Действительно, прошу прощения за нетерпеливость 😳 Я думал Вы в отпуске
ComboFix 08-12-14.05 — Admin 2009-09-26 22:29:47.2 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1251.1.1049.18.1023.579 [GMT 4:00]
Running from: c:documents and settingsAdminРабочий столComboFix.exe
Command switches used :: c:documents and settingsAdminРабочий столCFScript.txt
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
— REDUCED FUNCTIONALITY MODE —
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:documents and settingsAdminApplication DataAdRiver
c:documents and settingsAdminApplication DataAdRiverAdRiver.dat
c:documents and settingsAdminApplication DataAdRiverAdRiver.dll
c:documents and settingsAdminApplication DataAdRiverFeed0.jpg
c:documents and settingsAdminApplication DataAdRiverFeed1.jpg
c:documents and settingsAdminApplication DataAdRiverFeed10.jpg
c:documents and settingsAdminApplication DataAdRiverFeed11.jpg
c:documents and settingsAdminApplication DataAdRiverFeed12.jpg
c:documents and settingsAdminApplication DataAdRiverFeed13.jpg
c:documents and settingsAdminApplication DataAdRiverFeed14.jpg
c:documents and settingsAdminApplication DataAdRiverFeed15.jpg
c:documents and settingsAdminApplication DataAdRiverFeed2.jpg
c:documents and settingsAdminApplication DataAdRiverFeed3.jpg
c:documents and settingsAdminApplication DataAdRiverFeed4.jpg
c:documents and settingsAdminApplication DataAdRiverFeed5.jpg
c:documents and settingsAdminApplication DataAdRiverFeed6.jpg
c:documents and settingsAdminApplication DataAdRiverFeed7.jpg
c:documents and settingsAdminApplication DataAdRiverFeed8.jpg
c:documents and settingsAdminApplication DataAdRiverFeed9.jpg
c:documents and settingsAdminApplication DataAdRiverFeedfeed.xml
c:documents and settingsAdminApplication DataAdRiverg.fla
c:documents and settingsAdminApplication DataAdRiverUninstall.exe
.
((((((((((((((((((((((((( Files Created from 2009-08-26 to 2009-09-26 )))))))))))))))))))))))))))))))
.
2009-09-23 23:07 . 2009-09-25 23:18 d
c:documents and settingsAdminApplication DataPhoneRemoteControl
2009-09-22 23:30 . 2009-09-22 23:30 d
C:rsit
2009-09-22 23:30 . 2009-09-23 06:34 d
c:program filestrend micro
2009-09-22 15:04 . 2004-08-17 16:04 159,232 —a
c:windowssystem32ptpusd.dll
2009-09-22 15:04 . 2004-08-03 22:58 15,104 —a
c:windowssystem32driversusbscan.sys
2009-09-22 15:04 . 2004-08-03 22:58 15,104 —a—c— c:windowssystem32dllcacheusbscan.sys
2009-09-22 15:04 . 2001-10-19 21:06 5,632 —a
c:windowssystem32ptpusb.dll
2009-09-22 01:31 . 2009-09-22 01:31 96 —a
c:windowswininit.ini
2009-09-20 22:45 . 2004-08-17 15:54 14,848 —a
c:windowssystem32driverskbdhid.sys
2009-09-20 22:45 . 2004-08-17 15:54 14,848 —a—c— c:windowssystem32dllcachekbdhid.sys
2009-09-20 22:45 . 2001-10-19 20:33 12,160 —a
c:windowssystem32driversmouhid.sys
2009-09-20 22:45 . 2001-10-19 20:33 12,160 —a—c— c:windowssystem32dllcachemouhid.sys
2009-09-20 22:25 . 2009-09-20 22:25 303 —a
c:windowsST6UNST.003
2009-09-20 22:24 . 2009-09-20 22:24 303 —a
c:windowsST6UNST.002
2009-09-20 22:20 . 2009-09-20 22:20 303 —a
c:windowsST6UNST.001
2009-09-20 22:20 . 2009-09-20 22:20 303 —a
c:windowsST6UNST.000
2009-09-20 22:01 . 2009-09-20 22:12 d
c:documents and settingsAdminApplication DataFMA
2009-09-20 21:33 . 2009-09-20 21:33 d
c:documents and settingsAdminApplication DataFieryAds
2009-09-20 21:33 . 2009-09-20 21:33 43,819 —a
c:documents and settingsAdminApplication Datafieryads.dat
2009-09-20 21:21 . 2009-09-20 21:53 83 —a
c:windowsnt32200ax2R2.dll
2009-09-20 21:21 . 2009-09-20 21:53 32 —a
c:windowssystem32ntcheck3232bxR2.dll
2009-09-20 19:39 . 2009-09-20 19:44 d
C:~MSSTFQF.T
2009-09-20 19:31 . 1992-10-28 00:00 38,432 —a
c:windowssystemMSVIDC.DRV
2009-09-20 19:31 . 1992-10-28 00:00 5,744 —a
c:windowssystemDISPDIB.DLL
2009-09-20 16:39 . 2009-09-20 16:39 d
c:program filesNokia
2009-09-20 16:39 . 2009-09-20 16:39 d
c:documents and settingsAll Users.WINDOWSApplication DataNokia
2009-09-20 16:38 . 2009-09-20 16:38 d
c:program filesMSXML 6.0
2009-09-20 12:04 . 2009-09-20 12:04 d
c:documents and settingsAdminApplication DataCanon
2009-09-20 12:03 . 2009-09-20 12:03 d
c:documents and settingsAdminApplication DataZoomBrowser EX
2009-09-20 00:18 . 2009-09-20 00:19 d
c:program filesCanon
2009-09-20 00:17 . 2009-09-20 00:17 d
c:documents and settingsAll Users.WINDOWSApplication DataZoomBrowser
2009-09-20 00:14 . 2009-09-20 00:14 d
c:program filesCommon FilesCanon
2009-09-13 21:03 . 2005-10-21 05:47 30,592
c:windowssystem32driversrndismpx.sys
2009-09-13 21:03 . 2005-10-21 05:47 12,800
c:windowssystem32driversusb8023x.sys
2009-09-04 23:24 . 2009-09-04 23:24 0 —ah
c:windowssystem32driversMsftWdf_user_01_07_00.Wdf
2009-09-04 23:24 . 2009-09-04 23:24 0 —ah
c:windowssystem32driversMsft_User_PCCSWpdDriver_01_07_00.Wdf
2009-09-04 23:23 . 2004-08-03 23:08 25,600 —a
c:windowssystem32driversusbser.sys
2009-09-04 23:23 . 2004-08-03 23:08 25,600 —a—c— c:windowssystem32dllcacheusbser.sys
2009-09-04 23:23 . 2008-03-21 13:57 14,640 —a
c:windowssystem32spmsgXP_2k3.dll
2009-09-04 23:23 . 2009-09-04 23:23 0 —ah
c:windowssystem32driversMsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-09-04 23:23 . 2009-09-04 23:23 0 —ah
c:windowssystem32driversMsft_Kernel_ccdcmb_01007.Wdf
2009-09-04 23:18 . 2009-09-04 23:18 d
c:program filesCommon FilesPCSuite
2009-09-04 23:18 . 2009-09-20 16:39 d
c:program filesCommon FilesNokia
2009-09-04 23:18 . 2009-09-04 23:23 d
c:documents and settingsAll Users.WINDOWSApplication DataPC Suite
2009-09-04 23:18 . 2009-09-04 23:23 d
c:documents and settingsAdminApplication DataPC Suite
2009-09-04 23:18 . 2009-09-04 23:23 d
c:documents and settingsAdminApplication DataNokia
2009-09-04 23:17 . 2009-09-04 23:17 d
c:program filesPC Connectivity Solution
2009-09-04 23:17 . 2009-09-04 23:18 d
c:program filesDIFX
2009-09-04 23:17 . 2009-02-09 08:32 1,112,288 —a
c:windowssystem32wdfcoinstaller01007.dll
2009-09-04 23:17 . 2009-02-09 08:37 659,968 —a
c:windowssystem32nmwcdcocls.dll
2009-09-04 23:17 . 2009-03-19 14:48 136,704 —a
c:windowssystem32driversnmwcdnsu.sys
2009-09-04 23:17 . 2009-02-09 08:37 22,016 —a
c:windowssystem32driversccdcmbo.sys
2009-09-04 23:17 . 2008-08-26 10:26 18,816 —a
c:windowssystem32driverspccsmcfd.sys
2009-09-04 23:17 . 2009-02-09 08:37 17,664 —a
c:windowssystem32driversccdcmb.sys
2009-09-04 23:17 . 2009-02-09 08:37 7,808 —a
c:windowssystem32driversusbser_lowerfltj.sys
2009-09-04 23:17 . 2009-02-09 08:37 7,808 —a
c:windowssystem32driversusbser_lowerflt.sys
2009-09-04 23:16 . 2009-02-09 08:37 91,136 —a
c:windowssystem32nmwcdcls.dll
2009-09-04 23:13 . 2009-09-20 16:38 d
c:documents and settingsAll Users.WINDOWSApplication DataInstallations
2009-09-04 22:26 . 2009-09-04 22:26 65 —a
c:windowsFISHUI.INI
2009-09-01 21:55 . 2009-09-01 21:55 d
c:documents and settingsAdminAudiosurf.FullRip
2009-08-30 20:57 . 2009-08-30 20:57 d
c:documents and settingsAdminApplication DataBroken Rules
2009-08-30 20:57 . 2009-09-24 22:30 4,096 —a
c:windowsd3dx.dat
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-26 18:32
d
w c:program filesDrWeb AV-Desk
2009-09-26 08:06
d
w c:documents and settingsAdminApplication DatauTorrent
2009-09-25 19:36
d
w c:documents and settingsAdminApplication DataMedia Player Classic
2009-09-24 20:12
d
w c:documents and settingsAdminApplication DataLavasoft
2009-09-24 18:30 413,696 —-a-w c:windowssttray.exe
2009-09-24 18:30 36,864 —-a-w c:windowssystem32driversAmdK8.sys
2009-09-24 18:30 20,480 —-a-w c:windowssystem32driversblueletaudio.sys
2009-09-24 18:02
d
w c:documents and settingsAll Users.WINDOWSApplication DataSpybot — Search & Destroy
2009-09-23 19:25
d—a-w c:documents and settingsAll Users.WINDOWSApplication DataTEMP
2009-09-23 19:11
d
w c:documents and settingsAdminApplication DataMyPhoneExplorer
2009-09-22 11:35
d
w c:documents and settingsAdminApplication DataAIMP
2009-09-20 10:59
d
w c:documents and settingsAll Users.WINDOWSApplication DataMicrosoft Help
2009-09-04 18:25
d
w c:documents and settingsAdminApplication DataDataCast
2009-08-19 18:36
d
w c:documents and settingsAdminApplication DataVso
2009-07-04 16:26 87,608 —-a-w c:documents and settingsAdminApplication Datainst.exe
2009-07-04 16:26 47,360 —-a-w c:documents and settingsAdminApplication Datapcouffin.sys
2009-07-04 15:29 729,520 -c—a-w c:program filesCommon Filesunins000.exe
2009-07-04 15:29 3,207 -c—a-w c:program filesCommon Filesunins000.dat
2008-10-22 10:01 724,568 —-a-w c:program filesBitTorrent Fastest Toolvlnet3.com_Installer.exe
2008-03-02 08:08 17,067,560 —-a-w c:program filesDivXInstaller.exe
2006-12-03 20:35 17,920 -c—a-w c:windowsinfUSBEHCI.SYS
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2004-08-18 15360]
«AnVir Task Manager»=»d:program filesAnVir Task ManagerAnVir.exe» [2009-03-26 2665696]
«SpybotSD TeaTimer»=»f:program filesSpybot — Search & DestroyTeaTimer.exe» [2009-03-05 2260480]
«Auslogics BoostSpeed 4″=»d:program filesAuslogicsAuslogics BoostSpeedboostspeed.exe» [2009-03-16 362096]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«SysTrayApp»=»c:program filesIDTWDMsttray.exe» [2007-12-14 413696]
«DrWebAgentUI»=»c:program filesDrWeb AV-Deskdrwagnui.exe» [2009-07-03 812336]
«SpIDerMail»=»c:program filesDrWeb AV-Deskspiderml.exe» [2009-07-03 501080]
«SpIDerNT»=»c:progra~1DRWEBA~1spiderui.exe» [2009-07-03 197896]
«Synchronization Manager»=»c:windowssystem32mobsync.exe» [2004-08-18 394752]
[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2004-08-18 15360]
«LinkDel»=»linkdel.cmd» [2006-12-24 c:windowssystem32LINKDEL.CMD]
c:documents and settingsAll Users.WINDOWSѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
Punto Switcher.lnk — d:program filesPunto Switcherpunto.exe [2009-07-02 735016]
[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoRecentDocsNetHood»= 1818575963 (0x6c65445b)
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalWdf01000.sys]
@=»Driver»
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«d:\Program Files\ICQ6.5\ICQ.exe»=
«d:\Program Files\Opera\opera.exe»=
«c:\Documents and Settings\Admin\Рабочий стол\utorrent.exe»=
«c:\WINDOWS\system32\muzapp.exe»=
«c:\Program Files\Electronic Arts\EADM\Core.exe»=
«d:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe»=
«d:program filesMicrosoft ActiveSyncrapimgr.exe»= d:program filesMicrosoft ActiveSyncrapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
«d:program filesMicrosoft ActiveSyncwcescomm.exe»= d:program filesMicrosoft ActiveSyncwcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
«d:program filesMicrosoft ActiveSyncWCESMgr.exe»= d:program filesMicrosoft ActiveSyncWCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
«c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE»=
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«26675:TCP»= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
R2 spider;SpIDer Guard File System Monitor;??c:progra~1DRWEBA~1spider.sys [2009-07-03 268040]
R2 SPIDERNT;SpIDer Guard for Windows;c:progra~1DRWEBA~1spidernt.exe [2009-07-03 197896]
R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:windowssystem32DRIVERSl151x86.sys [2009-07-02 37376]
R3 drwagntd;Dr.Web(R) AV-Desk Agent;»c:program filesDrWeb AV-Deskdrwagntd.exe» [2009-07-03 1860912]
S2 drwupgrade;Dr.Web(R) AV-Desk Upgrade Service;»c:program filesDrWeb AV-Desk1drwupgrade.exe» -verbosity=all -rotate=10,10m [2009-07-03 410928]
S3 ATP;Comodo EasyVPN Miniport Driver;c:windowssystem32DRIVERScmdatp.sys []
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:windowssystem32driversnmwcdnsu.sys [2009-09-04 136704]
.
.
Supplementary Scan
.
uStart Page = hxxp://www.yandex.ru/?clid=46126
IE: &Перевести с помощью ABBYY Lingvo… — d:program filesABBYY Lingvo 11 Multilingual DictionaryLingvo.exe/3000
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
LSP: c:windowssystem32DRWEBSP.DLL
FF — ProfilePath — c:documents and settingsAdminApplication DataMozillaFirefoxProfiles9vf96daw.default
FF — prefs.js: browser.startup.homepage — hxxp://www.yandex.ru/?clid=40795
FF — plugin: d:program filesMozilla Firefoxpluginsnpdjvu.dll
FF — plugin: d:program filesOperaprogrampluginsnpdjvu.dll
FF — plugin: d:program filesOperaprogrampluginsnpdsplay.dll
FF — plugin: d:program filesOperaprogrampluginsNPOFF12.DLL
FF — plugin: d:program filesOperaprogrampluginsNPSWF32.dll
FF — plugin: d:program filesOperaprogrampluginsnpwmsdrm.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-26 22:32:07
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(724)
c:windowssystem32Ati2evxx.dll
— — — — — — — > ‘lsass.exe'(796)
c:windowssystem32DRWEBSP.DLL
.
Other Running Processes
.
c:windowssystem32uphclean.exe
c:windowssystem32wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-09-26 22:33:45 — machine was rebooted
ComboFix-quarantined-files.txt 2009-09-26 18:33:41
ComboFix2.txt 2009-09-25 19:07:47
Pre-Run: 5 795 041 280 байт свободно
Post-Run: 5,787,947,008 байт свободно
219
