OTL logfile created on: 01.04.2011 19:13:55 - Run 1 OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\User\Мои документы\Downloads Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000419 | Country: Россия | Language: RUS | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 73,00% Memory free 4,00 Gb Paging File | 3,00 Gb Available in Paging File | 91,00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 19,53 Gb Total Space | 1,80 Gb Free Space | 9,22% Space Free | Partition Type: NTFS Drive D: | 213,35 Gb Total Space | 105,67 Gb Free Space | 49,53% Space Free | Partition Type: NTFS Computer Name: MYCOMP | User Name: User | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2011.04.01 19:11:33 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\User\Мои документы\Downloads\OTL.exe PRC - [2011.03.23 21:49:21 | 001,004,088 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe PRC - [2011.02.23 18:04:20 | 003,451,496 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe PRC - [2011.02.23 18:04:19 | 000,042,184 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe PRC - [2011.01.01 19:45:29 | 001,041,088 | ---- | M] () -- C:\Program Files\Mail.Ru\Guard\GuardMailRu.exe PRC - [2009.07.27 06:10:00 | 001,983,816 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE PRC - [2009.01.11 19:28:29 | 000,132,096 | ---- | M] () -- C:\Program Files\VistaDriveIcon\VistaDrv.exe PRC - [2008.04.15 16:00:00 | 001,034,240 | ---- | M] () -- C:\WINDOWS\explorer.exe PRC - [2008.04.15 16:00:00 | 000,509,440 | ---- | M] () -- C:\WINDOWS\system32\winlogon.exe PRC - [2008.04.15 16:00:00 | 000,111,104 | ---- | M] (Корпорация Майкрософт) -- C:\WINDOWS\system32\services.exe PRC - [2008.04.15 16:00:00 | 000,050,688 | ---- | M] (Корпорация Майкрософт) -- C:\WINDOWS\system32\smss.exe PRC - [2008.02.19 21:32:12 | 000,041,472 | ---- | M] () -- C:\Program Files\Volumecontrol2\LouderIt.exe PRC - [2007.12.18 17:34:10 | 000,074,240 | ---- | M] (G&G Software, Moscow State University) -- C:\Program Files\AmlMaple\AmlMaple.exe PRC - [2007.12.14 18:17:33 | 000,086,016 | ---- | M] () -- C:\Program Files\LClock\LClock.exe PRC - [2007.03.09 12:47:08 | 000,062,976 | ---- | M] (Alexander Avdonin) -- C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe PRC - [2005.04.27 15:59:24 | 000,241,725 | ---- | M] (Microsoft Corporation) -- C:\Program Files\UPHClean\uphclean.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2011.04.01 19:11:33 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\User\Мои документы\Downloads\OTL.exe MOD - [2011.02.23 18:04:17 | 000,197,208 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\snxhk.dll MOD - [2008.04.15 16:00:00 | 008,480,256 | ---- | M] (Корпорация Майкрософт) -- C:\WINDOWS\system32\shell32.dll MOD - [2008.04.15 16:00:00 | 001,287,168 | ---- | M] (Корпорация Майкрософт) -- C:\WINDOWS\system32\ole32.dll MOD - [2008.04.15 16:00:00 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll MOD - [2008.04.15 16:00:00 | 000,997,888 | ---- | M] (Корпорация Майкрософт) -- C:\WINDOWS\system32\kernel32.dll MOD - [2008.04.15 16:00:00 | 000,991,744 | ---- | M] (Корпорация Майкрософт) -- C:\WINDOWS\system32\setupapi.dll MOD - [2008.04.15 16:00:00 | 000,797,696 | ---- | M] (Корпорация Майкрософт) -- C:\WINDOWS\system32\comres.dll MOD - [2008.04.15 16:00:00 | 000,719,360 | ---- | M] (Корпорация Майкрософт) -- C:\WINDOWS\system32\ntdll.dll MOD - [2008.04.15 16:00:00 | 000,687,616 | ---- | M] (Корпорация Майкрософт) -- C:\WINDOWS\system32\advapi32.dll MOD - [2008.04.15 16:00:00 | 000,634,368 | ---- | M] (Корпорация Майкрософт) -- C:\WINDOWS\system32\user32.dll MOD - [2008.04.15 16:00:00 | 000,586,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\mlang.dll MOD - [2008.04.15 16:00:00 | 000,474,112 | ---- | M] (Корпорация Майкрософт) -- C:\WINDOWS\system32\shlwapi.dll MOD - [2008.04.15 16:00:00 | 000,279,040 | ---- | M] (Корпорация Майкрософт) -- C:\WINDOWS\system32\comdlg32.dll MOD - [2008.04.15 16:00:00 | 000,219,648 | ---- | M] (Корпорация Майкрософт) -- C:\WINDOWS\system32\uxtheme.dll MOD - [2008.04.15 16:00:00 | 000,172,544 | ---- | M] (Корпорация Майкрософт) -- C:\WINDOWS\system32\wldap32.dll MOD - [2008.04.15 16:00:00 | 000,146,944 | ---- | M] (Корпорация Майкрософт) -- C:\WINDOWS\system32\winspool.drv MOD - [2008.04.15 16:00:00 | 000,119,296 | ---- | M] (Корпорация Майкрософт) -- C:\WINDOWS\system32\ntmarta.dll MOD - [2008.04.15 16:00:00 | 000,067,584 | ---- | M] (Корпорация Майкрософт) -- C:\WINDOWS\system32\srclient.dll MOD - [2008.02.19 21:32:38 | 000,018,944 | ---- | M] () -- C:\Program Files\Volumecontrol2\LHook.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [Disabled | Stopped] -- -- (HidServ) SRV - [2011.02.23 18:04:19 | 000,042,184 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus) SRV - [2011.01.01 19:45:29 | 001,041,088 | ---- | M] () [Auto | Stopped] -- C:\Program Files\Mail.Ru\Guard\GuardMailRu.exe -- (Guard.Mail.ru) SRV - [2010.11.04 21:44:34 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2008.04.15 16:00:00 | 000,687,616 | ---- | M] (Корпорация Майкрософт) [On_Demand | Stopped] -- C:\WINDOWS\system32\advapi32.dll -- (Wmi) Расширения драйверов WMI (Windows Management Instrumentation) SRV - [2008.04.15 16:00:00 | 000,483,840 | ---- | M] (Корпорация Майкрософт) [Auto | Running] -- C:\WINDOWS\system32\wzcsvc.dll -- (WZCSVC) SRV - [2008.04.15 16:00:00 | 000,436,736 | ---- | M] (Корпорация Майкрософт) [On_Demand | Stopped] -- C:\WINDOWS\system32\ntmssvc.dll -- (NtmsSvc) SRV - [2008.04.15 16:00:00 | 000,409,088 | ---- | M] (Корпорация Майкрософт) [On_Demand | Running] -- C:\WINDOWS\system32\qmgr.dll -- (BITS) Фоновая интеллектуальная служба передачи (BITS) SRV - [2008.04.15 16:00:00 | 000,333,824 | ---- | M] (Корпорация Майкрософт) [Auto | Running] -- C:\WINDOWS\system32\wiaservc.dll -- (stisvc) Служба загрузки изображений (WIA) SRV - [2008.04.15 16:00:00 | 000,330,752 | ---- | M] (Корпорация Майкрософт) [Auto | Running] -- C:\WINDOWS\system32\ipnathlp.dll -- (SharedAccess) Брандмауэр Windows/Общий доступ к Интернету (ICS) SRV - [2008.04.15 16:00:00 | 000,295,936 | ---- | M] (Корпорация Майкрософт) [On_Demand | Running] -- C:\WINDOWS\system32\termsrv.dll -- (TermService) SRV - [2008.04.15 16:00:00 | 000,290,304 | ---- | M] (Корпорация Майкрософт) [On_Demand | Stopped] -- C:\WINDOWS\system32\vssvc.exe -- (VSS) SRV - [2008.04.15 16:00:00 | 000,249,856 | ---- | M] (Корпорация Майкрософт) [On_Demand | Running] -- C:\WINDOWS\system32\tapisrv.dll -- (TapiSrv) SRV - [2008.04.15 16:00:00 | 000,247,296 | ---- | M] (Корпорация Майкрософт) [On_Demand | Running] -- C:\WINDOWS\system32\mswsock.dll -- (Nla) Служба сетевого расположения (NLA) SRV - [2008.04.15 16:00:00 | 000,198,144 | ---- | M] (Корпорация Майкрософт) [On_Demand | Running] -- C:\WINDOWS\system32\netman.dll -- (Netman) SRV - [2008.04.15 16:00:00 | 000,193,024 | ---- | M] (Корпорация Майкрософт) [Auto | Running] -- C:\WINDOWS\system32\schedsvc.dll -- (Schedule) SRV - [2008.04.15 16:00:00 | 000,186,368 | ---- | M] (Корпорация Майкрософт) [On_Demand | Stopped] -- C:\WINDOWS\system32\upnphost.dll -- (upnphost) SRV - [2008.04.15 16:00:00 | 000,175,616 | ---- | M] (Корпорация Майкрософт) [Auto | Running] -- C:\WINDOWS\system32\w32time.dll -- (W32Time) SRV - [2008.04.15 16:00:00 | 000,171,008 | ---- | M] (Корпорация Майкрософт) [Auto | Running] -- C:\WINDOWS\system32\srsvc.dll -- (srservice) SRV - [2008.04.15 16:00:00 | 000,171,008 | ---- | M] (Корпорация Майкрософт) [On_Demand | Stopped] -- C:\WINDOWS\system32\appmgmts.dll -- (AppMgmt) SRV - [2008.04.15 16:00:00 | 000,150,528 | ---- | M] (Корпорация Майкрософт) [On_Demand | Stopped] -- C:\WINDOWS\system32\imapi.exe -- (ImapiService) SRV - [2008.04.15 16:00:00 | 000,145,408 | ---- | M] (Корпорация Майкрософт) [Auto | Running] -- C:\WINDOWS\system32\wbem\wmisvc.dll -- (winmgmt) SRV - [2008.04.15 16:00:00 | 000,141,824 | ---- | M] (Корпорация Майкрософт) [On_Demand | Stopped] -- C:\WINDOWS\system32\sessmgr.exe -- (RDSessMgr) SRV - [2008.04.15 16:00:00 | 000,135,680 | ---- | M] (Корпорация Майкрософт) [Auto | Running] -- C:\WINDOWS\system32\shsvcs.dll -- (Themes) SRV - [2008.04.15 16:00:00 | 000,135,680 | ---- | M] (Корпорация Майкрософт) [Auto | Running] -- C:\WINDOWS\system32\shsvcs.dll -- (ShellHWDetection) SRV - [2008.04.15 16:00:00 | 000,135,680 | ---- | M] (Корпорация Майкрософт) [On_Demand | Running] -- C:\WINDOWS\system32\shsvcs.dll -- (FastUserSwitchingCompatibility) SRV - [2008.04.15 16:00:00 | 000,126,464 | ---- | M] (Корпорация Майкрософт) [On_Demand | Stopped] -- C:\WINDOWS\system32\wbem\wmiapsrv.exe -- (WmiApSrv) SRV - [2008.04.15 16:00:00 | 000,126,464 | ---- | M] (Корпорация Майкрософт) [Auto | Running] -- C:\WINDOWS\system32\dhcpcsvc.dll -- (Dhcp) SRV - [2008.04.15 16:00:00 | 000,113,664 | ---- | M] (Корпорация Майкрософт) [Disabled | Stopped] -- C:\WINDOWS\system32\netdde.exe -- (NetDDEdsdm) SRV - [2008.04.15 16:00:00 | 000,113,664 | ---- | M] (Корпорация Майкрософт) [Disabled | Stopped] -- C:\WINDOWS\system32\netdde.exe -- (NetDDE) SRV - [2008.04.15 16:00:00 | 000,111,104 | ---- | M] (Корпорация Майкрософт) [Auto | Running] -- C:\WINDOWS\system32\services.exe -- (PlugPlay) SRV - [2008.04.15 16:00:00 | 000,111,104 | ---- | M] (Корпорация Майкрософт) [Auto | Running] -- C:\WINDOWS\system32\services.exe -- (Eventlog) SRV - [2008.04.15 16:00:00 | 000,096,768 | ---- | M] (Корпорация Майкрософт) [Disabled | Stopped] -- C:\WINDOWS\system32\scardsvr.exe -- (SCardSvr) SRV - [2008.04.15 16:00:00 | 000,091,648 | ---- | M] (Корпорация Майкрософт) [On_Demand | Stopped] -- C:\WINDOWS\system32\smlogsvc.exe -- (SysmonLog) SRV - [2008.04.15 16:00:00 | 000,073,216 | ---- | M] (Корпорация Майкрософт) [On_Demand | Stopped] -- C:\WINDOWS\system32\tlntsvr.exe -- (TlntSvr) SRV - [2008.04.15 16:00:00 | 000,045,568 | ---- | M] (Корпорация Майкрософт) [Auto | Running] -- C:\WINDOWS\system32\dnsrslvr.dll -- (Dnscache) SRV - [2008.04.15 16:00:00 | 000,032,768 | ---- | M] (Корпорация Майкрософт) [On_Demand | Stopped] -- C:\WINDOWS\system32\mnmsrvc.exe -- (mnmsrvc) SRV - [2008.04.15 16:00:00 | 000,024,064 | ---- | M] (Корпорация Майкрософт) [On_Demand | Stopped] -- C:\WINDOWS\system32\dmserver.dll -- (dmserver) SRV - [2008.04.15 16:00:00 | 000,018,944 | ---- | M] (Корпорация Майкрософт) [Auto | Running] -- C:\WINDOWS\system32\seclogon.dll -- (seclogon) SRV - [2005.04.27 15:59:24 | 000,241,725 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\UPHClean\uphclean.exe -- (UPHClean) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - File not found [Kernel | On_Demand | Running] -- -- (catchme) DRV - [2011.02.23 17:56:55 | 000,371,544 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx) DRV - [2011.02.23 17:56:45 | 000,301,528 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP) DRV - [2011.02.23 17:55:49 | 000,049,240 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi) DRV - [2011.02.23 17:55:47 | 000,102,232 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2) DRV - [2011.02.23 17:55:10 | 000,025,432 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr) DRV - [2011.02.23 17:54:57 | 000,030,680 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4) DRV - [2011.02.23 17:54:55 | 000,019,544 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2009.06.30 01:15:27 | 000,038,912 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\l1e51x86.sys -- (L1e) DRV - [2009.06.09 18:29:22 | 001,177,600 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\athr.sys -- (athr) DRV - [2009.06.05 19:14:40 | 001,766,592 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC) DRV - [2009.03.27 17:43:42 | 001,529,600 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\athw.sys -- (AR5416) DRV - [2008.10.27 16:28:52 | 000,878,976 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\viahduaa.sys -- (VIAHdAudAddService) DRV - [2008.07.21 00:31:12 | 000,059,776 | ---- | M] (DEVGURU Co,LTD.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PTDLWWAN.sys -- (PTDLWWAN) DRV - [2008.07.21 00:31:06 | 000,039,936 | ---- | M] (DEVGURU Co,LTD.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PTDLVsp.sys -- (PTDLVsp) DRV - [2008.07.21 00:31:04 | 000,041,344 | ---- | M] (DEVGURU Co,LTD.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PTDLMdm.sys -- (PTDLMdm) DRV - [2008.07.21 00:31:02 | 000,032,256 | ---- | M] (DEVGURU Co,LTD.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PTDLBus.sys -- (PTDLBus) DRV - [2008.04.15 16:00:00 | 000,188,288 | ---- | M] (Корпорация Майкрософт) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ACPI.sys -- (ACPI) DRV - [2008.04.15 16:00:00 | 000,125,440 | ---- | M] (Корпорация Майкрософт) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ftdisk.sys -- (Ftdisk) DRV - [2008.04.15 16:00:00 | 000,120,192 | ---- | M] (Корпорация Майкрософт) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\pcmcia.sys -- (Pcmcia) DRV - [2008.04.15 16:00:00 | 000,080,128 | ---- | M] (Корпорация Майкрософт) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\parport.sys -- (Parport) DRV - [2008.04.15 16:00:00 | 000,073,472 | ---- | M] (Корпорация Майкрософт) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sr.sys -- (sr) DRV - [2008.04.15 16:00:00 | 000,065,024 | ---- | M] (Корпорация Майкрософт) [Kernel | Auto | Stopped] -- C:\WINDOWS\System32\drivers\serial.sys -- (Serial) DRV - [2008.04.15 16:00:00 | 000,051,968 | ---- | M] (Корпорация Майкрософт) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\volsnap.sys -- (VolSnap) DRV - [2008.04.15 16:00:00 | 000,044,544 | ---- | M] (Корпорация Майкрософт) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\fips.sys -- (Fips) DRV - [2008.04.15 16:00:00 | 000,030,208 | ---- | M] (Корпорация Майкрософт) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\modem.sys -- (Modem) DRV - [2008.04.15 16:00:00 | 000,024,832 | ---- | M] (Корпорация Майкрософт) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\kbdclass.sys -- (Kbdclass) DRV - [2008.04.15 16:00:00 | 000,012,160 | ---- | M] (Корпорация Майкрософт) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mouhid.sys -- (mouhid) DRV - [2008.04.15 16:00:00 | 000,011,776 | ---- | M] (Корпорация Майкрософт) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ACPIEC.sys -- (ACPIEC) DRV - [2008.04.15 16:00:00 | 000,006,912 | ---- | M] (Корпорация Майкрософт) [Kernel | Auto | Stopped] -- C:\WINDOWS\System32\drivers\parvdm.sys -- (ParVdm) DRV - [2008.04.15 01:11:48 | 000,058,368 | ---- | M] (Корпорация Майкрософт) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\redbook.sys -- (redbook) DRV - [2008.04.14 22:22:30 | 000,068,480 | ---- | M] (Корпорация Майкрософт) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\pci.sys -- (PCI) DRV - [2008.04.14 22:17:16 | 000,037,504 | ---- | M] (Корпорация Майкрософт) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\isapnp.sys -- (isapnp) DRV - [2008.04.14 22:14:10 | 000,053,120 | ---- | M] (Корпорация Майкрософт) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\i8042prt.sys -- (i8042prt) DRV - [2008.04.14 22:07:44 | 000,023,296 | ---- | M] (Корпорация Майкрософт) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\mouclass.sys -- (Mouclass) DRV - [2008.04.07 15:00:46 | 000,006,656 | ---- | M] (Generic) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CRFILTER.sys -- (CRFILTER) DRV - [2006.12.18 00:11:58 | 000,007,680 | ---- | M] (ATK0100) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ATKACPI.sys -- (MTsensor) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchURL\G, = http://www.google.com/search?q=%s IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchURL\G, = http://www.google.com/search?q=%s IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchURL\G, = http://www.google.com/search?q=%s IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchURL\G, = http://www.google.com/search?q=%s IE - HKU\S-1-5-21-2025429265-926492609-1417001333-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.mail.ru/cnt/7828 IE - HKU\S-1-5-21-2025429265-926492609-1417001333-1004\Software\Microsoft\Internet Explorer\SearchURL\G, = http://www.google.com/search?q=%s IE - HKU\S-1-5-21-2025429265-926492609-1417001333-1004\..\URLSearchHook: {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll (@Mail.Ru) IE - HKU\S-1-5-21-2025429265-926492609-1417001333-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2025429265-926492609-1417001333-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.defaultenginename: "http://www.mail.ru/" FF - prefs.js..browser.search.defaulturl: "http://go.mail.ru/search?fr=fftb&utf8in&q=" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "http://www.mail.ru/cnt/7828" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.1 FF - prefs.js..extensions.enabledItems: elemhidehelper@adblockplus.org:1.0.6 FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.6.5 FF - prefs.js..extensions.enabledItems: {3d7eb24f-2740-49df-8937-200b1cc08f8a}:1.5.11.2 FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.2.0.4 FF - prefs.js..extensions.enabledItems: imglikeopera@imfo.ru:0.6.18 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {EDA7B1D7-F793-4e03-B074-E6F303317FB0}:1.2.6 FF - prefs.js..extensions.enabledItems: {9669CC8F-B388-42FE-86F4-CB5E7F5A8BDC}:6.0.3.4 FF - prefs.js..extensions.enabledItems: yasearch@yandex.ru:5.0.3 FF - prefs.js..extensions.enabledItems: {37964A3C-4EE8-47b1-8321-34DE2C39BA4D}:2.4.0.30 FF - prefs.js..extensions.enabledItems: {81514210-E22A-4e69-93D5-E1EFD45B4620}:0.2.09.07.07 FF - prefs.js..keyword.URL: "http://go.mail.ru/search?utf8in=1&fr=fftbUFix&q=" [2010.11.04 21:42:15 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\User\Application Data\Mozilla\Extensions [2011.02.12 00:15:48 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\k7wui19f.default\extensions [2010.11.04 21:42:08 | 000,000,000 | ---D | M] (FlashGot) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\k7wui19f.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34} [2011.01.20 00:30:43 | 000,000,000 | ---D | M] (Спутник @Mail.Ru) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\k7wui19f.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D} [2010.11.04 21:42:08 | 000,000,000 | ---D | M] (Flashblock) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\k7wui19f.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2010.11.04 21:42:08 | 000,000,000 | ---D | M] ("Text Link") -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\k7wui19f.default\extensions\{54BB9F3F-07E5-486c-9B39-C7398B99391C} [2010.11.04 21:42:08 | 000,000,000 | ---D | M] (IE Tab) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\k7wui19f.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9} [2010.11.04 21:42:08 | 000,000,000 | ---D | M] (Past Modern) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\k7wui19f.default\extensions\{81514210-E22A-4e69-93D5-E1EFD45B4620} [2010.11.04 21:42:09 | 000,000,000 | ---D | M] (MR Tech Toolkit) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\k7wui19f.default\extensions\{9669CC8F-B388-42FE-86F4-CB5E7F5A8BDC} [2010.11.04 21:42:09 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\k7wui19f.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2010.11.04 21:42:09 | 000,000,000 | ---D | M] (Download Statusbar) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\k7wui19f.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} [2010.11.04 21:42:09 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\k7wui19f.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781} [2010.11.04 21:42:08 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\k7wui19f.default\extensions\elemhidehelper@adblockplus.org [2010.11.04 21:42:08 | 000,000,000 | ---D | M] (ImgLikeOpera) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\k7wui19f.default\extensions\imglikeopera@imfo.ru [2010.12.20 00:01:58 | 000,000,000 | ---D | M] (MyPlayCity.Бар) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\k7wui19f.default\extensions\yasearch@yandex.ru [2010.12.20 00:01:57 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\k7wui19f.default\extensions\yasearch@yandex.ru\chrome\skin\extensions-hacks [2011.02.05 23:20:33 | 000,001,544 | ---- | M] () -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\k7wui19f.default\searchplugins\mailru---.xml [2011.02.11 14:15:03 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2010.11.04 21:42:10 | 000,000,000 | ---D | M] (FlashGot) -- C:\Program Files\Mozilla Firefox\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34} [2010.11.04 21:42:10 | 000,000,000 | ---D | M] (Flashblock) -- C:\Program Files\Mozilla Firefox\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2010.11.04 21:42:10 | 000,000,000 | ---D | M] ("Text Link") -- C:\Program Files\Mozilla Firefox\extensions\{54BB9F3F-07E5-486c-9B39-C7398B99391C} [2010.11.04 21:42:10 | 000,000,000 | ---D | M] (IE Tab) -- C:\Program Files\Mozilla Firefox\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9} [2010.11.04 21:42:10 | 000,000,000 | ---D | M] (Past Modern) -- C:\Program Files\Mozilla Firefox\extensions\{81514210-E22A-4e69-93D5-E1EFD45B4620} [2010.11.04 21:42:10 | 000,000,000 | ---D | M] (MR Tech Toolkit) -- C:\Program Files\Mozilla Firefox\extensions\{9669CC8F-B388-42FE-86F4-CB5E7F5A8BDC} [2010.11.04 21:42:10 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Program Files\Mozilla Firefox\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2010.11.04 21:42:11 | 000,000,000 | ---D | M] (Download Statusbar) -- C:\Program Files\Mozilla Firefox\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} [2010.11.04 21:42:12 | 000,000,000 | ---D | M] (Menu Editor) -- C:\Program Files\Mozilla Firefox\extensions\{EDA7B1D7-F793-4e03-B074-E6F303317FB0} [2010.11.04 21:42:10 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Program Files\Mozilla Firefox\extensions\elemhidehelper@adblockplus.org [2010.11.04 21:42:10 | 000,000,000 | ---D | M] (ImgLikeOpera) -- C:\Program Files\Mozilla Firefox\extensions\imglikeopera@imfo.ru [2010.11.04 21:26:39 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2010.11.04 21:35:23 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION [2008.10.05 07:24:02 | 003,695,008 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\NPSWF32.dll [2009.07.03 20:36:44 | 000,001,122 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\priceru.xml [2009.07.03 20:36:44 | 000,002,395 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\rambler.xml [2009.07.03 20:36:44 | 000,001,945 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\torgmailru.xml [2009.07.03 20:36:44 | 000,001,304 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-ru.xml [2009.07.03 20:36:44 | 000,004,072 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yandex-slovari.xml [2009.07.03 20:36:44 | 000,004,281 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yandex.xml O1 HOSTS File: ([2011.04.01 18:11:10 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (MailRuBHO Class) - {8984B388-A5BB-4DF7-B274-77B879E179DB} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll (@Mail.Ru) O2 - BHO: (IE 4.x-6.x BHO for Download Master) - {9961627E-4059-41B4-8E0E-A7D6B3854ADF} - C:\Program Files\Download Master\dmiehlp.dll (WestByte) O3 - HKLM\..\Toolbar: (Спутник@Mail.Ru) - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll (@Mail.Ru) O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {EDF7BDB3-F1D6-4b9f-8E93-742A4D9443FC} - No CLSID value found. O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {EDF7BDB3-F1D6-4b9f-8E93-742A4D9443FC} - No CLSID value found. O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software) O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.) O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.) O4 - HKLM..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.) O4 - HKLM..\Run: [Guard.Mail.ru.gui] C:\Program Files\Mail.Ru\Guard\GuardMailRu.exe () O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe (Alexander Avdonin) O4 - HKU\.DEFAULT..\Run: [Aml Maple] C:\Program Files\AmlMaple\AmlMaple.exe (G&G Software, Moscow State University) O4 - HKU\.DEFAULT..\Run: [louderit.exe] C:\Program Files\Volumecontrol2\LouderIt.exe () O4 - HKU\.DEFAULT..\Run: [VistaIcon] C:\Program Files\VistaDriveIcon\VistaDrv.exe () O4 - HKU\S-1-5-18..\Run: [Aml Maple] C:\Program Files\AmlMaple\AmlMaple.exe (G&G Software, Moscow State University) O4 - HKU\S-1-5-18..\Run: [louderit.exe] C:\Program Files\Volumecontrol2\LouderIt.exe () O4 - HKU\S-1-5-18..\Run: [VistaIcon] C:\Program Files\VistaDriveIcon\VistaDrv.exe () O4 - HKU\S-1-5-21-2025429265-926492609-1417001333-1004..\Run: [Aml Maple] C:\Program Files\AmlMaple\AmlMaple.exe (G&G Software, Moscow State University) O4 - HKU\S-1-5-21-2025429265-926492609-1417001333-1004..\Run: [LClock] C:\Program Files\LClock\LClock.exe () O4 - HKU\S-1-5-21-2025429265-926492609-1417001333-1004..\Run: [louderit.exe] C:\Program Files\Volumecontrol2\LouderIt.exe () O4 - HKU\S-1-5-21-2025429265-926492609-1417001333-1004..\Run: [VistaIcon] C:\Program Files\VistaDriveIcon\VistaDrv.exe () O4 - HKU\.DEFAULT..\RunOnce: [IE7_00] File not found O4 - HKU\.DEFAULT..\RunOnce: [Rebuild Icon Cache] C:\WINDOWS\System32\REBUILDI.EXE (Quiet Installer by YikxX) O4 - HKU\S-1-5-18..\RunOnce: [IE7_00] File not found O4 - HKU\S-1-5-18..\RunOnce: [Rebuild Icon Cache] C:\WINDOWS\System32\REBUILDI.EXE (Quiet Installer by YikxX) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRemoteRecursiveEvents = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoInternetOpenWith = 1 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: InternetOpenWith = 0 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: InternetOpenWith = 0 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: InternetOpenWith = 0 O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: InternetOpenWith = 0 O7 - HKU\S-1-5-21-2025429265-926492609-1417001333-1004\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-2025429265-926492609-1417001333-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\S-1-5-21-2025429265-926492609-1417001333-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1 O7 - HKU\S-1-5-21-2025429265-926492609-1417001333-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1 O7 - HKU\S-1-5-21-2025429265-926492609-1417001333-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: InternetOpenWith = 0 O7 - HKU\S-1-5-21-2025429265-926492609-1417001333-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-21-2025429265-926492609-1417001333-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: Закачать ВСЕ при помощи Download Master - C:\Program Files\Download Master\dmieall.htm () O8 - Extra context menu item: Закачать при помощи Download Master - C:\Program Files\Download Master\dmie.htm () O9 - Extra Button: Download Master - {8DAE90AD-4583-4977-9DD4-4360F7A45C74} - C:\Program Files\Download Master\dmaster.exe (WestByte) O9 - Extra 'Tools' menuitem : &Download Master - {8DAE90AD-4583-4977-9DD4-4360F7A45C74} - C:\Program Files\Download Master\dmaster.exe (WestByte) O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\mswsock.dll (Корпорация Майкрософт) O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\system32\mswsock.dll (Корпорация Майкрософт) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\mswsock.dll (Корпорация Майкрософт) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Корпорация Майкрософт) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Корпорация Майкрософт) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\mswsock.dll (Корпорация Майкрософт) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Корпорация Майкрософт) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Корпорация Майкрософт) O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Корпорация Майкрософт) O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Корпорация Майкрософт) O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Корпорация Майкрософт) O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32\mswsock.dll (Корпорация Майкрософт) O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\system32\mswsock.dll (Корпорация Майкрософт) O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\system32\mswsock.dll (Корпорация Майкрософт) O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\system32\mswsock.dll (Корпорация Майкрософт) O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\system32\mswsock.dll (Корпорация Майкрософт) O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\system32\mswsock.dll (Корпорация Майкрософт) O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\WINDOWS\system32\mswsock.dll (Корпорация Майкрософт) O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\WINDOWS\system32\mswsock.dll (Корпорация Майкрософт) O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\WINDOWS\system32\mswsock.dll (Корпорация Майкрософт) O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\WINDOWS\system32\mswsock.dll (Корпорация Майкрософт) O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\WINDOWS\system32\mswsock.dll (Корпорация Майкрософт) O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\WINDOWS\system32\mswsock.dll (Корпорация Майкрософт) O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\WINDOWS\system32\mswsock.dll (Корпорация Майкрософт) O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - C:\WINDOWS\system32\mswsock.dll (Корпорация Майкрософт) O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - C:\WINDOWS\system32\mswsock.dll (Корпорация Майкрософт) O10 - Protocol_Catalog9\Catalog_Entries\000000000027 - C:\WINDOWS\system32\mswsock.dll (Корпорация Майкрософт) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16) O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.76.34.50 192.168.0.1 O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll (Корпорация Майкрософт) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll (Корпорация Майкрософт) O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\system32\shell32.dll (Корпорация Майкрософт) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe () O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Корпорация Майкрософт) O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Корпорация Майкрософт) O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Корпорация Майкрософт) O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\System32\crypt32.dll (Корпорация Майкрософт) O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\System32\cscdll.dll (Корпорация Майкрософт) O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Корпорация Майкрософт) O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Корпорация Майкрософт) O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\System32\sclgntfy.dll (Корпорация Майкрософт) O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\System32\wlnotify.dll (Корпорация Майкрософт) O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Корпорация Майкрософт) O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Корпорация Майкрософт) O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\shell32.dll (Корпорация Майкрософт) O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\shell32.dll (Корпорация Майкрософт) O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Корпорация Майкрософт) O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Предзагрузчик Browseui - C:\WINDOWS\system32\browseui.dll (Корпорация Майкрософт) O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Демон кэша категорий компонентов - C:\WINDOWS\system32\browseui.dll (Корпорация Майкрософт) O24 - Desktop Components:0 (Моя текущая домашняя страница) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Корпорация Майкрософт) O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Корпорация Майкрософт) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2010.11.04 21:24:10 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2011.04.01 18:14:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp [2011.04.01 18:02:18 | 000,000,000 | RHSD | C] -- C:\cmdcons [2011.04.01 18:00:59 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe [2011.04.01 18:00:59 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe [2011.04.01 18:00:59 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe [2011.04.01 18:00:59 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe [2011.04.01 18:00:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT [2011.04.01 18:00:28 | 000,000,000 | ---D | C] -- C:\Qoobox [2011.04.01 17:28:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Local Settings\Application Data\Mail.Ru [2011.03.31 15:41:46 | 000,371,544 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2011.04.01 18:28:01 | 000,000,928 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2011.04.01 18:15:28 | 001,095,360 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2011.04.01 18:15:28 | 000,484,600 | ---- | M] () -- C:\WINDOWS\System32\perfh019.dat [2011.04.01 18:15:28 | 000,441,322 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2011.04.01 18:15:28 | 000,084,280 | ---- | M] () -- C:\WINDOWS\System32\perfc019.dat [2011.04.01 18:15:28 | 000,071,258 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2011.04.01 18:11:20 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2011.04.01 18:11:12 | 000,000,924 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2011.04.01 18:11:10 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2011.04.01 18:11:08 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2011.04.01 18:11:01 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2011.04.01 18:10:59 | 2110,869,504 | -HS- | M] () -- C:\hiberfil.sys [2011.04.01 18:10:31 | 003,670,016 | -H-- | M] () -- C:\Documents and Settings\User\NTUSER.DAT [2011.04.01 18:02:22 | 000,000,330 | RHS- | M] () -- C:\boot.ini [2011.04.01 17:39:17 | 004,311,627 | R--- | M] () -- C:\Documents and Settings\User\Рабочий стол\ComboFix.exe [2011.04.01 17:31:43 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2011.04.01 17:31:05 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\User\ntuser.ini [2011.03.31 15:41:46 | 000,005,758 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT [2011.03.16 18:57:13 | 000,002,265 | ---- | M] () -- C:\Documents and Settings\All Users\Рабочий стол\Skype.lnk [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2011.04.01 18:02:22 | 000,000,214 | ---- | C] () -- C:\Boot.bak [2011.04.01 18:02:21 | 000,260,272 | RHS- | C] () -- C:\cmldr [2011.04.01 18:00:59 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe [2011.04.01 18:00:59 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe [2011.04.01 18:00:59 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe [2011.04.01 18:00:59 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe [2011.04.01 18:00:59 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe [2011.04.01 17:38:57 | 004,311,627 | R--- | C] () -- C:\Documents and Settings\User\Рабочий стол\ComboFix.exe [2011.02.13 05:27:20 | 000,262,144 | ---- | C] () -- C:\WINDOWS\System32\default_user_class.dat [2010.12.18 14:30:45 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat [2010.12.04 01:09:54 | 000,000,196 | ---- | C] () -- C:\WINDOWS\_delis43.ini [2010.12.04 01:09:52 | 000,000,000 | ---- | C] () -- C:\WINDOWS\SETUP32.INI [2010.11.05 00:17:04 | 001,095,360 | ---- | C] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2010.11.05 00:17:04 | 000,004,337 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2010.11.05 00:13:30 | 000,982,196 | ---- | C] () -- C:\WINDOWS\System32\igkrng500.bin [2010.11.05 00:13:30 | 000,417,344 | ---- | C] () -- C:\WINDOWS\System32\igcompkrng500.bin [2010.11.05 00:11:30 | 001,451,384 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2010.11.04 22:55:10 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2010.11.04 22:54:49 | 000,164,352 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2010.11.04 22:54:48 | 000,755,027 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2010.11.04 22:54:48 | 000,159,839 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2010.11.04 22:54:47 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2010.11.04 22:54:47 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2010.11.04 22:54:47 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2010.11.04 22:16:55 | 002,110,646 | -H-- | C] () -- C:\Documents and Settings\User\Local Settings\Application Data\IconCache.db [2010.11.04 22:15:09 | 001,766,592 | ---- | C] () -- C:\WINDOWS\System32\drivers\snp2uvc.sys [2010.11.04 22:15:09 | 000,035,264 | ---- | C] () -- C:\WINDOWS\System32\drivers\sncduvc.sys [2010.11.04 21:58:48 | 000,026,088 | ---- | C] () -- C:\Documents and Settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT [2010.11.04 21:37:35 | 000,001,174 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2010.11.04 21:35:08 | 000,066,592 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat [2010.11.04 21:28:50 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2010.11.04 21:26:53 | 000,696,240 | ---- | C] () -- C:\WINDOWS\System32\unins000.exe [2010.11.04 21:26:53 | 000,000,792 | ---- | C] () -- C:\WINDOWS\System32\unins000.dat [2010.11.04 21:26:08 | 000,002,048 | ---- | C] () -- C:\WINDOWS\System32\hidcon.exe [2010.11.04 21:25:54 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\LM_Helper.exe [2010.11.04 21:24:24 | 000,271,264 | ---- | C] () -- C:\WINDOWS\System32\vbrun100.dll [2010.11.04 21:24:24 | 000,210,944 | ---- | C] () -- C:\WINDOWS\System32\msvcrt10.dll [2010.11.04 21:24:24 | 000,052,836 | ---- | C] () -- C:\WINDOWS\System32\zlib1.dll [2010.11.04 21:24:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\control.ini [2010.11.04 21:23:08 | 000,000,488 | RH-- | C] () -- C:\WINDOWS\System32\logonui.exe.manifest [2010.11.04 21:23:04 | 000,000,749 | RH-- | C] () -- C:\WINDOWS\System32\cdplayer.exe.manifest [2010.11.04 21:21:23 | 000,022,564 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2010.11.04 21:21:22 | 000,000,037 | ---- | C] () -- C:\WINDOWS\vbaddin.ini [2010.11.04 21:21:22 | 000,000,036 | ---- | C] () -- C:\WINDOWS\vb.ini [2010.11.04 21:20:42 | 000,025,791 | ---- | C] () -- C:\WINDOWS\System32\tslabels.ini [2010.11.04 21:20:41 | 000,003,841 | ---- | C] () -- C:\WINDOWS\System32\msdtcprf.ini [2008.04.15 16:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2008.04.15 16:00:00 | 001,034,240 | ---- | C] () -- C:\WINDOWS\explorer.exe [2008.04.15 16:00:00 | 001,015,477 | ---- | C] () -- C:\WINDOWS\System32\esentprf.ini [2008.04.15 16:00:00 | 000,733,696 | ---- | C] () -- C:\WINDOWS\System32\qedwipes.dll [2008.04.15 16:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2008.04.15 16:00:00 | 000,509,440 | ---- | C] () -- C:\WINDOWS\System32\winlogon.exe [2008.04.15 16:00:00 | 000,484,600 | ---- | C] () -- C:\WINDOWS\System32\perfh019.dat [2008.04.15 16:00:00 | 000,441,322 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2008.04.15 16:00:00 | 000,355,112 | ---- | C] () -- C:\WINDOWS\System32\msjetoledb40.dll [2008.04.15 16:00:00 | 000,305,414 | ---- | C] () -- C:\WINDOWS\System32\perfi019.dat [2008.04.15 16:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2008.04.15 16:00:00 | 000,270,848 | ---- | C] () -- C:\WINDOWS\System32\sbe.dll [2008.04.15 16:00:00 | 000,252,928 | ---- | C] () -- C:\WINDOWS\System32\compatUI.dll [2008.04.15 16:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2008.04.15 16:00:00 | 000,199,168 | ---- | C] () -- C:\WINDOWS\System32\ir32_32.dll [2008.04.15 16:00:00 | 000,186,880 | ---- | C] () -- C:\WINDOWS\System32\encdec.dll [2008.04.15 16:00:00 | 000,094,282 | ---- | C] () -- C:\WINDOWS\System32\msencode.dll [2008.04.15 16:00:00 | 000,084,280 | ---- | C] () -- C:\WINDOWS\System32\perfc019.dat [2008.04.15 16:00:00 | 000,071,258 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2008.04.15 16:00:00 | 000,070,656 | ---- | C] () -- C:\WINDOWS\System32\amstream.dll [2008.04.15 16:00:00 | 000,070,318 | ---- | C] () -- C:\WINDOWS\System32\edit.com [2008.04.15 16:00:00 | 000,054,016 | ---- | C] () -- C:\WINDOWS\System32\dosx.exe [2008.04.15 16:00:00 | 000,053,478 | ---- | C] () -- C:\WINDOWS\System32\tcpmon.ini [2008.04.15 16:00:00 | 000,051,981 | ---- | C] () -- C:\WINDOWS\System32\command.com [2008.04.15 16:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2008.04.15 16:00:00 | 000,042,809 | ---- | C] () -- C:\WINDOWS\System32\key01.sys [2008.04.15 16:00:00 | 000,042,537 | ---- | C] () -- C:\WINDOWS\System32\keyboard.sys [2008.04.15 16:00:00 | 000,039,370 | ---- | C] () -- C:\WINDOWS\System32\mem.exe [2008.04.15 16:00:00 | 000,036,176 | ---- | C] () -- C:\WINDOWS\System32\perfd019.dat [2008.04.15 16:00:00 | 000,035,648 | ---- | C] () -- C:\WINDOWS\System32\ntio411.sys [2008.04.15 16:00:00 | 000,035,424 | ---- | C] () -- C:\WINDOWS\System32\ntio412.sys [2008.04.15 16:00:00 | 000,034,560 | ---- | C] () -- C:\WINDOWS\System32\ntio804.sys [2008.04.15 16:00:00 | 000,034,560 | ---- | C] () -- C:\WINDOWS\System32\ntio404.sys [2008.04.15 16:00:00 | 000,034,000 | ---- | C] () -- C:\WINDOWS\System32\ntio.sys [2008.04.15 16:00:00 | 000,029,370 | ---- | C] () -- C:\WINDOWS\System32\ntdos411.sys [2008.04.15 16:00:00 | 000,029,274 | ---- | C] () -- C:\WINDOWS\System32\ntdos412.sys [2008.04.15 16:00:00 | 000,029,146 | ---- | C] () -- C:\WINDOWS\System32\ntdos804.sys [2008.04.15 16:00:00 | 000,029,146 | ---- | C] () -- C:\WINDOWS\System32\ntdos404.sys [2008.04.15 16:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2008.04.15 16:00:00 | 000,027,900 | ---- | C] () -- C:\WINDOWS\System32\ntdos.sys [2008.04.15 16:00:00 | 000,027,097 | ---- | C] () -- C:\WINDOWS\System32\country.sys [2008.04.15 16:00:00 | 000,021,002 | ---- | C] () -- C:\WINDOWS\System32\debug.exe [2008.04.15 16:00:00 | 000,019,940 | ---- | C] () -- C:\WINDOWS\System32\mqperf.ini [2008.04.15 16:00:00 | 000,019,854 | ---- | C] () -- C:\WINDOWS\System32\graphics.com [2008.04.15 16:00:00 | 000,015,738 | ---- | C] () -- C:\WINDOWS\System32\rsvp.ini [2008.04.15 16:00:00 | 000,015,360 | ---- | C] () -- C:\WINDOWS\System32\tsd32.dll [2008.04.15 16:00:00 | 000,014,959 | ---- | C] () -- C:\WINDOWS\System32\kb16.com [2008.04.15 16:00:00 | 000,014,336 | ---- | C] () -- C:\WINDOWS\System32\msdmo.dll [2008.04.15 16:00:00 | 000,013,787 | ---- | C] () -- C:\WINDOWS\System32\pschdprf.ini [2008.04.15 16:00:00 | 000,013,312 | ---- | C] () -- C:\WINDOWS\System32\win87em.dll [2008.04.15 16:00:00 | 000,013,042 | ---- | C] () -- C:\WINDOWS\System32\edlin.exe [2008.04.15 16:00:00 | 000,012,610 | ---- | C] () -- C:\WINDOWS\System32\append.exe [2008.04.15 16:00:00 | 000,011,835 | ---- | C] () -- C:\WINDOWS\System32\setver.exe [2008.04.15 16:00:00 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\scriptpw.dll [2008.04.15 16:00:00 | 000,009,035 | ---- | C] () -- C:\WINDOWS\System32\ansi.sys [2008.04.15 16:00:00 | 000,008,456 | ---- | C] () -- C:\WINDOWS\System32\exe2bin.exe [2008.04.15 16:00:00 | 000,007,116 | ---- | C] () -- C:\WINDOWS\System32\nlsfunc.exe [2008.04.15 16:00:00 | 000,006,191 | ---- | C] () -- C:\WINDOWS\System32\rasctrs.ini [2008.04.15 16:00:00 | 000,004,960 | ---- | C] () -- C:\WINDOWS\System32\himem.sys [2008.04.15 16:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2008.04.15 16:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2008.04.15 16:00:00 | 000,003,584 | ---- | C] () -- C:\WINDOWS\System32\kb.dll [2008.04.15 16:00:00 | 000,003,332 | ---- | C] () -- C:\WINDOWS\System32\redir.exe [2008.04.15 16:00:00 | 000,003,244 | ---- | C] () -- C:\WINDOWS\System32\nw16.exe [2008.04.15 16:00:00 | 000,002,982 | ---- | C] () -- C:\WINDOWS\System32\perfci.ini [2008.04.15 16:00:00 | 000,002,903 | ---- | C] () -- C:\WINDOWS\System32\perfwci.ini [2008.04.15 16:00:00 | 000,002,656 | ---- | C] () -- C:\WINDOWS\System32\netware.drv [2008.04.15 16:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin [2008.04.15 16:00:00 | 000,001,405 | ---- | C] () -- C:\WINDOWS\msdfmap.ini [2008.04.15 16:00:00 | 000,001,269 | ---- | C] () -- C:\WINDOWS\System32\perffilt.ini [2008.04.15 16:00:00 | 000,001,149 | ---- | C] () -- C:\WINDOWS\System32\loadfix.com [2008.04.15 16:00:00 | 000,001,140 | ---- | C] () -- C:\WINDOWS\System32\vwipxspx.exe [2008.04.15 16:00:00 | 000,000,882 | ---- | C] () -- C:\WINDOWS\System32\share.exe [2008.04.15 16:00:00 | 000,000,882 | ---- | C] () -- C:\WINDOWS\System32\fastopen.exe [2008.04.15 16:00:00 | 000,000,817 | ---- | C] () -- C:\WINDOWS\System32\mscdexnt.exe [2008.04.15 16:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat [2008.04.15 16:00:00 | 000,000,507 | ---- | C] () -- C:\WINDOWS\win.ini [2008.04.15 16:00:00 | 000,000,423 | ---- | C] () -- C:\WINDOWS\System32\prodspec.ini [2008.04.15 16:00:00 | 000,000,227 | ---- | C] () -- C:\WINDOWS\system.ini [2008.04.15 16:00:00 | 000,000,143 | ---- | C] () -- C:\WINDOWS\System32\fSetup.ini [2008.04.07 15:00:46 | 000,005,120 | ---- | C] () -- C:\WINDOWS\System32\CRFILTER.dll [2001.10.20 01:06:36 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\dvdplay.exe [2001.10.20 01:06:20 | 000,157,696 | ---- | C] () -- C:\WINDOWS\System32\paqsp.dll [2001.04.25 17:37:43 | 000,319,488 | ---- | C] () -- C:\WINDOWS\System32\QTJavaNative.dll [color=#E56717]========== LOP Check ==========[/color] [2010.12.22 23:18:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software [2010.12.09 12:27:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\blg [2010.12.04 19:15:11 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonBJ [2010.12.04 19:41:33 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonIJScan [2011.01.01 19:45:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Guard.Mail.Ru [2010.12.09 12:25:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MonteCristo [2010.11.04 21:43:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\uTorrent [2010.12.22 23:17:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\{DCD48218-E972-4d0c-9E5F-43462BC13E3B} [2010.12.09 12:27:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\blg [2010.12.04 19:41:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Canon [2010.12.09 14:04:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Download Master [2010.11.29 19:47:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\iPlus [2010.11.04 21:41:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Opera [2011.02.17 04:36:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\uTorrent [2010.12.20 00:02:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Yandex [color=#E56717]========== Purity Check ==========[/color] < End of report >