Вирус делающий ярлыки на флешку. Процесс svchost.exe

ComboFix 13-08-19.02 - Sasha 2013.08.20 19:56:12.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.2047.1440 [GMT 3:00]
Running from: d:\_storage\_Software\Software3\=Security=\2013_08\cyberforum.ru\¦юью•№ яю ыхўхэш¦ ё ЇюЁєьр\ComboFix\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *Disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\0922503211MN
c:\documents and settings\All Users\Application Data\FNY991129018I0
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\Sasha\Recent\Thumbs.db
c:\windows\msmqinst.log
.
.
((((((((((((((((((((((((( Files Created from 2013-07-20 to 2013-08-20 )))))))))))))))))))))))))))))))
.
.
2013-08-19 14:21 . 2013-08-19 14:34 7168 ----a-w- c:\windows\system32\drivers\uti0ndix.sys
2013-08-19 12:15 . 2013-08-19 14:15 -------- d-----w- c:\program files\trend micro
2013-08-19 12:15 . 2013-08-19 14:51 -------- d-----w- C:\rsit
2013-08-17 17:53 . 2013-08-17 17:53 159744 ----a-w- c:\program files\Internet Explorer\Модули\npqtplugin5.dll
2013-08-17 17:53 . 2013-08-17 17:53 159744 ----a-w- c:\program files\Internet Explorer\Модули\npqtplugin4.dll
2013-08-17 17:53 . 2013-08-17 17:53 159744 ----a-w- c:\program files\Internet Explorer\Модули\npqtplugin3.dll
2013-08-17 17:53 . 2013-08-17 17:53 159744 ----a-w- c:\program files\Internet Explorer\Модули\npqtplugin2.dll
2013-08-17 17:53 . 2013-08-17 17:53 159744 ----a-w- c:\program files\Internet Explorer\Модули\npqtplugin.dll
2013-08-17 17:51 . 2013-08-17 17:51 -------- d-----w- c:\program files\Common Files\Apple
2013-08-17 17:51 . 2013-08-17 17:51 -------- d-----w- c:\program files\Apple Software Update
2013-08-17 17:51 . 2013-08-17 17:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2013-08-17 16:49 . 2013-08-17 16:50 -------- d-----w- c:\documents and settings\Администратор
2013-08-17 15:36 . 2013-08-17 15:36 -------- d--h--w- c:\windows\system32\GroupPolicy
2013-08-17 12:34 . 2013-08-17 15:27 -------- d-----w- c:\documents and settings\Sasha\Doctor Web
2013-08-15 16:19 . 2013-08-15 16:24 -------- d-----w- C:\ATI
2013-08-14 14:15 . 2013-08-14 14:19 -------- d-----w- c:\documents and settings\Sasha\Application Data\Astute Graphics
2013-08-14 14:13 . 2013-08-14 14:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Astute Graphics
2013-08-14 14:13 . 2013-08-14 14:13 -------- d-----w- c:\program files\com.astg.pcs2
2013-08-10 11:13 . 2013-08-10 11:13 -------- d-----w- c:\documents and settings\Sasha\Application Data\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2013-08-06 20:51 . 2013-08-06 21:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Protexis
2013-08-06 19:45 . 2013-08-06 19:45 -------- d-----w- c:\documents and settings\Sasha\Application Data\Corel
2013-08-06 19:22 . 2013-08-06 19:22 -------- d-----w- c:\program files\gs
2013-08-06 19:21 . 2013-08-06 19:21 -------- d-----w- c:\program files\Common Files\Corel
2013-08-06 19:20 . 2013-08-06 19:20 -------- d-----w- c:\program files\Common Files\Protexis
2013-08-06 19:20 . 2013-08-06 19:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Corel
2013-07-30 18:08 . 2013-07-30 18:08 -------- d-sh--w- c:\documents and settings\Sasha\IECompatCache
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-20 12:19 . 2013-07-20 12:19 346584 ----a-r- c:\documents and settings\Sasha\Application Data\Microsoft\Installer\{C2A2FC01-38B8-410B-A02E-53F404059003}\ARPPRODUCTICON.exe
2013-07-11 18:18 . 2013-07-11 18:18 867240 ----a-w- c:\windows\system32\npDeployJava1.dll
2013-07-11 18:18 . 2013-07-11 18:18 789416 ----a-w- c:\windows\system32\deployJava1.dll
2013-06-08 00:23 . 2008-04-15 12:00 920064 ----a-w- c:\windows\system32\wininet.dll
2013-06-07 21:53 . 2008-04-15 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2013-06-07 21:53 . 2008-04-15 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2013-06-07 18:27 . 2008-04-15 12:00 385024 ----a-w- c:\windows\system32\html.iec
2013-06-05 09:08 . 2008-04-15 12:00 1876864 ----a-w- c:\windows\system32\win32k.sys
2013-06-04 07:23 . 2008-04-15 12:00 563200 ----a-w- c:\windows\system32\qedit.dll
2013-06-03 12:20 . 2013-06-03 12:20 361296 ----a-w- c:\windows\system32\pythoncom26.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{405DFEAE-1D2F-4649-BE08-C92313C3E1CE}"= "c:\program files\WebMoney Advisor\2.2.4\wmadvisor.dll" [2011-07-20 288224]
.
[HKEY_CLASSES_ROOT\clsid\{405dfeae-1d2f-4649-be08-c92313c3e1ce}]
[HKEY_CLASSES_ROOT\TypeLib\{3B9F4DFC-44AF-45E0-A38D-0D35F70BB2B0}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{405DFEAE-1D2F-4649-BE08-C92313C3E1CE}"= "c:\program files\WebMoney Advisor\2.2.4\wmadvisor.dll" [2011-07-20 288224]
.
[HKEY_CLASSES_ROOT\clsid\{405dfeae-1d2f-4649-be08-c92313c3e1ce}]
[HKEY_CLASSES_ROOT\TypeLib\{3B9F4DFC-44AF-45E0-A38D-0D35F70BB2B0}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe" [2012-11-01 206448]
"RTHDCPL"="RTHDCPL.EXE" [2011-08-17 20064872]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-28 137752]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-28 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-28 166424]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2012-11-09 611712]
"Logitech Utility"="Logi_MwX.Exe" [2003-12-17 19968]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"QuickTime Task"="d:\program files\QuickTime\QTTask.exe" [2013-05-01 421888]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Главное меню^Программы^Автозагрузка^Device Detector 4.lnk]
path=c:\documents and settings\All Users\Главное меню\Программы\Автозагрузка\Device Detector 4.lnk
backup=c:\windows\pss\Device Detector 4.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2012-07-30 13:02 640480 ----a-w- d:\program files\Acrobat 9.0\Acrobat\acrotray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Acrobat Speed Launcher]
2012-07-31 02:19 41944 ----a-w- d:\program files\Acrobat 9.0\Acrobat\acrobat_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2013-04-04 21:06 958576 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
2010-03-06 01:44 500208 ------w- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
2010-07-22 20:10 402432 ----a-w- c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2013-04-21 18:43 59720 ----a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Autodesk Sync]
2012-07-25 20:01 387048 ----a-w- c:\program files\Autodesk\Autodesk Sync\AdSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2011-12-15 13:17 136176 ----atw- c:\documents and settings\Sasha\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2009-04-08 12:18 570664 -c--a-w- c:\program files\Common Files\Nero\Lib\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SsAAD.exe]
2006-11-02 10:43 472632 ----a-w- c:\progra~1\Sony\SONICS~1\SSAAD.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2012-07-03 21:48 98304 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]
2010-02-19 11:37 517096 ----a-w- c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wmagent.exe]
2009-10-19 11:47 210400 ----a-w- c:\program files\WebMoney Agent\wmagent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Authorize dApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Common Files\\XpressUpdate\\XPressUpdate.exe"=
"d:\\Program Files\\Autodesk\\3ds Max Design 2013\\NVIDIA\\raysat_3dsmax2013_32server.exe"=
"d:\\Program Files\\Autodesk\\3ds Max Design 2013\\NVIDIA\\raysat_3dsmax2013_32.exe"=
"d:\\Program Files\\Autodesk\\3ds Max Design 2013\\3dsmax.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\system32\\hasplms.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyO penPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"50248:TCP"= 50248:TCP:Autodesk Content Service
.
R1 kl2;kl2;c:\windows\system32\drivers\kl2.sys [2011.03.04 14:23 11352]
R1 se32;EnTech softEngine;c:\windows\system32\drivers\se32.sys [2007.05.03 18:19 12112]
R2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service;c:\program files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe [2007.12.06 22:03 660768]
R2 hasplms;Sentinel Local License Manager;c:\windows\system32\hasplms.exe -run --> c:\windows\system32\hasplms.exe -run [?]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011.12.15 19:55 366152]
R2 RefBookSvr;RefBook Server;d:\program files\ASCON\RefBook\RefBookServer.exe [2013.01.31 11:32 1245016]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdXP3.sys [2012.10.28 18:52 103040]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2011.03.10 19:34 34608]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2009.11.02 21:27 19472]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011.12.15 19:55 22216]
S2 mi-raysat_3dsmax2013_32;mental ray 3.10 Satellite for Autodesk 3ds Max 2013 32-bit;d:\program files\Autodesk\3ds Max Design 2013\NVIDIA\raysat_3dsmax2013_32server.exe [2011.09.15 0:19 86016]
S3 AIDA64Driver;FinalWire AIDA64 Kernel Driver;c:\program files\FinalWire\AIDA64 Extreme Edition\kerneld.x32 [2011.12.15 16:07 28824]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2011.12.15 14:49 1691480]
S3 Olympus DVR Service;Olympus DVR Service;c:\program files\Common Files\Olympus Shared\DeviceManager\olydvrsv.exe [2011.06.23 17:39 176128]
S3 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2013.06.03 16:21 162408]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010.02.19 14:37 517096]
S3 uti0ndix;AVZ Kernel Driver;c:\windows\system32\drivers\uti0ndix.sys [2013.08.19 17:21 7168]
S4 Autodesk Content Service;Autodesk Content Service;c:\program files\Autodesk\Content Service\Connect.Service.ContentService.exe [2012.01.31 11:46 19232]
S4 IObitUnlocker;IObitUnlocker;c:\program files\IObit\IObit Unlocker\IObitUnlocker.sys [2011.12.18 13:37 27552]
.
Contents of the 'Scheduled Tasks' folder
.
2013-08-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-527237240-507921405-1606980848-1003Core.job
- c:\documents and settings\Sasha\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-12-15 13:17]
.
2013-08-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-527237240-507921405-1606980848-1003UA.job
- c:\documents and settings\Sasha\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-12-15 13:17]
.
2013-08-09 c:\windows\Tasks\Дефрагментация дисков.job
- c:\windows\system32\dfrg.msc [2008-04-15 12:00]
.
2013-08-19 c:\windows\Tasks\Обновить Windows.job
- c:\windows\system32\svchost.exe [2008-04-15 12:00]
.
2013-08-08 c:\windows\Tasks\Очистка диска.job
- c:\windows\system32\cleanmgr.exe [2008-04-15 12:00]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = <local>
IE: &Экспорт в Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert link target to existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: {{807DF5E0-4EF7-48a8-A405-239F3E29FFA9} - {FE69C007-C452-4d3e-86D2-1730DF8BC871} - c:\program files\SimilarSites\similarsites.dll
TCP: Interfaces\{B4AE861C-3843-46A5-9410-3FA49103FD82}: NameServer = 192.168.0.1
.
.
------- File Associations -------
.
.scr=AutoCADScriptFile
.txt=
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{FE69C007-C452-4d3e-86D2-1730DF8BC871} - c:\program files\SimilarSites\similarsites.dll
Toolbar-{FE69C007-C452-4d3e-86D2-1730DF8BC871} - c:\program files\SimilarSites\similarsites.dll
MSConfigStartUp-Hoolapp Android - c:\docume~1\Sasha\APPLIC~1\HOOLAP~1\Hoolapp.exe
MSConfigStartUp-QuickTime Task - c:\program files\QuickTime\qttask.exe
AddRemove-_{511DE7EA-AA68-4D7A-A2E3-0E7B5186B822} - d:\program files\Corel\CorelDRAW Graphics Suite X6\Setup\SetupARP.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-08-20 20:04
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\AIDA64Driver]
"ImagePath"="\??\c:\program files\FinalWire\AIDA64 Extreme Edition\kerneld.x32"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1308)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
Completion time: 2013-08-20 20:06:43
ComboFix-quarantined-files.txt 2013-08-20 17:06
.
Pre-Run: 8*231*985*152 байт свободно
Post-Run: 8*266*178*560 байт свободно
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional RU" /noexecute=optin /fastdetect
.
- - End Of File - - 0F4976CDEFD370BF1A1303002E075660
8F558EB6672622401DA993E1E865C861

Security Check by glax24 version 0.1.6.55 rc2
WebSite: www.safezone.cc
DataLog 21.08.2013 18:37:03
Program directory: C:\Documents and Settings\Sasha\Local Settings\temp\SecurityCheck\
Log directory: C:\SecurityCheck\
IsAdmin: True
XML File - VersionInet=5.3
Диск C:\ ФС: NTFS Емкость: (30.3 Гб) Занято: (22.4 Гб) Свободно: (7.9 Гб)
__________________________________________________

WIN_XP(5.1) Build 2600 (x86) Lang: Russian(0419)
Дата установки ОС: 15.12.2011 10:18:32
Service Pack 3
Internet Explorer 8.0.6001.18702
-------------Windows------------------------------
Уведомлять о загрузке и установке обновлений
Дата установки обновлений: 2013-07-30 15:03:38
Automatic Updates (wuauserv) - Служба работает
Центр обеспечения безопасности (wscsvc) - Служба работает
-------------Antivirus_WMI------------------------
Kaspersky Internet Security
Антивирус устарел
-------------Firewall_WMI-------------------------
Kaspersky Internet Security
-------------AntiVirusFirewallInstall-------------
Kaspersky Internet Security 2012 v.12.0.0.374
-------------OtherUtilities-----------------------
CCleaner v.3.24
Malwarebytes' Anti-Malware, версия 1.51.2.1300 v.1.51.2.1300
Ghostscript GPL 8.64 (Msi Setup) v.8.64
-------------AppleProduction----------------------
QuickTime v.7.74.80.86 [+]
-------------AdobeProduction----------------------
Adobe Flash Player 11 ActiveX v.11.5.502.110 Внимание! Скачать обновления
Adobe Flash Player 11 Plugin v.11.5.502.110 Внимание! Скачать обновления
Adobe Shockwave Player 11.6 v.11.6.8.638 Внимание! Скачать обновления
-------------Browser------------------------------
Google Chrome v.28.0.1500.95
Opera 11.60 v.11.60.1185 Внимание! Скачать обновления
^Будет скачена последняя версия 12.16 (Для скачивания Opera на движке Chromium перейдите на www.opera.com)^
-------------RunningProcess-----------------------
C:\Documents and Settings\Sasha\Local Settings\Application Data\Google\Chrome\Application\chrome.exe v.28.0.1500.95
-------------EndLog-------------------------------

€¬п ®Ўа*§* PID ‘«г¦Ўл
========================= ====== =============================================
System Idle Process 0 Ќ/„
System 4 Ќ/„
smss.exe 1148 Ќ/„
csrss.exe 1316 Ќ/„
winlogon.exe 1376 Ќ/„
services.exe 1436 Eventlog, PlugPlay
lsass.exe 1448 PolicyAgent, ProtectedStorage, SamSs
ati2evxx.exe 1640 Ati HotKey Poller
svchost.exe 1660 DcomLaunch, TermService
svchost.exe 1776 RpcSs
svchost.exe 1948 AudioSrv, Browser, CryptSvc, Dhcp, dmserver,
ERSvc, EventSystem,
FastUserSwitchingCompatibility, helpsvc,
HidServ, LanmanServer, lanmanworkstation,
Netman, Nla, RasMan, Schedule, seclogon,
SENS, SharedAccess, ShellHWDetection,
srservice, TapiSrv, Themes, TrkWks, W32Time,
winmgmt, wscsvc, wuauserv, WZCSVC
svchost.exe 232 Dnscache
ati2evxx.exe 280 Ќ/„
svchost.exe 364 LmHosts, RemoteRegistry, SSDPSRV
spoolsv.exe 688 Spooler
explorer.exe 1680 Ќ/„
svchost.exe 1912 WebClient
avp.exe 1920 Ќ/„
RTHDCPL.EXE 1988 Ќ/„
NetworkLicenseServer.exe 348 ABBYY.Licensing.FineReader.Professional.9.0
jusched.exe 720 Ќ/„
ctfmon.exe 804 Ќ/„
EM_EXEC.EXE 868 Ќ/„
avp.exe 1128 AVP
FNPLicensingService.exe 1512 FLEXnet Licensing Service
hasplms.exe 488 hasplms
jqs.exe 712 JavaQuickStarterService
mbamservice.exe 1888 MBAMService
raysat_3dsmax2013_32serve 900 mi-raysat_3dsmax2013_32
RefBookServer.exe 1188 RefBookSvr
svchost.exe 2128 stisvc
wuauclt.exe 2312 Ќ/„
alg.exe 2840 ALG
svchost.exe 3448 HTTPFilter
wscntfy.exe 2752 Ќ/„
taskmgr.exe 2868 Ќ/„
wmiapsrv.exe 2452 WmiApSrv
wmiprvse.exe 2952 Ќ/„
cmd.exe 316 Ќ/„
tasklist.exe 2124 Ќ/„
wmiprvse.exe 2168 Ќ/„