ComboFix 10-06-26.02 — Администратор 27.06.2010 17:48:55.1.2 — x86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.2047.1681 [GMT 8:00]
Running from: c:documents and settingsАдминистраторРабочий столComboFix.exe
AV: avast! Internet Security *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Doctor Web Anti-Virus *On-access scanning enabled* (Updated) {3454C8F1-ECBC-4180-A6F4-04632FBA762B}
FW: avast! Internet Security *disabled* {7591DB91-41F0-48A3-B128-1A293FD8233D}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
ADS — WINDOWS: deleted 0 bytes in 1 streams.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:documents and settingsАдминистраторApplication DataAdSubscribe
c:documents and settingsАдминистраторApplication DataAdSubscribeFeedfeed.xml
c:documents and settingsАдминистраторApplication DataFieryAds
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr0.dat
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr1.dat
c:program filesCommon Fileskeylog.txt
c:program filesCompany
c:program filesCompanyNewProductfree_mobile.gif
c:program filesCompanyNewProductinstall.gif
c:program filesCompanyNewProductleft_but1_off.gif
c:program filesCompanyNewProductleft_but1_on.gif
c:program filesCompanyNewProductleft_but2_off.gif
c:program filesCompanyNewProductleft_but2_on.gif
c:program filesCompanyNewProductleft_but3_off.gif
c:program filesCompanyNewProductleft_but3_on.gif
c:program filesCompanyNewProductleft_but4_off.gif
c:program filesCompanyNewProductleft_but4_on.gif
c:program filesCompanyNewProductleft_but5_off.gif
c:program filesCompanyNewProductleft_but5_on.gif
c:program filesCompanyNewProductleft_but6_off.gif
c:program filesCompanyNewProductleft_but6_on.gif
c:program filesCompanyNewProductleft_but7_off.gif
c:program filesCompanyNewProductleft_but7_on.gif
c:program filesCompanyNewProductleft_but8_off.gif
c:program filesCompanyNewProductleft_but8_on.gif
c:program filesCompanyNewProductlng.gif
c:program filesCompanyNewProductMFS.swf
c:program filesCompanyNewProductnext1.gif
c:program filesCompanyNewProductnext1_s.gif
c:program filesCompanyNewProductnext2.gif
c:program filesCompanyNewProductnext2_s.gif
c:program filesCompanyNewProductnext3.gif
c:program filesCompanyNewProductnext3_s.gif
c:program filesCompanyNewProductUninstall.exe
c:program filesCompanyNewProductUninstall.ini
c:program filesDaemonTools_WhenUSave_Installer
c:program filesDaemonTools_WhenUSave_Installervvsn.cfg
c:windowsa3kebook.ini
c:windowsakebook.ini
c:windowsANS2000.INI
c:windowssystem32driverswdreg.exe
c:windowssystem32lowsec
c:windowssystem32lowseclocal.ds
c:windowssystem32lowsecuser.ds
c:windowssystem32ssRibbons.scr
e:c65d~1674B~19B02~1F3F5~1AUDIOB~1deMO-pol.exe
BITS: Possible infected sites
hxxp://soft.export.yandex.ru
.
((((((((((((((((((((((((( Files Created from 2010-05-27 to 2010-06-27 )))))))))))))))))))))))))))))))
.
2010-06-27 05:28 . 2010-06-27 05:28
d
w- c:documents and settingsАдминистраторLocal SettingsApplication DataOpera
2010-06-25 10:28 . 2010-06-25 10:36
d
w- c:program filestrend micro
2010-06-23 20:36 . 2010-06-23 20:36 2915944 —-a-w- c:windowssystem32driversappdrv01.sys
2010-06-23 20:36 . 2010-06-23 20:36 304528 —-a-w- c:windowssystem32appdrvrem01.exe
2010-06-23 12:36 . 2010-06-23 12:36
d
w- c:documents and settingsАдминистраторLocal SettingsApplication DataTargem
2010-06-23 12:31 . 2010-06-23 12:31
d
w- c:program filesBuka
2010-06-23 12:05 . 2010-06-23 12:05
d
w- c:program filesDAEMON Tools Toolbar
2010-06-23 12:04 . 2010-06-23 12:05
d
w- c:program filesDAEMON Tools Lite
2010-06-23 12:04 . 2010-06-23 12:04
d
w- c:documents and settingsАдминистраторApplication DataDAEMON Tools
2010-06-23 11:10 . 2010-06-23 11:10
d
w- c:windowssystem32AGEIA
2010-06-23 11:10 . 2010-06-23 11:10
d
w- c:program filesAGEIA Technologies
2010-06-23 10:59 . 2008-10-16 09:14 7680 —-a-r- c:windowssystem32driversFStarForce.sys
2010-06-20 12:29 . 2010-06-20 12:29
d
w- c:documents and settingsАдминистраторDoctorWeb
2010-06-20 08:46 . 2010-06-20 08:46
d
w- c:program filesVote Vkontakte
2010-06-20 07:35 . 2010-06-20 07:35
d
w- c:documents and settingsАдминистраторApplication DataBlackBean
2010-06-12 05:53 . 2010-06-16 07:56
d
w- c:documents and settingsАдминистраторLocal SettingsApplication DataTHQ
2010-06-11 17:35 . 2010-06-11 17:35
d
w- c:documents and settingsАдминистраторLocal SettingsApplication DataPCHealth
2010-06-01 10:25 . 2010-06-01 10:25
d
w- C:rsit
2010-05-30 15:43 . 2010-05-30 15:43
d
w- c:documents and settingsАдминистраторLocal SettingsApplication DataChemTable Software
2010-05-30 15:27 . 2010-05-30 15:27
d
w- c:documents and settingsАдминистраторApplication DataChemTable Software
2010-05-30 15:24 . 2010-05-30 15:24
d
w- c:documents and settingsAll UsersApplication DataYandex
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-27 09:27 . 2009-07-01 19:50
d
w- c:documents and settingsАдминистраторApplication DatauTorrent
2010-06-27 05:28 . 2009-04-30 16:19
d
w- c:documents and settingsАдминистраторApplication DataYandex
2010-06-23 15:57 . 2008-04-15 12:00 85028 —-a-w- c:windowssystem32perfc019.dat
2010-06-23 15:57 . 2008-04-15 12:00 485764 —-a-w- c:windowssystem32perfh019.dat
2010-06-19 15:39 . 2010-05-09 06:01 22 —-a-w- c:windowssystem32nvModes.dat
2010-06-18 07:05 . 2010-04-13 11:41 27264 —-a-w- c:documents and settingsАдминистраторLocal SettingsApplication DataGDIPFONTCACHEV1.DAT
2010-06-16 12:42 . 2010-05-17 11:32
d
w- c:program filesMy Games
2010-06-16 06:39 . 2010-05-20 05:04
d
w- c:program filesCommon FilesGTK
2010-06-02 09:34 . 2009-03-31 15:08
d
w- c:documents and settingsAll UsersApplication DataCanonIJPLM
2010-05-31 11:47 . 2010-05-20 05:04
d
w- c:documents and settingsАдминистраторApplication DataStarDict
2010-05-31 11:08 . 2009-03-07 18:13
d
w- c:program filesVistaDriveIcon
2010-05-28 13:43 . 2010-02-22 11:19
d
w- c:documents and settingsАдминистраторApplication DataCanon
2010-05-26 10:43 . 2010-05-26 10:43
d
w- c:program filesAlwil Software
2010-05-26 10:43 . 2010-05-26 10:43
d
w- c:documents and settingsAll UsersApplication DataAlwil Software
2010-05-25 13:30 . 2009-10-03 09:51
d
w- c:program filesCommon FilesDoctor Web
2010-05-25 08:52 . 2010-05-25 08:52
d
w- c:program filesAttansic
2010-05-25 08:52 . 2009-03-08 11:08
d—h—w- c:program filesInstallShield Installation Information
2010-05-23 16:54 . 2010-05-23 16:54
d
w- c:program filesOpera
2010-05-22 11:32 . 2010-05-22 11:20
d
w- c:program filesMaxthon2
2010-05-22 11:20 . 2010-05-22 11:20
d
w- c:documents and settingsАдминистраторApplication DataMxBoost
2010-05-20 14:34 . 2010-05-20 05:06
d
w- c:program filesStarDict
2010-05-19 11:58 . 2010-05-19 11:58
d
w- c:program filesConduit
2010-05-19 11:52 . 2010-05-19 11:52
d
w- c:documents and settingsAll UsersApplication DataBabylon
2010-05-19 11:52 . 2010-05-19 11:52
d
w- c:documents and settingsАдминистраторApplication DataBabylon
2010-05-18 13:44 . 2010-05-18 13:44
d—h—w- c:documents and settingsAll UsersApplication DataCanonBJ
2010-05-18 13:39 . 2010-05-18 13:39
d—h—w- c:program filesCanonBJ
2010-05-18 07:08 . 2010-05-18 07:08
d
w- c:documents and settingsAll UsersApplication DataPRMT
2010-05-17 11:13 . 2010-05-17 11:03
d
w- c:program filesDirectX
2010-05-17 11:12 . 2009-05-12 11:54 418480 —-a-w- c:windowssystem32wrap_oal.dll
2010-05-17 11:12 . 2009-05-12 11:54 115432 —-a-w- c:windowssystem32OpenAL32.dll
2010-05-17 11:09 . 2009-11-24 13:47
d
w- c:program filesuTorrent
2010-05-15 10:04 . 2010-04-27 23:51 162816 —-a-w- c:windowssystem32fmod.dll
2010-05-09 13:50 . 2010-05-09 13:50 75 —-a-w- c:windowssystem32nvUnsupRes.dat
2010-05-08 04:01 . 2009-11-29 11:26
d
w- c:program filesEnglish-easy.info
2010-05-08 04:01 . 2009-06-27 12:05
d
w- c:program filesDownload Master
2010-05-06 20:59 . 2010-05-26 10:43 38848 —-a-w- c:windowssystem32avastSS.scr
2010-05-06 20:59 . 2010-05-26 10:43 165032 —-a-w- c:windowssystem32aswBoot.exe
2010-05-06 20:41 . 2010-05-26 10:43 99280 —-a-w- c:windowssystem32driversaswFW.sys
2010-05-06 20:41 . 2010-05-26 10:43 307280 —-a-w- c:windowssystem32driversaswSnx.sys
2010-05-06 20:40 . 2010-05-26 10:43 190416 —-a-w- c:windowssystem32driversaswNdis2.sys
2010-05-06 20:39 . 2010-05-26 10:43 46672 —-a-w- c:windowssystem32driversaswTdi.sys
2010-05-06 20:39 . 2010-05-26 10:43 164048 —-a-w- c:windowssystem32driversaswSP.sys
2010-05-06 20:34 . 2010-05-26 10:43 23376 —-a-w- c:windowssystem32driversaswRdr.sys
2010-05-06 20:33 . 2010-05-26 10:43 100432 —-a-w- c:windowssystem32driversaswmon2.sys
2010-05-06 20:33 . 2010-05-26 10:43 94800 —-a-w- c:windowssystem32driversaswmon.sys
2010-05-06 20:33 . 2010-05-26 10:43 19024 —-a-w- c:windowssystem32driversaswFsBlk.sys
2010-05-06 20:33 . 2010-05-26 10:43 28880 —-a-w- c:windowssystem32driversaavmker4.sys
2010-05-04 17:11 . 2008-04-25 14:42 841216 —-a-w- c:windowssystem32wininet.dll
2010-05-04 17:11 . 2008-04-15 12:00 78336 —-a-w- c:windowssystem32ieencode.dll
2010-05-04 17:11 . 2008-04-15 12:00 17408 —-a-w- c:windowssystem32corpol.dll
2010-05-02 08:03 . 2010-04-03 08:35 1860480 —-a-w- c:windowssystem32win32k.sys
2010-04-30 07:13 . 2009-03-11 08:45
d
w- c:documents and settingsAll UsersApplication DataMicrosoft Help
2010-04-20 05:38 . 2008-04-15 12:00 285824 —-a-w- c:windowssystem32atmfd.dll
2010-04-06 11:14 . 2010-04-06 11:14 315392 —-a-w- c:windowsHideWin.exe
2010-03-30 16:16 . 2010-03-30 16:16 99176 —-a-w- c:windowssystem32PresentationHostProxy.dll
2010-03-30 16:10 . 2010-03-30 16:10 295264 —-a-w- c:windowssystem32PresentationHost.exe
2008-09-23 08:53 . 2008-09-23 08:53 39 —-a-w- c:program filesCD.INF
2008-08-28 14:06 . 2009-06-09 15:43 4743112 —-a-w- c:program filesdaemon4301-lite.exe
2008-03-09 04:25 . 2010-03-10 14:13 236 —ha-w- c:program filesCommon Filesdx.reg
2006-12-18 17:05 . 2006-12-18 17:05 23510720 —-a-w- c:program filesdotnetfx20.exe
2006-05-16 10:02 . 2006-05-16 10:02 6512 —-a-w- c:program filesx0419.ini
2006-05-16 09:58 . 2006-05-16 09:58 2584848 —-a-w- c:program filesWindowsInstaller-KB893803-x86.exe
.
Sigcheck
[-] 2009-07-16 . 038CA45522FE9B756EFB90DBFA9141EA . 361600 . . [5.1.2600.5649] . . c:windowssystem32driverstcpip.sys
[7] 2008-07-28 . 367DE8E5F638C091F49273144274F629 . 361600 . . [5.1.2600.5649] . . c:windowssystem32dllcachetcpip.sys
[-] 2008-04-25 . E506465BFB0821DC33077E29FD184E31 . 691200 . . [5.82] . . c:windowssystem32comctl32.dll
[-] 2008-04-25 . 371C41F777924F3EA3BFAD18C6A04502 . 584192 . . [5.1.2600.5512] . . c:windowssystem32user32.dll
[-] 2008-04-25 . 1C079017E180FB9AB4B56AA8F896F708 . 1571840 . . [5.1.2600.5512] . . c:windowssystem32sfcfiles.dll
[-] 2008-04-25 . 0CE07543B08FD1E209D99D504076102B . 17408 . . [5.1.2600.5512] . . c:windowssystem32ctfmon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]
«{3f8db0d0-d707-4e74-a1f7-d00c40dfb6cc}»= «c:program filesEnglish-easy.infotbEng1.dll» [2010-05-08 2349080]
[HKEY_CLASSES_ROOTclsid{3f8db0d0-d707-4e74-a1f7-d00c40dfb6cc}]
[HKEY_LOCAL_MACHINE~Browser Helper Objects{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-11-18 08:58 333192 —-a-w- c:program filesAskBarDisbarbinaskBar.dll
[HKEY_LOCAL_MACHINE~Browser Helper Objects{3f8db0d0-d707-4e74-a1f7-d00c40dfb6cc}]
2010-05-08 04:03 2349080 —-a-w- c:program filesEnglish-easy.infotbEng1.dll
[HKEY_LOCAL_MACHINE~Browser Helper Objects{9B5FB65F-631E-4564-ABF2-AD71845B28E0}]
2009-08-05 16:07 215040 —-a-w- c:program filesGet-Styles 2.0iejsloader.dll
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{3041d03e-fd4b-44e0-b742-2d9b88305f98}»= «c:program filesAskBarDisbarbinaskBar.dll» [2008-11-18 333192]
«{5BCDC9E9-A980-4B53-B2E8-60CFF484DA61}»= «c:program filesGet-Styles 2.0ietoolbar.dll» [2009-07-28 122368]
«{3f8db0d0-d707-4e74-a1f7-d00c40dfb6cc}»= «c:program filesEnglish-easy.infotbEng1.dll» [2010-05-08 2349080]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2010-06-01 10336584]
[HKEY_CLASSES_ROOTclsid{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOTTypeLib{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CLASSES_ROOTclsid{5bcdc9e9-a980-4b53-b2e8-60cff484da61}]
[HKEY_CLASSES_ROOTScriptedStar.Bar.2]
[HKEY_CLASSES_ROOTTypeLib{B124F09B-1B6C-431D-BE2D-DBA6864A8897}]
[HKEY_CLASSES_ROOTScriptedStar.Bar]
[HKEY_CLASSES_ROOTclsid{3f8db0d0-d707-4e74-a1f7-d00c40dfb6cc}]
[HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar]
[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{3F8DB0D0-D707-4E74-A1F7-D00C40DFB6CC}»= «c:program filesEnglish-easy.infotbEng1.dll» [2010-05-08 2349080]
«{3041D03E-FD4B-44E0-B742-2D9B88305F98}»= «c:program filesAskBarDisbarbinaskBar.dll» [2008-11-18 333192]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2010-06-01 10336584]
[HKEY_CLASSES_ROOTclsid{3f8db0d0-d707-4e74-a1f7-d00c40dfb6cc}]
[HKEY_CLASSES_ROOTclsid{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOTTypeLib{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifierssnxPluginsShell]
@=»{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}»
[HKEY_CLASSES_ROOTCLSID{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}]
2010-05-06 21:02 151648 —-a-w- c:program filesAlwil SoftwareAvast5snxPlugins.dll
[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«DAEMON Tools Lite»=»c:program filesDAEMON Tools Litedaemon.exe» [2008-07-24 490952]
«uTorrent»=»c:program filesuTorrentuTorrent.exe» [2010-05-17 322352]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2010-03-15 110696]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2010-03-15 13670504]
«RTHDCPL»=»RTHDCPL.EXE» [2007-03-21 16126464]
«avast5″=»c:progra~1ALWILS~1Avast5avastUI.exe» [2010-05-06 2815192]
[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-25 17408]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]
«SynchronousMachineGroupPolicy»= 0 (0x0)
«SynchronousUserGroupPolicy»= 0 (0x0)
[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoThumbnailCache»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)
«NoSMHelp»= 1 (0x1)
[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoThumbnailCache»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)
«NoSMHelp»= 1 (0x1)
[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicestcpipparameterspersistentroutes]
«172.19.224.0,255.255.240.0,10.19.240.129,1»=»»
«172.26.80.0,255.255.240.0,10.19.240.129,1»=»»
«172.19.220.0,255.255.252.0,10.19.240.129,1»=»»
«80.82.189.32,255.255.255.224,10.19.240.129,1»=»»
«62.33.58.0,255.255.254.0,10.19.240.129,1»=»»
«188.92.0.0,255.255.240.0,10.19.240.129,1»=»»
«84.22.139.224,255.255.255.240,10.19.240.129,1»=»»
[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetcontrolsession manager]
BootExecute REG_MULTI_SZ autocheck autochk *OODBS
[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusOverride»=dword:00000001
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«c:\Program Files\uTorrent\uTorrent.exe»=
«e:\Юлия\стронг\FlyLink Telemax Edition\FlylinkDC.exe»=
«d:\GAME\Binaries\Borderlands.exe»=
«c:\Documents and Settings\Администратор\Рабочий стол\utorrent.exe»=
«c:\Program Files\Opera\Opera.exe»=
«d:\GAME\PCGAME\RACE DRIVER GRID\GRID.exe»=
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«31809:TCP»= 31809:TCP
R0 aswNdis;avast! Firewall NDIS Filter Service;c:windowssystem32driversaswNdis.sys [26.05.2010 18:43 12112]
R0 aswNdis2;avast! Firewall Core Firewall Service;c:windowssystem32driversaswNdis2.sys [26.05.2010 18:43 190416]
R0 pe3ag8jb;Xpand Rally Xtreme Environment Driver (pe3ag8jb);c:windowssystem32driverspe3ag8jb.sys [09.02.2007 15:46 65424]
R0 ps6ag8jb;Xpand Rally Xtreme Synchronization Driver (ps6ag8jb);c:windowssystem32driversps6ag8jb.sys [09.02.2007 15:45 51608]
R1 appdrv01;Application Driver (01);c:windowssystem32driversappdrv01.sys [24.06.2010 4:36 2915944]
R1 aswFW;avast! TDI Firewall driver;c:windowssystem32driversaswFW.sys [26.05.2010 18:43 99280]
R1 aswSnx;aswSnx;c:windowssystem32driversaswSnx.sys [26.05.2010 18:43 307280]
R1 aswSP;aswSP;c:windowssystem32driversaswSP.sys [26.05.2010 18:43 164048]
R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [26.05.2010 18:43 19024]
R2 avast! Firewall;avast! Firewall;c:program filesAlwil SoftwareAvast5afwServ.exe [26.05.2010 18:43 119200]
R2 d348prt;Daemon Tools Bus;c:windowssystem32driversd348prt.sys [24.05.2009 4:43 2081792]
R2 LoviVkontakteService;LoviVkontake Service;d:славаLoviVkontakteVkontakteService.exe [18.06.2010 19:32 477184]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:windowssystem32driversatl01_xp.sys [08.03.2009 3:49 38656]
R3 FStarForce;FStarForce;c:windowssystem32driversFStarForce.sys [23.06.2010 18:59 7680]
R3 GrdKey;Guardant LPT Dongle Service;c:windowssystem32driversgrdkey.sys [08.11.2007 23:44 1189888]
R3 GrdUsb;Guardant USB Dongle Service;c:windowssystem32driversgrdusb.sys [24.05.2009 4:43 1112832]
S2 appdrvrem01;Application Driver Auto Removal Service (01);c:windowsSystem32appdrvrem01.exe svc —> c:windowsSystem32appdrvrem01.exe svc [?]
S2 d348bus;d348bus;c:windowssystem32driversd348bus.SYS —> c:windowssystem32driversd348bus.SYS [?]
S2 pr2ag8jb;Xpand Rally Xtreme Drivers Auto Removal (pr2ag8jb);c:windowssystem32pr2ag8jb.exe svc —> c:windowssystem32pr2ag8jb.exe svc [?]
S3 ASTSRV;Nalpeiron Licensing Service;c:windowssystem32ASTSRV.EXE [09.04.2009 23:00 57344]
S4 sptd;sptd;c:windowssystem32driverssptd.sys [08.03.2009 2:13 721904]
.
.
Supplementary Scan
.
uStart Page = hxxp://www.yandex.ru/?clid=121806
IE: Закачать ВСЕ при помощи Download Master — c:program filesDownload Masterdmieall.htm
IE: Закачать при помощи Download Master — c:program filesDownload Masterdmie.htm
IE: Передать на удаленную закачку DM — c:program filesDownload Masterremdown.htm
IE: Поиск в Интернете — c:program filesPRMT8PRMTIEsearch.htm
IE: Поиск@Mail.Ru — c:program filesmail.rusputnikMailRuSputnik.dll/282
IE: Словари@Mail.Ru — c:program filesmail.rusputnikMailRuSputnik.dll/283
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:program filesMail.RuAgentmagent.exe
IE: {{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — {3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} —
Handler: base64 — {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} — c:program filesGet-Styles 2.0ietdataprotocol.dll
Handler: chrome — {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} — c:program filesGet-Styles 2.0ietdataprotocol.dll
.
— — — — ORPHANS REMOVED — — — —
WebBrowser-{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — (no file)
HKU-Default-Run-VistaIcon — c:program filesVistaDriveIconVistaDrv.exe
AddRemove-DeleteProdRunControl_UK — c:viavoiceBinvunUK.exe
AddRemove-fastInstall — c:docume~19335~1LOCALS~1TempfastInstallUninstall.exe
AddRemove-Gold Wave Editor Pro_is1 — e:обработка звукаGold Wave Editor 10.5.5Gold Wave Editor Prounins000.exe
AddRemove-Magic Video Studio_is1 — e:обработка звукаНовая папкаMagic Video Studiounins000.exe
AddRemove-mission 1.0_is1 — d:gamesmissionunins000.exe
AddRemove-NewProduct 1.00 — c:program filesCompanyNewProductUninstall.exe
AddRemove-OperaAC — c:program filesOperaACUninstall.exe
AddRemove-Говорит и показывает Фотошоп_is1 — c:photoshoptvunins000.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-27 18:02
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(1144)
c:windowssystem32COMRes.dll
c:windowssystem32cscui.dll
.
Completion time: 2010-06-27 18:03:21
ComboFix-quarantined-files.txt 2010-06-27 10:03
Pre-Run: 38 205 042 688 байт свободно
Post-Run: 38 282 747 904 байт свободно
Current=5 Default=5 Failed=4 LastKnownGood=6 Sets=1,2,3,4,5,6
— — End Of File — — CE8C774AD9DC59172C8D306921A39E5B
