11-29 17:11
d
w c:program filesCommon FilesAutodesk Shared
2008-11-29 17:10
d
w c:documents and settingsAll UsersApplication DataAutodesk
2008-11-28 21:30
d
w c:program filesCommon FilesAdobe
2008-11-28 21:08
d—h—w c:program filesInstallShield Installation Information
2008-11-28 20:16
d
w c:program filesNokia
2008-11-28 20:05
d
w c:program filesCorel
2008-11-28 20:05
d
w c:documents and settingsAll UsersApplication DataCorel
2008-11-28 20:05
d
w c:documents and settingsAdminApplication DataCorel
2008-11-28 20:02
d
w c:program filesEPSON
2008-11-28 19:59
d
w c:program filesEPSON Print CD
2008-11-24 16:14
d
w c:program filesWinamp
2008-11-17 23:12
d
w c:program filesWindows Media Connect 2
2008-11-17 23:12
d
w c:program filesSetupRes
2008-11-17 23:12
d
w c:program filesDivX
2008-11-17 23:12
d
r c:program filesMediaBrowser
2008-11-14 22:32
d
w c:program filesДлинные нарды 2.0
2008-11-14 21:28
d
w c:documents and settingsAll UsersApplication DataMicrosoft Help
2008-11-07 08:02 22 —-a-w c:windowsFontsv_mather.dat
2008-11-07 08:02 20 —-a-w c:windowsFontsv_girl.dat
2008-11-07 08:02 16 —-a-w c:windowsFontsv_cow.dat
2008-11-07 08:02 15 —-a-w c:windowsFontsv_sister.dat
2008-11-07 08:02 14 —-a-w c:windowsFontsv_father.dat
2008-11-07 08:02 13 —-a-w c:windowsFontsv_zoo.dat
2008-11-07 08:02 12 —-a-w c:windowsFontsv_boy.dat
2008-11-01 08:09
d
w c:program files3D Home Architect
2008-10-24 11:25 455,936 —-a-w c:windowssystem32driversmrxsmb.sys
2008-10-23 06:32 47,616 —-a-w c:windowssystem32driversHaspnt.sys
2008-10-03 23:53
d
w c:program filesEset
2008-09-29 23:43
d
w c:program filesPunto Switcher
2008-09-23 08:53 39 —-a-w c:program filesCD.INF
2008-08-25 10:31 524,288 —-a-w c:windowsopuc.dll
2007-12-14 11:42 7,168 —-a-w c:program filesYa_bar.mst
2007-10-16 06:57 2,172 —-a-w c:program filesSetup.ini
2007-10-14 20:01 5,408 —-a-w c:program filesx-force.nfo
2007-09-25 15:59 626,688 —-a-w c:program filesmsvcr80.dll
2007-09-25 15:59 548,864 —-a-w c:program filesmsvcp80.dll
2007-09-25 15:59 479,232 —-a-w c:program filesmsvcm80.dll
2007-09-25 15:59 1,645,320 —-a-w c:program filesgdiplus.dll
2007-09-25 15:57 91,288 —-a-w c:program filesLiteHtml.dll
2007-09-25 15:57 522 —-a-w c:program filesMicrosoft.VC80.CRT.manifest
2007-09-25 15:57 49,152 —-a-w c:program filesSetupRes2.dll
2007-09-25 15:57 460,440 —-a-w c:program filesSetupAcadUi.dll
2007-09-25 15:57 459,416 —-a-w c:program filesDeployUi.dll
2007-09-25 15:57 437,912 —-a-w c:program filesSetupUi.dll
2007-09-25 15:57 234,136 —-a-w c:program filesSetupRes.dll
2007-09-25 15:57 176,128 —-a-w c:program filesCustomProductUI.dll
2007-04-02 14:57 34,261,421 —-a-w c:program filesData1.cab
2007-04-02 14:57 2,957,824 —-a-w c:program filesPROMT 4U ERRE.msi
2007-03-21 14:06 316,976 —-a-w c:program filesSetup.exe
2007-03-04 11:40 6,620,160 —-a-w c:program filesData_.cab
2006-12-18 16:05 23,510,720 —-a-w c:program filesdotnetfx20.exe
2006-08-16 10:09 7,980 —-a-w c:program fileslav.nfo
2006-08-16 09:57 222 —-a-w c:program filesfile_id.diz
2006-05-17 08:14 340,912 —-a-w c:program filesdotnetfx.exe
2006-05-16 09:02 6,512 —-a-w c:program files0x0419.ini
2006-05-16 08:58 2,584,848 —-a-w c:program filesWindowsInstaller-KB893803-x86.exe
2006-05-05 16:18 312 —-a-r c:program filesacadcd.mid
2006-04-10 12:47 167,424
w c:program filesmbsascripting.doc
2006-03-29 10:00 15,763 —-a-w c:program filesrollup.js
2006-03-16 10:50 3,728
w c:program filesAssemblyInfo.cs
2006-02-03 19:46 429 —-a-r c:program filesMediaBrowser.ini
2005-12-07 16:01 6,268
w c:program filesrollup.xslt
2005-11-10 14:58 11,192
w c:program filesConsoleMain.cs
2005-11-10 14:46 7,461
w c:program filesMultiScan.cs
2005-11-10 14:07 24,576
w c:program filesmultimbsa.exe
2005-11-10 13:04 897
w c:program filesmmm.sln
2005-11-10 13:04 3,914
w c:program filesmmm_cli.csproj
2005-11-02 18:49 28,026
w c:program filesMultiPatchRollupDemo.xml
2005-11-02 17:40 965,782
w c:program filesMultiCheckRollupDemo.xml
2004-10-22 04:38 126,976 —-a-r c:program filesMediaBrowser.exe
2008-06-15 20:43 56 —sh—r c:windowssystem32C8E076F1EC.sys
2008-05-06 21:04 8 —sh—r c:windowssystem32ECF176E0C8.sys
2008-06-15 20:43 1,682 —sha-w c:windowssystem32KGyGaAvL.sys
2008-01-22 19:30 16,384 —sha-w c:windowssystem32configsystemprofileCookiesindex.dat
2008-01-22 19:30 32,768 —sha-w c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5index.dat
2008-01-22 19:30 32,768 —sha-w c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5MSHist012008012220080123index.dat
2008-01-22 19:30 32,768 —sha-w c:windowssystem32configsystemprofileLocal SettingsTemporary Internet FilesContent.IE5index.dat
.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2008-10-16 1578248][HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2008-10-16 1578248][HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar][HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2007-01-25 201728]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2007-07-02 132608]
«BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=»c:program filesCommon FilesNeroLibNMBgMonitor.exe» [2007-10-23 202024]
«ctfmon.exe»=»c:windowssystem32ctfmon.exe» [2007-12-21 30208]
«PowerPanel Personal Edition User Interaction»=»c:program filesCyberPower PowerPanel Personal Editionpppeuser.exe» [2007-01-10 262144]
«µTorrent»=»c:program filesuTorrentutorrent.exe» [2007-02-15 177152]
«MultiLex 6″=»c:program filesParagon SoftwareMultiLex 6multilex.exe» [2007-07-17 610304]
«Yupdate!»=»c:program filesCommon FilesYandexYupdateyupdate.exe» [2008-09-01 479496]
«VistaStartMenu»=»c:program filesVista Start MenuVistaStartMenu.exe» [2007-12-12 1206784][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2007-07-13 8466432]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2007-07-13 81920]
«GrooveMonitor»=»c:program filesMicrosoft OfficeOffice12GrooveMonitor.exe» [2007-08-24 33648]
«nod32kui»=»c:program filesEsetnod32kui.exe» [2008-01-22 949376]
«NeroFilterCheck»=»c:program filesCommon FilesNeroLibNeroCheck.exe» [2007-03-01 153136]
«NBKeyScan»=»c:program filesNeroNero8Nero BackItUpNBKeyScan.exe» [2007-09-20 1836328]
«ISUSPM Startup»=»c:progra~1COMMON~1INSTAL~1UPDATE~1ISUSPM.exe» [2005-02-16 221184]
«ISUSScheduler»=»c:program filesCommon FilesInstallShieldUpdateServiceissch.exe» [2005-02-16 81920]
«MAgent»=»c:program filesMail.RuAgentMAgent.exe» [2008-10-11 4417016]
«Adobe Reader Speed Launcher»=»c:program filesAdobeReader 9.0ReaderReader_sl.exe» [2008-06-12 34672]
«nwiz»=»nwiz.exe» [2007-07-13 c:windowssystem32nwiz.exe]
«SoundMan»=»SOUNDMAN.EXE» [2006-01-11 c:windowssoundman.exe][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2007-01-25 201728]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2007-07-02 132608][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» [2008-08-22 c:windowssystem32advpack.dll]
«IE7_012″=»advpack.dll» [2008-08-22 c:windowssystem32advpack.dll]c:documents and settingsAdminѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
‚л१Є нЄа Ё Їа®Ја ¬¬ § ЇгбЄ ¤«п OneNote 2007.lnk — c:program filesMicrosoft OfficeOffice12ONENOTEM.EXE [2007-12-07 101440]c:documents and settingsAll Usersѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
Windows Search.lnk — c:program filesWindows Desktop SearchWindowsSearch.exe [2008-05-26 123904]
Ѓлбвал© § ЇгбЄ AutoCAD.lnk — c:program filesCommon FilesAutodesk Sharedacstart17.exe [2006-03-05 11000][HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoResolveTrack»= 0 (0x0)
«NoFileAssociate»= 0 (0x0)[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoThumbnailCache»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoThumbnailCache»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)[hkey_local_machinesoftwaremicrosoftwindowscurrentversionexplorerShellExecuteHooks]
«{56F9679E-7826-4C84-81F3-532071A8BCC5}»= «c:program filesWindows Desktop SearchMSNLNamespaceMgr.dll» [2008-05-26 304128][HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]
«msacm.l3codec»= l3codecp.acm
«SENTINEL»= snti386.dll[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesDisableNotify»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusDisableNotify»=dword:00000001
«AntiVirusOverride»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«c:\Program Files\Mail.Ru\Agent\magent.exe»=
«c:\Program Files\uTorrent\utorrent.exe»=
«c:\Program Files\Nero\Nero8\Nero Home\NeroHome.exe»=
«c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE»=
«c:\Program Files\Microsoft Office\Office12\GROOVE.EXE»=
«c:\Program Files\Microsoft Office\Office12\ONENOTE.EXE»=HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSvchost — NetSvcs
UxTuneUp
.
Contents of the ‘Scheduled Tasks’ folder2008-11-25 c:windowsTasks1-Click Maintenance.job
— c:program filesTuneUp Utilities 2007SystemOptimizer.exe [2007-08-02 19:35]2008-11-11 c:windowsTasksAppleSoftwareUpdate.job
— c:program filesApple Software UpdateSoftwareUpdate.exe [2008-07-30 12:34]
.**************************************************************************
catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-30 06:08:14
Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(700)
c:windowssystem32SETUPAPI.dll
c:windowssystem32COMRes.dll
c:windowssystem32cscui.dll— — — — — — — > ‘lsass.exe'(756)
c:windowssystem32setupapi.dll
c:windowssystem32imon.dll
c:program filesEsetpr_imon.dll
.
Other Running Processes
.
c:windowssystem32WgaTray.exe
c:windowssystem32rundll32.exe
c:windowssystem32rundll32.exe
c:program filesCommon FilesAppleMobile Device SupportbinAppleMobileDeviceService.exe
c:program filesCommon FilesAutodesk SharedServiceAdskScSrv.exe
c:program filesNeroNero8Nero BackItUpNBService.exe
c:program filesEsetnod32krn.exe
c:windowssystem32nvsvc32.exe
c:program filesCyberPower PowerPanel Personal Editionppped.exe
c:windowssystem32searchindexer.exe
c:windowssystem32searchprotocolhost.exe
c:windowssystem32searchfilterhost.exe
.
**************************************************************************
.
Completion time: 2008-11-30 6:10:33 — machine was rebooted
ComboFix-quarantined-files.txt 2008-11-30 03:10:12
ComboFix2.txt 2008-11-29 16:47:45Pre-Run: 115 013 095 424 байт свободно
Post-Run: 114,925,473,792 байт свободно317 — E O F — 2008-11-12 10:16:47
I — это вообще-то дисковод, но он пустой, а J — флэшка. Попробовал установить 3ds Max на диск С, сначала комп выдал такое сообщение: Exception Processing Massage Parameters 75b3bf7c 4 75b3bf7c 75b3bf7c , а потом программа установки зависла.
Вот лог:
ComboFix 08-11-28.03 — Admin 2008-11-29 19:46:24.6 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1251.1.1049.18.448 [GMT 3:00]
Running from: c:documents and settingsAdminРабочий столComboFix.exe
Command switches used :: c:documents and settingsAdminРабочий столCFScript.txt
* Created a new restore pointWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.((((((((((((((((((((((((( Files Created from 2008-10-28 to 2008-11-29 )))))))))))))))))))))))))))))))
.2008-11-29 17:45 . 2008-11-29 17:45
d
C:rsit
2008-11-29 05:30 . 2008-11-29 05:30d
c:program filesTrend Micro
2008-11-25 04:03 . 2008-11-25 04:05d
c:program filesVista Start Menu
2008-11-25 04:03 . 2008-11-29 19:32d
c:documents and settingsAdminApplication DataVista Start Menu
2008-11-25 03:09 . 2008-11-25 03:47d
c:program filesTuneUp Utilities 2007
2008-11-25 03:09 . 2008-11-25 03:09d
c:documents and settingsAll UsersApplication DataTuneUp Software
2008-11-25 03:09 . 2008-11-25 03:09d
c:documents and settingsAdminApplication DataTuneUp Software
2008-11-25 03:09 . 2007-05-16 09:41 29,704 —a
c:windowssystem32uxtuneup.dll
2008-11-25 03:08 . 2008-11-25 03:08d
c:program filesCommon FilesWise Installation Wizard
2008-11-25 01:50 . 2008-11-25 01:50 314,880 —a
c:windowssystem32lgllib.dll
2008-11-19 00:56 . 2008-11-19 00:56d
C:82e5ea2e39883a4ad234b8
2008-11-19 00:55 . 2008-11-19 00:56d
C:3def84c8e5498f8d9ae3910224fa
2008-11-15 03:55 . 2008-11-15 03:55d
c:program filesMicrosoft Silverlight
2008-11-14 22:42 . 2008-11-14 22:42d
c:program filesAshampoo
2008-11-13 17:12 . 2008-11-18 02:12d
c:program filesYandexBarIE
2008-11-13 12:38 . 2008-11-18 00:08d
C:unzipped
2008-11-12 13:28 . 2008-11-12 13:28d
c:program filesMSXML 4.0
2008-11-12 13:16 . 2008-10-24 14:25 455,936
c— c:windowssystem32dllcachemrxsmb.sys
2008-11-12 13:15 . 2008-11-12 13:15d
c:program filesMSXML 6.0
2008-11-12 12:58 . 2008-09-04 19:45 1,106,944
c— c:windowssystem32dllcachemsxml3.dll
2008-11-12 10:44 . 2008-11-12 11:28d
c:program filesAKVIS
2008-11-12 01:39 . 2008-11-12 01:39d
c:program filesCommon FilesAdobe AIR
2008-11-12 01:16 . 2008-11-12 01:16d
c:documents and settingsAdminApplication Datacom.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2008-11-11 19:53 . 2008-11-11 19:55d
C:Max 2008
2008-11-10 22:53 . 2008-11-11 00:11d
c:documents and settingsAdminApplication DataApple Computer
2008-11-10 22:51 . 2008-11-10 22:51d
c:program filesApple Software Update
2008-11-10 22:51 . 2008-11-11 16:48d
c:documents and settingsAll UsersApplication DataApple Computer
2008-11-10 22:50 . 2008-11-11 16:19d
c:program filesCommon FilesApple
2008-11-10 22:50 . 2008-11-10 22:50d
c:documents and settingsAll UsersApplication DataApple
2008-11-08 07:56 . 2008-11-08 07:56d
c:documents and settingsAdminApplication DataPROject MT
2008-11-08 07:47 . 2008-11-08 07:47d
c:program filesYandex
2008-11-08 07:47 . 2008-11-08 07:47d
c:program filesCommon FilesYandex
2008-11-08 07:47 . 2008-11-08 07:47d
c:documents and settingsAdminApplication DataYandex
2008-11-08 07:46 . 2008-11-08 07:46d
c:windowsspeech
2008-11-08 07:45 . 2008-11-08 09:00d
c:windowsLhsp
2008-11-08 07:45 . 2008-11-08 07:45d
c:documents and settingsAll UsersApplication DataPRMT
2008-11-08 07:41 . 2008-11-08 07:41d
c:program filesRedist
2008-11-04 22:49 . 2008-11-06 20:37 754 —a
c:windowsWORDPAD.INI
2008-11-04 19:58 . 2008-11-04 19:58d
c:windowssystem32user_unlock
2008-11-04 19:58 . 2008-11-04 19:58d
c:windowssystem32user_timeleft
2008-11-04 19:58 . 2008-11-04 19:58d
c:windowssystem32user_timecount
2008-11-04 19:58 . 2008-11-04 19:58d
c:windowssystem32user_time
2008-11-04 19:58 . 2008-11-04 19:58d
c:windowssystem32user_regedit
2008-11-04 19:58 . 2008-11-04 19:58d
c:windowssystem32user_patch
2008-11-04 19:58 . 2008-11-04 19:58d
c:windowssystem32user_lock
2008-11-04 19:58 . 2008-11-04 19:58d
c:windowssystem32user_id
2008-11-04 19:58 . 2008-11-04 19:58d
c:windowssystem32user_hardlock
2008-11-04 19:58 . 2008-11-18 02:12d
c:program filesVray Batch Render
2008-11-04 13:25 . 2008-11-04 13:25d
c:program filesTC
2008-11-04 13:22 . 2008-11-04 13:22d
c:program files3ddragon
2008-11-04 11:33 . 2008-11-04 23:41d
c:program filesCommon FilesChaosGroup
2008-11-04 11:17 . 2008-11-04 11:17d
c:program filesChaos Group
2008-11-03 06:49 . 2008-11-03 06:50d
c:program filesuTorrent
2008-11-03 06:13 . 2008-11-03 06:13 2,560 —a
c:windows_MSRSTRT.EXE
2008-11-03 05:26 . 2008-11-29 19:43d
c:documents and settingsAdminApplication DatauTorrent
2008-11-03 04:43 . 2004-08-25 11:33 1,056,768 —a
c:windowssystem32roboex32.dll
2008-11-03 04:43 . 2004-08-25 11:33 49,152 —a
c:windowssystem32inetwh32.dll
2008-11-03 04:30 . 2004-08-25 11:33 208,896 —a
c:windowssystem32wgsrvins.dll
2008-11-03 04:30 . 2004-08-25 11:33 11,264 —a
c:windowssystem32sporder.dll
2008-11-01 10:02 . 2008-11-01 10:02d
c:program files3Com
2008-11-01 02:54 . 2008-11-01 02:54d
c:program filesParagon Software
2008-11-01 02:54 . 2008-11-01 02:54d
c:program filesCommon FilesParagon Software.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-29 15:27
d
w c:program filesCyberPower PowerPanel Personal Edition
2008-11-28 21:30
d
w c:program filesCommon FilesAdobe
2008-11-28 21:08
d—h—w c:program filesInstallShield Installation Information
2008-11-28 21:08
d
w c:program filesPhone Suite
2008-11-28 20:16
d
w c:program filesNokia
2008-11-28 20:12
d
w c:program filesCommon FilesAutodesk Shared
2008-11-28 20:10
d
w c:documents and settingsAll UsersApplication DataAutodesk
2008-11-28 20:05
d
w c:program filesCorel
2008-11-28 20:05
d
w c:documents and settingsAll UsersApplication DataCorel
2008-11-28 20:05
d
w c:documents and settingsAdminApplication DataCorel
2008-11-28 20:02
d
w c:program filesEPSON
2008-11-28 19:59
d
w c:program filesEPSON Print CD
2008-11-24 16:14
d
w c:program filesWinamp
2008-11-17 23:12
d
w c:program filesWindows Media Connect 2
2008-11-17 23:12
d
w c:program filesSetupRes
2008-11-17 23:12
d
w c:program filesDivX
2008-11-17 23:12
d
r c:program filesMediaBrowser
2008-11-14 22:32
d
w c:program filesДлинные нарды 2.0
2008-11-14 21:28
d
w c:documents and settingsAll UsersApplication DataMicrosoft Help
2008-11-07 08:02 22 —-a-w c:windowsFontsv_mather.dat
2008-11-07 08:02 20 —-a-w c:windowsFontsv_girl.dat
2008-11-07 08:02 16 —-a-w c:windowsFontsv_cow.dat
2008-11-07 08:02 15 —-a-w c:windowsFontsv_sister.dat
2008-11-07 08:02 14 —-a-w c:windowsFontsv_father.dat
2008-11-07 08:02 13 —-a-w c:windowsFontsv_zoo.dat
2008-11-07 08:02 12 —-a-w c:windowsFontsv_boy.dat
2008-11-01 08:09
d
w c:program files3D Home Architect
2008-11-01 00:14
d
w c:documents and settingsAdminApplication DataOfficeUpdate12
2008-10-31 06:53
d
w c:documents and settingsAdminApplication DataMra
2008-10-24 11:25 455,936 —-a-w c:windowssystem32driversmrxsmb.sys
2008-10-23 06:32 6,656 —-a-w c:windowssystem32haspvdd.dll
2008-10-23 06:32 47,616 —-a-w c:windowssystem32driversHaspnt.sys
2008-10-23 06:32 264,704 —-a-w c:windowssystem32hlvdd.dll
2008-10-23 06:32
d
w c:program filesGLOBEtrotter Software Inc
2008-10-16 11:13 202,776 —-a-w c:windowssystem32wuweb.dll
2008-10-16 11:13 1,809,944 —-a-w c:windowssystem32wuaueng.dll
2008-10-16 11:12 561,688 —-a-w c:windowssystem32wuapi.dll
2008-10-16 11:12 323,608 —-a-w c:windowssystem32wucltui.dll
2008-10-16 11:09 92,696 —-a-w c:windowssystem32cdm.dll
2008-10-16 11:09 51,224 —-a-w c:windowssystem32wuauclt.exe
2008-10-16 11:09 43,544 —-a-w c:windowssystem32wups2.dll
2008-10-16 11:08 34,328 —-a-w c:windowssystem32wups.dll
2008-10-16 11:06 268,648 —-a-w c:windowssystem32mucltui.dll
2008-10-16 11:06 208,744 —-a-w c:windowssystem32muweb.dll
2008-10-15 01:03
d
w c:documents and settingsAll UsersApplication DataOffice Genuine Advantage
2008-10-10 21:22
d
w c:program filesMail.Ru
2008-10-07 21:16
d
w c:documents and settingsAdminApplication DataWindows Search
2008-10-07 21:09
d
w c:documents and settingsAdminApplication DataWindows Desktop Search
2008-10-07 21:06
d
w c:program filesWindows Desktop Search
2008-10-03 23:53
d
w c:program filesEset
2008-09-30 13:43 1,286,152 —-a-w c:windowssystem32msxml4.dll
2008-09-29 23:43
d
w c:program filesPunto Switcher
2008-09-23 08:53 39 —-a-w c:program filesCD.INF
2008-09-15 15:15 1,847,040 —-a-w c:windowssystem32win32k.sys
2008-09-04 16:45 1,106,944 —-a-w c:windowssystem32msxml3.dll
2008-08-29 17:06 1,350,664 —-a-w c:windowssystem32msxml6.dll
2007-12-14 11:42 7,168 —-a-w c:program filesYa_bar.mst
2007-10-16 06:57 2,172 —-a-w c:program filesSetup.ini
2007-10-14 20:01 5,408 —-a-w c:program filesx-force.nfo
2007-09-25 15:59 626,688 —-a-w c:program filesmsvcr80.dll
2007-09-25 15:59 548,864 —-a-w c:program filesmsvcp80.dll
2007-09-25 15:59 479,232 —-a-w c:program filesmsvcm80.dll
2007-09-25 15:59 1,645,320 —-a-w c:program filesgdiplus.dll
2007-09-25 15:57 91,288 —-a-w c:program filesLiteHtml.dll
2007-09-25 15:57 522 —-a-w c:program filesMicrosoft.VC80.CRT.manifest
2007-09-25 15:57 49,152 —-a-w c:program filesSetupRes2.dll
2007-09-25 15:57 460,440 —-a-w c:program filesSetupAcadUi.dll
2007-09-25 15:57 459,416 —-a-w c:program filesDeployUi.dll
2007-09-25 15:57 437,912 —-a-w c:program filesSetupUi.dll
2007-09-25 15:57 234,136 —-a-w c:program filesSetupRes.dll
2007-09-25 15:57 176,128 —-a-w c:program filesCustomProductUI.dll
2007-04-02 14:57 34,261,421 —-a-w c:program filesData1.cab
2007-04-02 14:57 2,957,824 —-a-w c:program filesPROMT 4U ERRE.msi
2007-03-21 14:06 316,976 —-a-w c:program filesSetup.exe
2007-03-04 11:40 6,620,160 —-a-w c:program filesData_.cab
2006-12-18 16:05 23,510,720 —-a-w c:program filesdotnetfx20.exe
2006-08-16 10:09 7,980 —-a-w c:program fileslav.nfo
2006-08-16 09:57 222 —-a-w c:program filesfile_id.diz
2006-05-17 08:14 340,912 —-a-w c:program filesdotnetfx.exe
2006-05-16 09:02 6,512 —-a-w c:program files0x0419.ini
2006-05-16 08:58 2,584,848 —-a-w c:program filesWindowsInstaller-KB893803-x86.exe
2006-05-05 16:18 312 —-a-r c:program filesacadcd.mid
2006-04-10 12:47 167,424
w c:program filesmbsascripting.doc
2006-03-29 10:00 15,763 —-a-w c:program filesrollup.js
2006-03-16 10:50 3,728
w c:program filesAssemblyInfo.cs
2006-02-03 19:46 429 —-a-r c:program filesMediaBrowser.ini
2005-12-07 16:01 6,268
w c:program filesrollup.xslt
2005-11-10 14:58 11,192
w c:program filesConsoleMain.cs
2005-11-10 14:46 7,461
w c:program filesMultiScan.cs
2005-11-10 14:07 24,576
w c:program filesmultimbsa.exe
2005-11-10 13:04 897
w c:program filesmmm.sln
2005-11-10 13:04 3,914
w c:program filesmmm_cli.csproj
2005-11-02 18:49 28,026
w c:program filesMultiPatchRollupDemo.xml
2005-11-02 17:40 965,782
w c:program filesMultiCheckRollupDemo.xml
2004-10-22 04:38 126,976 —-a-r c:program filesMediaBrowser.exe
2008-06-15 20:43 56 —sh—r c:windowssystem32C8E076F1EC.sys
2008-05-06 21:04 8 —sh—r c:windowssystem32ECF176E0C8.sys
2008-06-15 20:43 1,682 —sha-w c:windowssystem32KGyGaAvL.sys
2008-01-22 19:30 16,384 —sha-w c:windowssystem32configsystemprofileCookiesindex.dat
2008-01-22 19:30 32,768 —sha-w c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5index.dat
2008-01-22 19:30 32,768 —sha-w c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5MSHist012008012220080123index.dat
2008-01-22 19:30 32,768 —sha-w c:windowssystem32configsystemprofileLocal SettingsTemporary Internet FilesContent.IE5index.dat
.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2008-10-16 1578248][HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2008-10-16 1578248][HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar][HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2007-01-25 201728]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2007-07-02 132608]
«BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=»c:program filesCommon FilesNeroLibNMBgMonitor.exe» [2007-10-23 202024]
«ctfmon.exe»=»c:windowssystem32ctfmon.exe» [2007-12-21 30208]
«PowerPanel Personal Edition User Interaction»=»c:program filesCyberPower PowerPanel Personal Editionpppeuser.exe» [2007-01-10 262144]
«µTorrent»=»c:program filesuTorrentutorrent.exe» [2007-02-15 177152]
«MultiLex 6″=»c:program filesParagon SoftwareMultiLex 6multilex.exe» [2007-07-17 610304]
«Yupdate!»=»c:program filesCommon FilesYandexYupdateyupdate.exe» [2008-09-01 479496]
«VistaStartMenu»=»c:program filesVista Start MenuVistaStartMenu.exe» [2007-12-12 1206784][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2007-07-13 8466432]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2007-07-13 81920]
«GrooveMonitor»=»c:program filesMicrosoft OfficeOffice12GrooveMonitor.exe» [2007-08-24 33648]
«nod32kui»=»c:program filesEsetnod32kui.exe» [2008-01-22 949376]
«NeroFilterCheck»=»c:program filesCommon FilesNeroLibNeroCheck.exe» [2007-03-01 153136]
«NBKeyScan»=»c:program filesNeroNero8Nero BackItUpNBKeyScan.exe» [2007-09-20 1836328]
«ISUSPM Startup»=»c:progra~1COMMON~1INSTAL~1UPDATE~1ISUSPM.exe» [2005-02-16 221184]
«ISUSScheduler»=»c:program filesCommon FilesInstallShieldUpdateServiceissch.exe» [2005-02-16 81920]
«MAgent»=»c:program filesMail.RuAgentMAgent.exe» [2008-10-11 4417016]
«Adobe Reader Speed Launcher»=»c:program filesAdobeReader 9.0ReaderReader_sl.exe» [2008-06-12 34672]
«nwiz»=»nwiz.exe» [2007-07-13 c:windowssystem32nwiz.exe]
«SoundMan»=»SOUNDMAN.EXE» [2006-01-11 c:windowssoundman.exe][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2007-01-25 201728]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2007-07-02 132608][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» [2008-08-22 c:windowssystem32advpack.dll]
«IE7_012″=»advpack.dll» [2008-08-22 c:windowssystem32advpack.dll]c:documents and settingsAdminѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
‚л१Є нЄа Ё Їа®Ја ¬¬ § ЇгбЄ ¤«п OneNote 2007.lnk — c:program filesMicrosoft OfficeOffice12ONENOTEM.EXE [2007-12-07 101440]c:documents and settingsAll Usersѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
Windows Search.lnk — c:program filesWindows Desktop SearchWindowsSearch.exe [2008-05-26 123904]
Ѓлбвал© § ЇгбЄ AutoCAD.lnk — c:program filesCommon FilesAutodesk Sharedacstart17.exe [2006-03-05 11000][HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoResolveTrack»= 0 (0x0)
«NoFileAssociate»= 0 (0x0)[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoThumbnailCache»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoThumbnailCache»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)[hkey_local_machinesoftwaremicrosoftwindowscurrentversionexplorerShellExecuteHooks]
«{56F9679E-7826-4C84-81F3-532071A8BCC5}»= «c:program filesWindows Desktop SearchMSNLNamespaceMgr.dll» [2008-05-26 304128][HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]
«msacm.l3codec»= l3codecp.acm
«SENTINEL»= snti386.dll[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesDisableNotify»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusDisableNotify»=dword:00000001
«AntiVirusOverride»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«c:\Program Files\Mail.Ru\Agent\magent.exe»=
«c:\Program Files\uTorrent\utorrent.exe»=
«c:\Program Files\Nero\Nero8\Nero Home\NeroHome.exe»=
«c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE»=
«c:\Program Files\Microsoft Office\Office12\GROOVE.EXE»=
«c:\Program Files\Microsoft Office\Office12\ONENOTE.EXE»=S3 FXDrv32;FXDrv32;??I:FXDrv32.sys []
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSvchost — NetSvcs
UxTuneUp
.
Contents of the ‘Scheduled Tasks’ folder2008-11-25 c:windowsTasks1-Click Maintenance.job
— c:program filesTuneUp Utilities 2007SystemOptimizer.exe [2007-08-02 19:35]2008-11-11 c:windowsTasksAppleSoftwareUpdate.job
— c:program filesApple Software UpdateSoftwareUpdate.exe [2008-07-30 12:34]
.**************************************************************************
catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-29 19:47:07
Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(696)
c:windowssystem32SETUPAPI.dll
c:windowssystem32COMRes.dll
c:windowssystem32cscui.dll— — — — — — — > ‘lsass.exe'(752)
c:windowssystem32setupapi.dll
c:windowssystem32imon.dll
c:program filesEsetpr_imon.dll
.
Completion time: 2008-11-29 19:47:44
ComboFix-quarantined-files.txt 2008-11-29 16:47:28
ComboFix2.txt 2008-11-29 15:21:58Pre-Run: 115,366,146,048 байт свободно
Post-Run: 115,356,041,216 байт свободно290 — E O F — 2008-11-12 10:16:47
Ночью я уже запускал эти программы, ЧЕТКО СЛЕДУЯ ИНСТРУКЦИЯМ. Но попробуем еще раз.
ComboFix 08-11-28.03 — Admin 2008-11-29 18:19:39.4 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1251.1.1049.18.488 [GMT 3:00]
Running from: c:documents and settingsAdminРабочий столинтернет-блокнотComboFix.exe
* Created a new restore pointWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.c:documents and settingsAdminLocal SettingsTemporary Internet Files0EB9F12C_6E6B_4c03_AEBA_8C04CFA98AA4.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files15913497_F86C_4218_8817_F50940D1E1B2.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files29887DDE_00B9_4011_9CF7_59511F1ECC1B.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files2A665EDD_5758_480c_8366_66DFC5F23877.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files35B7DFFA_884F_4fbc_8E60_DA601BDC7BF7.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files362FD6E8_8CDA_4c2a_A8AA-BDA22B321711.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet Files3DF04940_9866_4241_A998_0CDDFAFD147A.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files426500D7_0FF3_426c_828D_065DBAEA0581.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files478BD4AE_2691_438d_BDCA_3485DC022700.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files5C6C645F_BAA8_4149_BFEB_2031230FF0FD.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files61EA7D69_19D4_421a_A899_0DF4D58CD119.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet Files777FDAFB_83CF_4960_AA71_4E5D7BCD8E57.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files8DA878D5_E80B_4721_B75A_17EFFAF1A700.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files98F6DF79_7171_452d_9C26_C0193E12DBDF.gif
c:documents and settingsAdminLocal SettingsTemporary Internet FilesA2B240D6_0386_419e_91C5_3F7D90437CD0.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet FilesC75CEF8D_5AF4_4563_8594_C45A45E14E63.gif
c:documents and settingsAdminLocal SettingsTemporary Internet FilesE21285C1_40E6_435c_A69F_3387E7BD89CB.gif
c:documents and settingsAdminLocal SettingsTemporary Internet FilesE9A4D648_ED73_4ea7_88B2_18332DBA4F3E.jpg.
((((((((((((((((((((((((( Files Created from 2008-10-28 to 2008-11-29 )))))))))))))))))))))))))))))))
.2008-11-29 17:45 . 2008-11-29 17:45
d
C:rsit
2008-11-29 05:30 . 2008-11-29 05:30d
c:program filesTrend Micro
2008-11-25 04:03 . 2008-11-25 04:05d
c:program filesVista Start Menu
2008-11-25 04:03 . 2008-11-29 03:28d
c:documents and settingsAdminApplication DataVista Start Menu
2008-11-25 03:09 . 2008-11-25 03:47d
c:program filesTuneUp Utilities 2007
2008-11-25 03:09 . 2008-11-25 03:09d
c:documents and settingsAll UsersApplication DataTuneUp Software
2008-11-25 03:09 . 2008-11-25 03:09d
c:documents and settingsAdminApplication DataTuneUp Software
2008-11-25 03:09 . 2007-05-16 09:41 29,704 —a
c:windowssystem32uxtuneup.dll
2008-11-25 03:08 . 2008-11-25 03:08d
c:program filesCommon FilesWise Installation Wizard
2008-11-25 01:50 . 2008-11-25 01:50 314,880 —a
c:windowssystem32lgllib.dll
2008-11-19 00:56 . 2008-11-19 00:56d
C:82e5ea2e39883a4ad234b8
2008-11-19 00:55 . 2008-11-19 00:56d
C:3def84c8e5498f8d9ae3910224fa
2008-11-15 03:55 . 2008-11-15 03:55d
c:program filesMicrosoft Silverlight
2008-11-14 22:42 . 2008-11-14 22:42d
c:program filesAshampoo
2008-11-13 17:12 . 2008-11-18 02:12d
c:program filesYandexBarIE
2008-11-13 12:38 . 2008-11-18 00:08d
C:unzipped
2008-11-12 13:28 . 2008-11-12 13:28d
c:program filesMSXML 4.0
2008-11-12 13:16 . 2008-10-24 14:25 455,936
c— c:windowssystem32dllcachemrxsmb.sys
2008-11-12 13:15 . 2008-11-12 13:15d
c:program filesMSXML 6.0
2008-11-12 12:58 . 2008-09-04 19:45 1,106,944
c— c:windowssystem32dllcachemsxml3.dll
2008-11-12 10:44 . 2008-11-12 11:28d
c:program filesAKVIS
2008-11-12 01:39 . 2008-11-12 01:39d
c:program filesCommon FilesAdobe AIR
2008-11-12 01:16 . 2008-11-12 01:16d
c:documents and settingsAdminApplication Datacom.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2008-11-11 19:53 . 2008-11-11 19:55d
C:Max 2008
2008-11-11 16:07 . 2008-11-11 16:07d
c:windowssystem32configsystemprofileApplication DataPC Suite
2008-11-10 22:53 . 2008-11-11 00:11d
c:documents and settingsAdminApplication DataApple Computer
2008-11-10 22:51 . 2008-11-10 22:51d
c:program filesApple Software Update
2008-11-10 22:51 . 2008-11-11 16:48d
c:documents and settingsAll UsersApplication DataApple Computer
2008-11-10 22:50 . 2008-11-11 16:19d
c:program filesCommon FilesApple
2008-11-10 22:50 . 2008-11-10 22:50d
c:documents and settingsAll UsersApplication DataApple
2008-11-08 07:56 . 2008-11-08 07:56d
c:documents and settingsAdminApplication DataPROject MT
2008-11-08 07:47 . 2008-11-08 07:47d
c:program filesYandex
2008-11-08 07:47 . 2008-11-08 07:47d
c:program filesCommon FilesYandex
2008-11-08 07:47 . 2008-11-08 07:47d
c:documents and settingsAdminApplication DataYandex
2008-11-08 07:46 . 2008-11-08 07:46d
c:windowsspeech
2008-11-08 07:45 . 2008-11-08 09:00d
c:windowsLhsp
2008-11-08 07:45 . 2008-11-08 07:45d
c:documents and settingsAll UsersApplication DataPRMT
2008-11-08 07:41 . 2008-11-08 07:41d
c:program filesRedist
2008-11-04 22:49 . 2008-11-06 20:37 754 —a
c:windowsWORDPAD.INI
2008-11-04 19:58 . 2008-11-04 19:58d
c:windowssystem32user_unlock
2008-11-04 19:58 . 2008-11-04 19:58d
c:windowssystem32user_timeleft
2008-11-04 19:58 . 2008-11-04 19:58d
c:windowssystem32user_timecount
2008-11-04 19:58 . 2008-11-04 19:58d
c:windowssystem32user_time
2008-11-04 19:58 . 2008-11-04 19:58d
c:windowssystem32user_regedit
2008-11-04 19:58 . 2008-11-04 19:58d
c:windowssystem32user_patch
2008-11-04 19:58 . 2008-11-04 19:58d
c:windowssystem32user_lock
2008-11-04 19:58 . 2008-11-04 19:58d
c:windowssystem32user_id
2008-11-04 19:58 . 2008-11-04 19:58d
c:windowssystem32user_hardlock
2008-11-04 19:58 . 2008-11-18 02:12d
c:program filesVray Batch Render
2008-11-04 13:25 . 2008-11-04 13:25d
c:program filesTC
2008-11-04 13:22 . 2008-11-04 13:22d
c:program files3ddragon
2008-11-04 11:33 . 2008-11-04 23:41d
c:program filesCommon FilesChaosGroup
2008-11-04 11:17 . 2008-11-04 11:17d
c:program filesChaos Group
2008-11-03 06:49 . 2008-11-03 06:50d
c:program filesuTorrent
2008-11-03 06:13 . 2008-11-03 06:13 2,560 —a
c:windows_MSRSTRT.EXE
2008-11-03 05:26 . 2008-11-29 18:18d
c:documents and settingsAdminApplication DatauTorrent
2008-11-03 04:43 . 2004-08-25 11:33 1,056,768 —a
c:windowssystem32roboex32.dll
2008-11-03 04:43 . 2004-08-25 11:33 49,152 —a
c:windowssystem32inetwh32.dll
2008-11-03 04:30 . 2004-08-25 11:33 208,896 —a
c:windowssystem32wgsrvins.dll
2008-11-03 04:30 . 2004-08-25 11:33 11,264 —a
c:windowssystem32sporder.dll
2008-11-01 10:02 . 2008-11-01 10:02d
c:program files3Com
2008-11-01 02:54 . 2008-11-01 02:54d
c:program filesParagon Software
2008-11-01 02:54 . 2008-11-01 02:54d
c:program filesCommon FilesParagon Software.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-29 15:10
d
w c:program filesCyberPower PowerPanel Personal Edition
2008-11-28 21:30
d
w c:program filesCommon FilesAdobe
2008-11-28 21:08
d—h—w c:program filesInstallShield Installation Information
2008-11-28 21:08
d
w c:program filesPhone Suite
2008-11-28 20:16
d
w c:program filesNokia
2008-11-28 20:12
d
w c:program filesCommon FilesAutodesk Shared
2008-11-28 20:10
d
w c:documents and settingsAll UsersApplication DataAutodesk
2008-11-28 20:05
d
w c:program filesCorel
2008-11-28 20:05
d
w c:documents and settingsAll UsersApplication DataCorel
2008-11-28 20:05
d
w c:documents and settingsAdminApplication DataCorel
2008-11-28 20:02
d
w c:program filesEPSON
2008-11-28 19:59
d
w c:program filesEPSON Print CD
2008-11-24 16:14
d
w c:program filesWinamp
2008-11-17 23:12
d
w c:program filesWindows Media Connect 2
2008-11-17 23:12
d
w c:program filesSetupRes
2008-11-17 23:12
d
w c:program filesDivX
2008-11-17 23:12
d
r c:program filesMediaBrowser
2008-11-14 22:32
d
w c:program filesДлинные нарды 2.0
2008-11-14 21:28
d
w c:documents and settingsAll UsersApplication DataMicrosoft Help
2008-11-07 08:02 22 —-a-w c:windowsFontsv_mather.dat
2008-11-07 08:02 20 —-a-w c:windowsFontsv_girl.dat
2008-11-07 08:02 16 —-a-w c:windowsFontsv_cow.dat
2008-11-07 08:02 15 —-a-w c:windowsFontsv_sister.dat
2008-11-07 08:02 14 —-a-w c:windowsFontsv_father.dat
2008-11-07 08:02 13 —-a-w c:windowsFontsv_zoo.dat
2008-11-07 08:02 12 —-a-w c:windowsFontsv_boy.dat
2008-11-01 08:09
d
w c:program files3D Home Architect
2008-11-01 00:14
d
w c:documents and settingsAdminApplication DataOfficeUpdate12
2008-10-31 06:53
d
w c:documents and settingsAdminApplication DataMra
2008-10-24 11:25 455,936 —-a-w c:windowssystem32driversmrxsmb.sys
2008-10-23 06:32 6,656 —-a-w c:windowssystem32haspvdd.dll
2008-10-23 06:32 47,616 —-a-w c:windowssystem32driversHaspnt.sys
2008-10-23 06:32 264,704 —-a-w c:windowssystem32hlvdd.dll
2008-10-23 06:32
d
w c:program filesGLOBEtrotter Software Inc
2008-10-16 11:13 202,776 —-a-w c:windowssystem32wuweb.dll
2008-10-16 11:13 1,809,944 —-a-w c:windowssystem32wuaueng.dll
2008-10-16 11:12 561,688 —-a-w c:windowssystem32wuapi.dll
2008-10-16 11:12 323,608 —-a-w c:windowssystem32wucltui.dll
2008-10-16 11:09 92,696 —-a-w c:windowssystem32cdm.dll
2008-10-16 11:09 51,224 —-a-w c:windowssystem32wuauclt.exe
2008-10-16 11:09 43,544 —-a-w c:windowssystem32wups2.dll
2008-10-16 11:08 34,328 —-a-w c:windowssystem32wups.dll
2008-10-16 11:06 268,648 —-a-w c:windowssystem32mucltui.dll
2008-10-16 11:06 208,744 —-a-w c:windowssystem32muweb.dll
2008-10-15 01:03
d
w c:documents and settingsAll UsersApplication DataOffice Genuine Advantage
2008-10-10 21:22
d
w c:program filesMail.Ru
2008-10-07 21:16
d
w c:documents and settingsAdminApplication DataWindows Search
2008-10-07 21:09
d
w c:documents and settingsAdminApplication DataWindows Desktop Search
2008-10-07 21:06
d
w c:program filesWindows Desktop Search
2008-10-03 23:53
d
w c:program filesEset
2008-09-30 13:43 1,286,152 —-a-w c:windowssystem32msxml4.dll
2008-09-29 23:43
d
w c:program filesPunto Switcher
2008-09-23 08:53 39 —-a-w c:program filesCD.INF
2008-09-15 15:15 1,847,040 —-a-w c:windowssystem32win32k.sys
2008-09-04 16:45 1,106,944 —-a-w c:windowssystem32msxml3.dll
2008-08-29 17:06 1,350,664 —-a-w c:windowssystem32msxml6.dll
2007-12-14 11:42 7,168 —-a-w c:program filesYa_bar.mst
2007-10-16 06:57 2,172 —-a-w c:program filesSetup.ini
2007-10-14 20:01 5,408 —-a-w c:program filesx-force.nfo
2007-09-25 15:59 626,688 —-a-w c:program filesmsvcr80.dll
2007-09-25 15:59 548,864 —-a-w c:program filesmsvcp80.dll
2007-09-25 15:59 479,232 —-a-w c:program filesmsvcm80.dll
2007-09-25 15:59 1,645,320 —-a-w c:program filesgdiplus.dll
2007-09-25 15:57 91,288 —-a-w c:program filesLiteHtml.dll
2007-09-25 15:57 522 —-a-w c:program filesMicrosoft.VC80.CRT.manifest
2007-09-25 15:57 49,152 —-a-w c:program filesSetupRes2.dll
2007-09-25 15:57 460,440 —-a-w c:program filesSetupAcadUi.dll
2007-09-25 15:57 459,416 —-a-w c:program filesDeployUi.dll
2007-09-25 15:57 437,912 —-a-w c:program filesSetupUi.dll
2007-09-25 15:57 234,136 —-a-w c:program filesSetupRes.dll
2007-09-25 15:57 176,128 —-a-w c:program filesCustomProductUI.dll
2007-04-02 14:57 34,261,421 —-a-w c:program filesData1.cab
2007-04-02 14:57 2,957,824 —-a-w c:program filesPROMT 4U ERRE.msi
2007-03-21 14:06 316,976 —-a-w c:program filesSetup.exe
2007-03-04 11:40 6,620,160 —-a-w c:program filesData_.cab
2006-12-18 16:05 23,510,720 —-a-w c:program filesdotnetfx20.exe
2006-08-16 10:09 7,980 —-a-w c:program fileslav.nfo
2006-08-16 09:57 222 —-a-w c:program filesfile_id.diz
2006-05-17 08:14 340,912 —-a-w c:program filesdotnetfx.exe
2006-05-16 09:02 6,512 —-a-w c:program files0x0419.ini
2006-05-16 08:58 2,584,848 —-a-w c:program filesWindowsInstaller-KB893803-x86.exe
2006-05-05 16:18 312 —-a-r c:program filesacadcd.mid
2006-04-10 12:47 167,424
w c:program filesmbsascripting.doc
2006-03-29 10:00 15,763 —-a-w c:program filesrollup.js
2006-03-16 10:50 3,728
w c:program filesAssemblyInfo.cs
2006-02-03 19:46 429 —-a-r c:program filesMediaBrowser.ini
2005-12-07 16:01 6,268
w c:program filesrollup.xslt
2005-11-10 14:58 11,192
w c:program filesConsoleMain.cs
2005-11-10 14:46 7,461
w c:program filesMultiScan.cs
2005-11-10 14:07 24,576
w c:program filesmultimbsa.exe
2005-11-10 13:04 897
w c:program filesmmm.sln
2005-11-10 13:04 3,914
w c:program filesmmm_cli.csproj
2005-11-02 18:49 28,026
w c:program filesMultiPatchRollupDemo.xml
2005-11-02 17:40 965,782
w c:program filesMultiCheckRollupDemo.xml
2004-10-22 04:38 126,976 —-a-r c:program filesMediaBrowser.exe
2008-06-15 20:43 56 —sh—r c:windowssystem32C8E076F1EC.sys
2008-05-06 21:04 8 —sh—r c:windowssystem32ECF176E0C8.sys
2008-06-15 20:43 1,682 —sha-w c:windowssystem32KGyGaAvL.sys
2008-01-22 19:30 16,384 —sha-w c:windowssystem32configsystemprofileCookiesindex.dat
2008-01-22 19:30 32,768 —sha-w c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5index.dat
2008-01-22 19:30 32,768 —sha-w c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5MSHist012008012220080123index.dat
2008-01-22 19:30 32,768 —sha-w c:windowssystem32configsystemprofileLocal SettingsTemporary Internet FilesContent.IE5index.dat
.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2008-10-16 1578248][HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2008-10-16 1578248][HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar][HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2007-01-25 201728]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2007-07-02 132608]
«BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=»c:program filesCommon FilesNeroLibNMBgMonitor.exe» [2007-10-23 202024]
«ctfmon.exe»=»c:windowssystem32ctfmon.exe» [2007-12-21 30208]
«PowerPanel Personal Edition User Interaction»=»c:program filesCyberPower PowerPanel Personal Editionpppeuser.exe» [2007-01-10 262144]
«µTorrent»=»c:program filesuTorrentutorrent.exe» [2007-02-15 177152]
«MultiLex 6″=»c:program filesParagon SoftwareMultiLex 6multilex.exe» [2007-07-17 610304]
«Yupdate!»=»c:program filesCommon FilesYandexYupdateyupdate.exe» [2008-09-01 479496]
«VistaStartMenu»=»c:program filesVista Start MenuVistaStartMenu.exe» [2007-12-12 1206784][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2007-07-13 8466432]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2007-07-13 81920]
«GrooveMonitor»=»c:program filesMicrosoft OfficeOffice12GrooveMonitor.exe» [2007-08-24 33648]
«nod32kui»=»c:program filesEsetnod32kui.exe» [2008-01-22 949376]
«NeroFilterCheck»=»c:program filesCommon FilesNeroLibNeroCheck.exe» [2007-03-01 153136]
«NBKeyScan»=»c:program filesNeroNero8Nero BackItUpNBKeyScan.exe» [2007-09-20 1836328]
«ISUSPM Startup»=»c:progra~1COMMON~1INSTAL~1UPDATE~1ISUSPM.exe» [2005-02-16 221184]
«ISUSScheduler»=»c:program filesCommon FilesInstallShieldUpdateServiceissch.exe» [2005-02-16 81920]
«MAgent»=»c:program filesMail.RuAgentMAgent.exe» [2008-10-11 4417016]
«Adobe Reader Speed Launcher»=»c:program filesAdobeReader 9.0ReaderReader_sl.exe» [2008-06-12 34672]
«nwiz»=»nwiz.exe» [2007-07-13 c:windowssystem32nwiz.exe]
«SoundMan»=»SOUNDMAN.EXE» [2006-01-11 c:windowssoundman.exe][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2007-01-25 201728]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2007-07-02 132608][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» [2008-08-22 c:windowssystem32advpack.dll]
«IE7_012″=»advpack.dll» [2008-08-22 c:windowssystem32advpack.dll]c:documents and settingsAdminѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
‚л१Є нЄа Ё Їа®Ја ¬¬ § ЇгбЄ ¤«п OneNote 2007.lnk — c:program filesMicrosoft OfficeOffice12ONENOTEM.EXE [2007-12-07 101440]c:documents and settingsAll Usersѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
Windows Search.lnk — c:program filesWindows Desktop SearchWindowsSearch.exe [2008-05-26 123904]
Ѓлбвал© § ЇгбЄ AutoCAD.lnk — c:program filesCommon FilesAutodesk Sharedacstart17.exe [2006-03-05 11000][HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoResolveTrack»= 0 (0x0)
«NoFileAssociate»= 0 (0x0)[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoThumbnailCache»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoThumbnailCache»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)[hkey_local_machinesoftwaremicrosoftwindowscurrentversionexplorerShellExecuteHooks]
«{56F9679E-7826-4C84-81F3-532071A8BCC5}»= «c:program filesWindows Desktop SearchMSNLNamespaceMgr.dll» [2008-05-26 304128][HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]
«msacm.l3codec»= l3codecp.acm
«SENTINEL»= snti386.dll[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesDisableNotify»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusDisableNotify»=dword:00000001
«AntiVirusOverride»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«c:\Program Files\Mail.Ru\Agent\magent.exe»=
«c:\Program Files\uTorrent\utorrent.exe»=
«c:\Program Files\Nero\Nero8\Nero Home\NeroHome.exe»=
«c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE»=
«c:\Program Files\Microsoft Office\Office12\GROOVE.EXE»=
«c:\Program Files\Microsoft Office\Office12\ONENOTE.EXE»=S3 FXDrv32;FXDrv32;??I:FXDrv32.sys []
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSvchost — NetSvcs
UxTuneUp[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2I]
ShellAutoRuncommand — I:autorun.exe[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{37f925c4-1a19-11dd-89ec-001c250eb376}]
ShellAutoRuncommand — J:ntde1ect.com
ShellexploreCommand — J:ntde1ect.com
ShellopenCommand — J:ntde1ect.com[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{54ad468c-ccdf-11dc-88e9-001c250eb376}]
ShellAutoRuncommand — J:ntde1ect.com
ShellexploreCommand — J:ntde1ect.com
ShellopenCommand — J:ntde1ect.com[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{89f4220a-1813-11dd-89e5-001c250eb376}]
ShellAutoRuncommand — J:ntde1ect.com
ShellexploreCommand — J:ntde1ect.com
ShellopenCommand — J:ntde1ect.com[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{c3502b92-e23b-11dc-8923-001c250eb376}]
ShellAutoRuncommand — J:ntde1ect.com
ShellexploreCommand — J:ntde1ect.com
ShellopenCommand — J:ntde1ect.com[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{f63e76b4-737f-11dd-8b05-001c250eb376}]
ShellAutoRuncommand — J:ntde1ect.com
ShellexploreCommand — J:ntde1ect.com
ShellopenCommand — J:ntde1ect.com
.
Contents of the ‘Scheduled Tasks’ folder2008-11-25 c:windowsTasks1-Click Maintenance.job
— c:program filesTuneUp Utilities 2007SystemOptimizer.exe [2007-08-02 19:35]2008-11-11 c:windowsTasksAppleSoftwareUpdate.job
— c:program filesApple Software UpdateSoftwareUpdate.exe [2008-07-30 12:34]
.**************************************************************************
catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-29 18:21:18
Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(696)
c:windowssystem32SETUPAPI.dll
c:windowssystem32COMRes.dll
c:windowssystem32cscui.dll— — — — — — — > ‘lsass.exe'(752)
c:windowssystem32setupapi.dll
c:windowssystem32imon.dll
c:program filesEsetpr_imon.dll
.
Completion time: 2008-11-29 18:21:57
ComboFix-quarantined-files.txt 2008-11-29 15:21:41
ComboFix2.txt 2008-11-29 00:58:39Pre-Run: 115 390 435 328 байт свободно
Post-Run: 115,385,577,472 байт свободно333 — E O F — 2008-11-12 10:16:47
Информера нет в IE на новом WINDOWS, который на диске D. После проделанной операции пропал и здесь, на старом. Может теперь и 3ds Max здесь заработает? Вот логи:
info.txt logfile of random’s system information tool 1.04 2008-11-29 17:45:36======Uninstall list======
—>C:Program FilesNeroNero8\nerouninstallUNNERO.exe /UNINSTALL
—>C:WINDOWSUNNeroBackItUp.exe /UNINSTALL
—>C:WINDOWSUNNeroMediaHome.exe /UNINSTALL
—>C:WINDOWSUNNeroShowTime.exe /UNINSTALL
—>C:WINDOWSUNNeroVision.exe /UNINSTALL
—>C:WINDOWSUNRecode.exe /UNINSTALL
—>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:WINDOWSINFPCHealth.inf
µTorrent—>»C:Program FilesuTorrentuninstall.exe»
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
Acrobat.com—>msiexec /qb /x {77DCDCE3-2DED-62F3-8154-05E745472D07}
Acrobat.com—>MsiExec.exe /I{77DCDCE3-2DED-62F3-8154-05E745472D07}
Adobe AIR—>c:Program FilesCommon FilesAdobe AIRVersions1.0ResourcesAdobe AIR Updater.exe -arp:uninstall
Adobe AIR—>MsiExec.exe /I{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}
Adobe Color Common Settings—>C:Program FilesCommon FilesAdobeInstallers6c8e2cb4fd241c55406016127a6ab2eSetup.exe
Adobe Color Common Settings—>MsiExec.exe /I{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}
Adobe ExtendScript Toolkit 2—>C:Program FilesCommon FilesAdobeInstallers3e054d2218e7aa282c2369d939e58ffSetup.exe
Adobe ExtendScript Toolkit 2—>MsiExec.exe /I{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}
Adobe Flash Player 10 ActiveX—>C:WINDOWSsystem32MacromedFlashuninstall_activeX.exe
Adobe Reader 9—>MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A90000000001}
Adobe Setup—>MsiExec.exe /I{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}
Adobe Setup—>MsiExec.exe /I{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}
Apple Mobile Device Support—>MsiExec.exe /I{976C2B2A-CE59-4AB3-83FB-BF895E28F2E6}
Apple Software Update—>MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Ashampoo WinOptimizer 4.20—>»C:Program FilesAshampooAshampoo WinOptimizer 4unins000.exe»
AutoCAD 2007 — Русский—>MsiExec.exe /I{5783F2D7-5001-0419-0002-0060B0CE6BBA}
Coloriage—>»C:Program FilesAKVISColoriageUninstall.exe» «C:Program FilesAKVISColoriageinstall.log» -u
Corel Painter X—>C:Program FilesCorelCorel Painter XMSILauncher {05D60953-9012-44DF-A1A6-9DD97AD6580A} C:DOCUME~1AdminLOCALS~1TempPainterX.log
Corel Painter X—>MsiExec.exe /I{05D60953-9012-44DF-A1A6-9DD97AD6580A}
CyberPower PowerPanel Personal Edition—>MsiExec.exe /I{A9AC88EB-AD72-45F3-B811-D740E2741761}
DivX Player—>C:Program FilesDivXDivXPlayerUninstall.exe /PLAYER
DivX Pro Trial—>C:Program FilesDivXDivXCodecUninstall.exe /CODEC
EPSON Printer Software—>C:WINDOWSSystem32spoolDRIVERSW32X863EPUPDATE.EXE /R
GLOBEtrotter FLEXid Drivers—>C:WINDOWSIsUninst.exe -f»C:Program FilesGLOBEtrotter Software Inc.GLOBEtrotter FLEXid DriversUninst.isu»
Google Toolbar for Internet Explorer—>regsvr32 /u /s «c:program filesgooglegoogletoolbar1.dll»
HijackThis 2.0.2—>»C:Program FilesTrend MicroHijackThisHijackThis.exe» /uninstall
Hotfix for Windows XP (KB915800-v4)—>»C:WINDOWS$NtUninstallKB915800-v4$spuninstspuninst.exe»
IrfanView (remove only)—>C:Program FilesIrfanViewiv_uninstall.exe
Java(TM) 6 Update 3—>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
K-Lite Mega Codec Pack 3.6.0 BETA—>»C:Program FilesK-Lite Codec Packunins000.exe»
L&H TTS3000 Russian—>RunDll32 advpack.dll,LaunchINFSection C:WINDOWSINFLHTTSRUR.inf, Uninstall
Lernout & Hauspie TruVoice American English TTS Engine—>RunDll32 advpack.dll,LaunchINFSection C:WINDOWSINFtv_enua.inf, Uninstall
Mail.Ru Агент 5.2 (сборка 2405, для всех пользователей)—>C:Program FilesMail.RuAgentmagentsetup.exe -uninstalllm
Mail.Ru Спутник 2.0.1.29—>C:Program FilesMail.RuSputnikSputnikInstaller.exe -uninstall
Microsoft .NET Framework 1.1 Russian Language Pack—>MsiExec.exe /X{2BB372D9-52B4-410A-BC1A-FEAB63181EEF}
Microsoft .NET Framework 1.1—>msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1—>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 1—>MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft Office Access MUI (Russian) 2007—>MsiExec.exe /X{90120000-0015-0419-0000-0000000FF1CE}
Microsoft Office Enterprise 2007—>»C:Program FilesCommon FilesMicrosoft SharedOFFICE12Office Setup Controllersetup.exe» /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007—>MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (Russian) 2007—>MsiExec.exe /X{90120000-0016-0419-0000-0000000FF1CE}
Microsoft Office Groove MUI (Russian) 2007—>MsiExec.exe /X{90120000-00BA-0419-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (Russian) 2007—>MsiExec.exe /X{90120000-0044-0419-0000-0000000FF1CE}
Microsoft Office OneNote MUI (Russian) 2007—>MsiExec.exe /X{90120000-00A1-0419-0000-0000000FF1CE}
Microsoft Office Outlook MUI (Russian) 2007—>MsiExec.exe /X{90120000-001A-0419-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (Russian) 2007—>MsiExec.exe /X{90120000-0018-0419-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007—>MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007—>MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Russian) 2007—>MsiExec.exe /X{90120000-001F-0419-0000-0000000FF1CE}
Microsoft Office Proof (Ukrainian) 2007—>MsiExec.exe /X{90120000-001F-0422-0000-0000000FF1CE}
Microsoft Office Proofing (Russian) 2007—>MsiExec.exe /X{90120000-002C-0419-0000-0000000FF1CE}
Microsoft Office Publisher MUI (Russian) 2007—>MsiExec.exe /X{90120000-0019-0419-0000-0000000FF1CE}
Microsoft Office Shared MUI (Russian) 2007—>MsiExec.exe /X{90120000-006E-0419-0000-0000000FF1CE}
Microsoft Office Word MUI (Russian) 2007—>MsiExec.exe /X{90120000-001B-0419-0000-0000000FF1CE}
Microsoft Silverlight—>MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft User-Mode Driver Framework Feature Pack 1.5—>»C:WINDOWS$NtUninstallWudf01005$spuninstspuninst.exe»
Microsoft Visual C++ 2005 Redistributable—>MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
MSXML 4.0 SP2 (KB936181)—>MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)—>MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 6 Service Pack 2 (KB954459)—>MsiExec.exe /I{12ADA7E9-D69A-4FF3-BA89-7EA3DF5A9A6A}
MultiLex Compact 6.4 English-Russian—>MsiExec.exe /X{73222BD1-C545-4C9E-AB28-17BC47BE8BA9}
Nero 8 Demo—>MsiExec.exe /X{88589E19-665C-4575-A4A0-CE9C43C51049}
neroxml—>MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
NOD32 FiX v2.1—>»C:Program FilesEsetunins000.exe»
Nokia Connectivity Cable Driver—>MsiExec.exe /X{972B1D9B-0EAD-49E8-B7D6-3B83FD5665B1}
NVIDIA Drivers—>C:WINDOWSsystem32nvudisp.exe UninstallGUI
OpenAL—>»C:Program FilesOpenALoalinst.exe» /U
Paint.NET v3.20—>rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFPaintDN.inf,Uninstall
PC Connectivity Solution—>MsiExec.exe /I{066D65EA-ED53-44E4-A96A-F81B6E409D2E}
PL-2303 USB-to-Serial—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}Setup.exe» -l0x9 Installed
Realtek AC’97 Audio—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime11 0Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{FB08F381-6533-4108-B7DD-039E11FBC27E}Setup.exe» -l0x19 -removeonly
Retoucher—>»C:Program FilesAKVISRetoucherUninstall.exe» «C:Program FilesAKVISRetoucherinstall.log» -u
Security Update for 2007 Microsoft Office System (KB951550)—>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
Security Update for 2007 Microsoft Office System (KB951944)—>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
Security Update for 2007 Microsoft Office System (KB955936)—>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {1D94099C-2BBA-440E-BD5E-093BBDF8F028}
Security Update for Microsoft Office Excel 2007 (KB955470)—>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {6E8637D8-10D6-4568-AA06-E2706F31685E}
Security Update for Microsoft Office OneNote 2007 (KB950130)—>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {F1B2401C-B610-4BF2-AA1C-52C55827A8F4}
Security Update for Microsoft Office PowerPoint 2007 (KB951338)—>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {558B709B-821B-4FC5-90FC-9A8890641E77}
Security Update for Microsoft Office Publisher 2007 (KB950114)—>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {F9C3CDBA-1F00-4D4D-959D-75C9D3ACDD85}
Security Update for Microsoft Office system 2007 (KB951808)—>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {8F375E11-4FD6-4B89-9E2B-A76D48B51E00}
Security Update for Microsoft Office system 2007 (KB954326)—>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
Security Update for Microsoft Office Word 2007 (KB950113)—>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {AD72BABE-C733-4FCF-9674-4314466191B9}
Sentinel System Driver—>C:WINDOWSSYSTEM32RNBOSENTSETUPX86.EXE /U /q
TuneUp Utilities 2007—>MsiExec.exe /I{C8BB4912-12D9-42AE-B571-E580D8CD1B5B}
Update for Microsoft Office Outlook 2007 (KB952142)—>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {4AD3A076-427C-491F-A5B7-7D1DE788A756}
Update for Office 2007 (KB946691)—>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
Update for Outlook 2007 Junk Email Filter (kb957829)—>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {07A1F6B6-4F1C-418C-A605-755A121C4A16}
Update Manager—>MsiExec.exe /I{F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}
VCRedistSetup—>MsiExec.exe /I{3921A67A-5AB1-4E48-9444-C71814CF3027}
Vista Start Menu—>C:Program FilesVista Start Menuuninstall.exe
Vray Batch Render Uninstall—>C:Program FilesVray Batch RenderUninstall.exe
Windows Driver Package — Nokia (WUDFRd) WPD (03/19/2007 6.83.31.1)—>C:PROGRA~1DIFXD6ACC4BE676423A2B130B78A4B627FC457D98997dpinst.exe /u C:WINDOWSsystem32DRVSTOREpccswpddri_039E7E24575DBAE6A389611AF28F4EB97729D33Epccswpddriver.inf
Windows Driver Package — Nokia Modem (02/15/2007 3.1)—>C:PROGRA~1DIFXD6ACC4BE676423A2B130B78A4B627FC457D98997dpinst.exe /u C:WINDOWSsystem32DRVSTOREpccs_bluet_8B37DC72918CCD58A6EC20373AF6242B037A293Bpccs_bluetooth.inf
Windows Internet Explorer 8 Beta 2—>»C:WINDOWSie8spuninstspuninst.exe»
Windows Search 4.0—>»C:WINDOWS$NtUninstallKB940157$spuninstspuninst.exe»
Антивирусная система NOD32—>C:Program FilesEsetSetupsetup.exe /UNINSTALL
Архиватор WinRAR—>C:Program FilesWinRARuninstall.exe
Исправление для Windows XP (KB952287)—>»C:WINDOWS$NtUninstallKB952287$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB938464)—>»C:WINDOWS$NtUninstallKB938464$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB941693)—>»C:WINDOWS$NtUninstallKB941693$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB943055)—>»C:WINDOWS$NtUninstallKB943055$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB943485)—>»C:WINDOWS$NtUninstallKB943485$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB945553)—>»C:WINDOWS$NtUninstallKB945553$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB946026)—>»C:WINDOWS$NtUninstallKB946026$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB948590)—>»C:WINDOWS$NtUninstallKB948590$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB950749)—>»C:WINDOWS$NtUninstallKB950749$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB950762)—>»C:WINDOWS$NtUninstallKB950762$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB950974)—>»C:WINDOWS$NtUninstallKB950974$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB951066)—>»C:WINDOWS$NtUninstallKB951066$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB951376-v2)—>»C:WINDOWS$NtUninstallKB951376-v2$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB951698)—>»C:WINDOWS$NtUninstallKB951698$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB951748)—>»C:WINDOWS$NtUninstallKB951748$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB952954)—>»C:WINDOWS$NtUninstallKB952954$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB953839)—>»C:WINDOWS$NtUninstallKB953839$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB954211)—>»C:WINDOWS$NtUninstallKB954211$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB955069)—>»C:WINDOWS$NtUninstallKB955069$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB956391)—>»C:WINDOWS$NtUninstallKB956391$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB956803)—>»C:WINDOWS$NtUninstallKB956803$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB956841)—>»C:WINDOWS$NtUninstallKB956841$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB957095)—>»C:WINDOWS$NtUninstallKB957095$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB957097)—>»C:WINDOWS$NtUninstallKB957097$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB958644)—>»C:WINDOWS$NtUninstallKB958644$spuninstspuninst.exe»
Обновление безопасности для проигрывателя Windows Media 11 — (KB954154)—>»C:WINDOWS$NtUninstallKB954154_WM11$spuninstspuninst.exe»
Обновление для Windows XP (KB932823-v3)—>»C:WINDOWS$NtUninstallKB932823-v3$spuninstspuninst.exe»
Обновление для Windows XP (KB951072-v2)—>»C:WINDOWS$NtUninstallKB951072-v2$spuninstspuninst.exe»
Удалить Winamp—>»C:Program FilesWinampunins000.exe»
Яндекс.Бар для Internet Explorer 3.5.4—>»C:Program FilesYandexYandexBarIEunins000.exe»=====HijackThis Backups=====
O2 — BHO: lsblibP — {D301FCD4-12D1-44C8-AAD9-A4FA9E268CC3} — C:WINDOWSsystem32lsblib.dll
O2 — BHO: clilibP — {42037581-6B92-4350-8191-55278D6276E5} — C:WINDOWSsystem32clilib.dll
O6 — HKLMSoftwarePoliciesMicrosoftInternet ExplorerRestrictions present
O6 — HKLMSoftwarePoliciesMicrosoftInternet ExplorerControl Panel present======Hosts File======
127.0.0.1 mpa.one.microsoft.com
======Security center information======
AV: Антивирусная система Eset NOD32 2.70
======Environment variables======
«ComSpec»=%SystemRoot%system32cmd.exe
«Path»=%systemroot%system32;%systemroot%;%systemroot%system32wbem;C:Program FilesPC Connectivity Solution;C:Program FilesCommon FilesAutodesk Shared
«windir»=%SystemRoot%
«FP_NO_HOST_CHECK»=NO
«OS»=Windows_NT
«PROCESSOR_ARCHITECTURE»=x86
«PROCESSOR_LEVEL»=15
«PROCESSOR_IDENTIFIER»=x86 Family 15 Model 107 Stepping 1, AuthenticAMD
«PROCESSOR_REVISION»=6b01
«NUMBER_OF_PROCESSORS»=2
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP
«cdrom»=I:
EOF
Logfile of random’s system information tool 1.04 (written by random/random)
Run by Admin at 2008-11-29 17:45:31
Microsoft Windows XP Professional Service Pack 2
System drive C: has 110 GB (81%) free of 136 GB
Total RAM: 1023 MB (47% free)Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:45:35, on 29.11.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: NormalRunning processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32RUNDLL32.EXE
C:Program FilesMicrosoft OfficeOffice12GrooveMonitor.exe
C:Program FilesEsetnod32kui.exe
C:WINDOWSSOUNDMAN.EXE
C:Program FilesCommon FilesInstallShieldUpdateServiceissch.exe
C:WINDOWSsystem32rundll32.exe
C:Program FilesMail.RuAgentMAgent.exe
C:Program FilesPunto Switcherps.exe
C:Program FilesCommon FilesNeroLibNMBgMonitor.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesCyberPower PowerPanel Personal Editionpppeuser.exe
C:Program FilesuTorrentutorrent.exe
C:Program FilesParagon SoftwareMultiLex 6multilex.exe
C:Program FilesCommon FilesYandexYupdateyupdate.exe
C:Program FilesVista Start MenuVistaStartMenu.exe
C:Program FilesWindows Desktop SearchWindowsSearch.exe
C:Program FilesMicrosoft OfficeOffice12ONENOTEM.EXE
C:Program FilesCommon FilesAppleMobile Device SupportbinAppleMobileDeviceService.exe
C:Program FilesCommon FilesAutodesk SharedServiceAdskScSrv.exe
C:Program FilesNeroNero8Nero BackItUpNBService.exe
C:Program FilesEsetnod32krn.exe
C:WINDOWSsystem32nvsvc32.exe
C:Program FilesCyberPower PowerPanel Personal Editionppped.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32SearchIndexer.exe
C:Program FilesCommon FilesNeroLibNMIndexingService.exe
C:Program FilesCommon FilesNeroLibNMIndexStoreSvr.exe
C:Program Filesinternet exploreriexplore.exe
C:Program Filesinternet exploreriexplore.exe
C:WINDOWSsystem32SearchProtocolHost.exe
C:Documents and SettingsAdminРабочий столинтернет-блокнотRSIT.exe
C:Program FilesTrend MicroHijackThisAdmin.exeR0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = about:blank
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: (no name) — {83821C2B-32A8-4DD7-B6D4-44309A78E668} — C:Program FilesMail.RuAgentMradllnewmrasearch.dll
R3 — URLSearchHook: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O2 — BHO: AcroIEHelperStub — {18DF081C-E8AD-4283-A596-FA578C2EBDC3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelperShim.dll
O2 — BHO: Groove GFS Browser Helper — {72853161-30C5-4D22-B7F9-0BBC1D38A37E} — C:Program FilesMicrosoft OfficeOffice12GrooveShellExtensions.dll
O2 — BHO: SSVHelper Class — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — C:Program FilesJavajre1.6.0_03binssv.dll
O2 — BHO: Спутник@Mail.Ru — {8984B388-A5BB-4DF7-B274-77B879E179DB} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O2 — BHO: Ask Search Assistant BHO — {9CB65201-89C4-402c-BA80-02D8C59F9B1D} — (no file)
O2 — BHO: Google Toolbar Helper — {AA58ED58-01DD-4d91-8333-CF10577473F7} — c:program filesgooglegoogletoolbar1.dll
O2 — BHO: Ask Toolbar BHO — {FE063DB1-4EC0-403e-8DD8-394C54984B2C} — (no file)
O3 — Toolbar: (no name) — {FE063DB9-4EC0-403e-8DD8-394C54984B2C} — (no file)
O3 — Toolbar: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O3 — Toolbar: Яндекс.Бар — {91397D20-1446-11D4-8AF4-0040CA1127B6} — C:Program FilesYandexYandexBarIEyndbar.dll
O3 — Toolbar: &Google — {2318C2B1-4965-11d4-9B18-009027A5CD4F} — c:program filesgooglegoogletoolbar1.dll
O4 — HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 — HKLM..Run: [nwiz] nwiz.exe /install
O4 — HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 — HKLM..Run: [GrooveMonitor] «C:Program FilesMicrosoft OfficeOffice12GrooveMonitor.exe»
O4 — HKLM..Run: [nod32kui] «C:Program FilesEsetnod32kui.exe» /WAITSERVICE
O4 — HKLM..Run: [NeroFilterCheck] C:Program FilesCommon FilesNeroLibNeroCheck.exe
O4 — HKLM..Run: [NBKeyScan] «C:Program FilesNeroNero8Nero BackItUpNBKeyScan.exe»
O4 — HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 — HKLM..Run: [ISUSPM Startup] C:PROGRA~1COMMON~1INSTAL~1UPDATE~1ISUSPM.exe -startup
O4 — HKLM..Run: [ISUSScheduler] «C:Program FilesCommon FilesInstallShieldUpdateServiceissch.exe» -start
O4 — HKLM..Run: [MAgent] C:Program FilesMail.RuAgentMAgent.exe -LM
O4 — HKLM..Run: [Adobe Reader Speed Launcher] «C:Program FilesAdobeReader 9.0ReaderReader_sl.exe»
O4 — HKCU..Run: [Punto Switcher] C:Program FilesPunto Switcherps.exe
O4 — HKCU..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe
O4 — HKCU..Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] «C:Program FilesCommon FilesNeroLibNMBgMonitor.exe»
O4 — HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [PowerPanel Personal Edition User Interaction] «C:Program FilesCyberPower PowerPanel Personal Editionpppeuser.exe»
O4 — HKCU..Run: [µTorrent] «C:Program FilesuTorrentutorrent.exe»
O4 — HKCU..Run: [MultiLex 6] «C:Program FilesParagon SoftwareMultiLex 6multilex.exe» /tray
O4 — HKCU..Run: [Yupdate!] «C:Program FilesCommon FilesYandexYupdateyupdate.exe»
O4 — HKCU..Run: [VistaStartMenu] «C:Program FilesVista Start MenuVistaStartMenu.exe»
O4 — HKUSS-1-5-18..Run: [Punto Switcher] C:Program FilesPunto Switcherps.exe (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,NewUserFirstLogonInstall,0 (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [Punto Switcher] C:Program FilesPunto Switcherps.exe (User ‘Default user’)
O4 — HKUS.DEFAULT..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,NewUserFirstLogonInstall,0 (User ‘Default user’)
O4 — Startup: Вырезка экрана и программа запуска для OneNote 2007.lnk = C:Program FilesMicrosoft OfficeOffice12ONENOTEM.EXE
O4 — Global Startup: Windows Search.lnk = C:Program FilesWindows Desktop SearchWindowsSearch.exe
O4 — Global Startup: Быстрый запуск AutoCAD.lnk = C:Program FilesCommon FilesAutodesk Sharedacstart17.exe
O8 — Extra context menu item: &Google Search — res://C:Program FilesGoogleGoogleToolbar1.dll/cmsearch.html
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2Office12EXCEL.EXE/3000
O8 — Extra context menu item: Backward &Links — res://C:Program FilesGoogleGoogleToolbar1.dll/cmbacklinks.html
O8 — Extra context menu item: Cac&hed Snapshot of Page — res://C:Program FilesGoogleGoogleToolbar1.dll/cmcache.html
O8 — Extra context menu item: Si&milar Pages — res://C:Program FilesGoogleGoogleToolbar1.dll/cmsimilar.html
O8 — Extra context menu item: Translate into English — res://C:Program FilesGoogleGoogleToolbar1.dll/cmtrans.html
O8 — Extra context menu item: Найти в интернете — res://C:Program FilesMail.RuSputnikMailRuSputnik.dll/282
O8 — Extra context menu item: Найти в словарях — res://C:Program FilesMail.RuSputnikMailRuSputnik.dll/283
O8 — Extra context menu item: Настроить параметры перевода — C:Program FilesPRMT8PRMTIEoptions.htm
O8 — Extra context menu item: Незнакомые слова — C:Program FilesPRMT8PRMTIEinfopanel.htm
O8 — Extra context menu item: Перевести — C:Program FilesPRMT8PRMTIEtranslat.htm
O8 — Extra context menu item: Перевести страницу — C:Program FilesPRMT8PRMTIEpage.htm
O8 — Extra context menu item: Поиск в Интернете — C:Program FilesPRMT8PRMTIEsearch.htm
O9 — Extra button: (no name) — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_03binssv.dll
O9 — Extra ‘Tools’ menuitem: Sun Java Console — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_03binssv.dll
O9 — Extra button: Отправить в OneNote — {2670000A-7350-4f3c-8081-5663EE0C6C49} — C:PROGRA~1MICROS~2Office12ONBttnIE.dll
O9 — Extra ‘Tools’ menuitem: &Отправить в OneNote — {2670000A-7350-4f3c-8081-5663EE0C6C49} — C:PROGRA~1MICROS~2Office12ONBttnIE.dll
O9 — Extra button: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra ‘Tools’ menuitem: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra button: Research — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2Office12REFIEBAR.DLL
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O16 — DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} — http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 — DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) — http://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1226708318937
O17 — HKLMSystemCCSServicesTcpip..{52E92B57-3E77-4641-B6F8-725D7C7E41A9}: NameServer = 192.168.49.2 85.172.0.250
O18 — Protocol: grooveLocalGWS — {88FED34C-F0CA-4636-A375-3CB6248B04CD} — C:Program FilesMicrosoft OfficeOffice12GrooveSystemServices.dll
O23 — Service: Apple Mobile Device — Apple Inc. — C:Program FilesCommon FilesAppleMobile Device SupportbinAppleMobileDeviceService.exe
O23 — Service: Autodesk Licensing Service — Autodesk — C:Program FilesCommon FilesAutodesk SharedServiceAdskScSrv.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: InstallDriver Table Manager (IDriverT) — Macrovision Corporation — C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: Nero BackItUp Scheduler 3 — Nero AG — C:Program FilesNeroNero8Nero BackItUpNBService.exe
O23 — Service: NMIndexingService — Nero AG — C:Program FilesCommon FilesNeroLibNMIndexingService.exe
O23 — Service: NOD32 Kernel Service (NOD32krn) — Eset — C:Program FilesEsetnod32krn.exe
O23 — Service: NVIDIA Display Driver Service (NVSvc) — NVIDIA Corporation — C:WINDOWSsystem32nvsvc32.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: PowerPanel Personal Edition Service (ppped) — Unknown owner — C:Program FilesCyberPower PowerPanel Personal Editionppped.exe
O23 — Service: ProtexisLicensing — Unknown owner — C:WINDOWSsystem32PSIService.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: ServiceLayer — Nokia. — C:Program FilesPC Connectivity SolutionServiceLayer.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe—
End of file — 12376 bytes======Scheduled tasks folder======
C:WINDOWStasks1-Click Maintenance.job
C:WINDOWStasksAppleSoftwareUpdate.job======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelperShim.dll [2008-06-11 75128][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper — C:Program FilesMicrosoft OfficeOffice12GrooveShellExtensions.dll [2007-08-24 2212224][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class — C:Program FilesJavajre1.6.0_03binssv.dll [2007-09-25 501136][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{8984B388-A5BB-4DF7-B274-77B879E179DB}]
MailRuBHO Class — C:Program FilesMail.RuSputnikMailRuSputnik.dll [2008-10-11 665800][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9CB65201-89C4-402c-BA80-02D8C59F9B1D}]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper — c:program filesgooglegoogletoolbar1.dll [2008-06-15 770048][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{FE063DB1-4EC0-403e-8DD8-394C54984B2C}]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{FE063DB9-4EC0-403e-8DD8-394C54984B2C}
{09900DE8-1DCA-443F-9243-26FF581438AF} — Спутник@Mail.Ru — C:Program FilesMail.RuSputnikMailRuSputnik.dll [2008-10-11 665800]
{91397D20-1446-11D4-8AF4-0040CA1127B6} — Яндекс.Бар — C:Program FilesYandexYandexBarIEyndbar.dll [2008-10-16 1578248]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} — &Google — c:program filesgooglegoogletoolbar1.dll [2008-06-15 770048][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«NvCplDaemon»=C:WINDOWSsystem32NvCpl.dll [2007-07-13 8466432]
«nwiz»=nwiz.exe /install []
«NvMediaCenter»=C:WINDOWSsystem32NvMcTray.dll [2007-07-13 81920]
«GrooveMonitor»=C:Program FilesMicrosoft OfficeOffice12GrooveMonitor.exe [2007-08-24 33648]
«nod32kui»=C:Program FilesEsetnod32kui.exe [2008-01-22 949376]
«NeroFilterCheck»=C:Program FilesCommon FilesNeroLibNeroCheck.exe [2007-03-01 153136]
«NBKeyScan»=C:Program FilesNeroNero8Nero BackItUpNBKeyScan.exe [2007-09-20 1836328]
«SoundMan»=C:WINDOWSSOUNDMAN.EXE [2006-01-11 577536]
«ISUSPM Startup»=C:PROGRA~1COMMON~1INSTAL~1UPDATE~1ISUSPM.exe [2005-02-16 221184]
«ISUSScheduler»=C:Program FilesCommon FilesInstallShieldUpdateServiceissch.exe [2005-02-16 81920]
«MAgent»=C:Program FilesMail.RuAgentMAgent.exe [2008-10-11 4417016]
«Adobe Reader Speed Launcher»=C:Program FilesAdobeReader 9.0ReaderReader_sl.exe [2008-06-12 34672][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«Punto Switcher»=C:Program FilesPunto Switcherps.exe [2007-01-25 201728]
«VistaIcon»=C:Program FilesVistaDriveIconVistaDrv.exe [2007-07-02 132608]
«BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=C:Program FilesCommon FilesNeroLibNMBgMonitor.exe [2007-10-23 202024]
«ctfmon.exe»=C:WINDOWSsystem32ctfmon.exe [2007-12-21 30208]
«PowerPanel Personal Edition User Interaction»=C:Program FilesCyberPower PowerPanel Personal Editionpppeuser.exe [2007-01-10 262144]
«µTorrent»=C:Program FilesuTorrentutorrent.exe [2007-02-15 177152]
«MultiLex 6″=C:Program FilesParagon SoftwareMultiLex 6multilex.exe [2007-07-17 610304]
«Yupdate!»=C:Program FilesCommon FilesYandexYupdateyupdate.exe [2008-09-01 479496]
«VistaStartMenu»=C:Program FilesVista Start MenuVistaStartMenu.exe [2007-12-12 1206784]C:Documents and SettingsAll UsersГлавное менюПрограммыАвтозагрузка
Windows Search.lnk — C:Program FilesWindows Desktop SearchWindowsSearch.exe
Быстрый запуск AutoCAD.lnk — C:Program FilesCommon FilesAutodesk Sharedacstart17.exeC:Documents and SettingsAdminГлавное менюПрограммыАвтозагрузка
Вырезка экрана и программа запуска для OneNote 2007.lnk — C:Program FilesMicrosoft OfficeOffice12ONENOTEM.EXE[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyWgaLogon]
C:WINDOWSsystem32WgaLogon.dll [2008-09-05 267304][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32wpdshserviceobj.dll [2007-06-18 133632][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks]
«{B5A7F190-DDA6-4420-B3BA-52453494E6CD}»=C:Program FilesMicrosoft OfficeOffice12GrooveShellExtensions.dll [2007-08-24 2212224]
«{56F9679E-7826-4C84-81F3-532071A8BCC5}»=C:Program FilesWindows Desktop SearchMSNLNamespaceMgr.dll [2008-05-26 304128][HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetwork{1a3e09be-1e45-494b-9174-d7385b45bbf5}]
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«undockwithoutlogon»=1
«ShutdownWithoutLogon»=1[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoSharedDocuments»=1
«NoThumbnailCache»=1
«NoSMConfigurePrograms»=1
«NoDrives»=0[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoResolveTrack»=
«NoFileAssociate»=
«NoDriveTypeAutoRun»=
«NoDrives»=
«NoDriveAutoRun»=[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«C:Program FilesMail.RuAgentmagent.exe»=»C:Program FilesMail.RuAgentmagent.exe:*:Enabled:Mail.Ru Агент»
«C:Program FilesuTorrentutorrent.exe»=»C:Program FilesuTorrentutorrent.exe:*:Enabled:µTorrent»
«C:Program FilesNeroNero8Nero HomeNeroHome.exe»=»C:Program FilesNeroNero8Nero HomeNeroHome.exe:*:Enabled:Nero Home»
«C:Program FilesMicrosoft OfficeOffice12OUTLOOK.EXE»=»C:Program FilesMicrosoft OfficeOffice12OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook»
«C:Program FilesMicrosoft OfficeOffice12GROOVE.EXE»=»C:Program FilesMicrosoft OfficeOffice12GROOVE.EXE:*:Enabled:Microsoft Office Groove»
«C:Program FilesMicrosoft OfficeOffice12ONENOTE.EXE»=»C:Program FilesMicrosoft OfficeOffice12ONENOTE.EXE:*:Enabled:Microsoft Office OneNote»[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2I]
shellAutoRuncommand — I:autorun.exe[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{37f925c4-1a19-11dd-89ec-001c250eb376}]
shellAutoRuncommand — J:ntde1ect.com
shellexplorecommand — J:ntde1ect.com
shellopencommand — J:ntde1ect.com[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{54ad468c-ccdf-11dc-88e9-001c250eb376}]
shellAutoRuncommand — J:ntde1ect.com
shellexplorecommand — J:ntde1ect.com
shellopencommand — J:ntde1ect.com[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{89f4220a-1813-11dd-89e5-001c250eb376}]
shellAutoRuncommand — J:ntde1ect.com
shellexplorecommand — J:ntde1ect.com
shellopencommand — J:ntde1ect.com[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{c3502b92-e23b-11dc-8923-001c250eb376}]
shellAutoRuncommand — J:ntde1ect.com
shellexplorecommand — J:ntde1ect.com
shellopencommand — J:ntde1ect.com[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{f63e76b4-737f-11dd-8b05-001c250eb376}]
shellAutoRuncommand — J:ntde1ect.com
shellexplorecommand — J:ntde1ect.com
shellopencommand — J:ntde1ect.com======File associations======
.scr — open — «C:WINDOWSsystem32NOTEPAD.EXE» «%1»
.scr — install —
.scr — config —======List of files/folders created in the last 1 months======
2008-11-29 17:45:31 —-D—- C:rsit
2008-11-29 05:30:57 —-D—- C:Program FilesTrend Micro
2008-11-29 04:05:43 —-D—- C:ComboFix
2008-11-29 04:05:03 —-SHD—- C:RECYCLER
2008-11-29 03:58:39 —-A—- C:ComboFix.txt
2008-11-29 02:51:45 —-D—- C:WINDOWSERDNT
2008-11-29 02:09:24 —-RASHD—- C:autorun.inf
2008-11-28 23:08:42 —-SHD—- C:Config.Msi
2008-11-25 04:03:24 —-D—- C:Documents and SettingsAdminApplication DataVista Start Menu
2008-11-25 04:03:15 —-D—- C:Program FilesVista Start Menu
2008-11-25 03:09:53 —-D—- C:Documents and SettingsAdminApplication DataTuneUp Software
2008-11-25 03:09:48 —-A—- C:WINDOWSsystem32uxtuneup.dll
2008-11-25 03:09:45 —-D—- C:Documents and SettingsAll UsersApplication DataTuneUp Software
2008-11-25 03:09:34 —-D—- C:Program FilesTuneUp Utilities 2007
2008-11-25 03:08:57 —-D—- C:Program FilesCommon FilesWise Installation Wizard
2008-11-25 01:50:59 —-A—- C:WINDOWSsystem32lgllib.dll
2008-11-19 00:56:03 —-D—- C:82e5ea2e39883a4ad234b8
2008-11-19 00:55:35 —-D—- C:3def84c8e5498f8d9ae3910224fa
2008-11-15 03:55:18 —-D—- C:Program FilesMicrosoft Silverlight
2008-11-14 22:42:37 —-D—- C:Program FilesAshampoo
2008-11-14 01:11:42 —-A—- C:instLog.txt
2008-11-13 17:12:20 —-D—- C:Program FilesYandexBarIE
2008-11-13 12:38:41 —-D—- C:unzipped
2008-11-12 13:28:42 —-HDC—- C:WINDOWS$NtUninstallKB957097$
2008-11-12 13:28:27 —-D—- C:Program FilesMSXML 4.0
2008-11-12 13:15:53 —-D—- C:Program FilesMSXML 6.0
2008-11-12 13:15:09 —-HDC—- C:WINDOWS$NtUninstallKB955069$
2008-11-12 10:44:03 —-D—- C:Program FilesAKVIS
2008-11-12 01:39:51 —-D—- C:Program FilesCommon FilesAdobe AIR
2008-11-12 01:16:08 —-D—- C:Documents and SettingsAdminApplication Datacom.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2008-11-11 19:53:17 —-D—- C:Max 2008
2008-11-11 19:50:28 —-A—- C:WINDOWSntbtlog.txt
2008-11-10 22:53:37 —-D—- C:Documents and SettingsAdminApplication DataApple Computer
2008-11-10 22:51:39 —-D—- C:Documents and SettingsAll UsersApplication DataApple Computer
2008-11-10 22:51:16 —-D—- C:Program FilesApple Software Update
2008-11-10 22:50:50 —-D—- C:Program FilesCommon FilesApple
2008-11-10 22:50:50 —-D—- C:Documents and SettingsAll UsersApplication DataApple
2008-11-08 07:56:52 —-D—- C:Documents and SettingsAdminApplication DataPROject MT
2008-11-08 07:47:08 —-D—- C:Program FilesYandex
2008-11-08 07:47:08 —-D—- C:Program FilesCommon FilesYandex
2008-11-08 07:47:08 —-D—- C:Documents and SettingsAdminApplication DataYandex
2008-11-08 07:47:08 —-D—- C:Documents and SettingsAdminApplication DataMozilla
2008-11-08 07:46:00 —-D—- C:WINDOWSspeech
2008-11-08 07:45:22 —-D—- C:WINDOWSLhsp
2008-11-08 07:45:22 —-D—- C:Documents and SettingsAll UsersApplication DataPRMT
2008-11-08 07:41:25 —-D—- C:Program FilesRedist
2008-11-04 22:49:11 —-A—- C:WINDOWSWORDPAD.INI
2008-11-04 19:58:14 —-D—- C:WINDOWSsystem32user_unlock
2008-11-04 19:58:14 —-D—- C:WINDOWSsystem32user_time
2008-11-04 19:58:14 —-D—- C:WINDOWSsystem32user_regedit
2008-11-04 19:58:14 —-D—- C:WINDOWSsystem32user_hardlock
2008-11-04 19:58:13 —-D—- C:WINDOWSsystem32user_timeleft
2008-11-04 19:58:13 —-D—- C:WINDOWSsystem32user_timecount
2008-11-04 19:58:13 —-D—- C:WINDOWSsystem32user_patch
2008-11-04 19:58:13 —-D—- C:WINDOWSsystem32user_lock
2008-11-04 19:58:13 —-D—- C:WINDOWSsystem32user_id
2008-11-04 19:58:13 —-D—- C:Program FilesVray Batch Render
2008-11-04 13:25:59 —-D—- C:Program FilesTC
2008-11-04 13:25:58 —-SHD—- C:Systmm Volume Information
2008-11-04 13:22:23 —-D—- C:Program Files3ddragon
2008-11-04 11:33:51 —-D—- C:Program FilesCommon FilesChaosGroup
2008-11-04 11:17:54 —-D—- C:Program FilesChaos Group
2008-11-03 06:49:56 —-D—- C:Program FilesuTorrent
2008-11-03 06:13:10 —-A—- C:WINDOWS_MSRSTRT.EXE
2008-11-03 05:26:06 —-D—- C:Documents and SettingsAdminApplication DatauTorrent
2008-11-03 04:43:08 —-A—- C:WINDOWSsystem32roboex32.dll
2008-11-03 04:43:08 —-A—- C:WINDOWSsystem32inetwh32.dll
2008-11-03 04:30:36 —-A—- C:WINDOWSsystem32wgsrvins.dll
2008-11-03 04:30:36 —-A—- C:WINDOWSsystem32sporder.dll
2008-11-01 10:02:37 —-D—- C:Program Files3Com
2008-11-01 02:54:48 —-D—- C:Program FilesCommon FilesParagon Software
2008-11-01 02:54:46 —-D—- C:Program FilesParagon Software======List of files/folders modified in the last 1 months======
2008-11-29 17:38:52 —-D—- C:Program FilesCyberPower PowerPanel Personal Edition
2008-11-29 17:35:30 —-A—- C:WINDOWSSchedLgU.Txt
2008-11-29 17:31:54 —-D—- C:WINDOWSsystem32
2008-11-29 17:20:57 —-D—- C:WINDOWSTemp
2008-11-29 05:30:57 —-RD—- C:Program Files
2008-11-29 04:10:43 —-SHD—- C:System Volume Information
2008-11-29 04:10:43 —-D—- C:WINDOWSsystem32Restore
2008-11-29 04:05:56 —-D—- C:WINDOWS
2008-11-29 03:57:59 —-A—- C:WINDOWSsystem.ini
2008-11-29 03:57:34 —-D—- C:WINDOWSsystem32drivers
2008-11-29 03:57:33 —-D—- C:WINDOWSAppPatch
2008-11-29 03:57:33 —-D—- C:Program FilesCommon Files
2008-11-29 02:53:25 —-RSD—- C:WINDOWSFonts
2008-11-29 01:42:36 —-D—- C:WINDOWSsystem32CatRoot2
2008-11-29 01:36:15 —-D—- C:Documents and SettingsAdminApplication DataAdobe
2008-11-29 00:55:03 —-A—- C:WINDOWSsystem32oeminfo.ini
2008-11-29 00:33:06 —-SHD—- C:WINDOWSInstaller
2008-11-29 00:30:15 —-D—- C:Program FilesCommon FilesAdobe
2008-11-29 00:21:35 —-D—- C:Program FilesAdobe
2008-11-29 00:14:14 —-D—- C:Documents and SettingsAll UsersApplication DataAdobe
2008-11-29 00:08:42 —-HD—- C:Program FilesInstallShield Installation Information
2008-11-29 00:08:42 —-D—- C:Program FilesPhone Suite
2008-11-28 23:16:49 —-D—- C:Program FilesNokia
2008-11-28 23:16:46 —-HD—- C:WINDOWSinf
2008-11-28 23:16:37 —-DC—- C:WINDOWSsystem32DRVSTORE
2008-11-28 23:12:41 —-D—- C:Program FilesCommon FilesAutodesk Shared
2008-11-28 23:10:17 —-D—- C:Documents and SettingsAll UsersApplication DataAutodesk
2008-11-28 23:05:44 —-D—- C:WINDOWSWinSxS
2008-11-28 23:05:44 —-D—- C:Documents and SettingsAdminApplication DataCorel
2008-11-28 23:05:42 —-D—- C:Program FilesCorel
2008-11-28 23:05:42 —-D—- C:Documents and SettingsAll UsersApplication DataCorel
2008-11-28 23:02:56 —-D—- C:Program FilesEPSON
2008-11-28 22:59:54 —-D—- C:Program FilesEPSON Print CD
2008-11-28 22:13:58 —-A—- C:WINDOWSNeroDigital.ini
2008-11-28 22:13:57 —-SD—- C:WINDOWSDownloaded Program Files
2008-11-25 03:09:55 —-SD—- C:WINDOWSTasks
2008-11-24 19:14:07 —-D—- C:Program FilesWinamp
2008-11-18 02:12:38 —-D—- C:Program FilesWindows Media Connect 2
2008-11-18 02:12:38 —-D—- C:Program FilesSetupRes
2008-11-18 02:12:37 —-RD—- C:Program FilesMediaBrowser
2008-11-18 02:12:35 —-D—- C:Program FilesDivX
2008-11-15 01:56:22 —-RSHDC—- C:WINDOWSsystem32dllcache
2008-11-15 01:32:55 —-D—- C:Program FilesДлинные нарды 2.0
2008-11-15 00:28:59 —-D—- C:Documents and SettingsAll UsersApplication DataMicrosoft Help
2008-11-14 22:58:32 —-D—- C:WINDOWSsystem32NtmsData
2008-11-14 21:50:07 —-D—- C:WINDOWSHelp
2008-11-13 12:00:13 —-SH—- C:boot.ini
2008-11-12 13:28:37 —-HD—- C:WINDOWS$hf_mig$
2008-11-12 01:15:03 —-D—- C:фото
2008-11-10 22:52:05 —-D—- C:Program FilesInternet Explorer
2008-11-08 07:45:53 —-D—- C:WINDOWSmsagent
2008-11-04 19:58:15 —-D—- C:WINDOWSsecurity
2008-11-04 03:10:25 —-A—- C:WINDOWSsystem32MRT.exe
2008-11-01 11:09:38 —-D—- C:Program Files3D Home Architect
2008-11-01 03:14:27 —-D—- C:Documents and SettingsAdminApplication DataOfficeUpdate12
2008-11-01 01:42:16 —-RSD—- C:WINDOWSassembly
2008-11-01 01:41:13 —-D—- C:Program FilesCommon FilesMicrosoft Shared
2008-10-31 13:47:47 —-D—- C:WINDOWSnetwork diagnostic
2008-10-31 09:53:06 —-D—- C:Documents and SettingsAdminApplication DataMra======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 nod32drv;nod32drv; C:WINDOWSsystem32driversnod32drv.sys [2008-01-22 15424]
R1 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:WINDOWSSystem32driversws2ifsl.sys [2004-08-18 12032]
R2 AMON;AMON; C:WINDOWSsystem32driversamon.sys [2008-01-22 512096]
R2 DS1410D;DS1410D; ??C:WINDOWSsystem32driversds1410d.sys []
R2 Hardlock;Hardlock; ??C:WINDOWSsystem32drivershardlock.sys []
R2 Haspnt;Haspnt; ??C:WINDOWSsystem32driversHaspnt.sys []
R2 irda;ИК-протокол IrDA; C:WINDOWSsystem32DRIVERSirda.sys [2007-12-22 87424]
R2 rspndr;Ответчик обнаружения топологии уровня связи; C:WINDOWSsystem32DRIVERSrspndr.sys [2006-12-04 62336]
R2 Sentinel;Sentinel; C:WINDOWSSystem32DriversSENTINEL.SYS [2001-06-21 73728]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:WINDOWSsystem32driversALCXWDM.SYS [2006-02-17 3846848]
R3 HidUsb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2001-08-17 9600]
R3 irsir;Драйвер для инфракрасного последовательного порта Microsoft; C:WINDOWSsystem32DRIVERSirsir.sys [2001-08-18 18688]
R3 nv;nv; C:WINDOWSsystem32DRIVERSnv4_mini.sys [2007-07-13 6807744]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:WINDOWSsystem32DRIVERSNVENETFD.sys [2006-02-17 34176]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:WINDOWSsystem32DRIVERSnvnetbus.sys [2006-02-17 13056]
R3 Rasirda;Минипорт WAN (IrDA); C:WINDOWSsystem32DRIVERSrasirda.sys [2001-08-18 19584]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2007-12-21 30208]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2007-12-21 59392]
R3 usbohci;Драйвер минипорта Microsoft USB открытого хост-контроллера; C:WINDOWSsystem32DRIVERSusbohci.sys [2007-12-21 17152]
R3 usbstor;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2004-08-18 26496]
S3 catchme;catchme; ??C:ComboFixcatchme.sys []
S3 FXDrv32;FXDrv32; ??I:FXDrv32.sys []
S3 nmwcd;Nokia USB Phone Parent; C:WINDOWSsystem32driversnmwcd.sys [2007-02-22 137216]
S3 nmwcdc;Nokia USB Generic; C:WINDOWSsystem32driversnmwcdc.sys [2007-02-22 8320]
S3 nmwcdcj;Nokia USB Port; C:WINDOWSsystem32driversnmwcdcj.sys [2007-02-22 12288]
S3 nmwcdcm;Nokia USB Modem; C:WINDOWSsystem32driversnmwcdcm.sys [2007-02-22 12288]
S3 Sntnlusb;Rainbow USB SuperPro; C:WINDOWSsystem32DRIVERSSNTNLUSB.SYS [2001-06-21 20032]
S3 usbccgp;Драйвер универсального родительского устройства USB (Microsoft); C:WINDOWSsystem32DRIVERSusbccgp.sys [2007-12-21 31616]
S3 usbprint;Класс принтеров Microsoft USB; C:WINDOWSsystem32DRIVERSusbprint.sys [2007-12-21 25856]
S3 WpdUsb;WpdUsb; C:WINDOWSsystem32DRIVERSwpdusb.sys [2007-06-18 38528]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2006-09-15 82688]
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 Apple Mobile Device;Apple Mobile Device; C:Program FilesCommon FilesAppleMobile Device SupportbinAppleMobileDeviceService.exe [2008-10-01 116040]
R2 Autodesk Licensing Service;Autodesk Licensing Service; C:Program FilesCommon FilesAutodesk SharedServiceAdskScSrv.exe [2008-02-04 79360]
R2 Irmon;Монитор инфракрасной связи; C:WINDOWSsystem32svchost.exe [2004-08-18 14336]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:Program FilesNeroNero8Nero BackItUpNBService.exe [2007-09-20 853288]
R2 NOD32krn;NOD32 Kernel Service; C:Program FilesEsetnod32krn.exe [2008-01-22 552064]
R2 NVSvc;NVIDIA Display Driver Service; C:WINDOWSsystem32nvsvc32.exe [2007-07-13 155716]
R2 ppped;PowerPanel Personal Edition Service; C:Program FilesCyberPower PowerPanel Personal Editionppped.exe [2007-01-10 512000]
R2 UxTuneUp;TuneUp Theme Extension; C:WINDOWSSystem32svchost.exe [2004-08-18 14336]
R2 WSearch;Windows Search; C:WINDOWSsystem32SearchIndexer.exe [2008-05-26 439808]
R2 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2004-08-18 14336]
R3 NMIndexingService;NMIndexingService; C:Program FilesCommon FilesNeroLibNMIndexingService.exe [2007-10-23 382248]
S2 ProtexisLicensing;ProtexisLicensing; C:WINDOWSsystem32PSIService.exe [2006-11-02 174656]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2007-10-24 70144]
S3 IDriverT;InstallDriver Table Manager; C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe [2005-04-04 69632]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:Program FilesMicrosoft OfficeOffice12GrooveAuditService.exe [2007-08-24 68464]
S3 odserv;Microsoft Office Diagnostics Service; C:Program FilesCommon FilesMicrosoft SharedOFFICE12ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2006-10-26 145184]
S3 ServiceLayer;ServiceLayer; C:Program FilesPC Connectivity SolutionServiceLayer.exe [2007-03-26 292864]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:Program FilesWindows Media Playerwmpnetwk.exe [2006-10-18 913408]
EOF
