Re: Re: Помогите удалить Trojan.TDSS

[ourida]

Сделала. Вот лог. НОД продолжает находить руткит.

ComboFix 09-09-06.06 — Администратор 09.09.2009 10:46.2.1 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.512.284 [GMT 1:00]
Running from: c:documents and settingsАдминистраторРабочий столComboFix.exe
Command switches used :: c:documents and settingsАдминистраторРабочий столCFScript.txt
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

FILE ::
«c:windowssystem32driversdbsejx.sys»
«c:windowssystem32driverssynsenddrv.sys»
«c:windowssystem32driversvabpmmgsj.sys»
«c:windowssystem32driversyghjklvild.sys»
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:windowssystem32driversstr.sys
c:windowssystem32driversyghjklvild.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

---

Legacy_GEOFEMBOPNWB

---

Legacy_SOXEBJNNELTOX

---

Legacy_SYNSEND

---

Legacy_TBAHKMFRZDLJITI

---

Service_geofembopnwb

---

Service_synsend

---

Service_tbahkmfrzdljiti

((((((((((((((((((((((((( Files Created from 2009-08-09 to 2009-09-09 )))))))))))))))))))))))))))))))
.

2009-09-07 13:04 . 2009-09-07 13:04

---

d

---

w- c:documents and settingsNetworkServiceLocal SettingsApplication DataESET
2009-09-02 18:19 . 2009-09-02 18:19

---

d

---

w- c:program filestrend micro
2009-09-02 18:18 . 2009-09-02 18:19

---

d

---

w- C:rsit
2009-08-31 20:32 . 2005-09-01 10:03 5888

---

w- c:windowssystem32driversimagedrv.sys
2009-08-31 20:32 . 2005-09-01 10:03 127488

---

w- c:windowssystem32driversimagesrv.sys
2009-08-16 16:51 . 2009-08-16 16:51

---

d

---

w- c:documents and settingsAll UsersApplication DataFriends Games

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-09 09:56 . 2008-11-07 19:29

---

d

---

w- c:program filesChameleon Clock
2009-09-07 13:21 . 2008-04-15 12:00 65616 —-a-w- c:windowssystem32perfc019.dat
2009-09-07 13:21 . 2008-04-15 12:00 424230 —-a-w- c:windowssystem32perfh019.dat
2009-09-05 17:39 . 2008-11-02 21:31 3268 —-a-w- c:windowssystem32d3d9caps.dat
2009-08-31 20:32 . 2009-02-22 18:48

---

d

---

w- c:program filesAhead
2009-08-30 16:36 . 2009-07-26 01:08

---

d

---

w- c:program filesТим и Тома — Каникулы на Тропическом Острове
2009-08-30 16:21 . 2008-11-02 23:44

---

d

---

w- c:documents and settingsАдминистраторApplication DataSkype
2009-08-30 15:01 . 2008-11-14 18:53

---

d

---

w- c:documents and settingsАдминистраторApplication DataskypePM
2009-08-27 01:33 . 2008-11-07 20:03 2496 —-a-w- c:windowssystem32d3d8caps.dat
2009-08-16 16:49 . 2008-11-02 21:57

---

d

---

w- c:program filesCommon FilesAdobe
2009-08-16 11:39 . 2009-04-01 22:59

---

d

---

w- c:documents and settingsAll UsersApplication DataAlawarWrapper
2009-07-30 12:26 . 2009-07-30 12:26

---

dc-h—w- c:documents and settingsAll UsersApplication Data{8CC5CF4A-124E-41BA-B58C-A41F05BE09CC}
2009-07-30 12:26 . 2009-07-30 12:26

---

d

---

w- c:program filesStardock
2009-07-29 01:46 . 2008-11-02 17:04

---

d

---

w- c:documents and settingsAll UsersApplication DataMicrosoft Help
2009-07-29 01:30 . 2009-07-29 01:30

---

d

---

w- c:program filesMSXML 4.0
2009-07-28 14:51 . 2009-07-28 14:51

---

d

---

w- c:documents and settingsАдминистраторApplication DataMalwarebytes
2009-07-28 14:51 . 2009-07-28 14:51

---

d

---

w- c:program filesMalwarebytes’ Anti-Malware
2009-07-28 14:51 . 2009-07-28 14:51

---

d

---

w- c:documents and settingsAll UsersApplication DataMalwarebytes
2009-07-27 10:45 . 2008-11-02 23:12

---

d

---

w- c:documents and settingsАдминистраторApplication DataMra
2009-07-24 23:58 . 2009-07-24 23:58

---

d

---

w- c:program filesМодные Пазлы
2009-07-13 17:27 . 2009-01-06 17:41

---

d

---

w- c:documents and settingsАдминистраторApplication DataImage Zone Express
2009-07-13 12:36 . 2009-07-28 14:51 38160 —-a-w- c:windowssystem32driversmbamswissarmy.sys
2009-07-13 12:36 . 2009-07-28 14:51 19096 —-a-w- c:windowssystem32driversmbam.sys
2009-06-16 14:40 . 2008-04-15 12:00 81920 —-a-w- c:windowssystem32fontsub.dll
2009-06-16 14:40 . 2008-04-15 12:00 119808 —-a-w- c:windowssystem32t2embed.dll
2009-04-21 19:33 . 2009-04-21 19:33 10856 —sha-w- c:windowssystem32KGyGaAvL.sys
.

---

Sigcheck

---

[-] 371C41F777924F3EA3BFAD18C6A04502 [5.1.2600.5512 (xpsp.080413-2105)] c:windowssystem32user32.dll

[-] A0F98BB46BEEAF2A94593FF9AB856A80 [6.00.2900.5512 (xpsp.080413-2105)] c:windowsexplorer.exe

[-] 0CE07543B08FD1E209D99D504076102B [5.1.2600.5512 (xpsp.080413-2105)] c:windowssystem32ctfmon.exe

[-] E26B65B5B17D8B13BFB15A44F9AF7E2E [2001.12.4414.700] c:windowssystem32comres.dll

[-] E506465BFB0821DC33077E29FD184E31 [5.82 (xpsp.080413-2105)] c:windowssystem32comctl32.dll
[7] AEF3D788DBF40C7C4D204EA45EB0C505 [6.0 (xpclient.010817-1148)] c:windowsWinSxSx86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70acomctl32.dll
[7] FF63BB56C05EA817124D4E18162FCE46 [6.0 (xpsp.080413-2105)] c:windowsWinSxSx86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83comctl32.dll

[-] 1C079017E180FB9AB4B56AA8F896F708 [5.1.2600.5512 (xpsp.080413-2111)] c:windowssystem32sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-09-07_13.18.21 )))))))))))))))))))))))))))))))))))))))))
.
— 2008-04-15 12:00 . 2009-07-29 11:04 53608 c:windowssystem32perfc009.dat
+ 2008-04-15 12:00 . 2009-09-07 13:21 53608 c:windowssystem32perfc009.dat
— 2009-09-07 11:51 . 2009-09-07 11:44 32768 c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5MSHist012009090720090908index.dat
+ 2009-09-07 11:51 . 2009-09-07 13:20 32768 c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5MSHist012009090720090908index.dat
— 2008-11-02 16:19 . 2009-09-07 13:17 49152 c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5index.dat
+ 2008-11-02 16:19 . 2009-09-09 08:59 49152 c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5index.dat
— 2009-09-03 13:23 . 2009-09-07 11:43 16384 c:windowssystem32configsystemprofileLocal SettingsApplication DataMicrosoftFeeds Cacheindex.dat
+ 2009-09-03 13:23 . 2009-09-08 15:18 16384 c:windowssystem32configsystemprofileLocal SettingsApplication DataMicrosoftFeeds Cacheindex.dat
+ 2008-11-02 16:19 . 2009-09-09 08:59 32768 c:windowssystem32configsystemprofileCookiesindex.dat
— 2008-11-02 16:19 . 2009-09-07 13:17 32768 c:windowssystem32configsystemprofileCookiesindex.dat
+ 2008-04-15 12:00 . 2009-09-07 13:21 383254 c:windowssystem32perfh009.dat
— 2008-04-15 12:00 . 2009-07-29 11:04 383254 c:windowssystem32perfh009.dat
— 2008-11-02 16:19 . 2009-09-07 13:17 114688 c:windowssystem32configsystemprofileLocal SettingsTemporary Internet FilesContent.IE5index.dat
+ 2008-11-02 16:19 . 2009-09-09 08:59 114688 c:windowssystem32configsystemprofileLocal SettingsTemporary Internet FilesContent.IE5index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2007-11-22 1090824]

[HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar]

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2007-11-22 1090824]

[HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar]

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-03-23 132096]
«Yupdate!»=»c:program filesCommon FilesYandexYupdateyupdate.exe» [2007-11-22 449800]
«DW6″=»c:program filesThe Weather Channel FWDesktopDesktopWeather.exe» [2009-02-11 801904]
«HomeAlarm»=»c:program filesChameleon ClockChamClock.exe» [2007-07-17 634368]
«AlcoholAutomount»=»c:program filesAlcohol SoftAlcohol 120axcmd.exe» [2007-08-01 222592]
«ctfmon.exe»=»c:windowssystem32ctfmon.exe» [2008-04-25 17408]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«egui»=»c:program filesESETESET NOD32 Antivirusegui.exe» [2008-03-13 1443072]
«GrooveMonitor»=»c:program filesMicrosoft OfficeOffice12GrooveMonitor.exe» [2007-08-24 33648]
«MAgent»=»c:program filesMail.RuAgentMAgent.exe» [2009-07-27 7975608]
«HP Software Update»=»c:program filesHPHP Software UpdateHPWuSchd2.exe» [2006-02-19 49152]
«PinnacleDriverCheck»=»c:windowssystem32\PSDrvCheck.exe» [2004-03-11 406016]
«BigDogPath»=»c:windowsVM_STI.EXE» [2004-12-15 40960]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2001-07-09 155648]
«Adobe Reader Speed Launcher»=»c:program filesAdobeReader 8.0ReaderReader_sl.exe» [2008-01-11 39792]
«SoundMan»=»SOUNDMAN.EXE» — c:windowsSOUNDMAN.EXE [2007-04-16 577536]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-25 17408]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-03-23 132096]

c:documents and settingsAll Usersѓ« ў­®Ґ ¬Ґ­оЏа®Ја ¬¬лЂўв®§ Јаг§Є 
DSLMON.lnk — c:program filesMenaradslmon.exe [2008-11-2 962661]
HP Digital Imaging Monitor.lnk — c:program filesHPDigital Imagingbinhpqtra08.exe [2006-2-19 288472]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]
«SynchronousMachineGroupPolicy»= 0 (0x0)
«SynchronousUserGroupPolicy»= 0 (0x0)

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoThumbnailCache»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoThumbnailCache»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)
«NoSMHelp»= 1 (0x1)

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusOverride»=dword:00000001
«UpdatesDisableNotify»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)
«DisableNotifications»= 1 (0x1)

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\Windows Live\Messenger\wlcsdk.exe»=
«c:\Program Files\Windows Live\Messenger\msnmsgr.exe»=

R1 epfwtdir;epfwtdir;c:windowssystem32driversepfwtdir.sys [13.03.2008 14:52 33800]
R2 ekrn;Eset Service;c:program filesESETESET NOD32 Antivirusekrn.exe [13.03.2008 14:49 472320]
S2 soxebjnneltox;soxebjnneltox;??c:windowssystem32driversyghjklvild.sys —> c:windowssystem32driversyghjklvild.sys [?]
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.yandex.ru/
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
IE: Закачать ВСЕ при помощи Download Master — c:program filesDownload Masterdmieall.htm
IE: Закачать при помощи Download Master — c:program filesDownload Masterdmie.htm
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:program filesMail.RuAgentmagent.exe
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe
TCP: {9DB9C1FB-3F64-4ECE-B05A-865F3323FC39} = 62.251.229.223 62.251.229.237
FF — ProfilePath — c:documents and settingsАдминистраторApplication DataMozillaFirefoxProfiles9vf96daw.default
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnppl3260.dll
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnprpjplug.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-09 10:58
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

LOCKED REGISTRY KEYS

---

[HKEY_USERSS-1-5-21-299502267-562591055-842925246-500SoftwareMicrosoftWindowsCurrentVersionExplorerClsid]
@Denied: (Full) (LocalSystem)
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘winlogon.exe'(692)
c:windowssystem32COMRes.dll
c:windowssystem32cscui.dll

— — — — — — — > ‘explorer.exe'(3648)
c:windowssystem32SHDOCVW.dll
c:windowssystem32COMRes.dll
c:windowsSystem32cscui.dll
c:windowssystem32NETSHELL.dll
c:windowssystem32credui.dll
c:windowssystem32MSVCP60.dll
c:windowssystem32WPDShServiceObj.dll
c:program filesStardockObject DesktopIconPackageriprepair.dll
c:windowssystem32PortableDeviceTypes.dll
c:windowssystem32PortableDeviceApi.dll
.

---

Other Running Processes

---

.
c:program filesAlcohol SoftAlcohol 120StarWindStarWindServiceAE.exe
c:program filesHPDigital Imagingbinhpqste08.exe
.
**************************************************************************
.
Completion time: 2009-09-09 11:04 — machine was rebooted
ComboFix-quarantined-files.txt 2009-09-09 10:03
ComboFix2.txt 2009-09-07 13:25

Pre-Run: 9 260 802 048 байт свободно
Post-Run: 9 284 812 800 байт свободно

214 — E O F — 2009-07-29 01:47