Znalazł chyba rootkita i jakiegos WinPC.
ComboFix 09-04-23.A3 - micza 2009-04-23 17:40.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.1023.768 [GMT 2:00]
Uruchomiony z: c:\documents and settings\micza\Pulpit\ComboFix2.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated)
* Utworzono nowy punkt przywracania
* Resident AV is active
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\micza\Menu Start\Programy\Autostart\lsass.exe
c:\windows\system32\drivers\UAChoepttitetoqfow.sys
c:\windows\system32\UACavbwqwgkvtpjpjs.dat
c:\windows\system32\UACffybstjpowpeihx.log
c:\windows\system32\UAChlnswgrqxxakiab.log
c:\windows\system32\uacinit.dll
c:\windows\system32\UAClekkdpxyigipkwx.dll
c:\windows\system32\UACmixjnscdpqqqdad.dll
c:\windows\system32\UACqafheajwurvqflr.dll
c:\windows\system32\UACrdopermqvwkmunq.log
c:\windows\system32\UACrfukbhjlkibrvpb.dll
c:\windows\system32\UACtggaspxrthfbeag.dll
.
((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_UACd.sys
((((((((((((((((((((((((( Pliki utworzone od 2009-05-23 do 2009-4-23 )))))))))))))))))))))))))))))))
.
2009-04-23 15:16 . 2009-04-23 15:16 -------- d-----w c:\documents and settings\micza\Ustawienia lokalne\Dane aplikacji\ESET
2009-04-23 15:14 . 2009-04-23 15:14 -------- d-----w c:\documents and settings\LocalService\Ustawienia lokalne\Dane aplikacji\ESET
2009-04-23 15:08 . 2009-04-23 15:08 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\ESET
2009-04-23 04:45 . 2009-04-23 04:45 -------- d-----w c:\windows\system32\KB905474
2009-04-23 04:45 . 2009-03-10 20:26 1436544 ----a-w c:\windows\system32\KB905474\wganotifypackageinner.exe
2009-04-23 04:45 . 2009-03-10 20:18 455048 ----a-w c:\windows\system32\KB905474\wgasetup.exe
2009-04-23 04:45 . 2009-02-09 16:51 16616 ----a-w c:\windows\system32\KB905474\wga_eula.txt
2009-04-21 06:46 . 2009-04-21 06:45 538138 ----a-w C:\temp5516.tmp
2009-04-16 04:03 . 2009-04-16 04:03 -------- d-----w c:\documents and settings\micza\Dane aplikacji\HP
2009-04-13 17:49 . 2009-04-13 17:49 -------- d-----w c:\documents and settings\micza\.javaws
2009-04-09 14:16 . 2009-04-09 14:16 -------- d-----w c:\windows\AudioStreamer
2009-04-04 18:25 . 2009-04-04 18:25 -------- d-----w c:\documents and settings\micza\Dane aplikacji\Cream Software
2009-04-02 16:31 . 2009-04-12 11:58 -------- d-----w c:\documents and settings\micza\.jpi_cache
2009-04-02 16:31 . 2009-04-02 16:31 -------- d-----w c:\documents and settings\micza\.java
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-23 15:36 . 2009-03-16 17:27 -------- d-----w c:\documents and settings\micza\Dane aplikacji\Skype
2009-04-23 15:35 . 2009-03-16 12:01 -------- d-----w c:\program files\Neostrada TP
2009-04-23 15:08 . 2009-04-23 15:08 -------- d-----w c:\program files\ESET
2009-04-23 14:45 . 2009-03-16 17:26 -------- d-----w c:\program files\Google
2009-04-23 14:44 . 2009-04-23 14:44 -------- d-----w c:\program files\VS Revo Group
2009-04-18 03:38 . 2001-10-26 14:15 49492 ----a-w c:\windows\system32\perfc015.dat
2009-04-18 03:38 . 2001-10-26 14:15 355486 ----a-w c:\windows\system32\perfh015.dat
2009-04-17 09:37 . 2009-04-17 09:37 0 ----a-w c:\documents and settings\micza\Dane aplikacji\~eu37.tmp
2009-04-17 07:05 . 2009-04-17 07:05 -------- d-----w c:\program files\WinDjView
2009-04-16 04:19 . 2009-04-16 04:19 -------- d-----w c:\program files\AnalogX
2009-04-13 17:49 . 2009-03-16 12:02 -------- d-----w c:\program files\Java Web Start
2009-04-09 14:19 . 2009-04-09 14:16 -------- d-----w c:\program files\AudioStreamer
2009-04-04 18:25 . 2009-04-04 18:25 -------- d-----w c:\program files\Cream Software
2009-04-04 10:17 . 2009-04-04 10:00 -------- d-----w c:\program files\AutoConnect
2009-03-23 17:15 . 2009-03-23 17:06 -------- d-----w c:\program files\APE for Windows
2009-03-23 15:54 . 2009-03-23 15:53 510 ----a-w C:\updatedatfix.log
2009-03-23 15:54 . 2009-03-22 13:59 -------- d-----w c:\program files\HP
2009-03-23 15:52 . 2009-03-23 15:52 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\HP Product Assistant
2009-03-22 15:30 . 2009-03-22 15:30 0 ----a-w C:\plx_proxy.log
2009-03-22 14:06 . 2009-03-22 13:58 105958 ----a-w c:\windows\HPFins09.dat
2009-03-22 14:05 . 2009-03-22 14:05 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\HP
2009-03-22 14:05 . 2009-03-22 14:05 -------- d-----w c:\program files\Common Files\HP
2009-03-22 13:47 . 2009-03-22 13:47 -------- d-----w c:\documents and settings\micza\Dane aplikacji\Apple Computer
2009-03-22 09:31 . 2009-03-22 09:03 -------- d-----w c:\documents and settings\micza\Dane aplikacji\InfraRecorder
2009-03-22 09:12 . 2009-03-22 09:11 -------- d-----w c:\program files\QuickTime
2009-03-22 09:11 . 2009-03-22 09:11 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple Computer
2009-03-22 09:10 . 2009-03-22 09:10 -------- d-----w c:\program files\OLYMPUS
2009-03-22 09:09 . 2009-03-22 09:09 -------- d-----w c:\program files\MSXML 4.0
2009-03-22 09:03 . 2009-03-22 09:03 -------- d-----w c:\program files\InfraRecorder
2009-03-22 07:34 . 2009-03-22 07:34 -------- d--h--w c:\documents and settings\All Users\Dane aplikacji\WebDrive
2009-03-22 07:33 . 2009-03-22 07:33 -------- d-----w c:\program files\WebDrive
2009-03-19 16:20 . 2009-03-19 16:20 -------- d-----w c:\program files\Bingo's Soft
2009-03-19 16:12 . 2009-03-19 16:05 -------- d-----w c:\program files\Ufasoft
2009-03-19 16:05 . 2009-03-19 16:05 -------- d-----w c:\documents and settings\micza\Dane aplikacji\Ufasoft
2009-03-19 11:43 . 2009-03-19 11:43 614400 ----a-w c:\windows\system32\msvcr80.dll
2009-03-19 11:43 . 2009-03-19 11:43 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-03-19 09:45 . 2009-03-19 09:45 93848 ----a-w c:\windows\system32\drivers\epfwtdir.sys
2009-03-19 09:44 . 2009-03-19 09:44 107256 ----a-w c:\windows\system32\drivers\ehdrv.sys
2009-03-19 09:41 . 2009-03-19 09:41 113960 ----a-w c:\windows\system32\drivers\eamon.sys
2009-03-18 18:43 . 2009-03-18 18:43 12328 ----a-w c:\documents and settings\micza\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-03-18 18:15 . 2009-03-18 18:15 -------- d-----w c:\program files\Audacity
2009-03-18 18:10 . 2009-03-18 18:10 -------- d-----w c:\program files\Ratajik Software
2009-03-18 18:08 . 2009-03-18 18:08 -------- d-----w c:\program files\NCH Swift Sound
2009-03-18 18:08 . 2009-03-18 17:58 -------- d-----w c:\documents and settings\micza\Dane aplikacji\NCH Swift Sound
2009-03-18 18:07 . 2009-03-18 17:58 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\NCH Swift Sound
2009-03-18 17:59 . 2009-03-18 17:59 -------- d-----w c:\documents and settings\micza\Dane aplikacji\Recordpad
2009-03-18 17:58 . 2009-03-18 17:58 -------- d-----w c:\program files\NCH Software
2009-03-17 16:19 . 2009-03-17 16:19 -------- d-----w c:\program files\Common Files\Adobe
2009-03-17 10:08 . 2009-03-16 09:58 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-03-16 17:26 . 2009-03-16 17:26 -------- d-----r c:\program files\Skype
2009-03-16 17:26 . 2009-03-16 17:26 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Skype
2009-03-16 12:27 . 2009-03-16 12:26 -------- d-----w c:\program files\mIRC
2009-03-16 12:11 . 2009-03-16 12:11 -------- d-----w c:\documents and settings\micza\Dane aplikacji\Mra
2009-03-16 12:11 . 2009-03-16 12:11 -------- d-----w c:\program files\Mail.Ru
2009-03-16 12:02 . 2009-03-16 12:02 23 ----a-w c:\windows\system32\drivers\adidsl.cfg
2009-03-16 12:02 . 2009-03-16 12:02 -------- d--h--w c:\program files\InstallShield Installation Information
2009-03-16 12:02 . 2009-03-16 12:02 -------- d-----w c:\program files\SAGEM
2009-03-16 12:02 . 2009-03-16 12:02 -------- d-----w c:\program files\Java
2009-03-16 12:02 . 2009-03-16 12:02 -------- d-----w c:\program files\Common Files\InstallShield
2009-03-16 09:59 . 2009-03-16 09:59 -------- d-----w c:\program files\microsoft frontpage
2009-03-16 09:57 . 2009-03-16 09:57 -------- d-----w c:\program files\Usługi online
2009-03-16 09:55 . 2009-03-16 09:55 21856 ----a-w c:\windows\system32\emptyregdb.dat
2009-03-06 14:47 . 2004-08-03 22:44 285184 ----a-w c:\windows\system32\pdh.dll
2009-03-05 07:46 . 2009-03-05 07:46 2220032 ----a-w c:\windows\system32\wdCryptoUtils.dll
2009-03-05 07:46 . 2009-03-05 07:46 663552 ----a-w c:\windows\system32\wdResDll.dll
2009-03-05 07:24 . 2009-03-05 07:24 454656 ----a-w c:\windows\system32\wdnp32.dll
2009-03-05 07:24 . 2009-03-05 07:24 1245184 ----a-w c:\windows\system32\wdShellExt.dll
2009-03-05 07:23 . 2009-03-05 07:23 1589248 ----a-w c:\windows\system32\wdHelper.dll
2009-03-05 07:23 . 2009-03-05 07:23 69632 ----a-w c:\windows\system32\wdIconDll.dll
2009-03-05 07:23 . 2009-03-05 07:23 237568 ----a-w c:\windows\system32\wdUIResDll.dll
2009-02-20 08:32 . 2004-08-03 22:44 662016 ----a-w c:\windows\system32\wininet.dll
2009-02-20 08:32 . 2004-08-03 22:44 81920 ----a-w c:\windows\system32\ieencode.dll
2009-02-09 14:19 . 2004-08-03 22:37 1846528 ----a-w c:\windows\system32\win32k.sys
2009-02-09 11:52 . 2004-08-04 00:38 2059008 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-09 11:52 . 2004-08-03 22:39 2181760 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-09 10:22 . 2004-08-03 22:44 399360 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 10:22 . 2004-08-03 22:44 725504 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:22 . 2004-08-03 22:43 686080 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 10:22 . 2004-08-03 22:43 722944 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 10:10 . 2004-08-03 22:44 111104 ----a-w c:\windows\system32\services.exe
2009-02-06 16:54 . 2001-10-26 15:30 35328 ----a-w c:\windows\system32\sc.exe
2009-02-03 20:11 . 2004-08-03 22:44 55808 ----a-w c:\windows\system32\secur32.dll
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-03-06 24095528]
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2007-02-08 95800]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WooCnxMon"="c:\progra~1\NEOSTR~1\CnxMon.exe" [2003-10-16 24576]
"WOOWATCH"="c:\progra~1\NEOSTR~1\Watch.exe" [2003-10-16 20480]
"WOOTASKBARICON"="c:\progra~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 53248]
"MAgent"="c:\program files\Mail.Ru\Agent\MAgent.exe" [2009-03-31 6210744]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"WebDriveTray"="c:\program files\WebDrive\webdrive.exe" [2009-03-05 1458176]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-01 282624]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-03-19 2029640]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\All Users\Menu Start\Programy\Autostart\
DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2009-3-16 966756]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-9-24 282624]
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"aux"= ctwdm32.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"="1"
"UpdatesDisableNotify"="1"
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Internet\\mIRC\\mirc.exe"=
"c:\\Program Files\\Mail.Ru\\Agent\\magent.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\WebDrive\\webdrive.exe"=
"c:\\Program Files\\WebDrive\\wdService.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R3 UfasoftSnifDriver4;Ufasoft Snif Driver v4; [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2009-03-19 107256]
S1 epfwtdir;epfwtdir;c:\windows\system32\DRIVERS\epfwtdir.sys [2009-03-19 93848]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-03-19 731840]
S2 WebDriveFSD;WebDrive Filesystem Driver;c:\program files\WebDrive\wdfsd.sys [2009-03-05 201112]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d1ab42bb-16b3-11de-ad48-4d6564696130}]
\Shell\AutoRun\command - F:\h6o0re.cmd
\Shell\explore\Command - F:\h6o0re.cmd
\Shell\open\Command - F:\h6o0re.cmd
.
Zawartość folderu 'Zaplanowane zadania'
2009-04-23 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-04-23 20:18]
.
- - - - USUNIĘTO PUSTE WPISY - - - -
BHO-{39fc2065-c9c7-49cd-8942-44cc2dedc844} - (no file)
ShellIconOverlayIdentifiers-{37D70BD3-073C-4180-ADD9-C032EA5A7204} - wdShellExt.dll
HKCU-Run-AutoConnect - c:\program files\AutoConnect\AutoConnect.exe
HKLM-RunOnce-<NO NAME> - (no file)
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.mail.ru
mSearch Bar = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Ďîčńę@Mail.Ru - c:\program files\mail.ru\sputnik\MailRuSputnik.dll/282
IE: Ńëîâŕđč@Mail.Ru - c:\program files\mail.ru\sputnik\MailRuSputnik.dll/283
IE: { - c:\program files\Messenger\msmsgs.exe
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} - c:\program files\Mail.Ru\Agent\magent.exe
FF - ProfilePath - c:\documents and settings\micza\Dane aplikacji\Mozilla\Firefox\Profiles\vev64dr0.default\
FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJava11.dll
FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJava12.dll
FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJava13.dll
FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJava32.dll
FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJPI140_03.dll
FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPOJI610.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-23 17:45
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
- - - - - - - > 'winlogon.exe'(500)
c:\windows\system32\wdnp32.dll
c:\windows\system32\wdHelper.dll
c:\windows\system32\wdUIResDll.dll
.
Czas ukończenia: 2009-04-23 17:47
ComboFix-quarantined-files.txt 2009-04-23 15:46
Przed: 6 092 206 080 bajtów wolnych
Po: 7 296 864 256 bajtów wolnych
WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
234 --- E O F --- 2009-04-23 04:45
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:49:08, on 2009-04-23
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\WebDrive\wdService.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mail.ru
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Ńďóňíčę@Mail.Ru - {09900DE8-1DCA-443F-9243-26FF581438AF} - c:\program files\mail.ru\sputnik\MailRuSputnik.dll
R3 - URLSearchHook: (no name) - {83821C2B-32A8-4DD7-B6D4-44309A78E668} - C:\Program Files\Mail.Ru\Agent\Mra\dll\newmrasearch.dll
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: ???????@Mail.Ru - {8984B388-A5BB-4DF7-B274-77B879E179DB} - c:\program files\mail.ru\sputnik\MailRuSputnik.dll
O3 - Toolbar: Ńďóňíčę@Mail.Ru - {09900DE8-1DCA-443F-9243-26FF581438AF} - c:\program files\mail.ru\sputnik\MailRuSputnik.dll
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [MAgent] C:\Program Files\Mail.Ru\Agent\MAgent.exe -LM
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WebDriveTray] C:\Program Files\WebDrive\webdrive.exe /trayicon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\RunOnce: [GrpConv] grpconv -o
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Ďîčńę@Mail.Ru - res://c:\program files\mail.ru\sputnik\MailRuSputnik.dll/282
O8 - Extra context menu item: Ńëîâŕđč@Mail.Ru - res://c:\program files\mail.ru\sputnik\MailRuSputnik.dll/283
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Mail.Ru ????? - {7558B7E5-7B26-4201-BEDB-00D5FF534523} - C:\Program Files\Mail.Ru\Agent\magent.exe
O9 - Extra 'Tools' menuitem: Mail.Ru ????? - {7558B7E5-7B26-4201-BEDB-00D5FF534523} - C:\Program Files\Mail.Ru\Agent\magent.exe
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O17 - HKLM\System\CS2\Services\Tcpip\..\{1A726CCF-8A2A-4F0E-88D5-A16461A35C7F}: NameServer = 194.204.159.1 217.98.63.164
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: WebDrive Service (WebDriveService) - South River Technologies, LLC - C:\Program Files\WebDrive\wdService.exe
--
End of file - 5224 bytes
