Лог сделал.Только со второй попытки,после первой что то не получился лог.ComboFix 09-03-01.01 — Игорь 2009-03-02 17:30:21.3 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.1.1049.18.1023.638 [GMT 7:00]
Running from: d:мои документы.игорьMy DownloadsComboFix.exe
Command switches used :: c:documents and settingsИгорьРабочий столCFScript.txt
AV: Doctor Web Anti-Virus *On-access scanning enabled* (Updated)
FW: Outpost Firewall Pro *enabled*
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
c:windowssystem32driversport135sik.sys
.
((((((((((((((((((((((((( Files Created from 2009-02-02 to 2009-03-02 )))))))))))))))))))))))))))))))
.
2009-03-01 17:29 . 2009-03-01 17:29 61 —a
c:documents and settingsИгорьtemp.bat
2009-03-01 17:29 . 2009-03-01 17:29 61 —a
c:documents and settingsИгорьtemp.bat
2009-02-21 22:21 . 2006-12-07 15:01 20,480 —a
c:windowssystem32DreamSaver.scr
2009-02-20 13:05 . 2008-07-11 15:41 673,920 —a
c:windowssystem32driversSandBox.sys
2009-02-20 13:05 . 2008-06-30 17:16 234,640 —a
c:windowssystem32driversafwcore.sys
2009-02-20 13:05 . 2008-06-30 17:16 30,864 —a
c:windowssystem32driversafw.sys
2009-02-20 13:05 . 2007-10-25 19:17 49 —a
c:windowstransp.gif
2009-02-20 13:04 . 2009-02-28 09:50
c:windowssystem32Filt
2009-02-20 13:04 . 2009-02-20 13:04
c:program filesAgnitum
2009-02-20 13:04 . 2009-02-20 13:04
c:documents and settingsAll UsersApplication DataAgnitum
2009-02-18 15:39 . 2009-02-18 15:39
c:documents and settingsИгорьWINDOWS
2009-02-18 15:39 . 2009-02-18 15:39
c:documents and settingsИгорьWINDOWS
2009-02-17 11:20 . 2009-02-17 11:20
c:documents and settingsAll UsersApplication DataHagel Technologies
2009-02-16 14:12 . 2009-02-18 15:59 886,900,768 —ahs—- c:windowssystem32driversfidbox.dat
2009-02-16 14:12 . 2009-02-18 15:59 10,382,276 —ahs—- c:windowssystem32driversfidbox.idx
2009-02-13 17:44 . 2009-02-13 17:44
c:documents and settingsИгорьApplication DataThinstall
2009-02-13 17:13 . 2009-02-13 17:17 1,031 —a
c:windowsARPR.INI
2009-02-08 13:07 . 2009-02-23 10:40
c:documents and settingsинна.xmoto
2009-02-08 13:07 . 2009-02-23 10:40
c:documents and settingsинна.xmoto
2009-02-08 10:35 . 2009-02-08 10:35
c:documents and settingsAll UsersApplication DataAlawarWrapper
2009-02-07 20:17 . 2009-03-01 12:02
c:documents and settingsИгорь.xmoto
2009-02-07 20:17 . 2009-03-01 12:02
c:documents and settingsИгорь.xmoto
2009-02-07 20:08 . 2009-02-07 20:08
c:windowsPIF
2009-02-06 17:25 . 2008-01-09 03:00 799,424 -ra
c:windowssystem32tmp2D2.tmp
2009-02-06 17:25 . 2008-01-09 03:00 799,424 -ra
c:windowssystem32tmp2D1.tmp
2009-02-06 17:22 . 2009-02-06 17:29
c:documents and settingsИгорьApplication DataDesktopicon
2009-02-02 22:10 . 2009-02-02 22:24
c:documents and settingsИгорьApplication DataICQ
2009-02-02 22:09 . 2009-02-02 22:24
c:program filesICQ6.5
2009-02-02 19:38 . 2009-02-02 19:38
c:program filesConduit
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-02 10:28
d
w c:documents and settingsИгорьApplication DataReGet Software
2009-03-02 10:17
d
w c:program filesDrWeb
2009-02-14 14:00
d—h—w c:program filesInstallShield Installation Information
2009-02-13 17:27
d
w c:program filesOpera
2009-02-06 10:26 418,480 —-a-w c:windowssystem32wrap_oal.dll
2009-02-06 10:26 115,432 —-a-w c:windowssystem32OpenAL32.dll
2009-02-03 04:41
d
w c:documents and settingsadminApplication DataATI
2009-01-28 18:09
d
w c:documents and settingsИгорьApplication DataROALDevelopment
2009-01-27 17:28
d
w c:documents and settingsИгорьApplication DataMedia Player Classic
2008-12-02 03:36 107,888 —-a-w c:windowssystem32CmdLineExt.dll
2008-11-30 09:01 22,328 —-a-w c:documents and settingsИгорьApplication DataPnkBstrK.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«ctfmon.exe»=»c:windowssystem32ctfmon.exe» [2008-04-15 15360]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«SpIDerNT»=»c:progra~1DrWebspiderui.exe» [2008-10-23 197896]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2001-07-09 155648]
«RemoteControl»=»c:program filesCyberLinkPowerDVDPDVDServ.exe» [2004-11-02 32768]
«ATICCC»=»c:program filesATI TechnologiesATI.ACECLIStart.exe» [2006-09-25 90112]
«OutpostMonitor»=»c:progra~1AgnitumOUTPOS~1op_mon.exe» [2008-07-15 1153352]
«OutpostFeedBack»=»c:program filesAgnitumOutpost Firewall Profeedback.exe» [2008-07-15 435528]
[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-15 15360]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]
«msacm.l3fhg»= mp3fhg.acm
«msacm.divxa32″= divxa32.acm
«VIDC.X264″= x264vfw.dll
«VIDC.HFYU»= huffyuv.dll
«vidc.i263″= i263_32.drv
«VIDC.MJPG»= mtkjpeg.dll
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\Ubisoft\Far Cry 2\bin\FarCry2.exe»=
«c:\Program Files\Ubisoft\Far Cry 2\bin\FC2Launcher.exe»=
«c:\Program Files\Ubisoft\Far Cry 2\bin\FC2Editor.exe»=
«c:\Program Files\ICQ6.5\ICQ.exe»=
«c:\WINDOWS\system32\userinit.exe»=
P2 SPIDERNT;SpIDer Guard for Windows;c:progra~1DrWebspidernt.exe [2008-09-16 197896]
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:windowssystem32driverssfsync03.sys [2005-08-16 33792]
R1 SandBox;SandBox;c:windowssystem32driversSandBox.sys [2009-02-20 673920]
R2 acssrv;Agnitum Client Security Service;c:progra~1AgnitumOUTPOS~1acs.exe [2009-02-20 1238344]
R2 SPIDER;SpIDer Guard File System Monitor;c:progra~1DrWebspider.sys [2008-09-16 268040]
R3 afw;Agnitum firewall driver;c:windowssystem32driversafw.sys [2009-02-20 30864]
R3 afwcore;afwcore;c:windowssystem32driversafwcore.sys [2009-02-20 234640]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Adapter;c:windowssystem32driversatl01_xp.sys [2008-09-16 35712]
S3 ASWFilt;ASWFilt;c:windowssystem32FiltASWFilt.dll [2009-02-20 33408]
.
— — — — ORPHANS REMOVED — — — —
HKCU-Run-Browser — c:documents and settingsИгорьa.exe
.
Supplementary Scan
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT1392749
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
TCP: {3E6E3103-A654-44B8-B626-F091545FB5D2} = 195.112.224.126,195.112.224.75
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-02 17:32:00
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(1036)
c:windowssystem32Ati2evxx.dll
.
Completion time: 2009-03-02 17:33:06
ComboFix-quarantined-files.txt 2009-03-02 10:33:03
Pre-Run: 11 945 304 064 байт свободно
Post-Run: 11,930,529,792 байт свободно
128
