ComboFix 09-07-06.02 — Администратор 07.07.2009 11:27.3 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.511.88 [GMT 3:00]
Running from: c:documents and settingsАдминистраторРабочий столЗАКАЧКИComboFix.exe
Command switches used :: c:documents and settingsАдминистраторРабочий столCFScript.txt
AV: ESET NOD32 Antivirus 3.0 *On-access scanning enabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Created a new restore point
* Resident AV is active
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:documents and settingsАдминистраторApplication DataAdSubscribe
c:documents and settingsАдминистраторApplication DataAdSubscribeAdSubscribe.dat
c:documents and settingsАдминистраторApplication DataAdSubscribeAdSubscribe.dll
c:documents and settingsАдминистраторApplication DataAdSubscribeFeed.jpg
c:documents and settingsАдминистраторApplication DataAdSubscribeFeed1.jpg
c:documents and settingsАдминистраторApplication DataAdSubscribeFeed10.jpg
c:documents and settingsАдминистраторApplication DataAdSubscribeFeed11.jpg
c:documents and settingsАдминистраторApplication DataAdSubscribeFeed12.jpg
c:documents and settingsАдминистраторApplication DataAdSubscribeFeed13.jpg
c:documents and settingsАдминистраторApplication DataAdSubscribeFeed14.jpg
c:documents and settingsАдминистраторApplication DataAdSubscribeFeed15.jpg
c:documents and settingsАдминистраторApplication DataAdSubscribeFeed2.jpg
c:documents and settingsАдминистраторApplication DataAdSubscribeFeed3.jpg
c:documents and settingsАдминистраторApplication DataAdSubscribeFeed4.jpg
c:documents and settingsАдминистраторApplication DataAdSubscribeFeed5.jpg
c:documents and settingsАдминистраторApplication DataAdSubscribeFeed6.jpg
c:documents and settingsАдминистраторApplication DataAdSubscribeFeed7.jpg
c:documents and settingsАдминистраторApplication DataAdSubscribeFeed8.jpg
c:documents and settingsАдминистраторApplication DataAdSubscribeFeed9.jpg
c:documents and settingsАдминистраторApplication DataAdSubscribeFeedfeed.xml
c:documents and settingsАдминистраторApplication DataAdSubscribeUninstall.exe
c:documents and settingsАдминистраторApplication DataFieryAds
c:documents and settingsАдминистраторApplication DataFieryAdsFieryAds.dll
c:documents and settingsАдминистраторApplication DataFieryAdsFieryAdsUninstall.exe
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr0.dat
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr1.dat
BITS: Possible infected sites
hxxp://soft.export.yandex.ru
.
((((((((((((((((((((((((( Files Created from 2009-06-07 to 2009-07-07 )))))))))))))))))))))))))))))))
.
2009-06-22 14:21 . 2009-06-22 14:41
d
w- c:program filestrend micro
2009-06-22 14:21 . 2009-06-22 14:22
d
w- C:rsit
2009-06-12 11:14 . 2009-05-07 15:16 347136 -c—-w- c:windowssystem32dllcachelocalspl.dll
2009-06-12 11:14 . 2009-04-15 14:53 585216 -c—-w- c:windowssystem32dllcacherpcrt4.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-07 08:16 . 2009-01-19 21:16
d
w- c:documents and settingsАдминистраторApplication DataSkype
2009-07-07 08:15 . 2009-01-20 14:13
d
w- c:documents and settingsАдминистраторApplication DataskypePM
2009-07-07 08:15 . 2009-01-20 14:10
d
w- c:documents and settingsАдминистраторApplication DataYaChatData
2009-07-06 21:16 . 2009-02-05 14:07
d
w- c:program filesWebTV
2009-07-06 19:30 . 2009-05-23 08:56
d
w- c:documents and settingsAll UsersApplication DataGoogle Updater
2009-06-26 11:14 . 2009-06-21 15:04 87373 —-a-w- c:documents and settingsАдминистраторApplication Datafieryads.dat
2009-06-21 07:52 . 2009-03-07 16:29
d
w- c:documents and settingsАдминистраторApplication DataU3
2009-05-23 08:59 . 2009-04-02 11:57
d
w- c:program filesGoogle
2009-05-07 15:16 . 2008-12-16 22:42 347136 —-a-w- c:windowssystem32localspl.dll
2009-05-01 18:30 . 2009-05-01 18:30 3366912 —-a-w- c:windowssystem32GPhotos.scr
2009-04-29 04:39 . 2009-01-01 23:44 828928 —-a-w- c:windowssystem32wininet.dll
2009-04-29 04:39 . 2008-04-15 09:00 78336 —-a-w- c:windowssystem32ieencode.dll
2009-04-19 19:51 . 2008-12-16 22:43 1847296 —-a-w- c:windowssystem32win32k.sys
2009-04-17 16:20 . 2008-04-15 09:00 84082 —-a-w- c:windowssystem32perfc019.dat
2009-04-17 16:20 . 2008-04-15 09:00 484362 —-a-w- c:windowssystem32perfh019.dat
2009-04-15 14:53 . 2008-04-15 09:00 585216 —-a-w- c:windowssystem32rpcrt4.dll
.
Sigcheck
[-] 2009-01-01 23:44 579072 B431D43105A8E73D5D68565340DBBB97 c:windowssystem32user32.dll
[-] 2009-01-01 23:43 3686912 C2935CBCE85357DD77EF9D88345DE4D3 c:windowsexplorer.exe
[-] 2009-01-01 23:43 30208 514718EADD9D3328F691197A210BA7DC c:windowssystem32ctfmon.exe
[-] 2009-01-01 23:44 78360 90EA1473BC9A593D9212986614E387E1 c:windowssystem32wuauclt.exe
[-] 2009-01-01 23:46 1571840 F7B38BADF9063B977E666658396E5AC1 c:windowssystem32sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-06-26_11.32.44 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-06 19:44 . 2009-07-06 19:44 22528 c:windowsInstallerd20fc.msi
+ 2008-12-03 12:36 . 2008-12-03 12:36 28160 c:windowsInstaller905c2.msp
+ 2009-01-19 20:30 . 2009-01-19 20:30 97280 c:windowsInstaller905ab.msi
+ 2008-07-29 18:07 . 2008-07-29 18:07 23040 c:windowsInstaller409cf.msp
+ 2009-01-19 20:24 . 2009-01-19 20:24 88576 c:windowsInstaller227ea.msi
+ 2009-01-19 20:26 . 2009-01-19 20:26 652800 c:windowsMicrosoft.NETFrameworkv3.5Microsoft .NET Framework 3.5 SP1vs_setup.msi
+ 2008-12-03 13:35 . 2008-12-03 13:35 440832 c:windowsMicrosoft.NETFrameworkv3.5Microsoft .NET Framework 3.5 Language Pack SP1 — rusvs_setup.msi
+ 2009-01-19 19:56 . 2008-11-11 18:41 432640 c:windowsInstallerInstallSource MSXMLmsxml.msi
+ 2009-01-19 20:00 . 2009-01-19 20:00 115712 c:windowsInstallerbcb04.msi
+ 2009-01-19 19:59 . 2009-01-19 19:59 259072 c:windowsInstallerbcaff.msi
+ 2009-01-19 19:56 . 2009-01-19 19:56 423424 c:windowsInstallerbcaef.msi
+ 2009-01-19 20:35 . 2009-01-19 20:35 265216 c:windowsInstallerba8a.msi
+ 2009-01-19 20:31 . 2009-01-19 20:31 436736 c:windowsInstaller905cc.msi
+ 2008-12-03 10:47 . 2008-12-03 10:47 911360 c:windowsInstaller905c6.msp
+ 2008-12-03 11:18 . 2008-12-03 11:18 187392 c:windowsInstaller905c5.msp
+ 2008-12-03 12:13 . 2008-12-03 12:13 107520 c:windowsInstaller905c4.msp
+ 2008-12-03 11:28 . 2008-12-03 11:28 220672 c:windowsInstaller905c3.msp
+ 2008-12-03 11:20 . 2008-12-03 11:20 119808 c:windowsInstaller905c1.msp
+ 2008-12-03 11:35 . 2008-12-03 11:35 186368 c:windowsInstaller905c0.msp
+ 2009-01-19 20:31 . 2009-01-19 20:31 296448 c:windowsInstaller905bf.msi
+ 2008-12-03 08:12 . 2008-12-03 08:12 381952 c:windowsInstaller905b0.msp
+ 2008-12-03 08:18 . 2008-12-03 08:18 582144 c:windowsInstaller905af.msp
+ 2008-12-03 08:16 . 2008-12-03 08:16 377856 c:windowsInstaller905ae.msp
+ 2008-12-03 08:09 . 2008-12-03 08:09 256512 c:windowsInstaller905ad.msp
+ 2008-12-03 08:14 . 2008-12-03 08:14 708608 c:windowsInstaller905ac.msp
+ 2008-12-13 06:58 . 2008-12-13 06:58 754688 c:windowsInstaller4e0de.msp
+ 2009-01-19 20:26 . 2009-01-19 20:26 648192 c:windowsInstaller4e0bb.msi
+ 2008-07-29 18:23 . 2008-07-29 18:23 250880 c:windowsInstaller409d8.msp
+ 2008-07-29 18:28 . 2008-07-29 18:28 278016 c:windowsInstaller409d6.msp
+ 2008-07-29 16:40 . 2008-07-29 16:40 291840 c:windowsInstaller409d4.msp
+ 2009-01-19 20:25 . 2009-01-19 20:25 137728 c:windowsInstaller409ce.msi
+ 2008-07-29 14:35 . 2008-07-29 14:35 553472 c:windowsInstaller227ef.msp
+ 2008-07-29 14:33 . 2008-07-29 14:33 506368 c:windowsInstaller227ed.msp
+ 2008-07-29 14:37 . 2008-07-29 14:37 911360 c:windowsInstaller227ec.msp
+ 2009-02-05 14:08 . 2009-02-05 14:08 204288 c:windowsInstaller217fb3.msi
+ 2009-01-19 20:13 . 2009-01-19 20:13 914432 c:windowsInstaller1a69ef.msi
+ 2009-01-19 20:12 . 2009-01-19 20:12 331776 c:windowsInstaller1a69ea.msi
+ 2008-04-15 09:00 . 2008-04-15 09:00 1359360 c:windowssystem32webfldrs.msi
+ 2009-04-01 16:06 . 2009-04-01 16:06 1602048 c:windowsInstallerfedd37.msi
+ 2009-01-19 19:59 . 2009-01-19 19:59 3908096 c:windowsInstallerbcafa.msi
+ 2009-01-19 19:57 . 2009-01-19 19:57 6284288 c:windowsInstallerbcaf5.msi
+ 2009-05-23 08:59 . 2009-05-23 08:59 1401344 c:windowsInstaller584861e.msi
+ 2008-12-13 06:57 . 2008-12-13 06:57 8397824 c:windowsInstaller4e0c9.msp
+ 2008-07-29 16:26 . 2008-07-29 16:26 1043456 c:windowsInstaller409d7.msp
+ 2008-07-29 17:37 . 2008-07-29 17:37 2679808 c:windowsInstaller409d5.msp
+ 2008-07-29 18:15 . 2008-07-29 18:15 3697664 c:windowsInstaller409d3.msp
+ 2008-07-29 16:34 . 2008-07-29 16:34 1448448 c:windowsInstaller409d2.msp
+ 2008-07-29 17:22 . 2008-07-29 17:22 4137984 c:windowsInstaller409d1.msp
+ 2008-07-29 16:18 . 2008-07-29 16:18 3376640 c:windowsInstaller409d0.msp
+ 2008-07-29 14:45 . 2008-07-29 14:45 2543616 c:windowsInstaller227f3.msp
+ 2008-07-29 14:29 . 2008-07-29 14:29 2926080 c:windowsInstaller227f2.msp
+ 2008-07-29 14:41 . 2008-07-29 14:41 6487040 c:windowsInstaller227f1.msp
+ 2008-07-29 14:39 . 2008-07-29 14:39 3403264 c:windowsInstaller227f0.msp
+ 2008-07-29 14:43 . 2008-07-29 14:43 1013248 c:windowsInstaller227ee.msp
+ 2008-07-29 14:31 . 2008-07-29 14:31 6083072 c:windowsInstaller227eb.msp
+ 2008-12-13 07:21 . 2008-12-13 07:21 10473472 c:windowsInstaller4e0d3.msp
.
— Snapshot reset to current date —
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
«YandexOnline»=»c:program filesYandexOnlineonline.exe» [2009-06-22 2558728]
«Skype»=»c:program filesSkypePhoneSkype.exe» [2009-03-27 24103720]
«ctfmon.exe»=»c:windowssystem32ctfmon.exe» [2009-01-01 30208]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«egui»=»c:program filesESETESET NOD32 Antivirusegui.exe» [2008-08-18 1447168]
«SoundMAXPnP»=»c:program filesAnalog DevicesSoundMAXSMax4PNP.exe» [2003-05-29 790528]
«CameraFixer»=»c:windowsCameraFixer.exe» [2005-10-03 20480]
«tsnp2std»=»c:windowstsnp2std.exe» [2005-11-03 106496]
«snp2std»=»c:windowsvsnp2std.exe» [2005-08-16 339968]
[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2009-01-01 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«IE7_012″=»advpack.dll» — c:windowssystem32advpack.dll [2009-04-29 124928]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«Start_ShowNetConn»= 1 (0x1)
[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«ForceClassicControlPanel»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)
[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«ForceClassicControlPanel»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\WebTV\webtv.exe»=
«c:\Program Files\Skype\Phone\Skype.exe»=
R1 epfwtdir;epfwtdir;c:windowssystem32driversepfwtdir.sys [18.08.2008 14:27 34312]
R2 ekrn;Eset Service;c:program filesESETESET NOD32 Antivirusekrn.exe [18.08.2008 14:25 468224]
S2 gupdate1c9db84908c7f24;Служба Google Update (gupdate1c9db84908c7f24);c:program filesGoogleUpdateGoogleUpdate.exe [23.05.2009 11:57 133104]
— Other Services/Drivers In Memory —
*Deregistered* — uphcleanhlp
.
Contents of the ‘Scheduled Tasks’ folder
2009-07-07 c:windowsTasksGoogle Software Updater.job
— c:program filesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe [2009-04-02 08:56]
2009-07-07 c:windowsTasksGoogleUpdateTaskMachineCore.job
— c:program filesGoogleUpdateGoogleUpdate.exe [2009-05-23 08:57]
2009-07-06 c:windowsTasksGoogleUpdateTaskMachineUA.job
— c:program filesGoogleUpdateGoogleUpdate.exe [2009-05-23 08:57]
2009-07-07 c:windowsTasksUser_Feed_Synchronization-{6ACE5A7B-D68A-419B-9DBB-A55E76443811}.job
— c:windowssystem32msfeedssync.exe [2009-01-19 16:36]
2009-07-07 c:windowsTasksWGASetup.job
— c:windowssystem32KB905474wgasetup.exe [2009-04-08 19:18]
.
.
Supplementary Scan
.
uStart Page = hxxp://www.yandex.ru?clid=40547&yasoft=online
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Block This Image (ABP) — c:program filesAdblock Problockimg.html
IE: &Блокировать это изображение (ABP) — c:program filesAdblock Problockimg.html
IE: Add to Google Photos Screensa&ver — c:windowssystem32GPhotos.scr/200
IE: {{E7FD3540-AB30-40f1-91E7-101F733C1FD5} — {7685B225-8229-4321-BA13-A24485B0A760} — c:program filesAdblock ProAdblockPro.dll
TCP: {835CAFFE-5E84-4C25-8E50-C8CC714A5A20} = 212.50.211.242 212.50.192.226
FF — ProfilePath — c:documents and settingsАдминистраторApplication DataMozillaFirefoxProfilesyf319neu.default
FF — component: c:program filesMozilla Firefoxextensions{B13721C7-F507-4982-B2E5-502A71474FED}componentsNPComponent.dll
FF — plugin: c:program filesGoogleGoogle Updater2.4.1487.6512npCIDetect13.dll
FF — plugin: c:program filesGooglePicasa3npPicasa3.dll
FF — plugin: c:program filesGoogleUpdate1.2.183.7npGoogleOneClick8.dll
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnppl3260.dll
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnprpjplug.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-07 11:34
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(668)
c:windowssystem32SETUPAPI.dll
c:windowssystem32COMRes.dll
c:windowssystem32cscui.dll
— — — — — — — > ‘lsass.exe'(724)
c:windowssystem32setupapi.dll
— — — — — — — > ‘explorer.exe'(1752)
c:windowssystem32SHDOCVW.dll
c:windowssystem32COMRes.dll
c:windowsSystem32cscui.dll
c:windowssystem32NETSHELL.dll
c:windowssystem32msi.dll
c:windowssystem32SETUPAPI.dll
c:windowssystem32wpdshserviceobj.dll
c:windowssystem32portabledevicetypes.dll
c:windowssystem32portabledeviceapi.dll
.
Other Running Processes
.
c:program filesAnalog DevicesSoundMAXSMAgent.exe
c:windowssystem32uphclean.exe
c:windowssystem32wscntfy.exe
c:program filesYandexOnlineyachatyachat.exe
c:program filesSkypePlugin ManagerskypePM.exe
.
**************************************************************************
.
Completion time: 2009-07-07 11:37 — machine was rebooted
ComboFix-quarantined-files.txt 2009-07-07 08:37
ComboFix2.txt 2009-06-26 11:34
Pre-Run: 60 899 057 664 байт свободно
Post-Run: 60 923 179 008 байт свободно
249 — E O F — 2009-06-12 20:12
