Сделала. Вот лог. НОД пока больше ничего не находит.
ComboFix 09-09-06.06 — Администратор 10.09.2009 19:33.3.1 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.512.168 [GMT 1:00]
Running from: c:documents and settingsАдминистраторРабочий столComboFix.exe
Command switches used :: c:documents and settingsАдминистраторРабочий столCFScript.txt
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FILE ::
«c:windowssystem32driversyghjklvild.sys»
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
Service_soxebjnneltox
((((((((((((((((((((((((( Files Created from 2009-08-10 to 2009-09-10 )))))))))))))))))))))))))))))))
.
2009-09-07 13:04 . 2009-09-07 13:04
d
w- c:documents and settingsNetworkServiceLocal SettingsApplication DataESET
2009-09-02 18:19 . 2009-09-02 18:19
d
w- c:program filestrend micro
2009-09-02 18:18 . 2009-09-02 18:19
d
w- C:rsit
2009-08-31 20:32 . 2005-09-01 10:03 5888
w- c:windowssystem32driversimagedrv.sys
2009-08-31 20:32 . 2005-09-01 10:03 127488
w- c:windowssystem32driversimagesrv.sys
2009-08-16 16:51 . 2009-08-16 16:51
d
w- c:documents and settingsAll UsersApplication DataFriends Games
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-10 18:43 . 2008-11-07 19:29
d
w- c:program filesChameleon Clock
2009-09-07 13:21 . 2008-04-15 12:00 65616 —-a-w- c:windowssystem32perfc019.dat
2009-09-07 13:21 . 2008-04-15 12:00 424230 —-a-w- c:windowssystem32perfh019.dat
2009-09-05 17:39 . 2008-11-02 21:31 3268 —-a-w- c:windowssystem32d3d9caps.dat
2009-08-31 20:32 . 2009-02-22 18:48
d
w- c:program filesAhead
2009-08-30 16:36 . 2009-07-26 01:08
d
w- c:program filesТим и Тома — Каникулы на Тропическом Острове
2009-08-30 16:21 . 2008-11-02 23:44
d
w- c:documents and settingsАдминистраторApplication DataSkype
2009-08-30 15:01 . 2008-11-14 18:53
d
w- c:documents and settingsАдминистраторApplication DataskypePM
2009-08-27 01:33 . 2008-11-07 20:03 2496 —-a-w- c:windowssystem32d3d8caps.dat
2009-08-16 16:49 . 2008-11-02 21:57
d
w- c:program filesCommon FilesAdobe
2009-08-16 11:39 . 2009-04-01 22:59
d
w- c:documents and settingsAll UsersApplication DataAlawarWrapper
2009-07-30 12:26 . 2009-07-30 12:26
dc-h—w- c:documents and settingsAll UsersApplication Data{8CC5CF4A-124E-41BA-B58C-A41F05BE09CC}
2009-07-30 12:26 . 2009-07-30 12:26
d
w- c:program filesStardock
2009-07-29 01:46 . 2008-11-02 17:04
d
w- c:documents and settingsAll UsersApplication DataMicrosoft Help
2009-07-29 01:30 . 2009-07-29 01:30
d
w- c:program filesMSXML 4.0
2009-07-28 14:51 . 2009-07-28 14:51
d
w- c:documents and settingsАдминистраторApplication DataMalwarebytes
2009-07-28 14:51 . 2009-07-28 14:51
d
w- c:program filesMalwarebytes’ Anti-Malware
2009-07-28 14:51 . 2009-07-28 14:51
d
w- c:documents and settingsAll UsersApplication DataMalwarebytes
2009-07-27 10:45 . 2008-11-02 23:12
d
w- c:documents and settingsАдминистраторApplication DataMra
2009-07-24 23:58 . 2009-07-24 23:58
d
w- c:program filesМодные Пазлы
2009-07-13 17:27 . 2009-01-06 17:41
d
w- c:documents and settingsАдминистраторApplication DataImage Zone Express
2009-07-13 12:36 . 2009-07-28 14:51 38160 —-a-w- c:windowssystem32driversmbamswissarmy.sys
2009-07-13 12:36 . 2009-07-28 14:51 19096 —-a-w- c:windowssystem32driversmbam.sys
2009-06-16 14:40 . 2008-04-15 12:00 81920 —-a-w- c:windowssystem32fontsub.dll
2009-06-16 14:40 . 2008-04-15 12:00 119808 —-a-w- c:windowssystem32t2embed.dll
2009-04-21 19:33 . 2009-04-21 19:33 10856 —sha-w- c:windowssystem32KGyGaAvL.sys
.
Sigcheck
[-] 371C41F777924F3EA3BFAD18C6A04502 [5.1.2600.5512 (xpsp.080413-2105)] c:windowssystem32user32.dll
[-] A0F98BB46BEEAF2A94593FF9AB856A80 [6.00.2900.5512 (xpsp.080413-2105)] c:windowsexplorer.exe
[-] 0CE07543B08FD1E209D99D504076102B [5.1.2600.5512 (xpsp.080413-2105)] c:windowssystem32ctfmon.exe
[-] E26B65B5B17D8B13BFB15A44F9AF7E2E [2001.12.4414.700] c:windowssystem32comres.dll
[-] E506465BFB0821DC33077E29FD184E31 [5.82 (xpsp.080413-2105)] c:windowssystem32comctl32.dll
[7] AEF3D788DBF40C7C4D204EA45EB0C505 [6.0 (xpclient.010817-1148)] c:windowsWinSxSx86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70acomctl32.dll
[7] FF63BB56C05EA817124D4E18162FCE46 [6.0 (xpsp.080413-2105)] c:windowsWinSxSx86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83comctl32.dll
[-] 1C079017E180FB9AB4B56AA8F896F708 [5.1.2600.5512 (xpsp.080413-2111)] c:windowssystem32sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-09-07_13.18.21 )))))))))))))))))))))))))))))))))))))))))
.
— 2008-04-15 12:00 . 2009-07-29 11:04 53608 c:windowssystem32perfc009.dat
+ 2008-04-15 12:00 . 2009-09-07 13:21 53608 c:windowssystem32perfc009.dat
— 2009-09-07 11:51 . 2009-09-07 11:44 32768 c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5MSHist012009090720090908index.dat
+ 2009-09-07 11:51 . 2009-09-07 13:20 32768 c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5MSHist012009090720090908index.dat
— 2008-11-02 16:19 . 2009-09-07 13:17 49152 c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5index.dat
+ 2008-11-02 16:19 . 2009-09-09 08:59 49152 c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5index.dat
— 2009-09-03 13:23 . 2009-09-07 11:43 16384 c:windowssystem32configsystemprofileLocal SettingsApplication DataMicrosoftFeeds Cacheindex.dat
+ 2009-09-03 13:23 . 2009-09-08 15:18 16384 c:windowssystem32configsystemprofileLocal SettingsApplication DataMicrosoftFeeds Cacheindex.dat
+ 2008-11-02 16:19 . 2009-09-09 08:59 32768 c:windowssystem32configsystemprofileCookiesindex.dat
— 2008-11-02 16:19 . 2009-09-07 13:17 32768 c:windowssystem32configsystemprofileCookiesindex.dat
+ 2008-04-15 12:00 . 2009-09-07 13:21 383254 c:windowssystem32perfh009.dat
— 2008-04-15 12:00 . 2009-07-29 11:04 383254 c:windowssystem32perfh009.dat
— 2008-11-02 16:19 . 2009-09-07 13:17 114688 c:windowssystem32configsystemprofileLocal SettingsTemporary Internet FilesContent.IE5index.dat
+ 2008-11-02 16:19 . 2009-09-09 08:59 114688 c:windowssystem32configsystemprofileLocal SettingsTemporary Internet FilesContent.IE5index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2007-11-22 1090824]
[HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar]
[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2007-11-22 1090824]
[HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar]
[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-03-23 132096]
«Yupdate!»=»c:program filesCommon FilesYandexYupdateyupdate.exe» [2007-11-22 449800]
«DW6″=»c:program filesThe Weather Channel FWDesktopDesktopWeather.exe» [2009-02-11 801904]
«HomeAlarm»=»c:program filesChameleon ClockChamClock.exe» [2007-07-17 634368]
«AlcoholAutomount»=»c:program filesAlcohol SoftAlcohol 120axcmd.exe» [2007-08-01 222592]
«ctfmon.exe»=»c:windowssystem32ctfmon.exe» [2008-04-25 17408]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«egui»=»c:program filesESETESET NOD32 Antivirusegui.exe» [2008-03-13 1443072]
«GrooveMonitor»=»c:program filesMicrosoft OfficeOffice12GrooveMonitor.exe» [2007-08-24 33648]
«MAgent»=»c:program filesMail.RuAgentMAgent.exe» [2009-07-27 7975608]
«HP Software Update»=»c:program filesHPHP Software UpdateHPWuSchd2.exe» [2006-02-19 49152]
«PinnacleDriverCheck»=»c:windowssystem32\PSDrvCheck.exe» [2004-03-11 406016]
«BigDogPath»=»c:windowsVM_STI.EXE» [2004-12-15 40960]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2001-07-09 155648]
«Adobe Reader Speed Launcher»=»c:program filesAdobeReader 8.0ReaderReader_sl.exe» [2008-01-11 39792]
«SoundMan»=»SOUNDMAN.EXE» — c:windowsSOUNDMAN.EXE [2007-04-16 577536]
[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-25 17408]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-03-23 132096]
c:documents and settingsAll Usersѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
DSLMON.lnk — c:program filesMenaradslmon.exe [2008-11-2 962661]
HP Digital Imaging Monitor.lnk — c:program filesHPDigital Imagingbinhpqtra08.exe [2006-2-19 288472]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]
«SynchronousMachineGroupPolicy»= 0 (0x0)
«SynchronousUserGroupPolicy»= 0 (0x0)
[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoThumbnailCache»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)
[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoThumbnailCache»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)
«NoSMHelp»= 1 (0x1)
[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusOverride»=dword:00000001
«UpdatesDisableNotify»=dword:00000001
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)
«DisableNotifications»= 1 (0x1)
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\Windows Live\Messenger\wlcsdk.exe»=
«c:\Program Files\Windows Live\Messenger\msnmsgr.exe»=
R1 epfwtdir;epfwtdir;c:windowssystem32driversepfwtdir.sys [13.03.2008 14:52 33800]
R2 ekrn;Eset Service;c:program filesESETESET NOD32 Antivirusekrn.exe [13.03.2008 14:49 472320]
.
.
Supplementary Scan
.
uStart Page = hxxp://www.yandex.ru/
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
IE: Закачать ВСЕ при помощи Download Master — c:program filesDownload Masterdmieall.htm
IE: Закачать при помощи Download Master — c:program filesDownload Masterdmie.htm
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:program filesMail.RuAgentmagent.exe
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe
TCP: {9DB9C1FB-3F64-4ECE-B05A-865F3323FC39} = 62.251.229.223 62.251.229.237
FF — ProfilePath — c:documents and settingsАдминистраторApplication DataMozillaFirefoxProfiles9vf96daw.default
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnppl3260.dll
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnprpjplug.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-10 19:43
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(692)
c:windowssystem32COMRes.dll
c:windowssystem32cscui.dll
— — — — — — — > ‘explorer.exe'(1308)
c:windowssystem32SHDOCVW.dll
c:windowssystem32COMRes.dll
c:windowsSystem32cscui.dll
c:windowssystem32NETSHELL.dll
c:windowssystem32credui.dll
c:windowssystem32MSVCP60.dll
c:windowssystem32WPDShServiceObj.dll
c:program filesStardockObject DesktopIconPackageriprepair.dll
c:windowssystem32PortableDeviceTypes.dll
c:windowssystem32PortableDeviceApi.dll
.
Other Running Processes
.
c:program filesAlcohol SoftAlcohol 120StarWindStarWindServiceAE.exe
c:program filesHPDigital Imagingbinhpqste08.exe
.
**************************************************************************
.
Completion time: 2009-09-10 19:49 — machine was rebooted
ComboFix-quarantined-files.txt 2009-09-10 18:49
ComboFix2.txt 2009-09-09 10:04
ComboFix3.txt 2009-09-07 13:25
Pre-Run: 9 120 436 224 байт свободно
Post-Run: 9 170 186 240 байт свободно
199 — E O F — 2009-07-29 01:47
