Scan saved at 10:28:37, on 05.06.2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Lenovo\EnergyCut\utilty.exe
C:\Program Files\Lenovo\EnergyCut\EnergyCut.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Lenovo\PowerDVD\PDVDServ.exe
C:\Program Files\WebMoney Agent\wmagent.exe
C:\Windows\VM303_STI.EXE
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Orbitdownloader\orbitdm.exe
C:\Program Files\Orbitdownloader\orbitnet.exe
C:\Program Files\QIP\qip.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Windows\explorer.exe
C:\downloads\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.apeha.ru
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.lenovo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - - (no file)
O1 - Hosts: ::1 localhost
O1 - Hosts: 89.111.185.214 mail.ru
O1 - Hosts: 89.111.185.214
www.mail.ru
O1 - Hosts: 89.111.185.214 rambler.ru
O1 - Hosts: 89.111.185.214
www.rambler.ru
O1 - Hosts: 89.111.185.214
www.yandex.ru
O1 - Hosts: 89.111.185.214 yandex.ru
O1 - Hosts: 89.111.185.214
www.vkontakte.ru
O1 - Hosts: 89.111.185.214 vkontakte.ru
O1 - Hosts: 89.111.185.214
www.odnoklassniki.ru
O1 - Hosts: 89.111.185.214 odnoklassniki.ru
O1 - Hosts: 62.149.17.45
www.a1agregator.ru
O1 - Hosts: 62.149.17.45 a1agregator.ru
O1 - Hosts: 62.149.17.45
www.a1help.ru
O1 - Hosts: 62.149.17.45 a1help.ru
O1 - Hosts: 62.149.17.45
www.sup-fd.ru
O1 - Hosts: 62.149.17.45 sup-fd.ru
O1 - Hosts: 62.149.17.45
www.nwhelps.ru
O1 - Hosts: 62.149.17.45 nwhelps.ru
O1 - Hosts: 62.149.17.45
www.sup24.ru
O1 - Hosts: 62.149.17.45 sup24.ru
O1 - Hosts: 62.149.17.45
www.smssupport.su
O1 - Hosts: 62.149.17.45 smssupport.su
O1 - Hosts: 62.149.17.45
www.kaspersky.ru
O1 - Hosts: 62.149.17.45 kaspersky.ru
O1 - Hosts: 62.149.17.45 forum.kaspersky.ru
O1 - Hosts: 62.149.17.45
www.6008help.ru
O1 - Hosts: 62.149.17.45 6008help.ru
O1 - Hosts: 62.149.17.45
www.sms911.ru
O1 - Hosts: 62.149.17.45 sms911.ru
O1 - Hosts: 62.149.17.45
www.help-cmc.ru
O1 - Hosts: 62.149.17.45 help-cmc.ru
O1 - Hosts: 62.149.17.45
www.forum.a1agregator.ru
O1 - Hosts: 62.149.17.45 forum.a1agregator.ru
O1 - Hosts: 62.149.17.45
www.virustotal.com
O1 - Hosts: 62.149.17.45 virustotal.com
O1 - Hosts: 89.111.185.214 mail.ru
O1 - Hosts: 89.111.185.214
www.mail.ru
O1 - Hosts: 89.111.185.214 rambler.ru
O1 - Hosts: 89.111.185.214
www.rambler.ru
O1 - Hosts: 89.111.185.214
www.yandex.ru
O1 - Hosts: 89.111.185.214 yandex.ru
O1 - Hosts: 89.111.185.214
www.vkontakte.ru
O1 - Hosts: 89.111.185.214 vkontakte.ru
O1 - Hosts: 89.111.185.214
www.odnoklassniki.ru
O1 - Hosts: 89.111.185.214 odnoklassniki.ru
O1 - Hosts: 62.149.17.45
www.a1agregator.ru
O1 - Hosts: 62.149.17.45 a1agregator.ru
O1 - Hosts: 62.149.17.45
www.a1help.ru
O1 - Hosts: 62.149.17.45 a1help.ru
O1 - Hosts: 62.149.17.45
www.sup-fd.ru
O1 - Hosts: 62.149.17.45 sup-fd.ru
O1 - Hosts: 62.149.17.45
www.nwhelps.ru
O1 - Hosts: 62.149.17.45 nwhelps.ru
O1 - Hosts: 62.149.17.45
www.sup24.ru
O1 - Hosts: 62.149.17.45 sup24.ru
O1 - Hosts: 62.149.17.45
www.smssupport.su
O1 - Hosts: 62.149.17.45 smssupport.su
O1 - Hosts: 62.149.17.45
www.kaspersky.ru
O1 - Hosts: 62.149.17.45 kaspersky.ru
O1 - Hosts: 62.149.17.45 forum.kaspersky.ru
O1 - Hosts: 62.149.17.45
www.6008help.ru
O1 - Hosts: 62.149.17.45 6008help.ru
O1 - Hosts: 62.149.17.45
www.sms911.ru
O1 - Hosts: 62.149.17.45 sms911.ru
O1 - Hosts: 62.149.17.45
www.help-cmc.ru
O1 - Hosts: 62.149.17.45 help-cmc.ru
O1 - Hosts: 62.149.17.45
www.forum.a1agregator.ru
O1 - Hosts: 62.149.17.45 forum.a1agregator.ru
O1 - Hosts: 62.149.17.45
www.virustotal.com
O1 - Hosts: 62.149.17.45 virustotal.com
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: TBSB03223 - {B4806C1A-FE8A-4008-9DA3-8CEDB6E82C10} - C:\Program Files\WebMoney Advisor\wmadvisor.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll
O3 - Toolbar: WebMoney Advisor - {3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} - C:\Program Files\WebMoney Advisor\wmadvisor.dll
O4 - HKLM\..\Run: [Unattend0000000001{0D12E576-92EF-4E85-9A29-F4B780F67C87}] C:\Windows\test.bat
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [EnergyUtility] C:\Program Files\Lenovo\EnergyCut\utilty.exe
O4 - HKLM\..\Run: [EnergyCut] C:\Program Files\Lenovo\EnergyCut\EnergyCut.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\Lenovo\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\Lenovo\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [wmagent.exe] "C:\Program Files\WebMoney Agent\wmagent.exe"
O4 - HKLM\..\Run: [BigDog303] C:\Windows\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [thebat_startup] C:\Program Files\The Bat!\thebat.exe /minimize
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6.5\ICQ.exe" silent
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Total Commander.lnk = C:\Program Files\Total Commander\Totalcmd.exe
O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: &Экспорт в Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O9 - Extra button: WebMoney Advisor - {3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} - C:\Program Files\WebMoney Advisor\wmadvisor.dll
O9 - Extra 'Tools' menuitem: WebMoney Advisor - {3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} - C:\Program Files\WebMoney Advisor\wmadvisor.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {463ED66E-431B-11D2-ADB0-0080C83DA4EB} (AcceptWM Class) -
https://w3s.webmoney.ru/WMAcceptor.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{7FF8B3BA-3922-4A52-A244-AC47C4DCB51A}: NameServer = 89.239.139.130 89.239.139.131
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Корпорация Майкрософт - C:\Windows\system32\DFSR.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - D:\Games\Про стрит\PB\PnkBstrA.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: @%systemroot%\system32\SearchIndexer.exe,-103 (WSearch) - Корпорация Майкрософт - C:\Windows\system32\SearchIndexer.exe
O23 - Service: Планировщик автоматического запуска LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
--
End of file - 10657 bytes
вот мой лог!