Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 0:05:53, on 03.08.2014
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
CHROME: 36.0.1985.125
Boot mode: Normal
Windows folder: C:\Windows
System folder: C:\Windows\SYSTEM32
Hosts file: C:\Windows\System32\drivers\etc\hosts
Running processes:
C:\Users\Администратор\AppData\Local\MailRu\MailRuUpdater.exe
C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
C:\ProgramData\Search Protection\SearchProtection.exe
C:\Program Files (x86)\Opera\opera.exe
C:\Users\Администратор\Desktop\HijackThis.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: QIPBHO Class - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Users\Администратор\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AVdowloads - {57FC7EA7-2F0D-4F3E-89BB-A1651B3F39AA} - C:\Program Files (x86)\Аудио и видео скачивание\IE\x86\Downloader.dll (file missing)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (filesize 2217848 bytes, MD5 A6B5A41C0ED007AB6C43CAD899E533D8)
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: QIPBHO - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Users\Администратор\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll (filesize 141184 bytes, MD5 B5E9118564DE4DFF41D4A9E3ABA1E4E1)
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" (filesize 31072 bytes, MD5 644795F6985C740F5E36E9336B837D0B)
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" (filesize 959904 bytes, MD5 048EA4B978851788E9F5E8E4F081DF7A)
O4 - HKLM\..\Run: [Ad-Aware Browsing Protection] "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe" (filesize 559696 bytes, MD5 D1A7A7D193A0DDBF31F53610DBA05CAC)
O4 - HKLM\..\Run: [Search Protection] C:\ProgramData\Search Protection\SearchProtection.exeC:\ProgramData\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "D:\Alcohol 52\AxAutoMntSrv.exe" -automount (filesize 33120 bytes, MD5 4FAF325D23AD2749564720997C0C98A1)
O4 - HKCU\..\Run: [MailRuUpdater] C:\Users\Администратор\AppData\Local\MailRu\MailRuUpdater.exeC:\Users\Администратор\AppData\Local\MailRu\MailRuUpdater.exe
O8 - Extra context menu item: &Экспорт в Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Отправить в OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (filesize 603040 bytes, MD5 79F7DB36E67B9E8365FA824AD96DF400)
O9 - Extra 'Tools' menuitem: &Отправить в OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (filesize 603040 bytes, MD5 79F7DB36E67B9E8365FA824AD96DF400)
O9 - Extra button: ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - C:\Program Files (x86)\ICQ7M\ICQ.exe (filesize 127040 bytes, MD5 4AE60CAE9A782C9CC54ADF3E41E04D2D)
O9 - Extra 'Tools' menuitem: ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - C:\Program Files (x86)\ICQ7M\ICQ.exe (filesize 127040 bytes, MD5 4AE60CAE9A782C9CC54ADF3E41E04D2D)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (filesize 39464 bytes, MD5 AEF204E782BFA2C8448CB43A58960744)
O15 - Trusted Zone: *.uralsibbank.ru
O16 - DPF: {113E52A8-A790-4B13-B5F8-B17BD5617707} (rg_call) - https://dbo.ufa.uralsibbank.ru/CODE/3.17.8.930/cr_call.cab
O16 - DPF: {34E60EF0-8825-4AD8-ABED-ADC2F358F2C9} - https://dbo.ufa.uralsibbank.ru/CODE/3.17.8.930/bsssl.cab
O16 - DPF: {884DFC1F-0E2A-48ED-8A93-FF60C0BF76B1} (AXToolsX Control) - https://dbo.ufa.uralsibbank.ru/v10/cab/bssural.cab
O16 - DPF: {B4200B70-4EA0-40EC-8F0D-09299BB8EC03} (rg_ossl) - https://dbo.ufa.uralsibbank.ru/CODE/3.17.8.930/cr_ossl.cab
O16 - DPF: {FB80FA57-8C28-4E02-BE2D-42C08E69A2E1} (InstLib) - https://dbo.ufa.uralsibbank.ru/v10/cab/InstLib.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7F1D8BB5-5D14-47B1-A936-39AF1ABAC2F6}: NameServer = 8.8.8.8
O17 - HKLM\System\CS1\Services\Tcpip\..\{7F1D8BB5-5D14-47B1-A936-39AF1ABAC2F6}: NameServer = 8.8.8.8
O17 - HKLM\System\CS2\Services\Tcpip\..\{7F1D8BB5-5D14-47B1-A936-39AF1ABAC2F6}: NameServer = 8.8.8.8
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll (filesize 178040 bytes, MD5 68747446F9D982938DB6B110F2908271)
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exeC:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeC:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Dr.Web AV-Desk Agent (drwagntd) - Doctor Web, Ltd. - C:\Program Files (x86)\DrWeb AV-Desk\drwagntd.exeC:\Program Files (x86)\DrWeb AV-Desk\drwagntd.exe
O23 - Service: Dr.Web Scanning Engine (DrWebEngine) (DrWebEngine) - Doctor Web, Ltd. - C:\Program Files (x86)\DrWeb AV-Desk\dwengine.exeC:\Program Files (x86)\DrWeb AV-Desk\dwengine.exe
O23 - Service: Dr.Web Net Filtering Service (DrWebNetFilter) - Doctor Web, Ltd. - C:\Program Files (x86)\DrWeb AV-Desk\DWNETFILTER.EXEC:\Program Files (x86)\DrWeb AV-Desk\DWNETFILTER.EXE
O23 - Service: Dr.Web AV-Desk Upgrade Service (drwupgrade) - Doctor Web, Ltd. - C:\Program Files (x86)\DrWeb AV-Desk\0\drwupgrade.exeC:\Program Files (x86)\DrWeb AV-Desk\0\drwupgrade.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Ralink Registry Writer (RalinkRegistryWriter) - Ralink Technology, Corp. - C:\Program Files (x86)\TP-LINK\Common\RaRegistry.exeC:\Program Files (x86)\TP-LINK\Common\RaRegistry.exe
O23 - Service: Ralink Registry Writer 64 (RalinkRegistryWriter64) - Ralink Technology, Corp. - C:\Program Files (x86)\TP-LINK\Common\RaRegistry64.exeC:\Program Files (x86)\TP-LINK\Common\RaRegistry64.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - StarWind Software - D:\Alcohol 52\StarWind\StarWindServiceAE.exeD:\Alcohol 52\StarWind\StarWindServiceAE.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: ynsOwaeHteehU - NVIDIA Corporation - C:\Program Files (x86)\AhYTeRvIWOunla\igfxtray.exeC:\Program Files (x86)\AhYTeRvIWOunla\igfxtray.exe
--
End of file - 9515 bytes