ComboFix 09-04-03.01 — Administrator 2009-04-04 18:01:57.6 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.1.1049.18.2047.1672 [GMT 7:00]
Running from: c:documents and settingsAdministratorРабочий столComboFix.exe
Command switches used :: c:documents and settingsAdministratorРабочий столCFScript.txt
FW: Outpost Firewall Pro *enabled*
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2009-03-04 to 2009-04-04 )))))))))))))))))))))))))))))))
.
2009-04-01 22:10 . 2009-04-01 22:10 d
c:documents and settingsAdministratorApplication DataImgBurn
2009-04-01 22:05 . 2009-04-01 22:05 d
c:program filesImgBurn
2009-03-29 18:42 . 2009-03-29 18:42 d
c:windowssystem32Kaspersky Lab
2009-03-29 18:42 . 2009-03-29 18:42 d
c:documents and settingsAll UsersApplication DataKaspersky Lab
2009-03-25 14:43 . 2009-03-25 14:48 d
c:program filesmIRC
2009-03-25 14:33 . 2009-03-25 14:37 d
c:program filesDenS-mIRC
2009-03-25 13:56 . 2009-03-25 13:56 361,600 —a
c:windowssystem32driversTCPIP.SYS.ORIGINAL
2009-03-25 00:16 . 2001-09-19 22:47 765,952 —a
c:windowssystemcrlds3d.dll
2009-03-25 00:16 . 2006-03-18 03:18 392,960 —a
c:windowssystem32driverssenfilt.sys
2009-03-25 00:16 . 2008-07-10 19:22 334,336 —a
c:windowssystem32driversADIHdAud.sys
2009-03-25 00:16 . 2007-10-18 00:37 28,672 —a
c:windowssystem32PostProc.dll
2009-03-24 22:03 . 2009-03-24 22:03 d
c:program filesInterpretatio
2009-03-23 15:22 . 2009-03-23 15:23 d
c:documents and settingsAll UsersApplication DataBarbie Fashion Show
2009-03-23 13:42 . 2009-03-25 20:05 d
c:program filesAlawar.ru
2009-03-23 13:25 . 2009-03-23 13:25 d
c:program filesVirtualDubMod
2009-03-22 17:00 . 2009-03-22 17:00 d
c:documents and settingsAdministratorApplication DataGaijin Ent
2009-03-20 19:02 . 2009-03-20 22:52 d
c:documents and settingsAll UsersApplication DataSpybot — Search & Destroy
2009-03-20 16:27 . 2009-03-20 16:27 d
c:documents and settingsAdministratorApplication DataBloom
2009-03-14 16:05 . 2009-04-03 22:55 d
c:windowssystem32Filt
2009-03-14 16:05 . 2009-03-14 16:05 d
c:program filesAgnitum
2009-03-14 16:05 . 2009-02-26 11:27 704,384 —a
c:windowssystem32driversSandBox.sys
2009-03-14 16:05 . 2009-02-10 17:15 257,432 —a
c:windowssystem32driversafwcore.sys
2009-03-14 16:05 . 2008-06-20 10:45 30,864 —a
c:windowssystem32driversafw.sys
2009-03-14 16:05 . 2009-01-16 12:14 49 —a
c:windowstransp.gif
2009-03-14 16:04 . 2009-03-14 16:04 d
c:documents and settingsAll UsersApplication DataAgnitum
2009-03-14 15:53 . 2009-03-14 15:53 d
c:program filesYandex
2009-03-11 19:28 . 2009-03-11 19:28 d
c:documents and settingsAll UsersApplication DataMalwarebytes
2009-03-11 19:28 . 2009-03-11 19:28 d
c:documents and settingsAdministratorApplication DataMalwarebytes
2009-03-09 20:42 . 2004-09-06 11:25 d
c:program filesDjvuReader
2009-03-09 19:21 . 2009-03-09 19:21 d
c:documents and settingsAdministratorApplication DataTurbogames.ru
2009-03-09 17:42 . 2009-03-09 17:50 d
c:documents and settingsAdministratorApplication DataDAEMON Tools Pro
2009-03-09 17:42 . 2009-03-09 17:42 d
c:documents and settingsAdministratorApplication DataDAEMON Tools
2009-03-09 17:41 . 2009-03-09 17:41 d
c:documents and settingsAll UsersApplication DataDAEMON Tools Lite
2009-03-09 17:40 . 2009-03-14 15:53 d
c:documents and settingsAdministratorApplication DataYandex
2009-03-09 17:39 . 2009-03-09 17:40 d
c:program filesDAEMON Tools Lite
2009-03-09 17:39 . 2009-03-09 17:57 d
c:documents and settingsAdministratorApplication DataDAEMON Tools Lite
2009-03-07 17:15 . 2009-03-07 20:54 d
c:documents and settingsAll UsersApplication DataDoctor Web
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-04 10:54
d
w c:documents and settingsAdministratorApplication DataAIMP
2009-04-03 17:50
d
w c:documents and settingsAdministratorApplication DatauTorrent
2009-03-30 05:04
d
w c:program filesFinale 2007
2009-03-30 04:51
d
w c:program filesNero
2009-03-25 06:56 361,600 —-a-w c:windowssystem32driversTCPIP.SYS
2009-03-20 09:22
d
w c:documents and settingsAll UsersApplication DataAlawarWrapper
2009-03-14 08:23
d
w c:program filesFinale 2006
2009-03-09 12:28
d
w c:documents and settingsAll UsersApplication DataPlayFirst
2009-03-09 12:28
d
w c:documents and settingsAdministratorApplication DataPlayFirst
2009-03-02 09:45
d—h—w c:program filesInstallShield Installation Information
2009-03-01 16:46
d
w c:program filesWindows Media Connect 2
2009-02-28 12:40 4,608 —-a-w c:windowssystem32w95inf32.dll
2009-02-28 12:40 2,272 —-a-w c:windowssystem32w95inf16.dll
2009-02-28 12:20
d
w c:program filesCommon FilesAdobe
2009-02-26 12:48
d
w c:documents and settingsAdministratorApplication DatamIRC
2009-02-21 12:01
d—a-w c:program filesCoolReader 3.0.8
2009-02-21 11:57
d
w c:documents and settingsAdministratorApplication Datacr3
2009-02-17 16:56
d
w c:program filesFinale GPO 2.0
2009-02-17 16:54
d
w c:program filesNative Instruments
2009-02-16 16:57
d
w c:program filesSolo9
2009-02-16 16:57
d
w c:documents and settingsAll UsersApplication DataSolo9
2009-02-15 11:37
d
w c:program filesuTorrent
2009-02-12 11:24
d
w c:program files2gis
2009-02-12 11:09
d
w c:documents and settingsAll UsersApplication Data2GIS
2009-02-12 11:05
d
w c:documents and settingsAdministratorApplication DataGrym
2009-02-12 10:30
d
w c:program filesK-Soft
2009-02-10 11:50
d
w c:program filesCommon FilesReGet Shared
2009-02-09 14:07 1,846,912 —-a-w c:windowssystem32win32k.sys
2009-02-08 12:26
d
w c:documents and settingsAdministratorApplication DataReGet Software
2009-02-07 18:52
d
w c:program filesMSXML 4.0
2009-01-31 11:43 14,336 —-a-w c:windowssystem32svchost.exe
2009-01-18 12:04 632 —-a-w C:settings.dat
2006-06-23 06:48 32,768 —-a-r c:windowsinfUpdateUSB.exe
.
Sigcheck
2008-06-20 18:59 361600 ad978a1b783b5719720cff204b666c8e c:windows$hf_mig$KB951748SP3QFEtcpip.sys
2008-04-15 19:00 361344 93ea8d04ec73a85db02eb8805988f733 c:windows$NtUninstallKB951748$tcpip.sys
2009-03-25 13:56 361600 cbeebeb899e31ef52b962cb31fc8ca5c c:windowssystem32dllcacheTCPIP.SYS
2009-03-25 13:56 361600 cbeebeb899e31ef52b962cb31fc8ca5c c:windowssystem32driversTCPIP.SYS
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2008-04-15 15360]
«MSMSGS»=»c:program filesMessengermsmsgs.exe» [2008-04-14 1695232]
«DAEMON Tools Lite»=»c:program filesDAEMON Tools Litedaemon.exe» [2008-12-29 687560]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2008-12-26 86016]
«2gis update client UI»=»c:program files2gisUpdateClientWin32UpdateClientUI.exe» [2008-09-17 4055040]
«Adobe Reader Speed Launcher»=»c:program filesAdobeReader 9.0ReaderReader_sl.exe» [2008-06-12 34672]
«OutpostFeedBack»=»c:program filesAgnitumOutpost Firewall Profeedback.exe» [2009-03-02 433480]
«SoundMAXPnP»=»c:program filesAnalog DevicesCoresmax4pnp.exe» [2008-04-15 1040384]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2008-12-26 13680640]
«nwiz»=»nwiz.exe» [2008-12-26 c:windowssystem32nwiz.exe]
[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-15 15360]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«AntiVirusOverride»=dword:00000001
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«c:\WINDOWS\Network Diagnostic\xpnetdiag.exe»=
«c:\WINDOWS\system32\sessmgr.exe»=
«c:\Program Files\uTorrent\utorrent.exe»=
R1 SandBox;SandBox;c:windowssystem32driversSandBox.sys [2009-03-14 704384]
R2 2GIS UpdateClientService;2GIS UpdateClientService;c:program files2gisUpdateClientWin32UpdateClientService.exe [2008-09-17 1134592]
R2 acssrv;Agnitum Client Security Service;c:progra~1AgnitumOUTPOS~1acs.exe [2009-03-14 1267016]
R3 afw;Agnitum firewall driver;c:windowssystem32driversafw.sys [2009-03-14 30864]
R3 afwcore;afwcore;c:windowssystem32driversafwcore.sys [2009-03-14 257432]
R3 ASWFilt;ASWFilt;c:windowssystem32FiltASWFilt.dll [2009-03-14 33888]
S3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:windowssystem32driversatl01_xp.sys [2009-01-05 35840]
.
Contents of the ‘Scheduled Tasks’ folder
2009-04-02 c:windowsTasks{DB41A4E8-349D-406A-AAA5-9B1F0B64152B}_HOME_Administrator.job
— c:windowssystem32mobsync.exe [2008-04-15 19:00]
.
.
Supplementary Scan
.
uStart Page = hxxp://www.tomtel.ru/
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
IE: Проверить ссылку Dr.Web — http://www.drweb.com/online/drweb-online-ru.html
Trusted Zone: vtomske.rutorrents
Handler: solores — {8FA1F4E9-444B-48BF-98CD-B8ECA88E6BA5} — c:progra~1Solo9SoloRes.dll
FF — ProfilePath — c:documents and settingsAdministratorApplication DataMozillaFirefoxProfileslbvkc7xv.default
FF — prefs.js: browser.search.selectedEngine — Яндекс
FF — prefs.js: browser.startup.homepage —
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-04 18:03:12
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2009-04-04 18:04:42
ComboFix-quarantined-files.txt 2009-04-04 11:04:40
ComboFix2.txt 2009-03-31 10:11:30
Pre-Run: 34 810 609 664 байт свободно
Post-Run: 34,802,872,320 байт свободно
157 — E O F — 2009-03-14 08:20:38
