Re: Re: всплывает порно реклама

[ovod]

Здравствуйте, Valeri !
Спасибо за оказываемую помощь. Попутно хотелось бы узнать, для чего нужны активные ссылки, которые появились в предыдущих сообщениях (лог-файлах, например hxxp://dt-updates.com/activate?query=Mc … 15eTmjg%3d или http://www.gmer.net)
Далее выполнил все как Вы рекомендовали. Вот полученный лог-файл:

ComboFix 09-06-24.05 — Admin 25.06.2009 16:00.2 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.2047.1568 [GMT 4:00]
Running from: c:documents and settingsAdminРабочий столComboFix.exe
Command switches used :: c:documents and settingsAll UsersРабочий столCFScript.txt
AV: Антивирусная система Eset NOD32 2.70 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Created a new restore point
* Resident AV is active

.

((((((((((((((((((((((((( Files Created from 2009-05-25 to 2009-06-25 )))))))))))))))))))))))))))))))
.

2009-06-14 21:00 . 2009-06-14 21:00

---

d—h—w- c:windows$hf_mig$
2009-06-14 21:00 . 2009-06-14 21:00

---

d

---

w- c:windowsie8updates
2009-06-14 20:59 . 2009-06-14 21:01

---

d—h—w- c:windowsmsdownld.tmp
2009-06-14 20:58 . 2009-06-14 20:58

---

dc-h—w- c:windowsie8
2009-06-14 20:48 . 2009-04-30 21:16 12800 -c—-w- c:windowssystem32dllcachexpshims.dll
2009-06-14 20:48 . 2009-04-30 21:16 246272 -c—-w- c:windowssystem32dllcacheieproxy.dll
2009-06-14 20:48 . 2009-04-30 21:16 1985024 -c—-w- c:windowssystem32dllcacheiertutil.dll
2009-06-14 20:48 . 2009-04-30 21:16 11064832 -c—-w- c:windowssystem32dllcacheieframe.dll
2009-06-14 20:42 . 2009-05-12 05:11 102912 -c—-w- c:windowssystem32dllcacheiecompat.dll
2009-06-13 18:27 . 2009-06-13 18:27

---

d

---

w- c:program filestrend micro
2009-06-13 18:27 . 2009-06-13 18:27

---

d

---

w- C:rsit

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-14 20:59 . 2002-01-01 19:07

---

d

---

w- c:program filesMail.Ru
2009-05-24 20:03 . 2009-02-23 20:52

---

d

---

w- c:program filesOpera
2009-05-23 12:10 . 2009-05-23 12:10 3416 —-a-w- c:windowssystem32PerfStringBackup.TMP
2009-05-23 12:10 . 2008-04-15 12:00 77202 —-a-w- c:windowssystem32perfc019.dat
2009-05-23 12:10 . 2008-04-15 12:00 449368 —-a-w- c:windowssystem32perfh019.dat
2009-05-18 18:00 . 2009-05-13 15:57

---

d

---

w- c:program filesPhotoScape
2009-05-17 20:30 . 2009-05-17 20:30

---

d

---

w- c:program filesFoxit Software
2009-05-17 19:57 . 2002-01-01 05:05

---

d

---

w- c:program filesFlash Player Pro
2009-05-15 18:20 . 2002-01-01 05:07

---

d

---

w- c:program filesCommon FilesAdobe
2009-05-13 05:05 . 2008-05-20 15:54 915456 —-a-w- c:windowssystem32wininet.dll
2009-05-11 07:05 . 2009-05-11 07:05

---

d

---

w- c:documents and settingsAdminApplication DataDivX
2009-05-11 07:05 . 2009-01-28 20:40 58016 —-a-w- c:documents and settingsAdminLocal SettingsApplication DataGDIPFONTCACHEV1.DAT
2009-05-10 14:50 . 2002-01-01 05:12

---

d

---

w- c:documents and settingsAdminApplication DataWinamp
2009-05-10 12:22 . 2009-05-10 12:22

---

d

---

w- c:documents and settingsAll UsersApplication DataAdobe Systems
2009-05-10 12:22 . 2009-05-10 12:22

---

d

---

w- c:program filesCommon FilesAdobe Systems Shared
2009-05-09 15:05 . 2009-05-09 15:05

---

d

---

w- c:program filesCommon FilesAdobe AIR
2009-05-07 16:49 . 2009-05-07 16:49

---

d

---

w- c:program filesPivim Multibar
2009-05-07 13:41 . 2009-01-28 21:42

---

d

---

w- c:documents and settingsAdminApplication DatauTorrent
2009-04-22 20:56 . 2009-04-22 20:56 180224 —-a-w- c:windowssystem32WinVd32.sys
2009-04-22 20:56 . 2009-04-22 20:56 16896 —-a-w- c:windowssystem32WinFl32.sys
2009-04-07 20:26 . 2009-04-07 20:26 5301432 —-a-w- c:documents and settingsAdminApplication DataMraUpdatemagentsetup.exe
.

---

Sigcheck

---

[-] 2008-05-20 15:54 579072 23B7D3F3F5EC8FEEA75EC381C71CBD5E c:windowssystem32user32.dll

[-] 2008-05-20 15:52 361344 030DC4D48CC2B894FEE2F390D8E66AD5 c:windowssystem32driverstcpip.sys

[-] 2008-05-20 15:53 1721344 DC5D73A9809B66026231A9D49DE6987F c:windowsexplorer.exe

[-] 2008-05-20 15:53 30208 AE0DB25EE10900C73D923AD5880564CF c:windowssystem32ctfmon.exe

[-] 2008-05-20 16:29 1571840 46D60730EE2DF438750B38370425BC74 c:windowssystem32sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2008-05-20 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
«LClock»=»c:program filesLClockLClock.exe» [2007-12-14 86016]
«KillCopy»=»c:windowssystem32killcopy.exe» [2006-10-29 1185792]
«BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=»c:program filesCommon FilesAheadlibNMBgMonitor.exe» [2006-03-01 90112]
«H/PC Connection Agent»=»c:program filesMicrosoft ActiveSyncwcescomm.exe» [2006-11-13 1289000]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«nod32kui»=»c:program filesEsetnod32kui.exe» [2009-01-30 949376]
«NeroFilterCheck»=»c:program filesCommon FilesAheadLibNeroCheck.exe» [2006-01-12 155648]
«RTHDCPL»=»RTHDCPL.EXE» — c:windowsRTHDCPL.EXE [2008-04-10 16861184]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-05-20 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» — c:windowssystem32advpack.dll [2009-03-08 128512]
«IE7_012″=»advpack.dll» — c:windowssystem32advpack.dll [2009-03-08 128512]

c:documents and settingsAdminѓ« ў­®Ґ ¬Ґ­оЏа®Ја ¬¬лЂўв®§ Јаг§Є 
Adobe Gamma.lnk — c:program filesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe [2005-3-16 113664]

c:documents and settingsAdminѓ« ў­®Ґ ¬Ґ­оЏа®Ја ¬¬лЂўв®§ Јаг§Є 
Adobe Gamma.lnk — c:program filesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe [2005-3-16 113664]

c:documents and settingsAdminѓ« ў­®Ґ ¬Ґ­оЏа®Ја ¬¬лЂўв®§ Јаг§Є 
Adobe Gamma.lnk — c:program filesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe [2005-3-16 113664]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesDisableNotify»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusDisableNotify»=dword:00000001
«AntiVirusOverride»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:program filesMicrosoft ActiveSyncrapimgr.exe»= c:program filesMicrosoft ActiveSyncrapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
«c:program filesMicrosoft ActiveSyncwcescomm.exe»= c:program filesMicrosoft ActiveSyncwcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
«c:program filesMicrosoft ActiveSyncWCESMgr.exe»= c:program filesMicrosoft ActiveSyncWCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
«c:\Program Files\Opera\opera.exe»=
«c:\Program Files\uTorrent\utorrent.exe»=
«c:\Program Files\StrongDC\StrongDC.exe»=
«c:\Program Files\Mail.Ru\Agent\magent.exe»=
«c:\Documents and Settings\Admin\Рабочий стол\Counter-strike\hl.exe»=
«c:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe»=

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«26675:TCP»= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R1 nod32drv;nod32drv;c:windowssystem32driversnod32drv.sys [30.01.2009 12:28 15424]
R2 TTFixerService;NST ToolTipFixer;c:program filesNeoSmart TechnologiesToolTipFixerToolTipFixer.exe [27.06.2007 9:20 10240]
R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:windowssystem32driversl151x86.sys [01.01.2002 11:34 36864]
S3 mirrorv3;mirrorv3;c:windowssystem32driversrminiv3.sys [01.11.2006 7:01 3328]
S3 Start BT in service;Start BT in service;c:program filesIVT CorporationBlueSoleilStartSkysolSvc.exe [21.04.2007 15:54 52080]
.
Contents of the ‘Scheduled Tasks’ folder

2009-06-24 c:windowsTasksUser_Feed_Synchronization-{8547AF36-B73C-4095-A9A2-D2A770FC0F49}.job
— c:windowssystem32msfeedssync.exe [2002-01-01 00:31]
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.mail.ru
uInternet Connection Wizard,ShellNext = hxxp://dt-updates.com/activate?query=Mc%2beSDUzG0eO%2f%2fGHftUgl1YCCX9SeJnDGgEtoRdidfp9zTQ2g9wXty0IsgbH3DWYGyAPxdUowT4PxW1pRhHwyEEn1O0vlGT2lRjByrOTKp2t0EZWA1aDpV9uKtcyg7R0tJp%2b8IYxZM4yzg8nmOvJLz6w9MLgk9hm4IEW8Owyk4rfWVXpfLF1J03HTRstj87rG61XCSdV9nvxpDIty%2fgicOpKhXjG%2fDDhnzIv8LUGSpT%2bo1kLlNyVIQj2KB3DIljKsS8jcXVhenj14wh5mWI4lIcH%2fuU0DCdoHvWE15eTmjg%3d
uInternet Settings,ProxyOverride =
IE: &Перевести — c:program filesArsenal CompanySOCRAT InternetHTMLWSocrat.js
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
IE: Закачать ВСЕ при помощи Download Master — c:program filesDownload Masterdmieall.htm
IE: Закачать при помощи Download Master — c:program filesDownload Masterdmie.htm
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:program filesMail.RuAgentmagent.exe
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe
IE: {{17FA5CD6-5737-45c2-B194-74C8A4A7F7E7} — {7E1F0737-53A5-4EDC-8734-DD94B50AAF83} — c:program filesArsenal CompanySOCRAT InternetSocratInternet.dll
IE: {{DFDC8970-FD66-4385-B8C0-835A4AA1DA00} — {A3400175-12F9-4220-83BF-A7210CA4003E} — c:program filesArsenal CompanySOCRAT InternetSocratInternet.dll
LSP: c:windowssystem32imon.dll
FF — ProfilePath —
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-25 16:03
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

LOCKED REGISTRY KEYS

---

[HKEY_USERSS-1-5-21-1292428093-1708537768-1417001333-500SoftwareMicrosoftInternet ExplorerUser Preferences]
@Denied: (2) (Administrator)
«88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977″=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,fe,d2,91,19,71,2a,3a,44,9a,58,a6,
«2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81″=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,fe,d2,91,19,71,2a,3a,44,9a,58,a6,
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘winlogon.exe'(1144)
c:windowssystem32SETUPAPI.dll
c:windowssystem32Ati2evxx.dll
c:windowssystem32cscui.dll
c:windowssystem32COMRes.dll

— — — — — — — > ‘lsass.exe'(1204)
c:windowssystem32setupapi.dll
c:windowssystem32imon.dll
c:program filesEsetpr_imon.dll

— — — — — — — > ‘explorer.exe'(15944)
c:windowssystem32WININET.dll
c:windowssystem32COMRes.dll
c:windowsSystem32cscui.dll
c:windowssystem32msi.dll
c:program filesLClockLC.dll
c:windowssystem32wpdshserviceobj.dll
c:windowssystem32webcheck.dll
c:windowssystem32portabledevicetypes.dll
c:windowssystem32portabledeviceapi.dll
c:windowssystem32SETUPAPI.dll
c:windowssystem32NETSHELL.dll
.
Completion time: 2009-06-25 16:05
ComboFix-quarantined-files.txt 2009-06-25 12:05
ComboFix2.txt 2009-06-21 14:51

Pre-Run: 17 256 124 416 байт свободно
Post-Run: 17 271 119 872 байт свободно

180

Надеюсь, что и этот файл что-нибудь прояснит. Заранее благодарен, Ovod.