Corrupted download

Sovjez · February 23, 2009

μTorrent version 1.8.2. Torrent was downloaded as "100%", but it was corrupted. Reloading it in μTorrent showed only "99.8%": one piece was not downloaded correctly. Then the same thing again. From the third attempt full torrent was downloaded ok.

By the way: μTorrent still does not close directories correctly (it may be problematic to delete directories even after removing the corresponding torrents from μTorrent).

I don't believe it's useful in this case, but here are the logs:

HiJack log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:21:08, on 23.02.2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe

C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\A4Tech\Mouse\Amoumain.exe

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\Program Files\VMware\VMware Workstation\vmware-tray.exe

C:\WINDOWS\system32\crypserv.exe

C:\Program Files\VMware\VMware Workstation\hqtray.exe

C:\WINDOWS\system32\taskswitch.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\system32\emaudsv.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Pen_Tablet.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Creative Professional\E-MU USB Audio\EmuUsbAudioCP.exe

C:\Program Files\DAEMON Tools Lite\daemon.exe

C:\WINDOWS\system32\WTablet\Pen_TabletUser.exe

C:\WINDOWS\system32\Pen_Tablet.exe

C:\Program Files\OpenOffice.org 3\program\soffice.exe

C:\Program Files\OpenOffice.org 3\program\soffice.bin

C:\Program Files\uTorrent\uTorrent.exe

C:\Program Files\Opera\opera.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Ссылки

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [Launch LgDevAgt] "C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe"

O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"

O4 - HKLM\..\Run: [vmware-tray] C:\Program Files\VMware\VMware Workstation\vmware-tray.exe

O4 - HKLM\..\Run: [VMware hqtray] "C:\Program Files\VMware\VMware Workstation\hqtray.exe"

O4 - HKLM\..\Run: [updReg] C:\WINDOWS\UpdReg.EXE

O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"

O4 - HKCU\..\Run: [E-MU USB Audio Control Panel] "C:\Program Files\Creative Professional\E-MU USB Audio\EmuUsbAudioCP.exe"

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe

O8 - Extra context menu item: &Закачать все при помощи FlashGet - C:\Program Files\FlashGet\jc_all.htm

O8 - Extra context menu item: &Закачать при помощи FlashGet - C:\Program Files\FlashGet\jc_link.htm

O8 - Extra context menu item: Add to &Teleport - C:\Program Files\Teleport Pro\teleport.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe

O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{45ACF536-0AEB-4B83-9305-62EE62AD8BDD}: NameServer = 10.130.16.2

O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe

O23 - Service: E-MU Audio Service (emaudsv) - E-MU Systems - C:\WINDOWS\system32\emaudsv.exe

O23 - Service: Журнал событий (Eventlog) - Корпорация Майкрософт - C:\WINDOWS\system32\services.exe

O23 - Service: Служба COM записи компакт-дисков IMAPI (ImapiService) - Корпорация Майкрософт - C:\WINDOWS\system32\imapi.exe

O23 - Service: NetMeeting Remote Desktop Sharing (mnmsrvc) - Корпорация Майкрософт - C:\WINDOWS\system32\mnmsrvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Plug and Play (PlugPlay) - Корпорация Майкрософт - C:\WINDOWS\system32\services.exe

O23 - Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) - Корпорация Майкрософт - C:\WINDOWS\system32\sessmgr.exe

O23 - Service: Смарт-карты (SCardSvr) - Корпорация Майкрософт - C:\WINDOWS\System32\SCardSvr.exe

O23 - Service: Журналы и оповещения производительности (SysmonLog) - Корпорация Майкрософт - C:\WINDOWS\system32\smlogsvc.exe

O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\WINDOWS\system32\Pen_Tablet.exe

O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe

O23 - Service: Теневое копирование тома (VSS) - Корпорация Майкрософт - C:\WINDOWS\System32\vssvc.exe

O23 - Service: Адаптер производительности WMI (WmiApSrv) - Корпорация Майкрософт - C:\WINDOWS\system32\wbem\wmiapsrv.exe

--

End of file - 7884 bytes

ProcessExplorer log1 (handles):

Process PID CPU Description Company Name User Name Window Title Session Path Command Line Version Comment Window Status DEP Verified Signer

System Idle Process 0 88.57 NT AUTHORITY\SYSTEM <n/a>

Interrupts n/a Hardware Interrupts 0 <n/a>

DPCs n/a Deferred Procedure Calls 0 <n/a>

System 4 NT AUTHORITY\SYSTEM 0 DEP

smss.exe 604 Диспетчер сеанса Windows NT Корпорация Майкрософт NT AUTHORITY\SYSTEM 0 C:\WINDOWS\system32\smss.exe \SystemRoot\System32\smss.exe 5.1.2600.5512 DEP

csrss.exe 660 Client Server Runtime Process Microsoft Corporation NT AUTHORITY\SYSTEM 0 C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 5.1.2600.5512 DEP

winlogon.exe 684 Программа входа в систему Windows NT Корпорация Майкрософт NT AUTHORITY\SYSTEM 0 C:\WINDOWS\system32\winlogon.exe winlogon.exe 5.1.2600.5512 DEP

services.exe 728 Приложение служб и контроллеров Корпорация Майкрософт NT AUTHORITY\SYSTEM 0 C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\services.exe 5.1.2600.5512

svchost.exe 908 Generic Host Process for Win32 Services Microsoft Corporation NT AUTHORITY\SYSTEM 0 C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost -k DcomLaunch 5.1.2600.5512 DEP

svchost.exe 988 Generic Host Process for Win32 Services Microsoft Corporation NT AUTHORITY\NETWORK SERVICE 0 C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost -k rpcss 5.1.2600.5512 DEP

svchost.exe 1488 1.43 Generic Host Process for Win32 Services Microsoft Corporation NT AUTHORITY\SYSTEM 0 C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs 5.1.2600.5512 DEP

svchost.exe 1596 Generic Host Process for Win32 Services Microsoft Corporation NT AUTHORITY\NETWORK SERVICE 0 C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe -k NetworkService 5.1.2600.5512 DEP

spoolsv.exe 1908 Spooler SubSystem App Microsoft Corporation NT AUTHORITY\SYSTEM 0 C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\spoolsv.exe 5.1.2600.5512 DEP

svchost.exe 1332 Generic Host Process for Win32 Services Microsoft Corporation NT AUTHORITY\LOCAL SERVICE 0 C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe -k LocalService 5.1.2600.5512 DEP

Crypserv.exe 1568 CrypKey NT Service CrypKey (Canada) Ltd. NT AUTHORITY\SYSTEM 0 C:\WINDOWS\system32\Crypserv.exe crypserv.exe 1.0.1.2

emaudsv.exe 1664 E-MU Audio Service E-MU Systems NT AUTHORITY\SYSTEM 0 C:\WINDOWS\system32\emaudsv.exe C:\WINDOWS\system32\emaudsv.exe 6.0.1.1

nvsvc32.exe 1748 NVIDIA Driver Helper Service, Version 175.19 NVIDIA Corporation NT AUTHORITY\SYSTEM 0 C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\nvsvc32.exe 6.14.11.7519

svchost.exe 1820 Generic Host Process for Win32 Services Microsoft Corporation NT AUTHORITY\SYSTEM 0 C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe -k imgsvc 5.1.2600.5512 DEP

Pen_Tablet.exe 1872 Tablet Service for consumer driver Wacom Technology, Corp. NT AUTHORITY\SYSTEM 0 C:\WINDOWS\system32\Pen_Tablet.exe C:\WINDOWS\system32\Pen_Tablet.exe 5.1.0.4

Pen_TabletUser.exe 1628 Tablet user module for consumer driver Wacom Technology, Corp. ...\... 0 C:\WINDOWS\system32\WTablet\Pen_TabletUser.exe WTablet\Pen_TabletUser.exe 5.1.0.4

Pen_Tablet.exe 1608 Tablet Service for consumer driver Wacom Technology, Corp. NT AUTHORITY\SYSTEM 0 C:\WINDOWS\system32\Pen_Tablet.exe Pen_Tablet.exe au 5.1.0.4

alg.exe 2120 Application Layer Gateway Service Microsoft Corporation NT AUTHORITY\LOCAL SERVICE 0 C:\WINDOWS\system32\alg.exe C:\WINDOWS\System32\alg.exe 5.1.2600.5512 DEP

lsass.exe 740 LSA Shell (Export Version) Microsoft Corporation NT AUTHORITY\SYSTEM 0 C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\lsass.exe 5.1.2600.5512 DEP

explorer.exe 528 Проводник Корпорация Майкрософт ...\... Program Manager 0 C:\WINDOWS\explorer.exe C:\WINDOWS\Explorer.EXE 6.0.2900.5512 Running

LGDevAgt.exe 1364 Logitech GamePanel Agent Logitech Inc. ...\... 0 C:\Program Files\Logitech\GamePanel Software\LGDevAgt.exe "C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe" 2.2.101.0

LGDCore.exe 1376 Logitech G-series Profiler Logitech Inc. ...\... 0 C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE 2.2.101.0

soundman.exe 1412 Realtek Sound Manager Realtek Semiconductor Corp. ...\... 0 C:\WINDOWS\soundman.exe "C:\WINDOWS\SOUNDMAN.EXE" 5.1.0.58

Amoumain.exe 1440 Amoumain A4Tech Co.,Ltd. ...\... 0 C:\Program Files\A4Tech\Mouse\Amoumain.exe "C:\Program Files\A4Tech\Mouse\Amoumain.exe" 7.80.0.2

PDVDServ.exe 1544 PowerDVD RC Service Cyberlink Corp. ...\... 0 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" 7.0.2406.0

vmware-tray.exe 1560 VMware Tray Process VMware, Inc. ...\... 0 C:\Program Files\VMware\VMware Workstation\vmware-tray.exe "C:\Program Files\VMware\VMware Workstation\vmware-tray.exe" 6.0.1613.0

hqtray.exe 1572 VMware Host Network Access Status Tray Application VMware, Inc. ...\... 0 C:\Program Files\VMware\VMware Workstation\hqtray.exe "C:\Program Files\VMware\VMware Workstation\hqtray.exe" 6.0.1613.0

TaskSwitch.exe 1632 ...\... 0 C:\WINDOWS\system32\taskswitch.exe "C:\WINDOWS\system32\taskswitch.exe"

rundll32.exe 1668 Запуск библиотеки DLL как приложения Корпорация Майкрософт ...\... 0 C:\WINDOWS\system32\rundll32.exe "C:\WINDOWS\system32\RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit 5.1.2600.5512

jusched.exe 1800 Java Platform SE binary Sun Microsystems, Inc. ...\... 0 C:\Program Files\Java\jre6\bin\jusched.exe "C:\Program Files\Java\jre6\bin\jusched.exe" 6.0.110.3

ctfmon.exe 1876 CTF Loader Microsoft Corporation ...\... 0 C:\WINDOWS\system32\ctfmon.exe "C:\WINDOWS\system32\ctfmon.exe" 5.1.2600.5512 DEP

EmuUsbAudioCP.exe 348 E-MU USB Audio Application E-MU Systems ...\... 0 C:\Program Files\Creative Professional\E-MU USB Audio\EmuUsbAudioCP.exe "C:\Program Files\Creative Professional\E-MU USB Audio\EmuUsbAudioCP.exe" 1.3.0.8

daemon.exe 364 DAEMON Tools Lite DT Soft Ltd ...\... 0 C:\Program Files\DAEMON Tools Lite\daemon.exe "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun 4.30.2.0

uTorrent.exe 1072 чTorrent BitTorrent, Inc. ...\... 0 C:\Program Files\uTorrent\uTorrent.exe "C:\Program Files\uTorrent\uTorrent.exe" 1.8.2.14458

opera.exe 1512 Opera Internet Browser Opera Software ...\... forum.utorrent.com / How to report a bug - Opera 0 C:\Program Files\Opera\opera.exe "C:\Program Files\Opera\opera.exe" 9.63.10476.0 Running

Far.exe 3152 File and archive manager Eugene Roshal & FAR Group ...\... {C:\Tools\sysinternals} - Far 0 C:\Tools\Far\Far.exe "C:\Tools\Far\Far.exe" 1.70.2087.0 Running

procexp.exe 3440 10.00 Sysinternals Process Explorer Sysinternals - www.sysinternals.com ...\... Process Explorer - Sysinternals: www.sysinternals.com [...\...] 0 C:\Tools\sysinternals\procexp.exe "C:\Tools\sysinternals\procexp.exe" 11.33.0.0 Running

soffice.exe 1964 OpenOffice.org 3.0 OpenOffice.org ...\... 0 C:\Program Files\OpenOffice.org 3\program\soffice.exe "C:\Program Files\OpenOffice.org 3\program\soffice.exe" -quickstart 3.0.9358.500

soffice.bin 1988 OpenOffice.org 3.0 OpenOffice.org ...\... 0 C:\Program Files\OpenOffice.org 3\program\soffice.bin "C:\Program Files\OpenOffice.org 3\program\soffice.exe" "-quickstart" "-env:OOO_CWD=2C:\\Program Files\\OpenOffice.org 3\\program" 3.0.9358.500

Process: uTorrent.exe Pid: 1072

Type Name

WindowStation \Windows\WindowStations\WinSta0

Thread uTorrent.exe(1072): 3552

Thread uTorrent.exe(1072): 3636

Thread uTorrent.exe(1072): 632

Thread uTorrent.exe(1072): 3296

Thread uTorrent.exe(1072): 3032

Thread uTorrent.exe(1072): 1100

Thread uTorrent.exe(1072): 560

Thread uTorrent.exe(1072): 3032

Thread uTorrent.exe(1072): 3296

Thread uTorrent.exe(1072): 632

Thread uTorrent.exe(1072): 3032

Thread uTorrent.exe(1072): 2300

Semaphore \BaseNamedObjects\shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}

Semaphore \BaseNamedObjects\shell.{7CB834F0-527B-11D2-9D1F-0000F805CA57}

Semaphore \BaseNamedObjects\shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}

Semaphore \BaseNamedObjects\shell.{090851A5-EB96-11D2-8BE4-00C04FA31A66}

Semaphore \BaseNamedObjects\shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}

Semaphore \BaseNamedObjects\shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}

Section \BaseNamedObjects\MSCTF.Shared.SFM.MPI

Section \BaseNamedObjects\A44DwheelMouseSharedMemory

Section \BaseNamedObjects\MSCTF.Shared.SFM.AJH

Section \BaseNamedObjects\AtlDebugAllocator_FileMappingNameStatic3_430

Section \BaseNamedObjects\ShimSharedMemory

Section \BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-823518204-842925246-839522115-1003SFM.DefaultS-1-5-21-823518204-842925246-839522115-1003

Section \BaseNamedObjects\CiceroSharedMemDefaultS-1-5-21-823518204-842925246-839522115-1003

Process uTorrent.exe(1072)

Port \RPC Control\OLE71B56666FE85456AB8393EE0105A

Mutant \BaseNamedObjects\_SHuassist.mtx

Mutant \BaseNamedObjects\MSCTF.Shared.MUTEX.MPI

Mutant \BaseNamedObjects\MSCTF.Shared.MUTEX.AJH

Mutant \BaseNamedObjects\ShimCacheMutex

Mutant \BaseNamedObjects\чTorrent4823DF041B09

Mutant \BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-823518204-842925246-839522115-1003MUTEX.DefaultS-1-5-21-823518204-842925246-839522115-1003

Mutant \BaseNamedObjects\CTF.TMD.MutexDefaultS-1-5-21-823518204-842925246-839522115-1003

Mutant \BaseNamedObjects\CTF.Layouts.MutexDefaultS-1-5-21-823518204-842925246-839522115-1003

Mutant \BaseNamedObjects\CTF.Asm.MutexDefaultS-1-5-21-823518204-842925246-839522115-1003

Mutant \BaseNamedObjects\CTF.Compart.MutexDefaultS-1-5-21-823518204-842925246-839522115-1003

Mutant \BaseNamedObjects\CTF.LBES.MutexDefaultS-1-5-21-823518204-842925246-839522115-1003

KeyedEvent \KernelObjects\CritSecOutOfMemoryEvent

Key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count

Key HKCU\Software\Classes

Key HKCU\Software\Microsoft\Windows\ShellNoRoam\Bags\112\Shell

Key HKCU\Software\Classes

Key HKCU\Software\Microsoft\Windows\ShellNoRoam\Bags\112\Shell

Key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\World Full Access Shared Parameters

Key HKCU\Software\Classes

Key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached

Key HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked

Key HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached

Key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked

Key HKCU\Software\Classes

Key HKLM\SOFTWARE\Microsoft\Windows\Shell

Key HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings

Key HKCU\Software\Classes

Key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts

Key HKCU\Software\Classes

Key HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache

Key HKCU\Software\Microsoft\Windows\ShellNoRoam

Key HKCU\Software\Microsoft\Windows\Shell

Key HKCU\Software\Classes

Key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer

Key HKCU\Software\Classes

Key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer

Key HKLM\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder

Key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count

Key HKLM\SYSTEM\ControlSet001\Control\Nls\Locale\Alternate Sorts

Key HKLM\SYSTEM\ControlSet001\Control\Nls\Locale

Key HKCU\Software\Classes

Key HKLM\SYSTEM\ControlSet001\Control\Nls\Language Groups

Key HKLM\SYSTEM\ControlSet001\Services\NetBT\Parameters

Key HKLM\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces

Key HKLM\SYSTEM\ControlSet001\Services\Tcpip\Parameters

Key HKLM\SYSTEM\ControlSet001\Services\Tcpip\Linkage

Key HKCU\Software\Classes

Key HKCR\CLSID

Key HKLM\SOFTWARE\Microsoft\COM3

Key HKU

Key HKLM\SOFTWARE\Microsoft\COM3

Key HKCR

Key HKCR\CLSID

Key HKLM\SOFTWARE\Microsoft\COM3

Key HKU

Key HKCR

Key HKU

Key HKLM\SOFTWARE\Microsoft\COM3

Key HKCU\Software\Classes

Key HKCR

Key HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5

Key HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9

Key HKU

Key HKCU

Key HKLM

File \Device\Afd

...

File \Device\Tcp

File P:\TPB\Postal Fudge Pack\Postal.Fudge.Pack-DOLi.part11.rar

File \Device\Tcp

File \Device\Afd

File \Device\Tcp

File \Device\Afd

File \Device\Tcp

...

File \Device\Tcp

...

File \Device\Tcp

File \Device\Afd

File \Device\Tcp

File \Device\Afd

...

File \Device\Afd

File \Device\Tcp

File \Device\Afd

File \Device\Tcp

File \Device\Afd

File \Device\Tcp

...

File \Device\Tcp

File \Device\Afd

File \Device\Tcp

File \Device\Afd

File \Device\Tcp

File \Device\Afd

...

File \Device\Tcp

File \Device\Afd

File P:\TPB\Postal Fudge Pack\Postal.Fudge.Pack-DOLi.part08.rar

File \Device\Tcp

File \Device\Afd

File \Device\Tcp

File \Device\Afd

File \Device\Tcp

File \Device\Afd

File P:\TPB\Postal Fudge Pack\Postal.Fudge.Pack-DOLi.part04.rar

File \Device\Tcp

File \Device\Afd

File \Device\Tcp

File \Device\Afd

File \Device\Tcp

File \Device\Afd

File \Device\Tcp

...

File \Device\Tcp

File \Device\Afd

File \Device\Tcp

File \Device\Afd

File \Device\Tcp

File \Device\Afd

File P:\TPB\Postal Fudge Pack\Postal.Fudge.Pack-DOLi.part18.rar

File \Device\Tcp

File \Device\Afd

File \Device\Tcp

File \Device\Afd

File \Device\Tcp

...

File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.5512_x-ww_dfb54e0c

File \Device\Afd

File \Dfs

File \Device\Tcp

File \Device\Afd

File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83

File \Device\Afd

...

File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83

File \Device\Afd

File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83

File \Device\Afd

File \Device\Tcp

...

File \Device\Tcp

File \Device\Afd

File P:\TPB\Postal Fudge Pack\Postal.Fudge.Pack-DOLi.part17.rar

File \Device\Afd

File \Device\Tcp

File \Device\Afd

File \Device\Tcp

File \Device\Afd

File \Device\Tcp

File P:\Разное

File \Device\Tcp

File \Device\Afd

File \Device\Tcp

File \Device\Udp

File \Device\Tcp

File \Device\Afd

File \Device\Tcp

File \Device\Afd

...

File \Device\Afd

File \Device\Udp

File \Device\Afd

File \Device\Tcp

File \Device\Afd

File \Device\Tcp

File P:\TPB\Postal Fudge Pack\Postal.Fudge.Pack-DOLi.part14.rar

File \Device\Tcp

File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83

File \Device\Afd

File \Device\WMIDataDevice

File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83

File \Device\Afd

File \Device\Tcp

File \Device\RawIp

File \Device\Afd

File \Device\Udp

File \Device\Tcp

File \Device\Ip

File \Device\Tcp

File \Device\Afd

File \Device\KsecDD

File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83

File \Device\Afd

Event \BaseNamedObjects\crypt32LogoffEvent

Event \BaseNamedObjects\userenv: User Profile setup event

Directory \BaseNamedObjects

Directory \Windows

Directory \KnownDlls

Desktop \Default

ProcessExplorer log2 (dll-s):

Process PID CPU Description Company Name User Name Window Title Session Path Command Line Version Comment Window Status DEP Verified Signer

System Idle Process 0 96.92 NT AUTHORITY\SYSTEM <n/a>

Interrupts n/a 1.54 Hardware Interrupts 0 <n/a>

DPCs n/a Deferred Procedure Calls 0 <n/a>

System 4 NT AUTHORITY\SYSTEM 0 DEP

smss.exe 604 Диспетчер сеанса Windows NT Корпорация Майкрософт NT AUTHORITY\SYSTEM 0 C:\WINDOWS\system32\smss.exe \SystemRoot\System32\smss.exe 5.1.2600.5512 DEP

csrss.exe 660 Client Server Runtime Process Microsoft Corporation NT AUTHORITY\SYSTEM 0 C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 5.1.2600.5512 DEP

winlogon.exe 684 Программа входа в систему Windows NT Корпорация Майкрософт NT AUTHORITY\SYSTEM 0 C:\WINDOWS\system32\winlogon.exe winlogon.exe 5.1.2600.5512 DEP

services.exe 728 Приложение служб и контроллеров Корпорация Майкрософт NT AUTHORITY\SYSTEM 0 C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\services.exe 5.1.2600.5512

svchost.exe 908 Generic Host Process for Win32 Services Microsoft Corporation NT AUTHORITY\SYSTEM 0 C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost -k DcomLaunch 5.1.2600.5512 DEP

svchost.exe 988 Generic Host Process for Win32 Services Microsoft Corporation NT AUTHORITY\NETWORK SERVICE 0 C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost -k rpcss 5.1.2600.5512 DEP

svchost.exe 1488 Generic Host Process for Win32 Services Microsoft Corporation NT AUTHORITY\SYSTEM 0 C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs 5.1.2600.5512 DEP