Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:25:56, on 23.08.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
c:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Documents and Settings\All Users\Application Data\VKSaver\VKSaver.exe
C:\Program Files\Common Files\Doctor Web\Scanning Engine\dwengine.exe
C:\Program Files\DrWeb\frwl_svc.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Mail.Ru\Guard\GuardMailRu.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\explorer.exe
C:\install\svchost.exe
C:\Program Files\Drive Space Indicator\DrvSpace.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Mail.Ru\Agent\MAgent.exe
C:\Program Files\WebMoney Agent\wmagent.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Mail.Ru\Guard\GuardMailRu.exe
C:\Documents and Settings\All Users\Application Data\VKSaver\VKSaver.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Program Files\DrWeb\frwl_notify.exe
C:\Program Files\DrWeb\SpIDerAgent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hyperionics DB Toolbar\TbHelper2.exe
C:\WINDOWS\system32\mstsc.exe
D:\Games\CweryMt21\CweryMT2.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

O23 - Service: Dr.Web Scanning Engine (DrWebEngine) (DrWebEngine) - Doctor Web, Ltd. - C:\Program Files\Common Files\Doctor Web\Scanning Engine\dwengine.exe
O23 - Service: Dr.Web Firewall Service (DrWebFwSvc) - Doctor Web, Ltd. - C:\Program Files\DrWeb\frwl_svc.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Журнал событий (Eventlog) - Корпорация Майкрософт - C:\WINDOWS\system32\services.exe
O23 - Service: Guard.Mail.ru - Unknown owner - C:\Program Files\Mail.Ru\Guard\GuardMailRu.exe
O23 - Service: Служба COM записи компакт-дисков IMAPI (ImapiService) - Корпорация Майкрософт - C:\WINDOWS\system32\imapi.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - c:\WINDOWS\system32\nvsvc32.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: Plug and Play (PlugPlay) - Корпорация Майкрософт - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Смарт-карты (SCardSvr) - Корпорация Майкрософт - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - StarWind Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: Журналы и оповещения производительности (SysmonLog) - Корпорация Майкрософт - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Теневое копирование тома (VSS) - Корпорация Майкрософт - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Адаптер производительности WMI (WmiApSrv) - Корпорация Майкрософт - C:\WINDOWS\system32\wbem\wmiapsrv.exe
O23 - Service: webcamXP Service (wxpSvc) - Unknown owner - C:\Program Files\webcamXP 5\wService.exe

--
End of file - 4266 bytes

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 TerminateProcessByName('c:\install\svchost.exe');
 QuarantineFile('C:\WINDOWS\system32\3.tmp','');
 QuarantineFile('C:\WINDOWS\system32\cpldapu\produkey.exe','');
 QuarantineFile('C:\Program Files\\Outlook Express\setup50.exe','');
 QuarantineFile('C:\Documents and Settings\Манжет\Рабочий стол\S\itztehhack.sys','');
 QuarantineFile('C:\WINDOWS\system32\Drivers\pssdk40.sys','');
 QuarantineFile('C:\WINDOWS\system32\Drivers\pssdklbf.sys','');
 QuarantineFile('C:\WINDOWS\system32\eqlphln.dll','');
 QuarantineFile('c:\install\svchost.exe','');
 DeleteFile('c:\install\svchost.exe');
 DeleteFile('C:\WINDOWS\system32\eqlphln.dll');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','HKLM');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','HKCU');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','Policies');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','Policies');
 DeleteFile('C:\Program Files\\Outlook Express\setup50.exe');
 DeleteFile('C:\WINDOWS\system32\cpldapu\produkey.exe');
 DeleteFile('C:\WINDOWS\system32\3.tmp');
RegKeyStrParamWrite('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows','AppInit_DLLs','');
ExecuteSysClean;
BC_Activate;
ExecuteWizard('TSW',2,3,true);
RebootWindows(true);
end.

 begin
 CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
 end.