Re: Re: Помогите убрать спайдера с машины!

[Steve]

Все прошло как по маслу. ComboFix успешно запустился в безопасном режиме. С нетерпением жду дальнейших инструкций. Спасибо огромное за то, что Вы есть.

ComboFix 08-11-12.01 — Степан 2008-11-13 21:51:28.1 — NTFSx86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.2.1251.1.1049.18.1814 [GMT 3:00]
Running from: d:soft-waresoft-инвентарьлекариComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-10-13 to 2008-11-13 )))))))))))))))))))))))))))))))
.

2008-11-13 21:32 . 2008-11-09 16:00

dr-h

---

c:documents and settingsАдминистраторSendTo
2008-11-13 21:32 . 2008-11-09 18:52 d—h

---

c:documents and settingsАдминистраторRecent
2008-11-13 21:32 . 2008-11-09 18:52 d—h

---

c:documents and settingsАдминистраторPrintHood
2008-11-13 21:32 . 2008-11-09 18:52 d—h

---

c:documents and settingsАдминистраторNetHood
2008-11-13 21:32 . 2008-11-13 21:38 d—h

---

c:documents and settingsАдминистраторLocal Settings
2008-11-13 21:32 . 2008-11-13 21:34 d—s—- c:documents and settingsАдминистраторCookies
2008-11-13 21:32 . 2008-11-09 18:52 dr-h

---

c:documents and settingsАдминистраторApplication Data
2008-11-13 21:32 . 2008-11-09 15:57 d—h

---

c:documents and settingsАдминистраторШаблоны
2008-11-13 21:32 . 2008-11-09 18:52 d

---

c:documents and settingsАдминистраторРабочий стол
2008-11-13 21:32 . 2008-11-09 18:52 d

---

c:documents and settingsАдминистраторМои документы
2008-11-13 21:32 . 2008-11-09 18:52 dr

---

c:documents and settingsАдминистраторГлавное меню
2008-11-13 21:32 . 2008-11-13 21:33 d

---

c:documents and settingsАдминистраторИзбранное
2008-11-13 21:32 . 2008-11-13 21:32 d

---

c:documents and settingsАдминистратор
2008-11-13 21:32 . 2008-11-13 21:37 524,288 —ah

---

c:documents and settingsАдминистраторNTUSER.DAT
2008-11-13 21:11 . 2008-11-13 21:11 d

---

c:documents and settingsСтепанApplication DataSamsung
2008-11-13 20:52 . 2006-05-03 22:53 174,592 —a

---

c:windowssystem32framedyn.dll
2008-11-13 20:51 . 2008-11-13 21:10 5,632 —a

---

c:windowssystem32driversStarOpen.sys
2008-11-13 20:47 . 2008-11-13 20:47 d

---

c:windowssystem32Samsung_USB_Drivers
2008-11-13 20:47 . 2007-05-02 11:11 109,704 —a

---

c:windowssystem32driversss_mdm.sys
2008-11-13 20:47 . 2007-05-02 11:11 83,592 —a

---

c:windowssystem32driversss_bus.sys
2008-11-13 20:47 . 2007-05-02 11:11 15,112 —a

---

c:windowssystem32driversss_mdfl.sys
2008-11-13 20:47 . 2007-05-02 11:11 12,424 —a

---

c:windowssystem32driversss_whnt.sys
2008-11-13 20:47 . 2007-05-02 11:11 12,424 —a

---

c:windowssystem32driversss_wh.sys
2008-11-13 20:47 . 2007-05-02 11:11 12,424 —a

---

c:windowssystem32driversss_cmnt.sys
2008-11-13 20:47 . 2007-05-02 11:11 12,424 —a

---

c:windowssystem32driversss_cm.sys
2008-11-13 20:46 . 2008-11-13 20:46 d

---

c:program filesSamsung
2008-11-13 20:46 . 2005-08-28 20:51 766 —a

---

c:windowssystem32Uninstall.ico
2008-11-13 20:45 . 2008-11-13 20:45 d

---

c:program filesCommon FilesAdobe
2008-11-13 18:06 . 2008-11-13 18:06 d—h

---

c:windowsPIF
2008-11-13 17:08 . 2008-11-13 17:08 d

---

c:windowssystem32NtmsData
2008-11-13 01:33 . 2008-11-13 01:33 230 —a

---

c:windowssystem32spupdsvc.inf
2008-11-13 01:30 . 2008-11-13 01:30 d

---

c:documents and settingsСтепанDoctorWeb
2008-11-13 01:30 . 2008-11-13 01:30 d

---

c:documents and settingsСтепанDoctorWeb
2008-11-13 00:40 . 2008-11-13 00:40 d

---

c:documents and settingsСтепанApplication DataMacromedia
2008-11-13 00:34 . 2008-11-13 00:34 d

---

c:documents and settingsСтепанApplication DataAdobe
2008-11-13 00:14 . 2008-10-24 14:10 453,632

---

c— c:windowssystem32dllcachemrxsmb.sys
2008-11-13 00:06 . 2008-11-13 01:35 d

---

c:windowssystem32ru-ru
2008-11-13 00:06 . 2008-11-13 00:07 d—h

---

c:windowsmsdownld.tmp
2008-11-13 00:06 . 2008-11-13 02:08 d

---

c:program filesCommon FilesYandex
2008-11-13 00:06 . 2008-11-13 00:06 d

---

c:documents and settingsСтепанApplication DataYandex
2008-11-12 23:56 . 2008-10-03 20:26 6,066,176

---

c— c:windowssystem32dllcacheieframe.dll
2008-11-12 23:56 . 2007-04-17 12:32 2,455,488

---

c— c:windowssystem32dllcacheieapfltr.dat
2008-11-12 23:56 . 2007-03-08 08:12 1,060,864

---

c— c:windowssystem32dllcacheieframe.dll.mui
2008-11-12 23:56 . 2008-08-26 11:26 459,264

---

c— c:windowssystem32dllcachemsfeeds.dll
2008-11-12 23:56 . 2008-08-26 11:26 383,488

---

c— c:windowssystem32dllcacheieapfltr.dll
2008-11-12 23:56 . 2008-08-26 11:26 267,776

---

c— c:windowssystem32dllcacheiertutil.dll
2008-11-12 23:56 . 2008-08-26 11:26 63,488

---

c— c:windowssystem32dllcacheicardie.dll
2008-11-12 23:56 . 2008-08-26 11:26 52,224

---

c— c:windowssystem32dllcachemsfeedsbs.dll
2008-11-12 23:56 . 2008-08-25 11:38 13,824

---

c— c:windowssystem32dllcacheieudinit.exe
2008-11-12 23:37 . 2008-11-12 23:48 d

---

c:program filesInternet Explorer 7
2008-11-12 20:48 . 2008-11-12 20:48 13,881 —a

---

c:windowsAscd_tmp.ini
2008-11-12 20:39 . 2008-11-12 20:39 d

---

c:documents and settingsСтепанApplication DataPROject MT
2008-11-12 20:28 . 2008-11-12 20:28 d

---

c:windowsspeech
2008-11-12 20:27 . 2008-11-12 20:28 d

---

c:windowsLhsp
2008-11-12 20:27 . 2008-11-12 20:27 d

---

c:program filesCommon FilesPROject MT
2008-11-12 20:27 . 2008-11-12 20:27 d

---

c:documents and settingsAll UsersApplication DataPROject MT
2008-11-12 10:01 . 2008-11-12 10:01 d

---

c:documents and settingsLocalServiceГлавное меню
2008-11-12 01:21 . 2008-11-12 01:21 dr

---

c:windowsAsDmiHtm
2008-11-12 00:55 . 2008-11-13 21:45 d-a

---

c:documents and settingsAll UsersApplication DataTEMP
2008-11-12 00:55 . 2008-11-12 00:55 d

---

c:documents and settingsAll UsersApplication DataPC Tools
2008-11-12 00:55 . 2008-10-24 15:07 51,488 —a

---

c:windowssystem32driversTfFsMon.sys
2008-11-12 00:55 . 2008-10-24 15:07 39,200 —a

---

c:windowssystem32driversTfSysMon.sys
2008-11-12 00:55 . 2008-10-24 15:07 33,056 —a

---

c:windowssystem32driversTfNetMon.sys
2008-11-12 00:55 . 2008-10-24 15:07 12,576 —a

---

c:windowssystem32driversTfKbMon.sys
2008-11-12 00:24 . 2008-11-12 00:24 d

---

C:!KillBox
2008-11-12 00:19 . 2008-06-14 20:59 272,512

---

c:windowssystem32driversbthport.sys
2008-11-12 00:19 . 2008-06-14 20:59 272,512

---

c— c:windowssystem32dllcachebthport.sys
2008-11-12 00:17 . 2008-08-14 16:47 2,182,144

---

c— c:windowssystem32dllcachentoskrnl.exe
2008-11-12 00:17 . 2008-08-14 16:47 2,138,112

---

c— c:windowssystem32dllcachentkrnlmp.exe
2008-11-12 00:17 . 2008-08-14 16:47 2,059,520

---

c— c:windowssystem32dllcachentkrnlpa.exe
2008-11-12 00:17 . 2008-08-14 16:47 2,017,792

---

c— c:windowssystem32dllcachentkrpamp.exe
2008-11-12 00:12 . 2008-11-12 00:25 209 —a

---

c:windowsWINCMD.INI
2008-11-11 21:47 . 2008-11-13 17:06 d—h

---

c:windows$hf_mig$
2008-11-11 21:35 . 2008-11-11 21:35 d

---

c:program filesSiber Systems
2008-11-11 20:51 . 2008-11-11 20:51 d

---

c:program filesASUS
2008-11-11 20:50 . 2008-11-11 20:53 d

---

c:windowsNV31763180.TMP
2008-11-11 20:50 . 2007-06-28 19:43 17,254 —a

---

c:windowssystem32nvwsapps.nvb
2008-11-11 20:47 . 2008-11-11 20:47 d

---

c:windowssystem32CatRoot_bak
2008-11-11 20:25 . 2008-11-11 20:25 13,646 —a

---

c:windowssystem32wpa.bak
2008-11-11 20:14 . 2008-11-11 20:14 d

---

c:program filesAnalog Devices
2008-11-11 20:13 . 2002-04-17 14:05 45,056

---

c:windowssystem32CleanUp.exe
2008-11-11 20:13 . 2006-09-06 17:43 22,752 —a

---

c:windowssystem32spupdsvc.exe
2008-11-11 20:09 . 2008-11-11 20:09 d—-c— c:windowssystem32DRVSTORE
2008-11-11 20:09 . 2008-11-11 20:09 d

---

c:program filesDIFX
2008-11-11 20:09 . 2006-06-18 23:38 43,520 —a

---

c:windowssystem32driversAmdK8.sys
2008-11-11 20:04 . 2008-11-11 20:04 d

---

c:windowsASUSInstAll
2008-11-11 20:02 . 2008-11-11 20:02 d

---

c:program filesNVIDIA Corporation
2008-11-11 20:02 . 2008-11-11 20:02 1,024 —a

---

C:.rnd
2008-11-11 20:02 . 2008-11-11 20:02 22 —a

---

c:windowsFileName
2008-11-11 20:00 . 2008-11-11 20:15 14,129 —a

---

c:windowsAscd_log.ini
2008-11-11 19:50 . 2007-07-12 10:03 12,288 —a

---

c:windowssystem32driversEIO.sys
2008-11-11 19:49 . 2008-11-11 19:49 d

---

c:program filesMy Company Name
2008-11-11 19:48 . 2008-11-13 20:51 d—h

---

c:program filesInstallShield Installation Information
2008-11-11 19:48 . 2004-08-17 16:05 130,048 —a

---

c:windowssystem32ksproxy.ax
2008-11-11 19:47 . 2008-11-11 20:53 d

---

c:windowsnview
2008-11-11 19:47 . 2007-06-28 19:43 356,352 —a

---

c:windowssystem32nvudisp.exe
2008-11-11 19:47 . 2008-11-11 20:54 127,254 —a

---

c:windowssystem32nvapps.xml
2008-11-11 19:47 . 2007-06-28 19:43 17,463 —a

---

c:windowssystem32nvdisp.nvu
2008-11-11 19:47 . 2007-06-28 19:43 17,254 —a

---

c:windowssystem32nvwsapps.xml
2008-11-11 19:46 . 2007-06-29 01:54 356,352 —a

---

c:windowssystem32NVUNINST.EXE
2008-11-11 19:45 . 2008-11-11 19:46 d

---

c:program filesCommon FilesInstallShield
2008-11-09 20:31 . 2004-08-12 11:00 5,810 -ra

---

c:windowssystem32driversASACPI.sys
2008-11-09 20:30 . 2006-10-11 06:33 10,288 —a

---

c:windowssystem32driversASUSHWIO.SYS
2008-11-09 16:05 . 2008-11-09 16:05 dr-h

---

c:documents and settingsСтепанSendTo
2008-11-09 16:05 . 2008-11-09 16:05 dr-h

---

c:documents and settingsСтепанSendTo
2008-11-09 16:05 . 2008-11-13 21:19 dr-h

---

c:documents and settingsСтепанRecent
2008-11-09 16:05 . 2008-11-13 21:19 dr-h

---

c:documents and settingsСтепанRecent
2008-11-09 16:05 . 2008-11-09 18:52 d—h

---

c:documents and settingsСтепанPrintHood
2008-11-09 16:05 . 2008-11-09 18:52 d—h

---

c:documents and settingsСтепанPrintHood
2008-11-09 16:05 . 2008-11-09 18:52 d—h

---

c:documents and settingsСтепанNetHood
2008-11-09 16:05 . 2008-11-09 18:52 d—h

---

c:documents and settingsСтепанNetHood
2008-11-09 16:05 . 2008-11-13 21:52 d—h

---

c:documents and settingsСтепанLocal Settings
2008-11-09 16:05 . 2008-11-13 21:52 d—h

---

c:documents and settingsСтепанLocal Settings
2008-11-09 16:05 . 2008-11-13 21:50 d—s—- c:documents and settingsСтепанCookies
2008-11-09 16:05 . 2008-11-13 21:50 d—s—- c:documents and settingsСтепанCookies
2008-11-09 16:05 . 2008-11-11 20:25 d—s—- c:documents and settingsСтепанApplication DataMicrosoft
2008-11-09 16:05 . 2008-11-09 16:05 d

---

c:documents and settingsСтепанApplication DataIdentities
2008-11-09 16:05 . 2008-11-13 00:40 dr-h

---

c:documents and settingsСтепанApplication Data
2008-11-09 16:05 . 2008-11-13 00:40 dr-h

---

c:documents and settingsСтепанApplication Data
2008-11-09 16:05 . 2008-11-09 15:57 d—h

---

c:documents and settingsСтепанШаблоны
2008-11-09 16:05 . 2008-11-09 15:57 d—h

---

c:documents and settingsСтепанШаблоны
2008-11-09 16:05 . 2008-11-13 21:13 d

---

c:documents and settingsСтепанРабочий стол
2008-11-09 16:05 . 2008-11-13 21:13 d

---

c:documents and settingsСтепанРабочий стол
2008-11-09 16:05 . 2008-11-13 21:13 dr

---

c:documents and settingsСтепанМои документы
2008-11-09 16:05 . 2008-11-13 21:13 dr

---

c:documents and settingsСтепанМои документы

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-09 13:01

---

d

---

w c:program filesmicrosoft frontpage
2008-10-24 11:10 453,632 —-a-w c:windowssystem32driversmrxsmb.sys
2008-09-15 15:40 1,846,144 —-a-w c:windowssystem32win32k.sys
2008-09-04 16:45 1,106,944 —-a-w c:windowssystem32msxml3.dll
2008-08-20 05:37 659,968 —-a-w c:windowssystem32wininet.dll
2008-08-14 13:47 2,138,112 —-a-w c:windowssystem32ntoskrnl.exe
2008-08-14 13:47 2,017,792 —-a-w c:windowssystem32ntkrnlpa.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2004-08-18 15360]
«EDLauncher»=»d:soft-wareТренажерыСловариRedistPRMTEDEDLauncher.exe» [2004-07-09 73728]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2007-06-28 8466432]
«SoundMAXPnP»=»c:program filesAnalog DevicesCoresmax4pnp.exe» [2006-12-18 868352]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2007-06-28 81920]
«ASUSGamerOSD»=»c:program filesASUSGamerOSDGamerOSD.exe» [2007-07-12 380928]
«ThreatFire»=»d:soft-waresoft-инвентарьлекариThreat-fileThreatFireTFTray.exe» [2008-10-24 263456]
«nwiz»=»nwiz.exe» [2007-06-28 c:windowssystem32nwiz.exe]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2004-08-18 15360]

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=

R0 TfFsMon;TfFsMon;c:windowssystem32driversTfFsMon.sys [2008-10-24 51488]
R0 TfSysMon;TfSysMon;c:windowssystem32driversTfSysMon.sys [2008-10-24 39200]
S2 ThreatFire;ThreatFire;d:soft-waresoft-инвентарьлекариThreat-fileThreatFireTFService.exe service [ ]
S3 asusgsb;ASUS Virtual Video Capture Device Driver;c:windowssystem32driversasusgsb.sys [2007-07-12 12416]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);c:windowssystem32DRIVERSss_bus.sys [2007-05-02 83592]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;c:windowssystem32DRIVERSss_mdfl.sys [2007-05-02 15112]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;c:windowssystem32DRIVERSss_mdm.sys [2007-05-02 109704]
S3 TfNetMon;TfNetMon;c:windowssystem32driversTfNetMon.sys [2008-10-24 33056]
S3 Video3D;ASUS Video3D Service;c:windowssystem32DriversVideo3D32.sys [2007-07-12 10752]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2G]
ShellAutoRuncommand — G:Install.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{f1ca546b-aded-11dd-871a-806d6172696f}]
ShellAutoRuncommand — G:Install.exe
.
.

---

Supplementary Scan

---

.
R0 -: HKCU-Main,Start Page = hxxp://www.yandex.ru/?clid=40316
O9 -: {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} — d:soft-wareТренажерыСловариRedistPRMTIEprmtie5.htm
O9 -: {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} — d:soft-wareТренажерыСловариRedistPRMTIEoptions.htm
O9 -: {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} — d:soft-wareТренажерыСловариRedistPRMTIEprmtie5.htm —
O9 -: {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} — d:soft-wareТренажерыСловариRedistPRMTIEoptions.htm —
O17 -: HKLMCCSInterface{F7CE899F-F444-4088-8621-2D3974EFAFDE}: NameServer = 192.168.1.1
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-13 21:52:10
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-11-13 21:52:39
ComboFix-quarantined-files.txt 2008-11-13 18:52:31
ComboFix2.txt 2008-11-13 18:48:22
ComboFix3.txt 2008-11-13 18:38:20
ComboFix4.txt 2008-11-13 00:04:28
ComboFix5.txt 2008-11-13 18:51:18

Pre-Run: 5 355 286 528 байт свободно
Post-Run: 5,346,611,200 байт свободно

207 — E O F — 2008-11-13 00:08:07