((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2009-07-24 5586208]
[HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar]
[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2009-07-24 5586208]
[HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar]
[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«MSMSGS»=»c:program filesMessengermsmsgs.exe» [2004-08-17 1667584]
«EDLauncher»=»c:program filesPRMT6PRMTEDEDLauncher.exe» [2002-03-28 81920]
«Skype»=»c:program filesSkypePhoneSkype.exe» [2008-11-07 21633320]
«H/PC Connection Agent»=»c:program filesMicrosoft ActiveSyncwcescomm.exe» [2006-11-13 1289000]
«AlcoholAutomount»=»c:program filesAlcohol 120axcmd.exe» [2007-12-22 221568]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2001-07-09 155648]
«StartCCC»=»c:program filesATI TechnologiesATI.ACECore-StaticCLIStart.exe» [2006-11-10 90112]
«PCMService»=»c:program filesCyberLinkPowerCinemaPCMService.exe» [2005-05-23 127118]
«VX1000″=»c:windowsvVX1000.exe» [2007-04-10 709992]
«LifeCam»=»c:program filesMicrosoft LifeCamLifeExp.exe» [2007-05-17 279912]
«RemoteControl»=»c:program filesASUSTekASUSDVDPDVDServ.exe» [2003-10-31 32768]
«C-Media Mixer»=»Mixer.exe» — c:windowsmixer.exe [2004-08-11 1228800]
[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2004-10-21 15360]
c:documents and settings пѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
Adobe Gamma.lnk — c:program filesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe [2005-3-16 113664]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«AntiVirusOverride»=dword:00000001
[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringKasperskyAntiVirus]
«DisableMonitoring»=dword:00000001
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«c:program filesMicrosoft ActiveSyncrapimgr.exe»= c:program filesMicrosoft ActiveSyncrapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
«c:program filesMicrosoft ActiveSyncwcescomm.exe»= c:program filesMicrosoft ActiveSyncwcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
«c:program filesMicrosoft ActiveSyncWCESMgr.exe»= c:program filesMicrosoft ActiveSyncWCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
«c:\Program Files\Microsoft LifeCam\LifeCam.exe»=
«c:\Program Files\Microsoft LifeCam\LifeExp.exe»=
«c:\Program Files\CyberLink\PowerCinema\PowerCinema.exe»=
«c:\Program Files\uTorrent\uTorrent.exe»=
«c:\Program Files\Autodesk\Backburner\monitor.exe»=
«c:\Program Files\Autodesk\Backburner\manager.exe»=
«c:\Program Files\Autodesk\Backburner\server.exe»=
«c:\Program Files\OperaAC\Opera.exe»=
«c:\Program Files\Skype\Phone\Skype.exe»=
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«14522:TCP»= 14522:TCP:*:Disabled:NortonAV
«12591:TCP»= 12591:TCP:*:Disabled:NortonAV
«12698:TCP»= 12698:TCP:*:Disabled:NortonAV
«26675:TCP»= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
R0 HFXP2;HFXP2;c:windowsSYSTEM32DRIVERShfxp2.sys [07.04.2009 19:33 17264]
R0 klbg;Kaspersky Lab Boot Guard Driver;c:windowsSYSTEM32DRIVERSklbg.sys [29.01.2008 18:29 33808]
R0 ps6ajtsb;Stalker (Pro) Synchronization Driver (ps6ajtsb);c:windowsSYSTEM32DRIVERSps6ajtsb.sys [05.03.2007 20:57 52104]
R0 UP55bus;UP55bus;c:windowsSYSTEM32DRIVERSUP55bus.sys [29.08.2008 16:53 155136]
R0 UP55prt;UP55prt;c:windowsSYSTEM32DRIVERSUP55prt.sys [29.08.2008 16:53 5248]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:windowsSYSTEM32DRIVERSklim5.sys [30.04.2008 18:06 24592]
S2 pr2ajtsb;Stalker (Pro) Drivers Auto Removal (pr2ajtsb);c:windowssystem32pr2ajtsb.exe svc —> c:windowssystem32pr2ajtsb.exe svc [?]
S3 MBAMSwissArmy;MBAMSwissArmy;c:windowsSYSTEM32DRIVERSmbamswissarmy.sys [03.11.2009 16:35 38224]
— Other Services/Drivers In Memory —
*Deregistered* — mbr
*Deregistered* — PROCEXP113
.
.
Supplementary Scan
.
uStart Page = http://www.nevosoft.ru
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
IE: {{7A2EFD41-E6B3-11D2-89E3-00E0292EE574} — c:program filesPRMT6PRMTIEprmtie5.htm
IE: {{7A2EFD41-E6B3-11D2-89E3-00E0292EE575} — c:program filesPRMT6PRMTIEoptions.htm
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-13 07:36
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x836A0530]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
Driveratapi -> 0x836a0530
Warning: possible MBR rootkit infection !
user & kernel MBR OK
Use «Recovery Console» command «fixmbr» to clear infection !
**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(904)
c:windowssystem32Ati2evxx.dll
— — — — — — — > ‘explorer.exe'(3308)
c:program filesPRMT6PRMTEDEDSel.dll
c:windowssystem32msi.dll
c:windowssystem32WPDShServiceObj.dll
c:windowssystem32PortableDeviceTypes.dll
c:windowssystem32PortableDeviceApi.dll
.
Completion time: 2009-11-13 07:42
ComboFix-quarantined-files.txt 2009-11-13 01:42
ComboFix2.txt 2009-11-06 02:09
Pre-Run: 22 035 189 760 байт свободно
Post-Run: 22 065 982 976 байт свободно
— — End Of File — — B93C05535E2D3FAB9B3C1E2C0395BD05
