Вот лог-файл. Думаю, что уже всё в порядке с моим компьютером. 🙂 Кстати, перед установкой ComboFix я удалила свой антивирус AVG Free 8.0. Теперь хочу установить какой-нибудь получше, чтобы в дальнейшем не возникало проблем. Посоветуйте что-нибудь. 💡
ComboFix 09-04-24.01 — Root 24.04.2009 16:59.1 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.1023.653 [GMT 3:00]
Running from: c:documents and settingsRootРабочий столComboFix.exe
Command switches used :: c:documents and settingsRootРабочий столWindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr0.dat
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr1.dat
c:windowsIE4 Error Log.txt
c:windowssystem32_000006_.tmp.dll
c:windowssystem32tmp12.tmp
c:windowssystem32tmp13.tmp
BITS: Possible infected sites
hxxp://soft.export.yandex.ru
hxxp://download.yandex.ru
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
Legacy_OREANS32
Service_oreans32
((((((((((((((((((((((((( Files Created from 2009-05-24 to 2009-4-24 )))))))))))))))))))))))))))))))
.
8200-05-08 10:50 . 8200-05-08 10:50 99 —-a-w c:windowsWSIMFARM.INI
2009-04-24 14:05 . 2009-04-24 14:05 53248 -c—a-w c:tempcatchme.dll
2009-04-24 14:03 . 2009-04-24 14:03
dc—-w c:tempWPDNSE
2009-04-24 14:00 . 2009-04-24 14:00 60416 —-a-w c:tempPerflib_Perfdata__755.dat
2009-04-23 17:39 . 2009-04-23 19:48
dc—-w c:tempmsohtml1
2009-04-23 17:39 . 2009-04-23 17:39
dc—-w c:tempmsohtml
2009-04-23 13:13 . 2009-04-23 13:13
dc—-w c:program filesAlawar.ru
2009-04-22 16:07 . 2009-04-24 14:00
dc—-w c:tempoutlook logging
2009-04-17 14:32 . 2009-04-17 14:32
dc—-w c:tempfontconfig
2009-04-15 18:17 . 2009-04-15 18:17 33952 —-a-w c:windowssystem32driversoreans32.sys
2009-04-15 17:27 . 2009-02-06 10:10 227840 -c—-w c:windowssystem32dllcachewmiprvse.exe
2009-04-15 17:27 . 2009-03-06 14:23 284672 -c—-w c:windowssystem32dllcachepdh.dll
2009-04-15 17:27 . 2009-02-09 11:25 111104 -c—-w c:windowssystem32dllcacheservices.exe
2009-04-15 17:27 . 2009-02-09 10:54 401408 -c—-w c:windowssystem32dllcacherpcss.dll
2009-04-15 17:27 . 2009-02-09 10:54 473600 -c—-w c:windowssystem32dllcachefastprox.dll
2009-04-15 17:27 . 2009-02-09 10:54 687616 -c—-w c:windowssystem32dllcacheadvapi32.dll
2009-04-15 17:27 . 2009-02-09 10:54 731136 -c—-w c:windowssystem32dllcachelsasrv.dll
2009-04-15 17:27 . 2009-02-09 10:54 718848 -c—-w c:windowssystem32dllcachentdll.dll
2009-04-15 17:27 . 2009-02-09 10:54 453120 -c—-w c:windowssystem32dllcachewmiprvsd.dll
2009-04-15 17:25 . 2009-03-27 06:58 1203922 -c—-w c:windowssystem32dllcachesysmain.sdb
2009-04-15 17:25 . 2008-04-21 21:15 218624 -c—-w c:windowssystem32dllcachewordpad.exe
2009-04-15 17:14 . 2009-04-15 17:14
d
w C:_OTMoveIt
2009-04-14 13:56 . 2009-04-14 13:56
d
w c:documents and settingsRootApplication Dataanv1E
2009-04-14 13:49 . 2009-04-14 13:49
d
w c:documents and settingsRootApplication DataanvB
2009-04-14 13:29 . 2009-04-14 13:29
d
w c:documents and settingsRootApplication Dataanv62
2009-04-14 13:24 . 2009-04-14 13:24
d
w c:documents and settingsRootApplication DataanvB0
2009-04-13 18:20 . 2009-04-13 18:20
d
w c:documents and settingsRootApplication Dataanv5D
2009-04-13 18:05 . 2009-04-13 18:05
d
w c:documents and settingsRootApplication DataanvC6
2009-04-13 18:01 . 2009-04-20 18:41
dc—-w c:program filestrend micro
2009-04-13 18:01 . 2009-04-13 18:02
d
w C:rsit
2009-04-13 17:06 . 2009-04-13 17:06
d
w c:documents and settingsRootApplication DataMalwarebytes
2009-04-13 17:06 . 2009-04-06 12:32 15504 —-a-w c:windowssystem32driversmbam.sys
2009-04-13 17:06 . 2009-04-06 12:32 38496 —-a-w c:windowssystem32driversmbamswissarmy.sys
2009-04-13 17:06 . 2009-04-13 17:06
dc—-w c:program filesMalwarebytes’ Anti-Malware
2009-04-13 17:06 . 2009-04-13 17:06
dc—-w c:documents and settingsAll UsersApplication DataMalwarebytes
2009-04-13 16:52 . 2009-04-13 16:52
d
w c:documents and settingsRootApplication DataanvB4
2009-04-13 15:25 . 2009-04-13 15:25
d
w c:documents and settingsRootApplication DataanvA7
2009-04-12 20:21 . 2009-04-12 20:21
d
w c:documents and settingsRootApplication Dataanv23
2009-04-12 09:35 . 2009-04-12 09:35
d
w c:documents and settingsRootApplication DataanvA5
2009-04-12 09:30 . 2009-04-12 09:30
d
w c:documents and settingsRootApplication DataanvB5
2009-04-12 09:20 . 2009-04-12 09:20
d
w c:documents and settingsRootApplication Dataanv6C
2009-04-12 09:15 . 2009-04-12 09:15
d
w c:documents and settingsRootApplication DataanvA0
2009-04-12 09:05 . 2009-04-12 09:05
d
w c:documents and settingsRootApplication DataanvD5
2009-04-11 12:26 . 2009-04-11 12:26
d
w c:documents and settingsRootApplication Dataanv12
2009-04-11 12:11 . 2009-04-11 12:11
d
w c:documents and settingsRootApplication Dataanv66
2009-04-11 10:39 . 2009-04-11 10:39
d
w c:documents and settingsRootApplication DataanvFB
2009-04-11 08:12 . 2009-04-11 08:12
d
w c:documents and settingsRootApplication DataanvAF
2009-04-10 20:31 . 2009-04-10 20:31
d
w c:documents and settingsRootApplication Dataanv80
2009-04-03 15:28 . 2009-04-03 15:28
d-sh—w c:documents and settingsRootIECompatCache
2009-04-03 15:28 . 2009-04-03 15:28
d
w C:Сервіси Яндекса
2009-04-03 15:27 . 2009-04-03 15:27
d-sh—w c:documents and settingsRootPrivacIE
2009-04-03 15:26 . 2009-04-03 15:26
dcsh—w c:documents and settingsLocalServiceIETldCache
2009-04-03 15:23 . 2009-04-03 15:23
d-sh—w c:documents and settingsRootIETldCache
2009-04-03 15:21 . 2009-04-03 15:21
d—h—w c:windowsmsdownld.tmp
2009-04-03 15:19 . 2009-04-03 15:20
dc-h—w c:windowsie8
2009-04-02 15:47 . 2009-04-02 15:47
d
w c:documents and settingsRootLocal SettingsApplication DataInstaller2896
2009-04-02 15:30 . 2009-04-02 15:31
d
w c:documents and settingsRootLocal SettingsApplication DataInstaller4060
2009-04-02 14:18 . 2009-04-07 10:43 3 —-a-w c:windowsTwain001.Mtx
2009-04-02 14:18 . 2009-04-07 10:42 156 —-a-w c:windowsTwunk001.MTX
2009-04-02 14:18 . 2009-04-02 14:18 0 —-a-w c:windowsTwunk002.MTX
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-24 09:58 . 2009-01-22 17:22
dc—-w c:documents and settingsAll UsersApplication Dataavg8
2009-04-23 13:14 . 2009-02-12 19:08
dc—-w c:documents and settingsAll UsersApplication DataAlawarWrapper
2009-04-22 16:07 . 2004-08-18 12:00 90464 —-a-w c:windowssystem32perfc019.dat
2009-04-22 16:07 . 2004-08-18 12:00 501070 —-a-w c:windowssystem32perfh019.dat
2009-04-20 18:39 . 2009-04-20 18:39 1778 -c—a-w C:avenger.txt
2009-04-18 11:29 . 2009-02-15 13:34
d
w c:documents and settingsRootApplication Datagtk-2.0
2009-04-17 13:35 . 2007-11-08 07:01 73328 —-a-w c:documents and settingsRootLocal SettingsApplication DataGDIPFONTCACHEV1.DAT
2009-04-13 16:18 . 2007-11-08 07:10
dc-h—w c:program filesInstallShield Installation Information
2009-04-13 16:07 . 2008-12-17 10:19
d
w c:documents and settingsRootApplication DatauTorrent
2009-04-13 15:38 . 2009-03-18 20:32
dc—-w c:program filesGoogle
2009-04-11 13:52 . 2009-03-20 16:01
dc—-w c:program filesArtweaver 0.5
2009-04-02 14:20 . 2009-04-02 14:20 162 -c—a-w C:FONTLOG.TXT
2009-04-02 11:25 . 2009-03-19 16:01
dc—-w c:program filesСтудия Эффектов
2009-03-31 18:14 . 2009-03-23 18:52
d
w c:documents and settingsRootApplication DataGearbox Software
2009-03-19 14:13 . 2009-02-14 16:12
dc—-w c:program filesGIMP-2.0
2009-03-15 13:23 . 2008-05-19 11:39
dc—-w c:program filesCommon FilesWise Installation Wizard
2009-03-12 15:27 . 2009-03-12 15:26
dc—-w c:program filesCommon FilesOutlook Security Manager
2009-03-08 01:34 . 2007-03-20 17:21 914944 —-a-w c:windowssystem32wininet.dll
2009-03-08 01:34 . 2004-08-18 12:00 43008 —-a-w c:windowssystem32licmgr10.dll
2009-03-08 01:33 . 2004-08-18 12:00 18944 —-a-w c:windowssystem32corpol.dll
2009-03-08 01:33 . 2007-03-20 14:17 420352 —-a-w c:windowssystem32vbscript.dll
2009-03-08 01:32 . 2004-08-18 12:00 72704 —-a-w c:windowssystem32admparse.dll
2009-03-08 01:32 . 2004-08-18 12:00 71680 —-a-w c:windowssystem32iesetup.dll
2009-03-08 01:31 . 2004-08-18 12:00 34816 —-a-w c:windowssystem32imgutil.dll
2009-03-08 01:31 . 2004-08-18 12:00 48128 —-a-w c:windowssystem32mshtmler.dll
2009-03-08 01:31 . 2004-08-18 12:00 45568 —-a-w c:windowssystem32mshta.exe
2009-03-08 01:22 . 2004-08-18 12:00 156160 —-a-w c:windowssystem32msls31.dll
2009-03-07 16:15 . 2008-11-25 16:00
dc—-w c:program filesCommon FilesAdobe
2009-03-06 14:23 . 2004-08-18 12:00 284672 —-a-w c:windowssystem32pdh.dll
2009-03-03 17:32 . 2009-03-03 17:33 410984 —-a-w c:windowssystem32deploytk.dll
2009-03-03 17:32 . 2007-11-15 15:45
dc—-w c:program filesJava
2009-02-10 16:09 . 2006-12-19 23:47 2067840 —-a-w c:windowssystem32ntkrnlpa.exe
2009-02-09 14:07 . 2007-03-20 14:17 1846912 —-a-w c:windowssystem32win32k.sys
2009-02-09 11:26 . 2007-03-20 17:22 2190848 —-a-w c:windowssystem32ntoskrnl.exe
2009-02-09 11:25 . 2004-08-18 12:00 111104 —-a-w c:windowssystem32services.exe
2009-02-09 10:54 . 2007-03-20 14:15 731136 —-a-w c:windowssystem32lsasrv.dll
2009-02-09 10:54 . 2007-03-20 14:18 401408 —-a-w c:windowssystem32rpcss.dll
2009-02-09 10:54 . 2004-08-18 12:00 687616 —-a-w c:windowssystem32advapi32.dll
2009-02-09 10:54 . 2006-06-17 07:20 718848 —-a-w c:windowssystem32ntdll.dll
2009-02-06 10:39 . 2004-08-18 12:00 35328 —-a-w c:windowssystem32sc.exe
2009-02-03 20:33 . 2009-02-03 20:33 59981528 -c—a-w c:program filesavg_free_stf_en_8_233a1415.exe
2009-02-03 19:58 . 2004-08-18 12:00 56832 —-a-w c:windowssystem32secur32.dll
2009-02-03 19:30 . 2009-02-03 16:14 66872 —-a-w c:windowssystem32PnkBstrA.exe
2008-11-09 13:31 . 2008-11-09 13:30 2959376 -c—a-w c:program filesdotnetfx35setup.exe
2008-10-28 16:57 . 2008-10-28 16:57 32768 —sha-w c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5MSHist012008102820081029index.dat
.
Sigcheck
[-] 2008-04-14 16:11 14336 E948A9079D0E6350BE92D4D3E0077F81 c:windowsServicePackFilesi386svchost.exe
[-] 2008-04-14 16:11 14336 E948A9079D0E6350BE92D4D3E0077F81 c:windowssystem32svchost.exe
[-] 2008-04-14 16:10 579072 A9CDF92EA1CFFB67448EF26F5DF21A6F c:windowsServicePackFilesi386user32.dll
[-] 2008-04-14 16:10 579072 A9CDF92EA1CFFB67448EF26F5DF21A6F c:windowssystem32user32.dll
[-] 2008-04-14 16:10 82432 5E2915645A0D139519A99F0F95437D96 c:windowsServicePackFilesi386ws2_32.dll
[-] 2008-04-14 16:10 82432 5E2915645A0D139519A99F0F95437D96 c:windowssystem32ws2_32.dll
[-] 2007-10-30 16:53 360832 64798ECFA43D78C7178375FCDD16D8C8 c:windows$hf_mig$KB941644SP2QFEtcpip.sys
[-] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:windows$hf_mig$KB951748SP3GDRtcpip.sys
[-] 2008-06-20 11:59 361600 AD978A1B783B5719720CFF204B666C8E c:windows$hf_mig$KB951748SP3QFEtcpip.sys
[-] 2008-04-13 19:20 361344 93EA8D04EC73A85DB02EB8805988F733 c:windowsServicePackFilesi386tcpip.sys
[-] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:windowssystem32dllcachetcpip.sys
[-] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:windowssystem32driverstcpip.sys
[-] 2008-04-14 16:11 509440 B3B5D5855127E240C88451030AAEE76E c:windowsServicePackFilesi386winlogon.exe
[-] 2008-04-14 16:11 509440 B3B5D5855127E240C88451030AAEE76E c:windowssystem32winlogon.exe
[-] 2008-04-13 19:20 182656 1DF7F42665C94B825322FAE71721130D c:windowsServicePackFilesi386ndis.sys
[-] 2008-04-13 19:20 182656 1DF7F42665C94B825322FAE71721130D c:windowssystem32driversndis.sys
[-] 2008-04-13 18:53 36608 3BB22519A194418D5FEC05D800A19AD0 c:windowsServicePackFilesi386ip6fw.sys
[-] 2008-04-13 18:53 36608 3BB22519A194418D5FEC05D800A19AD0 c:windowssystem32driversip6fw.sys
[-] 2008-04-14 16:10 1034240 847C01CA71883702CC7445364DD9D097 c:windowsexplorer.exe
[-] 2007-06-13 13:11 1033728 A1BFBE52E8865C5641AC6EB1CEE8DB26 c:windows$hf_mig$KB938828SP2QFEexplorer.exe
[-] 2008-04-14 16:10 1034240 847C01CA71883702CC7445364DD9D097 c:windowsServicePackFilesi386explorer.exe
[-] 2008-04-14 16:10 13312 17C1AC326238EFADF17A0612AFD822AD c:windowsServicePackFilesi386lsass.exe
[-] 2008-04-14 16:10 13312 17C1AC326238EFADF17A0612AFD822AD c:windowssystem32lsass.exe
[-] 2008-04-14 16:10 15360 B5DC70BB43A14093E00C5A735CC5DFD4 c:windowsServicePackFilesi386ctfmon.exe
[-] 2008-04-14 16:10 15360 B5DC70BB43A14093E00C5A735CC5DFD4 c:windowssystem32ctfmon.exe
[-] 2008-04-14 16:11 57856 0139187CDD1B598B6CBB235517117832 c:windowsServicePackFilesi386spoolsv.exe
[-] 2008-04-14 16:11 57856 0139187CDD1B598B6CBB235517117832 c:windowssystem32spoolsv.exe
[-] 2008-04-14 16:11 26624 4F88778DD0CD6B99FCDA408E16B36AE7 c:windowsServicePackFilesi386userinit.exe
[-] 2008-04-14 16:11 26624 4F88778DD0CD6B99FCDA408E16B36AE7 c:windowssystem32userinit.exe
[-] 2008-04-14 16:10 295936 804A741E1806E8C33C8C642781896C0D c:windowsServicePackFilesi386termsrv.dll
[-] 2008-04-14 16:10 295936 804A741E1806E8C33C8C642781896C0D c:windowssystem32termsrv.dll
[-] 2008-04-14 16:10 17408 DDDB63DB4C327CA3996AD326C1A8B8D4 c:windowsServicePackFilesi386powrprof.dll
[-] 2008-04-14 16:10 17408 DDDB63DB4C327CA3996AD326C1A8B8D4 c:windowssystem32powrprof.dll
[-] 2008-04-14 16:10 110080 A9690FD601E9F5102F0D3388DF6081BD c:windowsServicePackFilesi386imm32.dll
[-] 2008-04-14 16:10 110080 A9690FD601E9F5102F0D3388DF6081BD c:windowssystem32imm32.dll
[-] 2008-04-14 16:10 1571840 4379CA978CB35BB2458156B2B6CB35DF c:windowsServicePackFilesi386sfcfiles.dll
[-] 2008-04-14 16:10 1571840 4379CA978CB35BB2458156B2B6CB35DF c:windowssystem32sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2009-03-24 3697952]
[HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar]
[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2009-03-24 3697952]
[HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar]
[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2004-11-13 205824]
«ctfmon.exe»=»c:windowssystem32ctfmon.exe» [2008-04-14 15360]
«EDLauncher»=»c:program filesPRMT8PRMTEDEDLauncher.exe» [2007-03-14 118784]
«MSMSGS»=»c:program filesMessengermsmsgs.exe» [2008-04-14 1695232]
«DAEMON Tools Lite»=»c:program filesDAEMON Tools Litedaemon.exe» [2008-04-01 486856]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2008-12-02 13680640]
«Safonov DuTraffic»=»c:program filesSafHouseDUTrafficDUTraffic.exe» [2004-10-02 1393664]
«SunJavaUpdateSched»=»c:program filesJavajre6binjusched.exe» [2009-03-03 136600]
«ISUSPM»=»c:program filesCommon FilesInstallShieldUpdateServiceisuspm.exe» [2006-05-16 213936]
«WinampAgent»=»c:program filesWinampwinampa.exe» [2006-09-26 35328]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2008-12-02 86016]
«Adobe Reader Speed Launcher»=»c:program filesAdobeReader 8.0ReaderReader_sl.exe» [2008-01-11 39792]
«NevoDRM»=»c:игры от nevosoftNevoDRMNevoDRM.exe» [2008-12-11 41984]
«SoundMan»=»SOUNDMAN.EXE» — c:windowsSOUNDMAN.EXE [2004-11-15 77824]
«nwiz»=»nwiz.exe» — c:windowssystem32nwiz.exe [2008-12-02 1657376]
[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«nltide_3″=»advpack.dll» — c:windowssystem32advpack.dll [2009-03-08 128512]
c:documents and settingsAll Usersѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
TMTray.lnk — f:program fileseSMSeMMSOEBinTMTray.exe [2008-6-30 1028096]
Windows Search.lnk — c:program filesWindows Desktop SearchWindowsSearch.exe [2008-5-26 123904]
[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMMyPictures»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)
[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMMyPictures»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)
«NoSMHelp»= 1 (0x1)
[hkey_local_machinesoftwaremicrosoftwindowscurrentversionexplorerShellExecuteHooks]
«{56F9679E-7826-4C84-81F3-532071A8BCC5}»= «c:program filesWindows Desktop SearchMSNLNamespaceMgr.dll» [2008-05-26 304128]
«{E1B51DF9-6548-4673-AE63-4EFA313E5907}»= «f:program fileseSMSeMMSOEBinTMShell.dll» [2008-06-30 176128]
HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32
«wave1″= serwvdrv.dll
[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«AntiVirusOverride»=dword:00000001
«FirewallOverride»=dword:00000001
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«c:\WINDOWS\system32\PnkBstrA.exe»=
«c:\WINDOWS\system32\PnkBstrB.exe»=
«d:\Program Files\COL-4\iw3mp.exe»=
«d:\Program Files\MOHPA\mohpa.exe»=
«c:\Program Files\Messenger\msmsgs.exe»=
«c:\Program Files\uTorrent [tfile.ru]\utorrent.exe»=
«f:\Program Files\3\Soldier Of Fortune — Payback\sof3.exe»=
«c:\Program Files\Artweaver 0.5\Artweaver.exe»=
«c:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe»=
«c:\WINDOWS\regedit.exe»=
«c:\Program Files\GIMP-2.0\lib\gimp\2.0\plug-ins\script-fu.exe»=
«c:\Program Files\GIMP-2.0\lib\gimp\2.0\plug-ins\blur-gauss-selective.exe»=
«c:\Program Files\GIMP-2.0\lib\gimp\2.0\plug-ins\noise-randomize.exe»=
«c:\Program Files\GIMP-2.0\lib\gimp\2.0\plug-ins\sharpen.exe»=
«c:\Program Files\GIMP-2.0\lib\gimp\2.0\plug-ins\wind.exe»=
«c:\Program Files\GIMP-2.0\lib\gimp\2.0\plug-ins\displace.exe»=
«c:\Program Files\GIMP-2.0\lib\gimp\2.0\plug-ins\blur-motion.exe»=
«c:\Program Files\GIMP-2.0\lib\gimp\2.0\plug-ins\pixelize.exe»=
«c:\Program Files\GIMP-2.0\lib\gimp\2.0\plug-ins\file-jpeg.exe»=
«c:\Program Files\GIMP-2.0\lib\gimp\2.0\plug-ins\noise-rgb.exe»=
«c:\Program Files\GIMP-2.0\lib\gimp\2.0\plug-ins\noise-spread.exe»=
«c:\Program Files\GIMP-2.0\lib\gimp\2.0\plug-ins\threshold-alpha.exe»=
«c:\Program Files\GIMP-2.0\lib\gimp\2.0\plug-ins\blur-gauss.exe»=
«c:\Program Files\Total Commander\Totalcmd.exe»=
«d:\Program Files\Battlestrike\Battlestrike.exe»=
«d:\Program Files\РЕМБО II — ВЬЕТНАМ\Bin32\FarCry.exe»=
«c:\WINDOWS\system32\msfeedssync.exe»=
«c:\WINDOWS\system32\spider.exe»=
«c:\Program Files\Windows Media Player\wmplayer.exe»=
«c:\WINDOWS\system32\winmine.exe»=
«f:\Program Files\Winamp\Winamp.exe»=
«c:\Program Files\Mozilla Firefox\firefox.exe»=
«c:\WINDOWS\SOUNDMAN.EXE»=
«c:\Program Files\SafHouse\DUTraffic\DUTraffic.exe»=
«c:\Program Files\Java\jre6\bin\jusched.exe»=
«c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe»=
«c:\Program Files\Winamp\winampa.exe»=
«c:\Program Files\Punto Switcher\ps.exe»=
«c:\Program Files\PRMT8\PRMTED\EDLauncher.exe»=
«c:\Program Files\DAEMON Tools Lite\daemon.exe»=
«f:\Program Files\eSMSeMMS\OE\Bin\TMTray.exe»=
«c:\Program Files\PRMT8\PRMTED\prmedsvr.exe»=
«c:\Игры от NevoSoft\NevoDRM\run.exe»=
«c:\Program Files\Windows Desktop Search\WindowsSearch.exe»=
«c:\WINDOWS\system32\netsh.exe»=
«c:\Program Files\Common Files\InstallShield\UpdateService\agent.exe»=
«c:\WINDOWS\system32\taskmgr.exe»=
«c:\WINDOWS\system32\SearchProtocolHost.exe»=
R3 getPlus(R) Helper;getPlus(R) Helper; [x]
.
— — — — ORPHANS REMOVED — — — —
HKCU-Run-Skype — c:program filesSkypePhoneSkype.exe
HKLM-Run-TkBellExe — realsched.exe
.
Supplementary Scan
.
uStart Page = hxxp://www.yandex.ru/?clid=44290
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
IE: Online-словари — c:program filesPRMT8PRMTIEoda.htm
IE: Автоматически определить шаблон тематики — c:program filesPRMT8PRMTIEaot.htm
IE: Відправити як MMS — file://f:program fileseSMSeMMSMMSForwardbinredirect.html
IE: Настроить параметры перевода — c:program filesPRMT8PRMTIEoptions.htm
IE: Незнакомые слова — c:program filesPRMT8PRMTIEinfopanel.htm
IE: Открыть словарную статью — c:program filesPRMT8PRMTIEaddentry.htm
IE: Перевести — c:program filesPRMT8PRMTIEtranslat.htm
IE: Перевести страницу — c:program filesPRMT8PRMTIEpage.htm
IE: Поиск в Интернете — c:program filesPRMT8PRMTIEsearch.htm
IE: {{4034D172-4C52-49de-A6A1-E75F8F591FEC} — c:program filesPRMT8PRMTIEoptions.htm
IE: {{A2DA13D5-AC77-43b7-963B-40445EBCB8E0} — c:program filesPRMT8PRMTIEprmtie5.htm
FF — ProfilePath — c:documents and settingsRootApplication DataMozillaFirefoxProfiles5nvn18m3.default
FF — prefs.js: browser.search.defaulturl — hxxp://uk.search.yahoo.com/search?ei=UTF-8&fr=ytff-divxd&p=
FF — prefs.js: browser.startup.homepage — hxxp://www.yandex.ua/?clid=40795
FF — plugin: f:games mashaprogrampluginsnpdivx32.dll
FF — plugin: f:games mashaprogrampluginsnpdsplay.dll
FF — plugin: f:games mashaprogrampluginsNPSWF32.dll
FF — plugin: f:games mashaprogrampluginsnpwmsdrm.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-24 17:05
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘explorer.exe'(3944)
c:program filesPRMT8PRMTEDEDSel.dll
c:progra~1WINDOW~2wmpband.dll
c:windowssystem32ieframe.dll
c:windowssystem32webcheck.dll
c:windowssystem32WPDShServiceObj.dll
c:windowssystem32PortableDeviceTypes.dll
c:windowssystem32PortableDeviceApi.dll
.
Other Running Processes
.
c:windowssystem32rundll32.exe
c:program filesPRMT8PRMTEDprmedsvr.exe
c:c:WINDOWSsystem32svchost.exe
c:program filesJavajre6binjqs.exe
c:program filesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
c:windowssystem32nvsvc32.exe
c:windowssystem32PnkBstrA.exe
c:windowssystem32PnkBstrB.exe
c:program filesAlcohol SoftAlcohol 120StarWindStarWindService.exe
c:windowssystem32searchindexer.exe
.
**************************************************************************
.
Completion time: 2009-04-24 17:08 — machine was rebooted
ComboFix-quarantined-files.txt 2009-04-24 14:08
Pre-Run: 155 299 840 байт свободно
Post-Run: 103 849 984 байт свободно
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)WINDOWS
[operating systems]
c:cmdconsBOOTSECT.DAT=»Microsoft Windows Recovery Console» /cmdcons
multi(0)disk(0)rdisk(0)partition(1)WINDOWS=»Microsoft Windows XP Professional RU» /noexecute=optin /fastdetect
355 — E O F — 2009-04-15 19:53
