ComboFix 09-06-21.01 — Администратор 26.06.2009 14:28.2 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.511.173 [GMT 3:00]
Running from: c:documents and settingsАдминистраторРабочий столЗАКАЧКИComboFix.exe
Command switches used :: c:documents and settingsАдминистраторРабочий столЗАКАЧКИWindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
AV: ESET NOD32 Antivirus 3.0 *On-access scanning enabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Created a new restore point
* Resident AV is active
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr0.dat
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr1.dat
BITS: Possible infected sites
hxxp://soft.export.yandex.ru
hxxp://download.yandex.ru
.
((((((((((((((((((((((((( Files Created from 2009-05-26 to 2009-06-26 )))))))))))))))))))))))))))))))
.
2009-06-22 14:21 . 2009-06-22 14:41
d
w- c:program filestrend micro
2009-06-22 14:21 . 2009-06-22 14:22
d
w- C:rsit
2009-06-21 15:04 . 2009-06-21 15:04 293376 —-a-w- c:documents and settingsАдминистраторApplication DataFieryAdsFieryAdsUninstall.exe
2009-06-21 15:04 . 2009-06-21 15:04
d
w- c:documents and settingsАдминистраторApplication DataFieryAds
2009-06-21 15:04 . 2009-06-21 15:04 667136 —-a-w- c:documents and settingsАдминистраторApplication DataFieryAdsFieryAds.dll
2009-06-21 15:04 . 2009-06-21 15:04 804864 —-a-w- c:documents and settingsАдминистраторApplication DataAdSubscribeUninstall.exe
2009-06-21 15:04 . 2009-06-21 15:04
d
w- c:documents and settingsАдминистраторApplication DataAdSubscribe
2009-06-21 15:04 . 2009-06-21 15:04 749056 —-a-w- c:documents and settingsАдминистраторApplication DataAdSubscribeAdSubscribe.dll
2009-06-12 11:14 . 2009-05-07 15:16 347136 -c—-w- c:windowssystem32dllcachelocalspl.dll
2009-06-12 11:14 . 2009-04-15 14:53 585216 -c—-w- c:windowssystem32dllcacherpcrt4.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-26 11:24 . 2009-01-19 21:16
d
w- c:documents and settingsАдминистраторApplication DataSkype
2009-06-26 11:14 . 2009-06-21 15:04 87373 —-a-w- c:documents and settingsАдминистраторApplication Datafieryads.dat
2009-06-26 11:08 . 2009-01-20 14:13
d
w- c:documents and settingsАдминистраторApplication DataskypePM
2009-06-26 11:08 . 2009-01-20 14:10
d
w- c:documents and settingsАдминистраторApplication DataYaChatData
2009-06-25 18:28 . 2009-02-05 14:07
d
w- c:program filesWebTV
2009-06-25 11:06 . 2009-05-23 08:56
d
w- c:documents and settingsAll UsersApplication DataGoogle Updater
2009-06-21 07:52 . 2009-03-07 16:29
d
w- c:documents and settingsАдминистраторApplication DataU3
2009-05-23 08:59 . 2009-04-02 11:57
d
w- c:program filesGoogle
2009-05-07 15:16 . 2008-12-16 22:42 347136 —-a-w- c:windowssystem32localspl.dll
2009-05-01 18:30 . 2009-05-01 18:30 3366912 —-a-w- c:windowssystem32GPhotos.scr
2009-04-29 04:39 . 2009-01-01 23:44 828928 —-a-w- c:windowssystem32wininet.dll
2009-04-29 04:39 . 2008-04-15 09:00 78336 —-a-w- c:windowssystem32ieencode.dll
2009-04-19 19:51 . 2008-12-16 22:43 1847296 —-a-w- c:windowssystem32win32k.sys
2009-04-17 16:20 . 2008-04-15 09:00 84082 —-a-w- c:windowssystem32perfc019.dat
2009-04-17 16:20 . 2008-04-15 09:00 484362 —-a-w- c:windowssystem32perfh019.dat
2009-04-15 14:53 . 2008-04-15 09:00 585216 —-a-w- c:windowssystem32rpcrt4.dll
2009-04-03 16:01 . 2009-04-03 16:01 8512 —ha-w- c:windowssystem32mlfcache.dat
.
Sigcheck
[-] 2009-01-01 23:44 579072 B431D43105A8E73D5D68565340DBBB97 c:windowssystem32user32.dll
[-] 2009-01-01 23:43 3686912 C2935CBCE85357DD77EF9D88345DE4D3 c:windowsexplorer.exe
[-] 2009-01-01 23:43 30208 514718EADD9D3328F691197A210BA7DC c:windowssystem32ctfmon.exe
[-] 2009-01-01 23:44 78360 90EA1473BC9A593D9212986614E387E1 c:windowssystem32wuauclt.exe
[-] 2009-01-01 23:46 1571840 F7B38BADF9063B977E666658396E5AC1 c:windowssystem32sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiersAdSubscribe]
@=»{82C885EE-6B87-4D51-9EF4-0CFE9FADA900}»
[HKEY_CLASSES_ROOTCLSID{82C885EE-6B87-4D51-9EF4-0CFE9FADA900}]
2009-06-21 15:04 749056 —-a-w- c:documents and settingsАдминистраторApplication DataAdSubscribeAdSubscribe.dll
[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
«YandexOnline»=»c:program filesYandexOnlineonline.exe» [2009-06-22 2558728]
«Skype»=»c:program filesSkypePhoneSkype.exe» [2009-03-27 24103720]
«ctfmon.exe»=»c:windowssystem32ctfmon.exe» [2009-01-01 30208]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«egui»=»c:program filesESETESET NOD32 Antivirusegui.exe» [2008-08-18 1447168]
«SoundMAXPnP»=»c:program filesAnalog DevicesSoundMAXSMax4PNP.exe» [2003-05-29 790528]
«CameraFixer»=»c:windowsCameraFixer.exe» [2005-10-03 20480]
«tsnp2std»=»c:windowstsnp2std.exe» [2005-11-03 106496]
«snp2std»=»c:windowsvsnp2std.exe» [2005-08-16 339968]
[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2009-01-01 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«IE7_012″=»advpack.dll» — c:windowssystem32advpack.dll [2009-04-29 124928]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«Start_ShowNetConn»= 1 (0x1)
[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«ForceClassicControlPanel»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)
[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«ForceClassicControlPanel»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)
[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«AntiVirusDisableNotify»=dword:00000001
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\WebTV\webtv.exe»=
«c:\Program Files\Skype\Phone\Skype.exe»=
R1 epfwtdir;epfwtdir;c:windowssystem32driversepfwtdir.sys [18.08.2008 14:27 34312]
R2 ekrn;Eset Service;c:program filesESETESET NOD32 Antivirusekrn.exe [18.08.2008 14:25 468224]
S2 gupdate1c9db84908c7f24;Служба Google Update (gupdate1c9db84908c7f24);c:program filesGoogleUpdateGoogleUpdate.exe [23.05.2009 11:57 133104]
— Other Services/Drivers In Memory —
*Deregistered* — uphcleanhlp
.
Contents of the ‘Scheduled Tasks’ folder
2009-06-26 c:windowsTasksGoogle Software Updater.job
— c:program filesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe [2009-04-02 08:56]
2009-06-26 c:windowsTasksGoogleUpdateTaskMachine.job
— c:program filesGoogleUpdateGoogleUpdate.exe [2009-05-23 08:57]
2009-06-26 c:windowsTasksUser_Feed_Synchronization-{6ACE5A7B-D68A-419B-9DBB-A55E76443811}.job
— c:windowssystem32msfeedssync.exe [2009-01-19 16:36]
2009-06-26 c:windowsTasksWGASetup.job
— c:windowssystem32KB905474wgasetup.exe [2009-04-08 19:18]
.
.
Supplementary Scan
.
uStart Page = hxxp://www.yandex.ru?clid=40547&yasoft=online
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Block This Image (ABP) — c:program filesAdblock Problockimg.html
IE: &Блокировать это изображение (ABP) — c:program filesAdblock Problockimg.html
IE: Add to Google Photos Screensa&ver — c:windowssystem32GPhotos.scr/200
IE: {{E7FD3540-AB30-40f1-91E7-101F733C1FD5} — {7685B225-8229-4321-BA13-A24485B0A760} — c:program filesAdblock ProAdblockPro.dll
FF — ProfilePath —
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-26 14:32
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(672)
c:windowssystem32SETUPAPI.dll
c:windowssystem32COMRes.dll
c:windowssystem32cscui.dll
— — — — — — — > ‘lsass.exe'(728)
c:windowssystem32setupapi.dll
.
Completion time: 2009-06-26 14:34
ComboFix-quarantined-files.txt 2009-06-26 11:34
Pre-Run: 60 974 616 576 байт свободно
Post-Run: 60 979 445 760 байт свободно
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
