- Темы:532
- Сообщений:1553
- ☆☆☆☆☆
ComboFix 09-08-18.03 — Ronny 19.08.2009 17:26.1.1 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.1151.769 [GMT 4:00]
Running from: c:documents and settingsRonnyРабочий столComboFix.exe
Command switches used :: c:documents and settingsRonnyРабочий столWindowsXP-KB310994-SP2-Pro-BootDisk-RUS.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr0.dat
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr1.dat
c:documents and settingsRonnyLocal SettingsTemporary Internet Filesbmp2F43.tmp
c:progra~1COMMON~1{7445F~1
c:progra~1COMMON~1{7445F~1chrome.manifest
c:progra~1COMMON~1{7445F~1chromecontentextensions.xul
c:progra~1COMMON~1{7445F~1chromecontentlogo.png
c:progra~1COMMON~1{7445F~1chromecontentmain.js
c:progra~1COMMON~1{7445F~1chromecontentmain.xul
c:progra~1COMMON~1{7445F~1chromecontentq.png
c:progra~1COMMON~1{7445F~1chromecontentq_gray.png
c:progra~1COMMON~1{7445F~1chromecontentx.png
c:progra~1COMMON~1{7445F~1chromecontentx_gray.png
c:progra~1COMMON~1{7445F~1defaultspreferencesmain.js
c:progra~1COMMON~1{7445F~1defaultspreferencesmain.js.old
c:progra~1COMMON~1{7445F~1extension.reg
c:progra~1COMMON~1{7445F~1install.rdf
c:program filesGooglegoogletoolbar1.dll
c:program filesGooglesetupcom.dat
c:program filesGooglesetupext.dat
c:windowssystem323rs23525.dll
BITS: Possible infected sites
hxxp://soft.export.yandex.ru
hxxp://download.yandex.ru
Infected copy of c:windowssystem32mspmsnsv.dll was found and disinfected
Restored copy from — c:windowssystem32dllcachemspmsnsv.dll
.
((((((((((((((((((((((((( Files Created from 2009-07-19 to 2009-08-19 )))))))))))))))))))))))))))))))
.
2009-08-16 14:56 . 2009-08-16 14:56
dc—-w- c:documents and settingsRonnyLocal SettingsApplication DataWinamp Toolbar
2009-08-16 14:05 . 2009-08-16 14:05
dc—-w- c:program filesWinamp Toolbar
2009-08-16 14:05 . 2009-08-16 14:05
dc—-w- c:documents and settingsAll UsersApplication DataWinamp Toolbar
2009-08-16 14:04 . 2009-08-16 14:04
dc—-w- c:program filesWinamp Remote
2009-08-16 13:58 . 2009-08-16 13:58
dc-h—w- c:windowssystem32GroupPolicy
2009-08-16 13:33 . 2009-08-16 13:34
dc—-w- c:documents and settingsRonnyApplication DataXP Visual Tools
2009-08-16 13:25 . 2009-08-16 13:25
dc—-w- c:documents and settingsRonnyLocal SettingsApplication DataPixoria
2009-08-16 12:42 . 2009-08-16 13:32
dc—-w- C:Downloads
2009-08-16 12:41 . 2009-08-16 12:52
dc—-w- c:documents and settingsRonnyApplication DataDownload Master
2009-08-16 12:41 . 2007-12-18 10:56 1412608 -c—a-w- c:documents and settingsRonnyApplication DataDownload Mastertempskin.dll
2009-08-16 12:41 . 2009-08-16 12:41
dc—-w- c:documents and settingsRonnyLocal SettingsApplication DataYandex
2009-08-16 11:25 . 2009-08-16 11:43
dc-h—w- c:program filesRS
2009-08-16 10:30 . 2009-08-16 10:30
dc—-w- c:program filesESET
2009-08-15 17:37 . 2009-08-15 17:37
dc—-w- c:windowssystem32XPSViewer
2009-08-15 17:37 . 2009-08-15 17:37
dc—-w- c:program filesMSBuild
2009-08-15 17:36 . 2008-07-06 12:06 117760 -c—-w- c:windowssystem32prntvpt.dll
2009-08-15 17:36 . 2008-07-06 12:06 89088 -c—-w- c:windowssystem32dllcachefilterpipelineprintproc.dll
2009-08-15 17:36 . 2008-07-06 12:06 575488 -c—-w- c:windowssystem32xpsshhdr.dll
2009-08-15 17:36 . 2008-07-06 12:06 575488 -c—-w- c:windowssystem32dllcachexpsshhdr.dll
2009-08-15 17:36 . 2008-07-06 10:50 597504 -c—-w- c:windowssystem32dllcacheprintfilterpipelinesvc.exe
2009-08-15 17:36 . 2008-07-06 12:06 1676288 -c—-w- c:windowssystem32xpssvcs.dll
2009-08-15 17:36 . 2008-07-06 12:06 1676288 -c—-w- c:windowssystem32dllcachexpssvcs.dll
2009-08-15 17:33 . 2009-08-15 17:33
dcsh—w- c:documents and settingsNetworkServiceIETldCache
2009-08-15 17:27 . 2009-08-15 17:27
dc—-w- c:windowssystem32wbemRepository
2009-08-15 15:32 . 2009-08-15 17:25
dc—-w- c:program filestrend micro
2009-08-14 15:13 . 2009-07-03 17:00 55296 -c—-w- c:windowssystem32dllcachemsfeedsbs.dll
2009-08-14 15:13 . 2009-07-03 17:00 594432 -c—-w- c:windowssystem32dllcachemsfeeds.dll
2009-07-23 10:16 . 2009-07-23 10:16
dc—-w- c:documents and settingsRonnyApplication DataMra
2009-07-22 17:27 . 2009-07-22 18:29
dc—-w- c:documents and settingsAll UsersApplication DataElectronic Arts
2009-07-22 16:30 . 2008-09-05 00:22 447752 -c—a-r- c:windowssystem32vp6vfw.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-19 13:30 . 2009-07-11 14:46
dc—-w- c:program filesGoogle
2009-08-19 09:08 . 2009-05-14 11:41 264 -c-ha-w- c:documents and settingsRonnyApplication Datastore.dat
2009-08-19 09:08 . 2009-05-14 11:41 264 -c-ha-w- c:documents and settingsAll UsersApplication Datastore.dat
2009-08-18 14:01 . 2009-08-16 13:57
dc—-w- c:documents and settingsRonnyApplication DataWinamp
2009-08-16 12:42 . 2009-05-10 11:15
dc—-w- c:program filesOpera
2009-08-16 12:41 . 2009-07-18 11:43
dc—-w- c:documents and settingsRonnyApplication DataYandex
2009-08-16 11:22 . 2009-05-10 10:29
dc-h—w- c:program filesInstallShield Installation Information
2009-08-16 11:20 . 2009-05-10 10:21 14048 -c—a-w- c:documents and settingsRonnyLocal SettingsApplication DataGDIPFONTCACHEV1.DAT
2009-08-15 17:42 . 2008-04-15 12:00 79546 —-a-w- c:windowssystem32perfc019.dat
2009-08-15 17:42 . 2008-04-15 12:00 474518 —-a-w- c:windowssystem32perfh019.dat
2009-08-05 09:01 . 2008-04-15 12:00 204800 -c—a-w- c:windowssystem32mswebdvd.dll
2009-07-23 10:16 . 2009-05-17 09:57
dc—-w- c:program filesCyberLink
2009-07-22 18:28 . 2009-05-10 11:30
dc—-w- c:program filesICQ6Toolbar
2009-07-18 11:43 . 2009-07-18 11:43 0 -c—a-w- c:windowsnsreg.dat
2009-07-18 11:23 . 2009-07-18 11:23
dc—-w- c:documents and settingsRonnyApplication DataTrident Software
2009-07-17 19:03 . 2008-04-15 12:00 58880 -c—a-w- c:windowssystem32atl.dll
2009-07-15 17:35 . 2009-07-15 17:35 62760 -c—a-w- c:documents and settingsRonnyApplication DataMozillaFirefoxProfilesdimucpfp.defaultextensions{0b38152b-1b20-484d-a11f-5e04a9b0661f}componentsWinampTBPlayer.dll
2009-07-12 08:21 . 2008-04-15 12:00 233472 -c—a-w- c:windowssystem32wmpdxm.dll
2009-07-03 17:00 . 2008-04-15 12:00 915456 -c—a-w- c:windowssystem32wininet.dll
2009-07-02 16:08 . 2009-05-27 10:46
dc—-w- c:program filesWindows Media Connect 2
2009-06-28 10:30 . 2009-06-17 11:45
dc—-w- c:documents and settingsRonnyApplication DataNSeries
2009-06-27 20:16 . 2009-05-10 11:26
dc—-w- c:documents and settingsRonnyApplication DataICQ
2009-06-17 16:47 . 2009-06-17 16:47 3351812 -c—a-w- c:documents and settingsAll UsersApplication DataInstallations{9F59C3AE-81B0-4EF6-9762-D674BB079705}InstallerCommonCustomActionsmsxml6Exec.exe
2009-06-17 16:46 . 2009-06-17 16:46 36864 -c—a-w- c:documents and settingsAll UsersApplication DataInstallations{9F59C3AE-81B0-4EF6-9762-D674BB079705}InstallerCommonCustomActionsSleep.exe
2009-06-17 16:46 . 2009-06-17 16:46 3181612 -c—a-w- c:documents and settingsAll UsersApplication DataInstallations{9F59C3AE-81B0-4EF6-9762-D674BB079705}InstallerCommonCustomActionsvcredistExec.exe
2009-06-17 16:46 . 2009-06-17 16:47 24503944 -c—a-w- c:documents and settingsAll UsersApplication DataInstallations{9F59C3AE-81B0-4EF6-9762-D674BB079705}NokiaSoftwareUpdaterSetup_1.6.13RU.exe
2009-06-16 14:40 . 2008-04-15 12:00 81920 -c—a-w- c:windowssystem32fontsub.dll
2009-06-16 14:40 . 2008-04-15 12:00 119808 -c—a-w- c:windowssystem32t2embed.dll
2009-06-15 10:45 . 2008-04-15 12:00 79872 -c—a-w- c:windowssystem32telnet.exe
2009-06-15 10:45 . 2008-04-15 12:00 80896 -c—a-w- c:windowssystem32tlntsess.exe
2009-06-13 19:24 . 2009-06-13 19:24 5132 -c—a-w- c:windowssystem32bsvi.dll
2009-06-13 19:23 . 2009-06-13 19:23 875520 -c—a-w- c:windowssystem32VFP6RENU.DLL
2009-06-13 19:23 . 2009-06-13 19:23 3370768 -c—a-w- c:windowssystem32VFP6R.DLL
2009-06-13 19:23 . 2009-06-13 19:23 24990 -c—a-w- c:windowssystem32VFP6RUN.EXE
2009-06-13 17:22 . 2009-06-13 17:22 766 -c—a-w- c:windowsmd.dll
2009-06-10 14:14 . 2008-04-15 12:00 85504 -c—a-w- c:windowssystem32avifil32.dll
2009-06-10 06:16 . 2008-04-15 12:00 132096 -c—a-w- c:windowssystem32wkssvc.dll
2009-06-10 05:21 . 2009-05-10 10:03 2066432 -c—a-w- c:windowssystem32mstscax.dll
2009-06-03 19:11 . 2008-04-15 12:00 1292800 -c—a-w- c:windowssystem32quartz.dll
2009-05-28 09:21 . 2009-05-28 09:21 685816 —-a-w- c:windowssystem32driverssptd.sys
2009-05-28 09:18 . 2009-05-28 09:18 278728 -c—a-w- c:windowssystem32driversatksgt.sys
2009-05-28 09:18 . 2009-05-28 09:18 25416 -c—a-w- c:windowssystem32driverslirsgt.sys
2009-05-21 16:15 . 2009-05-10 10:08 86327 -c—a-w- c:windowspchealthhelpctrOfflineCacheindex.dat
2005-02-04 13:03 . 2009-07-18 14:39 36864 -c—a-w- c:program filesmozilla firefoxcomponentspragma.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]
«{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}»= «c:program filesWinamp Toolbarwinamptb.dll» [2009-05-06 1262888]
[HKEY_CLASSES_ROOTclsid{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOTWINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOTTypeLib{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOTWINAMPTB.AOLTBSearch]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiersAdRouter]
@=»{E2085722-3AC0-4411-A14B-906AFE1A75C4}»
[HKEY_CLASSES_ROOTCLSID{E2085722-3AC0-4411-A14B-906AFE1A75C4}]
2009-07-11 14:51 98304 -c—a-w- c:program filesAdobeadrouter.dll
[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=»c:program filesCommon FilesNeroLibNMBgMonitor.exe» [2007-09-20 202024]
«MSMSGS»=»c:program filesMessengermsmsgs.exe» [2008-04-14 1695232]
«Download Master»=»d:download masterdmaster.exe» [2009-08-05 3777536]
«Orb»=»c:program filesWinamp RemotebinOrbTray.exe» [2008-04-01 507904]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«egui»=»D:New Folder» [X]
«ATIPTA»=»c:program filesATI TechnologiesATI Control Panelatiptaxx.exe» [2003-09-12 335872]
«Adobe Reader Speed Launcher»=»c:program filesAdobeReader 9.0ReaderReader_sl.exe» [2009-02-27 35696]
«NeroFilterCheck»=»c:program filesCommon FilesNeroLibNeroCheck.exe» [2007-03-01 153136]
«NBKeyScan»=»d:новая папка (6)Nero 8Nero BackItUpNBKeyScan.exe» [2007-09-20 1836328]
«sclauncher»=»d:program filesSimpleCenterbinwinsclauncher.exe» [2007-10-11 94208]
«Pragma»=»d:5ce5c~1pragma.exe» [2005-05-27 204288]
«WinampAgent»=»d:winampwinampa.exe» [2009-07-01 37888]
«SoundMan»=»SOUNDMAN.EXE» — c:windowsSOUNDMAN.EXE [2003-10-08 57344]
[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-15 15360]
c:documents and settingsRonnyѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
Konfabulator.lnk — d:new folderKonfabulator.exe [2005-8-4 1282048]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«AntiVirusOverride»=dword:00000001
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\ICQ6.5\ICQ.exe»=
«d:\Program Files\SimpleCenter\Home Media Server.exe»=
«c:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe»=
«c:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe»=
«c:\Program Files\Opera\opera.exe»=
«c:\Program Files\Winamp Remote\bin\Orb.exe»=
«c:\Program Files\Winamp Remote\bin\OrbTray.exe»=
«c:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe»=
R1 ehdrv;ehdrv;c:windowssystem32driversehdrv.sys [19.03.2009 11:44 107256]
R1 epfwtdir;epfwtdir;c:windowssystem32driversepfwtdir.sys [19.03.2009 11:45 93848]
R2 ekrn;ESET Service;d:new folder,антивирусekrn.exe [19.03.2009 11:44 731840]
R2 ICQ Service;ICQ Service;c:program filesICQ6ToolbarICQ Service.exe [10.05.2009 15:30 222456]
S3 KTalk;KTalk;??c:docume~1RonnyLOCALS~1Tempktalk.sys —> c:docume~1RonnyLOCALS~1Tempktalk.sys [?]
S3 MHIKEY10;MHIKEY10;c:windowssystem32driversMHIKEY10.sys [27.05.2008 2:52 51072]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled components>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
«c:windowssystem32rundll32.exe» «c:windowssystem32iedkcs32.dll»,BrandIEActiveSetup SIGNUP
.
Contents of the ‘Scheduled Tasks’ folder
2009-08-19 c:windowsTasksUser_Feed_Synchronization-{9BD7C4F2-5613-4135-A70B-E1B6375BFDD2}.job
— c:windowssystem32msfeedssync.exe [2009-03-08 00:31]
.
— — — — ORPHANS REMOVED — — — —
Toolbar-{91397D20-1446-11D4-8AF4-0040CA1127B6} — c:program filesYandexYandexBarIEyndbar.dll
WebBrowser-{91397D20-1446-11D4-8AF4-0040CA1127B6} — c:program filesYandexYandexBarIEyndbar.dll
HKCU-Run-AmazingClock — d:amazing clockAClock.exe
HKCU-Run-EA Core — c:program filesElectronic ArtsEADMCore.exe
HKCU-Run-SpeedConnectStartUp — (no file)
.
Supplementary Scan
.
uStart Page = mail.ru
uInternet Connection Wizard,ShellNext = iexplore
IE: &Winamp Search — c:documents and settingsAll UsersApplication DataWinamp ToolbarieToolbarresourcesen-USlocalsearch.html
IE: Закачать ВСЕ при помощи Download Master — d:download masterdmieall.htm
IE: Закачать при помощи Download Master — d:download masterdmie.htm
IE: Передать на удаленную закачку DM — d:download masterremdown.htm
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — d:download masterdmaster.exe
TCP: {77C3A8D2-C93A-468F-ABF3-B63BC4E67238} = 91.103.73.7,91.103.76.2
FF — ProfilePath — c:documents and settingsRonnyApplication DataMozillaFirefoxProfilesdimucpfp.default
FF — prefs.js: browser.search.defaulturl — hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
FF — prefs.js: browser.search.selectedEngine — Winamp Search
FF — prefs.js: keyword.URL — hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=
FF — prefs.js: network.proxy.type — 4
FF — component: c:documents and settingsRonnyApplication DataMozillaFirefoxProfilesdimucpfp.defaultextensions{0b38152b-1b20-484d-a11f-5e04a9b0661f}componentsWinampTBPlayer.dll
FF — plugin: c:program filesMozilla Firefoxpluginsnpdm.dll
FF — plugin: c:program filesOperaprogrampluginsnpdm.dll
—- FIREFOX POLICIES —-
c:program filesMozilla Firefoxgreprefsall.js — pref(«media.enforce_same_site_origin», false);
c:program filesMozilla Firefoxgreprefsall.js — pref(«media.cache_size», 51200);
c:program filesMozilla Firefoxgreprefsall.js — pref(«media.ogg.enabled», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«media.wave.enabled», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«media.autoplay.enabled», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«browser.urlbar.autocomplete.enabled», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«capability.policy.mailnews.*.wholeText», «noAccess»);
c:program filesMozilla Firefoxgreprefsall.js — pref(«dom.storage.default_quota», 5120);
c:program filesMozilla Firefoxgreprefsall.js — pref(«content.sink.event_probe_rate», 3);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.http.prompt-temp-redirect», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«layout.css.dpi», -1);
c:program filesMozilla Firefoxgreprefsall.js — pref(«layout.css.devPixelsPerPx», -1);
c:program filesMozilla Firefoxgreprefsall.js — pref(«gestures.enable_single_finger_input», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«dom.max_chrome_script_run_time», 0);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.tcp.sendbuffer», 131072);
c:program filesMozilla Firefoxgreprefsall.js — pref(«geo.enabled», true);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js — pref(«security.remember_cert_checkbox_default_setting», true);
c:program filesMozilla Firefoxdefaultspreffirefox-branding.js — pref(«browser.search.param.yahoo-fr», «moz35»);
c:program filesMozilla Firefoxdefaultspreffirefox-branding.js — pref(«browser.search.param.yahoo-fr-cjkt», «moz35»);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«extensions.blocklist.level», 2);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«browser.urlbar.restrict.typed», «~»);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«browser.urlbar.default.behavior», 0);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.clearOnShutdown.history», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.clearOnShutdown.formdata», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.clearOnShutdown.passwords», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.clearOnShutdown.downloads», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.clearOnShutdown.cookies», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.clearOnShutdown.cache», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.clearOnShutdown.sessions», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.clearOnShutdown.offlineApps», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.clearOnShutdown.siteSettings», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.cpd.history», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.cpd.formdata», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.cpd.passwords», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.cpd.downloads», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.cpd.cookies», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.cpd.cache», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.cpd.sessions», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.cpd.offlineApps», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.cpd.siteSettings», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.sanitize.migrateFx3Prefs», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«browser.ssl_override_behavior», 2);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«security.alternate_certificate_error_page», «certerror»);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«browser.privatebrowsing.autostart», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«browser.privatebrowsing.dont_prompt_on_enter», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«geo.wifi.uri», «https://www.google.com/loc/json»);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-19 17:32
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(612)
c:windowssystem32Ati2evxx.dll
— — — — — — — > ‘explorer.exe'(1112)
c:windowssystem32WININET.dll
c:program filesAdobeadrouter.dll
c:windowssystem32mshtml.dll
c:windowssystem32msls31.dll
c:windowssystem32webcheck.dll
c:windowssystem32WPDShServiceObj.dll
c:windowssystem32PortableDeviceTypes.dll
c:windowssystem32PortableDeviceApi.dll
.
Other Running Processes
.
c:windowssystem32ati2evxx.exe
c:windowssystem32ati2evxx.exe
d:new folder,c:WINDOWSsystem32CF17955.exe
d:c:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
d:new folder,d:Winampwinampa.exe
c:program filesCommon FilesNeroLibNMIndexingService.exe
c:program filesCommon FilesNeroLibNMIndexStoreSvr.exe
.
**************************************************************************
.
Completion time: 2009-08-19 17:36 — machine was rebooted
ComboFix-quarantined-files.txt 2009-08-19 13:36
Pre-Run: 507 990 016 байт свободно
Post-Run: 1 001 603 072 байт свободно
WindowsXP-KB310994-SP2-Pro-BootDisk-RUS.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)WINDOWS
[operating systems]
c:cmdconsBOOTSECT.DAT=»Microsoft Windows Recovery Console» /cmdcons
multi(0)disk(0)rdisk(0)partition(1)WINDOWS=»Microsoft Windows XP Professional RU» /noexecute=optin /fastdetect
296 — E O F — 2009-08-16 09:01
