Re: Re: помогите НОВЫЙ ВИРУС.

[fredperry]

здравствуйте.

вот лог.

ComboFix 08-11-24.01 — пппп 2008-11-25 10:58:47.1 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.1.1049.18.254 [GMT 3:00]
Running from: c:интернетComboFix.exe
* Created a new restore point
* Resident AV is active

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

D:install.exe
d:windowssystem32FOLESVR.DLL
d:windowssystem32msvcsv60.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

---

Legacy_NPF

---

Legacy_ODBCASVC

---

Service_odbcasvc

((((((((((((((((((((((((( Files Created from 2008-10-25 to 2008-11-25 )))))))))))))))))))))))))))))))
.

2008-11-24 15:48 . 2008-11-25 10:54

dr-h

---

d:documents and settingsппппRecent
2008-11-24 15:48 . 2008-11-25 10:54 dr-h

---

d:documents and settingsппппRecent
2008-11-21 13:16 . 2008-11-21 13:16 d

---

d:documents and settingsAll Users.WINDOWSApplication DataSony
2008-11-21 13:07 . 2006-06-29 13:07 14,048

---

d:windowssystem32spmsg2.dll
2008-11-21 13:04 . 2008-11-21 13:04 d

---

d:documents and settingsппппApplication DataSony Setup
2008-11-20 22:59 . 2008-11-20 22:59 d

---

d:windowsSun
2008-11-20 22:59 . 2008-11-20 23:43 d

---

d:documents and settingsпппп.housecall6.6
2008-11-20 22:59 . 2008-11-20 23:43 d

---

d:documents and settingsпппп.housecall6.6
2008-11-20 22:55 . 2008-11-20 22:55 d

---

d:documents and settingsппппApplication DataMalwarebytes
2008-11-20 22:55 . 2008-11-20 22:55 d

---

d:documents and settingsAll Users.WINDOWSApplication DataMalwarebytes
2008-11-20 22:38 . 2008-11-20 22:38 410,976 —a

---

d:windowssystem32deploytk.dll
2008-11-20 22:38 . 2008-11-20 22:38 73,728 —a

---

d:windowssystem32javacpl.cpl
2008-11-20 22:37 . 2008-11-20 22:37 d

---

d:documents and settingsппппApplication DataSun
2008-11-19 04:30 . 2007-09-05 23:22 289,144 —a

---

d:windowssystem32VCCLSID.exe
2008-11-19 04:30 . 2006-04-27 16:49 288,417 —a

---

d:windowssystem32SrchSTS.exe
2008-11-19 04:30 . 2008-10-01 14:51 87,552 —a

---

d:windowssystem32VACFix.exe
2008-11-19 04:30 . 2008-10-10 07:58 82,944 —a

---

d:windowssystem32o4Patch.exe
2008-11-19 04:30 . 2008-05-18 20:40 82,944 —a

---

d:windowssystem32IEDFix.exe
2008-11-19 04:30 . 2008-10-10 07:58 82,944 —a

---

d:windowssystem32IEDFix.C.exe
2008-11-19 04:30 . 2008-08-18 11:19 82,432 —a

---

d:windowssystem32404Fix.exe
2008-11-19 04:30 . 2004-07-31 17:50 51,200 —a

---

d:windowssystem32dumphive.exe
2008-11-19 04:30 . 2007-10-03 23:36 25,600 —a

---

d:windowssystem32WS2Fix.exe
2008-11-19 04:26 . 2008-11-19 04:30 3,222 —a

---

d:windowssystem32tmp.reg
2008-11-19 03:58 . 2008-11-19 03:58 1,393 —a

---

d:windowsimsins.BAK
2008-11-18 06:28 . 2008-11-18 06:28 d

---

d:documents and settingsппппApplication DataMacromedia
2008-11-18 06:04 . 2008-11-18 06:04 11 —a

---

d:windows3DShadow.INI
2008-11-18 03:10 . 2008-11-18 03:10 d

---

d:program filesCommon FilesWise Installation Wizard
2008-11-18 00:49 . 2008-11-18 00:49 d

---

d:windowssystem32bits
2008-11-18 00:36 . 2008-11-18 00:36 0 —a—-t- d:windows005435_.tmp
2008-11-17 13:46 . 2008-11-17 13:46 77,824 —a—-t- d:windowssystem32DRWEBSP.DLL
2008-11-17 07:01 . 2008-11-17 07:01 d

---

d:documents and settingsппппApplication Datavlc
2008-11-17 01:10 . 2008-11-17 01:10 552 —a

---

d:windowssystem32d3d8caps.dat
2008-11-15 19:22 . 2008-10-03 20:26 6,066,176

---

c— d:windowssystem32dllcacheieframe.dll
2008-11-15 19:22 . 2007-04-17 12:32 2,455,488

---

c— d:windowssystem32dllcacheieapfltr.dat
2008-11-15 19:22 . 2007-03-08 08:12 1,060,864

---

c— d:windowssystem32dllcacheieframe.dll.mui
2008-11-15 19:22 . 2008-08-26 11:26 459,264

---

c— d:windowssystem32dllcachemsfeeds.dll
2008-11-15 19:22 . 2008-08-26 11:26 383,488

---

c— d:windowssystem32dllcacheieapfltr.dll
2008-11-15 19:22 . 2008-08-26 11:26 267,776

---

c— d:windowssystem32dllcacheiertutil.dll
2008-11-15 19:22 . 2008-08-26 11:26 63,488

---

c— d:windowssystem32dllcacheicardie.dll
2008-11-15 19:22 . 2008-08-26 11:26 52,224

---

c— d:windowssystem32dllcachemsfeedsbs.dll
2008-11-15 19:22 . 2008-08-25 11:38 13,824

---

c— d:windowssystem32dllcacheieudinit.exe
2008-11-15 19:18 . 2008-04-14 19:10 276,992

---

d:windowssystem32wmphoto.dll
2008-11-15 19:18 . 2008-04-14 19:10 69,120

---

d:windowssystem32wlanapi.dll
2008-11-15 19:16 . 2004-08-03 22:41 1,041,536

---

d:windowssystem32drivershsfdpsp2.sys
2008-11-15 07:50 . 2008-11-15 07:50 d

---

d:program filesuTorrent
2008-11-15 07:50 . 2008-11-19 13:37 d-a

---

d:documents and settingsAll Users.WINDOWSApplication DataTEMP
2008-11-15 00:42 . 2008-11-21 08:53 d

---

d:documents and settingsппппApplication DataLavasoft
2008-11-15 00:19 . 2008-10-24 14:21 455,296

---

c— d:windowssystem32dllcachemrxsmb.sys
2008-11-15 00:13 . 2008-11-15 07:51 d—hs—- d:documents and settingsппппUserData
2008-11-15 00:13 . 2008-11-15 07:51 d—hs—- d:documents and settingsппппUserData
2008-11-14 21:09 . 2008-11-14 21:12 d

---

d:program filesEsetOnlineScanner
2008-11-11 02:19 . 2008-11-24 15:36 d

---

d:documents and settingsппппApplication DatauTorrent
2008-11-10 18:53 . 2008-11-10 18:53 d

---

d:program filesSourceTec
2008-11-10 18:53 . 2007-09-27 08:00 44,544 —a

---

d:windowssystem32msxml4a.dll
2008-11-10 11:41 . 2008-11-15 07:50 d

---

d:program filesStereo Pictures 1.0
2008-11-10 03:41 . 2008-11-25 11:02 16,986,112 —a

---

d:documents and settingsппппntuser.dat
2008-11-10 03:41 . 2008-11-25 11:02 16,986,112 —a

---

d:documents and settingsппппntuser.dat
2008-11-02 06:19 . 2008-11-02 06:19 d

---

d:documents and settingsппппApplication DataThinstall
2008-11-01 19:51 . 2008-11-15 12:54 54,156 —ah

---

d:windowsQTFont.qfn
2008-11-01 19:51 . 2008-11-01 19:51 1,409 —a

---

d:windowsQTFont.for
2008-11-01 09:30 . 2008-06-30 17:16 234,640 —a

---

d:windowssystem32driversafwcore.sys
2008-11-01 09:29 . 2008-07-11 15:41 673,920 —a

---

d:windowssystem32driversSandBox.sys
2008-11-01 09:29 . 2008-06-30 17:16 30,864 —a

---

d:windowssystem32driversafw.sys
2008-11-01 09:29 . 2007-10-25 19:17 49 —a

---

d:windowstransp.gif
2008-11-01 09:28 . 2008-11-17 13:06 d

---

d:windowssystem32Filt
2008-11-01 09:28 . 2008-11-01 09:28 d

---

d:program filesAgnitum
2008-11-01 09:28 . 2008-11-01 09:28 d

---

d:documents and settingsAll Users.WINDOWSApplication DataAgnitum
2008-11-01 03:40 . 2008-11-01 03:40 d

---

d:program filesVideoLAN
2008-10-31 22:25 . 2008-10-31 22:25 d

---

d:windowsl2schemas
2008-10-31 22:21 . 2008-10-31 22:25 d

---

d:windowsServicePackFiles
2008-10-31 20:40 . 2008-11-16 01:01 d

---

d:windowssystem32ru-ru
2008-10-31 18:38 . 2008-10-31 18:54 d

---

d:documents and settingsппппApplication DataSendSpace Wizard
2008-10-30 20:59 . 2008-11-01 03:40 d

---

d:documents and settingsппппApplication Datavlc(2)
2008-10-30 12:21 . 2008-10-30 12:56 d

---

d:documents and settingsппппApplication DataYaChatData
2008-10-30 12:20 . 2008-10-30 12:20 d

---

d:program filesYandex
2008-10-30 12:20 . 2008-11-18 00:41 d

---

d:documents and settingsппппApplication DataYandex
2008-10-30 07:11 . 2008-10-30 07:11 d

---

d:program filesLokas
2008-10-30 07:11 . 2008-10-30 07:30 44,544

---

d:windowsAWuninstall.exe
2008-10-30 06:08 . 2008-10-30 06:09 d

---

d:program filesVertus Fluid Mask 3
2008-10-30 06:08 . 2008-10-30 06:08 d

---

d:documents and settingsAll Users.WINDOWSApplication DataVertusTech
2008-10-30 06:06 . 2008-10-30 06:06 d

---

d:program filesImage Doctor
2008-10-29 07:45 . 2008-10-29 07:45 d

---

d:program filesTeleport Pro
2008-10-29 07:15 . 2004-07-17 11:35 67,866

---

d:windowssystem32driversnetwlan5.img
2008-10-29 07:12 . 2004-07-17 11:36 64,352

---

d:windowssystem32driversativmc20.cod
2008-10-29 03:02 . 2008-10-29 03:02 d

---

d:program filesMSXML 4.0
2008-10-29 00:54 . 2008-09-08 13:41 333,824

---

c— d:windowssystem32dllcachesrv.sys
2008-10-29 00:54 . 2008-06-14 20:35 272,512 —a

---

d:windowssystem32driversbthport.sys
2008-10-29 00:54 . 2008-06-14 20:35 272,512

---

c— d:windowssystem32dllcachebthport.sys
2008-10-29 00:54 . 2008-08-14 13:04 138,496

---

c— d:windowssystem32dllcacheafd.sys
2008-10-29 00:53 . 2008-08-14 16:26 2,190,976

---

c— d:windowssystem32dllcachentoskrnl.exe
2008-10-29 00:53 . 2008-08-14 16:26 2,147,328

---

c— d:windowssystem32dllcachentkrnlmp.exe
2008-10-29 00:53 . 2008-08-14 16:26 2,067,840

---

c— d:windowssystem32dllcachentkrnlpa.exe
2008-10-29 00:53 . 2008-08-14 16:26 2,025,984

---

c— d:windowssystem32dllcachentkrpamp.exe
2008-10-29 00:53 . 2008-09-15 18:27 1,846,528

---

c— d:windowssystem32dllcachewin32k.sys
2008-10-29 00:52 . 2008-05-08 17:02 203,136

---

c— d:windowssystem32dllcachermcast.sys
2008-10-29 00:51 . 2008-04-11 22:06 691,712

---

c— d:windowssystem32dllcacheinetcomm.dll
2008-10-29 00:49 . 2008-10-15 19:37 337,408

---

c— d:windowssystem32dllcachenetapi32.dll
2008-10-28 19:56 . 2008-10-30 13:14 d

---

d:documents and settingsппппApplication DataMozilla
2008-10-28 19:56 . 2008-10-28 19:56 0 —a

---

d:windowsnsreg.dat
2008-10-28 19:44 . 2005-11-17 07:46 337,320 —a

---

d:windowssystem32difxapi.dll
2008-10-28 19:44 . 2007-05-16 11:20 43,008 —a

---

d:windowssystem32driversdlkfet5b.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-21 10:34

---

d

---

w d:documents and settingsппппApplication DataSony
2008-11-21 10:16

---

d

---

w d:program filesSony
2008-11-21 10:03

---

d

---

w d:program filesSony Setup
2008-11-20 19:38

---

d

---

w d:program filesJava
2008-11-20 18:38

---

d

---

w d:program filesEasy FLV Converter
2008-11-20 08:59

---

d

---

w d:program filesKoolMoves
2008-11-17 14:44

---

d—h—w d:program filesInstallShield Installation Information
2008-11-17 00:50

---

d

---

w d:program filesVstPlugins
2008-11-17 00:49

---

d

---

w d:documents and settingsAll Users.WINDOWSApplication DataACD Systems
2008-11-17 00:48

---

d

---

w d:program filesCommon FilesACD Systems
2008-11-16 23:42

---

d

---

w d:documents and settingsAll Users.WINDOWSApplication DataRight Hemisphere
2008-11-15 04:51

---

d

---

w d:program filesSilent Hill 2
2008-11-15 04:50

---

d

---

w d:program filesImage-Line
2008-11-15 04:50

---

d

---

w d:program filesCommon FilesSourceTec
2008-11-10 10:12

---

d

---

w d:program filesCounter-Strike 1.6
2008-11-05 22:27

---

d

---

w d:program filesCommon FilesMacromedia
2008-11-01 00:40

---

d

---

w d:documents and settingsAll Users.WINDOWSApplication DataSmartSound Software Inc
2008-10-30 16:56

---

d

---

w d:program filesCommon FilesUlead Systems
2008-10-30 16:56

---

d

---

w d:documents and settingsAll Users.WINDOWSApplication DataUlead Systems
2008-10-30 14:36

---

d

---

w d:program filesJetAudio
2008-10-30 07:02

---

d

---

w d:program filesCommon FilesAdobe
2008-10-28 22:20

---

d

---

w d:program filesVirtualNetwork
2008-10-28 19:16

---

d

---

w d:program filesEset
2008-10-28 19:16

---

d

---

w d:documents and settingsAll Users.WINDOWSApplication DataESET
2008-10-24 11:21 455,296 —-a-w d:windowssystem32driversmrxsmb.sys
2008-10-23 15:04

---

d

---

w d:program filesWaves
2008-10-21 01:04

---

d

---

w d:program filesRoger Nichols Digital, Inc
2008-10-18 14:45

---

d

---

w d:program filesWWAYM
2008-10-04 22:11

---

d

---

w d:program filesCommon FilesStardock
2008-05-17 14:55 281 —-a-w d:documents and settingsппппApplication DataDelAll.bat
2008-01-13 18:24 94,080 —-a-w d:documents and settingsппппApplication Dataezplay.sys
2008-01-13 18:24 81,920 —-a-w d:documents and settingsппппApplication Dataezpinst.exe
2008-01-13 18:24 47,360 —-a-w d:documents and settingsппппApplication Datapcouffin.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»d:windowssystem32ctfmon.exe» [2008-04-14 15360]
«EVEREST AutoStart»=»d:program filesLavalysEVEREST Ultimate Editioneverest.exe» [2006-02-21 46080]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«ATICCC»=»d:program filesATI TechnologiesATI.ACEcli.exe» [2005-08-12 45056]
«NeroFilterCheck»=»d:program filesCommon FilesAheadLibNeroCheck.exe» [2006-01-12 155648]
«ISUSPM Startup»=»d:program filesCommon FilesInstallShieldUpdateServiceisuspm.exe» [2005-08-11 249856]
«ISUSScheduler»=»d:program filesCommon FilesInstallShieldUpdateServiceissch.exe» [2005-08-11 81920]
«Transparent»=»d:program filesTweakNow Accelerator XPTransparent.exe» [2001-10-23 17408]
«WinampAgent»=»d:program filesWinampWinampa.exe» [2006-09-01 35328]
«egui»=»d:program filesESETESET NOD32 Antivirusegui.exe» [2008-07-01 1447168]
«SunJavaUpdateSched»=»d:program filesJavajre6binjusched.exe» [2008-11-20 136600]
«RTHDCPL»=»RTHDCPL.EXE» [2006-08-01 d:windowsRTHDCPL.EXE]
«SkyTel»=»SkyTel.EXE» [2006-05-16 d:windowsSkyTel.exe]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»d:windowssystem32CTFMON.EXE» [2008-04-14 15360]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«MaxRecentDocs»= 11 (0xb)
«NoViewOnDrive»= 0 (0x0)

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotifyMCPClient]
2003-08-25 11:25 139264 d:program filesCommon FilesStardockMCPStub.dll

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]
«vidc.3ivx»= 3ivxVfWCodec.dll
«vidc.3iv2″= 3ivxVfWCodec.dll
«msacm.divxa32″= divxa32.acm
«VIDC.HFYU»= huffyuv.dll
«VIDC.VP31″= vp31vfw.dll
«VIDC.ACDV»= ACDV.dll

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregA!K Mouse Off-road]
—a

---

2008-04-02 22:09 620032 d:program filesA!K Research LabsOff-roadOffRoad.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregBgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
—a

---

2006-08-22 09:52 94208 d:program filesCommon FilesAheadLibNMBgMonitor.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoring]
«DisableMonitoring»=dword:00000001

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringPandaAntiVirus]
«DisableMonitoring»=dword:00000001

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringPandaFirewall]
«DisableMonitoring»=dword:00000001

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringSymantecAntiVirus]
«DisableMonitoring»=dword:00000001

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringSymantecFirewall]
«DisableMonitoring»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«d:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe»=
«c:\ИГРЫ\Q3Ademo\quake3.exe»=
«d:\Program Files\InterVideo\DVD6\WinDVD.exe»=
«d:\Program Files\Counter-Strike 1.6\hl.exe»=
«d:\Program Files\uTorrent\uTorrent.exe»=
«d:\Program Files\Counter-Strike 1.6\hltv.exe»=
«d:\Program Files\VideoLAN\VLC\vlc.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«c:\Program Files\Unreal Tournament 2004\System\UT2004.exe»=

R1 epfwtdir;epfwtdir;d:windowssystem32DRIVERSepfwtdir.sys [2008-07-01 34312]
R1 SandBox;SandBox;d:windowssystem32DRIVERSSandBox.sys [2008-11-01 673920]
R2 litdpl;litdpl;d:windowssystem32DRIVERSlitdpl.sys [2008-02-12 4736]
R3 CLEDX;Team H2O CLEDX service;d:windowssystem32DRIVERScledx.sys [2008-05-09 33792]
R3 EverestDriver;Lavalys EVEREST Kernel Driver;??d:program filesLavalysEVEREST Ultimate Editionkerneld.wnt [2007-12-19 11776]
S2 PTsup5;PsViatau;d:program filesTrident SoftwarePragmaptsup5.exe [2007-03-16 77824]
S3 afwcore;afwcore;d:windowssystem32driversafwcore.sys [2008-11-01 234640]
S3 ASWFilt;ASWFilt;d:windowssystem32FiltASWFilt.dll [2008-11-01 33408]
S3 ATE_PROCMON;ATE_PROCMON;??d:program filesAnti Trojan EliteATEPMon.sys []
S3 EWAVE;EWAVE;??d:windowssystem32driversew.sys []
S3 FILESPY;FILESPY;??d:windowssystem32driversFILESPY.sys []
S3 NSTATION;NSTATION;??d:windowssystem32driversnstation.sys []
S3 SetupNTGLM7X;SetupNTGLM7X;??E:NTGLM7X.sys []

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2F]
ShellAutoRuncommand — f:menumenu.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2G]
ShellAutoRuncommand — G:autorun.exe

*Newly Created Service* — EVERESTDRIVER
.
— — — — ORPHANS REMOVED — — — —

Notify-avldr — avldr.dll

.

---

Supplementary Scan

---

.
FireFox -: Profile — d:documents and settingsппппApplication DataMozillaFirefoxProfileswydwmfza.default
FireFox -: prefs.js — STARTUP.HOMEPAGE — hxxp://www.yandex.ru/?clid=40795
FF -: plugin — d:program filesJavajre6binnew_pluginnpdeploytk.dll
FF -: plugin — d:program filesJavajre6binnew_pluginnpjp2.dll
FF -: plugin — d:program filesMozilla Firefoxpluginsnpdeploytk.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-25 11:04:21
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘winlogon.exe'(816)
d:windowssystem32Ati2evxx.dll
d:program filesCommon FilesStardockmcpstub.dll
.

---

Other Running Processes

---

.
d:windowssystem32ati2evxx.exe
d:program filesCommon FilesStardocksdmcp.exe
d:program filesSymantecLiveUpdateAluSchedulerSvc.exe
d:program filesEsetESET NOD32 Antivirusekrn.exe
d:program filesJavajre6binjqs.exe
d:program filesCommon FilesUlead SystemsDVDULCDRSvr.exe
d:windowssystem32wdfmgr.exe
d:windowssystem32ati2evxx.exe
d:windowssystem32wbemwmiapsrv.exe
d:program filesStardockObject DesktopIconXIconX.exe
d:program filesLavalysEVEREST Ultimate Editioneverest.bin
d:windowssystem32wpabaln.exe
.
**************************************************************************
.
Completion time: 2008-11-25 11:08:36 — machine was rebooted
ComboFix-quarantined-files.txt 2008-11-25 08:08:32

Pre-Run: 5 056 454 656 байт свободно
Post-Run: 4,960,989,184 байт свободно

283 — E O F — 2008-11-19 00:58:41

спасибо.