antivirus pro 2010

[Ryjik-r]

Здравствуйте, не сразу прочитала что нужно создавать отдельную тему.
Проблема антивир. Лог прилагаю. Была еще куча троянов, но вроде бы все вычистилиа от этого не знаю как избавиться.
Помогите пожалуйста.

Running from: C:Documents and SettingsÀäìèíèñòðàòîðLocal SettingsTemporary Internet FilesContent.IE54INWVFB5Win32kDiag[1].exe

Log file at : C:Documents and SettingsАдминистраторРабочий столWin32kDiag.txt

WARNING: Could not get backup privileges!

Searching ‘C:WINDOWS’…

Finished!

[Admin]

Здравствуйте, добро пожаловать на Spyware-ru форум.

Скачайте программу Combofix. Закройте все открытые окна и запустите эту программу.
После выполнения будет создан лог файл, пожалуйста вставьте его в ваш ответ.

[Ryjik-r]

ComboFix 09-10-03.01 — Администратор 04.10.2009 17:59.1.1 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.1014.571 [GMT 4:00]
Running from: c:documents and settingsАдминистраторРабочий столComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:documents and settingsАдминистраторApplication Data.#
c:documents and settingsАдминистраторApplication Dataaqasax.ban
c:documents and settingsАдминистраторApplication Datalizkavd.exe
c:documents and settingsАдминистраторApplication DataMicrosoftInternet ExplorerQuick LaunchAntivirusPro_2010.lnk
c:documents and settingsАдминистраторApplication Dataohyjo.exe
c:documents and settingsАдминистраторApplication Datatytucy.scr
c:documents and settingsАдминистраторApplication Datawiaserva.log
c:documents and settingsАдминистраторApplication Dataxykuqukiv.lib
c:documents and settingsАдминистраторCookiescyxucen.exe
c:documents and settingsАдминистраторCookiesitunah.com
c:documents and settingsАдминистраторCookiesomucipen.dll
c:documents and settingsАдминистраторCookiesubileg.lib
c:documents and settingsАдминистраторLocal SettingsApplication Dataahyviwaq.exe
c:documents and settingsАдминистраторLocal SettingsApplication Dataimuqywih.com
c:documents and settingsАдминистраторLocal SettingsApplication Dataiqofyby.bin
c:documents and settingsАдминистраторLocal SettingsApplication Dataxyza.sys
c:documents and settingsАдминистраторoashdihasidhasuidhiasdhiashdiuasdhasd
c:documents and settingsAll UsersДокументыalozulite.dll
c:documents and settingsAll UsersДокументыfelim.pif
c:documents and settingsAll UsersДокументыjywafugaf.scr
c:documents and settingsAll UsersДокументыpyci.dl
c:documents and settingsAll UsersApplication Datafucynap.dl
c:documents and settingsAll UsersApplication Datagamiduwysi.scr
c:documents and settingsAll UsersApplication Dataguzar.vbs
c:documents and settingsAll UsersApplication Dataodad.bin
c:documents and settingsAll UsersApplication Dataopomyve.inf
c:documents and settingsAll UsersApplication Dataufali.sys
c:documents and settingsAll UsersApplication Dataupezini._sy
c:documents and settingsAll Users„®Єг¬Ґ­влepafuromuz.inf
c:documents and settingsAll Users„®Єг¬Ґ­влorocy.bat
c:documents and settingsAll Users„®Єг¬Ґ­влpiqih.bat
c:documents and settingsAll Users„®Єг¬Ґ­влsonelex.reg
c:documents and settingsЂ¤¬Ё­Ёбва в®аLocal SettingsApplication Dataamuqiniqux.reg
c:documents and settingsЂ¤¬Ё­Ёбва в®аLocal SettingsApplication Dataipojadaz.vbs
c:documents and settingsЂ¤¬Ё­Ёбва в®аLocal SettingsApplication Dataodoc.inf
c:program filesCommon Filesahuve.dll
c:program filesCommon Filesgiqocubaza.bin
c:program filesCommon Filesledymala.vbs
c:program filesCommon Filesvejugu.scr
c:windowsacupec.scr
c:windowsevebubon.reg
c:windowsfymyluqo.vbs
c:windowshiqikofyzu.vbs
c:windowsibepodip._dl
c:windowsitewet.bat
c:windowsqoqice.reg
c:windowsrikevele.vbs
c:windowssojaqehyb.vbs
c:windowssystem32ejikysoqib.pif
c:windowssystem32hotyjixafo.reg
c:windowssystem32icasy.sys
c:windowssystem32isaku.dll
c:windowssystem32pycawuh.bin
c:windowssystem32ubuguwe.scr
c:windowssystem32ygevogi.pif
c:windowsturewyca.vbs
c:windowstywelywude.dll
c:windowsykanyged.reg
c:windowszidijiror.vbs
c:windowszobetuv.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

---

Legacy_MESSAGER

((((((((((((((((((((((((( Files Created from 2009-09-04 to 2009-10-04 )))))))))))))))))))))))))))))))
.

2009-10-04 13:15 . 2009-10-04 13:15

---

d

---

w- c:documents and settingsAll UsersApplication DataSUPERAntiSpyware.com
2009-10-04 13:15 . 2009-10-04 13:15

---

d

---

w- c:program filesSUPERAntiSpyware
2009-10-04 13:15 . 2009-10-04 13:15

---

d

---

w- c:documents and settingsАдминистраторApplication DataSUPERAntiSpyware.com
2009-10-04 13:15 . 2009-10-04 13:15

---

d

---

w- c:program filesCommon FilesWise Installation Wizard
2009-10-04 05:08 . 2009-10-04 05:08 15682 —-a-w- c:windowsanuso.com
2009-10-04 05:08 . 2009-10-04 05:08 11007 —-a-w- c:windowsijusalynu.dat
2009-10-04 04:57 . 2009-10-04 04:57 18343 —-a-w- c:windowsymoneb.com
2009-10-04 04:57 . 2009-10-04 04:57 13261 —-a-w- c:documents and settingsАдминистраторLocal SettingsApplication Dataipojadaz.vbs
2009-10-04 04:57 . 2009-10-04 04:57 11928 —-a-w- c:windowsvybolerako.dat
2009-10-04 04:54 . 2009-10-04 04:54 17608 —-a-w- c:documents and settingsАдминистраторLocal SettingsApplication Dataamuqiniqux.reg
2009-10-02 19:22 . 2009-10-04 13:48

---

d

---

w- c:documents and settingsАдминистраторLocal SettingsApplication Datantias64
2009-10-01 08:46 . 2009-10-04 13:51

---

d—a-w- c:documents and settingsAll UsersApplication DataTEMP
2009-10-01 08:45 . 2006-06-19 09:01 69632 —-a-w- c:windowssystem32ztvcabinet.dll
2009-10-01 08:45 . 2006-05-25 11:52 162304 —-a-w- c:windowssystem32ztvunrar36.dll
2009-10-01 08:45 . 2005-08-25 21:50 77312 —-a-w- c:windowssystem32ztvunace26.dll
2009-10-01 08:45 . 2003-02-02 16:06 153088 —-a-w- c:windowssystem32UNRAR3.dll
2009-10-01 08:45 . 2002-03-05 21:00 75264 —-a-w- c:windowssystem32unacev2.dll
2009-10-01 08:45 . 2009-10-01 08:45

---

d

---

w- c:program filesTrojan Remover
2009-10-01 08:45 . 2009-10-01 08:45

---

d

---

w- c:documents and settingsAll UsersApplication DataSimply Super Software
2009-10-01 08:45 . 2009-10-01 08:45

---

d

---

w- c:documents and settingsАдминистраторApplication DataSimply Super Software
2009-10-01 07:40 . 2009-10-01 07:41

---

d

---

w- c:program filesRegCleaner4.3
2009-10-01 07:34 . 2009-10-04 13:50

---

d

---

w- c:program filesKerish Doctor 2008
2009-10-01 07:30 . 2009-10-01 07:30 11197 —-a-w- c:program filesCommon Fileskubopypu.dat
2009-09-30 19:52 . 2009-09-30 19:52

---

d

---

w- c:windowsSun
2009-09-30 06:02 . 2008-07-16 18:18 21504 —-a-w- c:windowssystem32hidserv.dll
2009-09-30 06:02 . 2008-07-16 18:18 14720 —-a-w- c:windowssystem32driverskbdhid.sys
2009-09-29 08:09 . 2009-09-29 08:09

---

d

---

w- c:documents and settingsАдминистраторApplication DataQIP
2009-09-29 08:07 . 2009-09-29 08:07

---

d

---

w- c:program filesQIP Infium
2009-09-29 07:53 . 2009-09-29 07:53

---

d

---

r- c:documents and settingsLocalServiceИзбранное
2009-09-29 07:53 . 2009-09-29 07:53

---

d-sh—w- c:documents and settingsLocalServiceIETldCache
2009-09-29 07:43 . 2009-07-28 12:33 55656 —-a-w- c:windowssystem32driversavgntflt.sys
2009-09-29 07:43 . 2009-03-30 06:33 96104 —-a-w- c:windowssystem32driversavipbb.sys
2009-09-29 07:43 . 2009-02-13 08:29 22360 —-a-w- c:windowssystem32driversavgntmgr.sys
2009-09-29 07:43 . 2009-02-13 08:17 45416 —-a-w- c:windowssystem32driversavgntdd.sys
2009-09-29 07:11 . 2009-09-29 08:40

---

d

---

w- c:program filesAvira
2009-09-29 06:38 . 2009-09-29 07:42

---

d

---

w- c:documents and settingsAll UsersApplication DataAvira
2009-09-28 21:33 . 2009-09-28 21:33

---

d

---

w- c:documents and settingsLocalServiceLocal SettingsApplication DataESET
2009-09-28 17:07 . 2009-09-29 07:01

---

d

---

w- c:program filesSamsung Electronics
2009-09-28 16:55 . 2009-09-28 16:55

---

d

---

w- C:CanonMF
2009-09-28 15:50 . 2009-09-28 15:50

---

d

---

w- c:documents and settingsАдминистраторDoctorWeb
2009-09-27 16:56 . 2009-09-27 16:56

---

d

---

w- c:documents and settingsАдминистраторLocal SettingsApplication DataESET
2009-09-27 15:54 . 2009-09-27 15:54

---

d

---

w- c:program filesESET
2009-09-27 15:54 . 2009-09-27 15:54

---

d

---

w- c:documents and settingsAll UsersApplication DataESET
2009-09-25 20:33 . 2005-06-10 09:39 53248 —-a-w- c:windowssystem32CNAS0MMK.DLL
2009-09-25 18:30 . 2009-09-25 19:56

---

d

---

w- c:program filescanon
2009-09-25 17:11 . 2009-06-25 08:42 54272 -c—-w- c:windowssystem32dllcachewdigest.dll
2009-09-25 17:11 . 2009-06-25 08:42 301568 -c—-w- c:windowssystem32dllcachekerberos.dll
2009-09-25 17:11 . 2009-06-25 08:42 136704 -c—-w- c:windowssystem32dllcachemsv1_0.dll
2009-09-25 17:11 . 2009-06-24 10:28 92928 -c—-w- c:windowssystem32dllcacheksecdd.sys
2009-09-25 15:46 . 2009-06-15 11:10 80896 -c—-w- c:windowssystem32dllcachetlntsess.exe
2009-09-25 15:46 . 2009-06-15 10:45 79872 -c—-w- c:windowssystem32dllcachetelnet.exe
2009-09-25 15:46 . 2009-07-29 04:36 81920 -c—-w- c:windowssystem32dllcachefontsub.dll
2009-09-25 15:46 . 2009-07-29 04:36 119808 -c—-w- c:windowssystem32dllcachet2embed.dll
2009-09-25 15:46 . 2009-06-10 06:17 134144 -c—-w- c:windowssystem32dllcachewkssvc.dll
2009-09-25 15:45 . 2009-06-10 14:14 85504 -c—-w- c:windowssystem32dllcacheavifil32.dll
2009-09-25 15:44 . 2009-07-17 19:03 58880 -c—-w- c:windowssystem32dllcacheatl.dll
2009-09-25 15:41 . 2009-08-05 09:01 204800 -c—-w- c:windowssystem32dllcachemswebdvd.dll
2009-09-25 15:29 . 2009-06-21 21:48 153088 -c—-w- c:windowssystem32dllcachetriedit.dll
2009-09-25 15:29 . 2009-07-10 13:28 1315328 -c—-w- c:windowssystem32dllcachemsoe.dll
2009-09-25 10:02 . 2009-09-25 10:02

---

d

---

w- c:documents and settingsАдминистраторApplication DataYahoo!
2009-09-25 09:54 . 2009-09-29 07:31

---

d

---

w- c:program filesCommon FilesScanner
2009-09-25 09:54 . 2002-02-21 14:56 24576 —-a-w- c:windowssystem32msxml3a.dll
2009-09-25 09:54 . 2009-09-29 07:32

---

d

---

w- c:program filesYahoo!
2009-09-25 09:50 . 2007-04-11 11:33 79376 —-a-w- c:windowssystem32driversLMouKE.Sys
2009-09-25 09:50 . 2007-04-11 11:32 63248 —-a-w- c:windowssystem32driversL8042mou.Sys
2009-09-25 09:50 . 2007-04-11 11:32 20496 —-a-w- c:windowssystem32driversL8042Kbd.sys
2009-09-25 09:50 . 2007-04-11 11:32 36112 —-a-w- c:windowssystem32driversLMouFilt.Sys
2009-09-25 09:50 . 2007-04-11 11:32 34832 —-a-w- c:windowssystem32driversLHidFilt.Sys
2009-09-25 09:50 . 2007-04-11 11:32 56080 —-a-w- c:windowsKHALMNPR.Exe
2009-09-25 09:50 . 2007-04-11 11:33 1419024 —-a-w- c:windowssystem32WdfCoInstaller01005.dll
2009-09-25 09:50 . 2007-04-11 11:33 28688 —-a-w- c:windowssystem32driversLUsbFilt.sys
2009-09-25 09:48 . 2009-09-25 09:48

---

d

---

w- c:documents and settingsAll UsersApplication DataLogiShrd
2009-09-24 18:53 . 2009-10-01 17:46

---

d

---

w- c:documents and settingsАдминистраторApplication DataCanon
2009-09-24 06:33 . 2009-09-24 06:33

---

d

---

w- c:documents and settingsAll UsersApplication DataSeoAdministrator
2009-09-24 06:33 . 2009-09-01 08:53 639488 —-a-w- c:windowssystem32semtempl.dll
2009-09-24 06:33 . 2005-05-19 23:26 343040 —-a-w- c:windowssystem32arcdll.dll
2009-09-24 06:33 . 2004-06-14 11:19 3072 —-a-w- c:windowssystem32hashfunc.dll
2009-09-24 06:33 . 2000-01-31 01:00 25600 —-a-w- c:windowssystem32BORLNDMM.DLL
2009-09-24 06:33 . 2000-01-31 01:00 219648 —-a-w- c:windowssystem32cg32.dll
2009-09-24 06:33 . 2000-01-31 01:00 1496064 —-a-w- c:windowssystem32cc3250mt.dll
2009-09-15 06:44 . 2008-07-16 18:17 12928 —-a-w- c:windowssystem32driversDot4Prt.sys
2009-09-15 06:44 . 2008-07-16 18:18 206976 —-a-w- c:windowssystem32driversDot4.sys
2009-09-15 06:44 . 2008-07-16 18:17 23936 —-a-w- c:windowssystem32driversDot4usb.sys
2009-09-15 06:43 . 2009-09-15 06:43

---

d

---

w- c:program filesHewlett-Packard
2009-09-15 06:39 . 2009-09-15 06:39

---

d

---

w- C:lj1010seriesprintsys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-04 13:53 . 2008-04-15 12:00 65160 —-a-w- c:windowssystem32perfc019.dat
2009-10-04 13:53 . 2008-04-15 12:00 421696 —-a-w- c:windowssystem32perfh019.dat
2009-10-04 04:54 . 2009-10-04 04:54 14686 —-a-w- c:documents and settingsAll UsersApplication Dataokus.dat
2009-09-30 07:23 . 2009-07-07 08:09

---

d

---

w- c:documents and settingsАдминистраторApplication DatauTorrent
2009-09-29 12:42 . 2007-07-02 14:45

---

d

---

w- c:program filesSystem
2009-09-29 07:31 . 2007-07-02 15:26

---

d

---

w- c:program filesUnlocker
2009-09-29 07:30 . 2009-07-02 17:05

---

d

---

w- c:program filesTuneUp Utilities 2009
2009-09-29 07:25 . 2009-07-02 18:09

---

d

---

w- c:program filesAd Muncher
2009-09-27 06:11 . 2009-07-21 13:49

---

d

---

w- c:program filesCommon FilesInstallShield
2009-09-27 06:10 . 2009-07-21 13:49

---

d—h—w- c:program filesInstallShield Installation Information
2009-09-25 14:53 . 2007-07-02 15:08 62640 —-a-w- c:documents and settingsАдминистраторLocal SettingsApplication DataGDIPFONTCACHEV1.DAT
2009-09-25 09:52 . 2009-09-25 09:52 0 —ha-w- c:windowssystem32driversMsft_Kernel_LMouFilt_01005.Wdf
2009-09-25 09:52 . 2009-09-25 09:52 0 —ha-w- c:windowssystem32driversMsft_Kernel_LUsbFilt_01005.Wdf
2009-09-25 09:52 . 2009-09-25 09:52 0 —ha-w- c:windowssystem32driversMsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-09-24 18:53 . 2009-07-02 16:46

---

d

---

w- c:documents and settingsAll UsersApplication DataABBYY
2009-08-26 06:31 . 2009-07-02 19:20

---

d

---

w- c:program filesTotal Commander
2009-08-19 05:46 . 2009-08-19 05:46 6656 —-a-w- c:windowssystem32haspvdd.dll
2009-08-19 05:46 . 2009-08-19 05:46 47616 —-a-w- c:windowssystem32driversHaspnt.sys
2009-08-19 05:46 . 2009-08-19 05:46 453632 —-a-w- c:windowssystem32drivershardlock.sys
2009-08-19 05:46 . 2009-08-19 05:46 383 —-a-w- c:windowssystem32haspdos.sys
2009-08-19 05:46 . 2009-07-21 15:25

---

d

---

w- c:program files1Cv77
2009-08-19 05:45 . 2009-08-19 05:45 5967580 —-a-w- c:program files1CSetup27.exe
2009-08-17 12:54 . 2009-07-02 18:03 2828 —sha-w- c:documents and settingsAll UsersApplication DataKGyGaAvL.sys
2009-08-05 09:01 . 2008-04-15 12:00 204800 —-a-w- c:windowssystem32mswebdvd.dll
2009-07-30 05:12 . 2009-05-19 07:31 36352 —-a-w- c:windowssystem32driversC7xUSBX3.sys
2009-07-29 04:36 . 2008-04-15 12:00 81920 —-a-w- c:windowssystem32fontsub.dll
2009-07-29 04:36 . 2008-04-15 12:00 119808 —-a-w- c:windowssystem32t2embed.dll
2009-07-17 19:03 . 2008-04-15 12:00 58880 —-a-w- c:windowssystem32atl.dll
2009-07-13 19:43 . 2008-07-16 18:16 286208 —-a-w- c:windowssystem32wmpdxm.dll
2009-07-07 08:08 . 2009-07-07 08:08 629686 —-a-w- c:program filesuTorrent-1.6.1-install.rar
2008-07-02 00:31 . 2009-07-02 14:41 53142888 —-a-w- c:program filesLingvo.exe
2009-08-31 13:55 . 2009-09-29 08:08 118000 —-a-w- c:program filesmozilla firefoxcomponentsqippipe.dll
.

---

Sigcheck

---

[-] 2008-07-16 . 4378CDCD0EDB9BA360B44591B09A50E7 . 691200 . . [5.82] . . c:windowssystem32comctl32.dll
[7] 2008-04-15 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:windowsWinSxSx86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70acomctl32.dll
[7] 2008-04-15 . FF63BB56C05EA817124D4E18162FCE46 . 1054208 . . [6.0] . . c:windowsWinSxSx86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83comctl32.dll

[-] 2008-07-16 . 371C41F777924F3EA3BFAD18C6A04502 . 584192 . . [5.1.2600.5512] . . c:windowssystem32user32.dll

[-] 2008-07-16 . 5116FC3994DF129F40B9DDBCCC394195 . 1597952 . . [6.00.2900.5512] . . c:windowsexplorer.exe

[-] 2008-07-16 . A20D3430A2FF4E619FE9FAA1D2FD2970 . 1571840 . . [5.1.2600.5512] . . c:windowssystem32sfcfiles.dll

[-] 2008-07-16 . 17A73D46CA1D681CEE05658A2F4419DA . 17408 . . [5.1.2600.5512] . . c:windowssystem32ctfmon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-03-23 132096]
«Punto Switcher»=»c:program filesPunto Switcherpunto.exe» [2008-10-16 735016]
«Active Desktop Calendar»=»c:program filesXemiComputersActive Desktop CalendarADC.exe» [2009-02-02 4483584]
«swg»=»c:program filesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe» [2009-07-07 39408]
«ccleaner»=»c:program filesCCleanerCCleaner.exe» [2009-06-25 1578736]
«YotaAccess_U200″=»c:program filesSamsung ElectronicsmWiMAX U200YotaAccess.exe» [2009-09-15 280440]
«SUPERAntiSpyware»=»c:program filesSUPERAntiSpywareSUPERAntiSpyware.exe» [2009-09-15 1998576]
«ctfmon.exe»=»c:windowssystem32ctfmon.exe» [2008-07-16 17408]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«StatusClient»=»c:program filesHewlett-PackardToolbox2.0Apache Tomcat 4.0webappsToolboxStatusClientStatusClient.exe» [2002-12-16 36864]
«TomcatStartup»=»c:program filesHewlett-PackardToolbox2.0hpbpsttp.exe» [2003-03-31 155648]
«egui»=»c:program filesESETESET NOD32 Antivirusegui.exe» [2009-05-14 2029640]
«YotaAccess_U200″=»c:program filesSamsung ElectronicsmWiMAX U200YotaAccess.exe» [2009-09-15 280440]
«avgnt»=»c:program filesAviraAntiVir Desktopavgnt.exe» [2009-03-02 209153]
«Kerish Doctor 2006″=»c:program filesKerish Doctor 2008Doctor.exe» [2008-04-10 1593344]
«TrojanScanner»=»c:program filesTrojan RemoverTrjscan.exe» [2009-09-15 1069960]
«Kernel and Hardware Abstraction Layer»=»KHALMNPR.EXE» — c:windowsKHALMNPR.Exe [2007-04-11 56080]
«Logitech Hardware Abstraction Layer»=»KHALMNPR.EXE» — c:windowsKHALMNPR.Exe [2007-04-11 56080]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-07-16 17408]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-03-23 132096]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«IE7_012″=»advpack.dll» — c:windowssystem32advpack.dll [2009-03-08 128512]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoThumbnailCache»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)
«ForceClassicControlPanel»= 1 (0x1)

[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoThumbnailCache»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)
«NoSMHelp»= 1 (0x1)

[hkey_local_machinesoftwaremicrosoftwindowscurrentversionexplorerShellExecuteHooks]
«{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}»= «c:program filesSUPERAntiSpywareSASSEH.DLL» [2008-05-13 77824]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotify!SASWinLogon]
2009-09-03 11:21 548352 —-a-w- c:program filesSUPERAntiSpywareSASWINLO.dll

[HKLM~startupfolderC:^Documents and Settings^All Users^Главное меню^Программы^Автозагрузка^Total Commander.lnk]
path=c:documents and settingsAll UsersГлавное менюПрограммыАвтозагрузкаTotal Commander.lnk
backup=c:windowspssTotal Commander.lnkCommon Startup

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionrun-]
«ctfmon.exe»=c:windowssystem32ctfmon.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionrun-]
«HotKeysCmds»=c:windowssystem32hkcmd.exe
«IgfxTray»=c:windowssystem32igfxtray.exe
«Persistence»=c:windowssystem32igfxpers.exe
«Alcmtr»=ALCMTR.EXE
«RTHDCPL»=RTHDCPL.EXE

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesDisableNotify»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusOverride»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\Bonjour\mDNSResponder.exe»=
«c:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe»=
«c:\Program Files\uTorrent\utorrent.exe»=
«c:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe»=
«c:\Program Files\Samsung Electronics\mWiMAX U200\YotaAccess.exe»=

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«5353:TCP»= 5353:TCP:*:Disabled:Adobe CSI CS4

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileIcmpSettings]
«AllowInboundEchoRequest»= 1 (0x1)

R1 ehdrv;ehdrv;c:windowssystem32driversehdrv.sys [14.05.2009 15:47 107256]
R1 epfwtdir;epfwtdir;c:windowssystem32driversepfwtdir.sys [14.05.2009 15:49 94360]
R1 SASDIFSV;SASDIFSV;c:program filesSUPERAntiSpywaresasdifsv.sys [15.09.2009 11:42 9968]
R1 SASKUTIL;SASKUTIL;c:program filesSUPERAntiSpywareSASKUTIL.SYS [15.09.2009 11:42 74480]
R2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 Licensing Service;c:program filesABBYY FineReader 9.0NetworkLicenseServer.exe [02.11.2007 18:58 566560]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:program filesAviraAntiVir Desktopsched.exe [29.09.2009 11:43 108289]
R2 ekrn;ESET Service;c:program filesESETESET NOD32 Antivirusekrn.exe [14.05.2009 15:47 731840]
R3 C7xxUSB;Samsung CMC7xx USB Network Driver;c:windowssystem32driversC7xUSBX3.sys [19.05.2009 11:31 36352]
R3 SASENUM;SASENUM;c:program filesSUPERAntiSpywareSASENUM.SYS [15.09.2009 11:42 7408]
S3 adusbser;AnyDATA USB Device for Legacy Serial Communication;c:windowssystem32driversadusbser.sys [27.07.2009 9:44 93440]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled components>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
«c:windowssystem32rundll32.exe» «c:windowssystem32iedkcs32.dll»,BrandIEActiveSetup SIGNUP
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://yandex.ru/
uDefault_Search_URL = hxxp://search.qip.ru
uInternet Settings,ProxyOverride = *.local;
uSearchURL,(Default) = Root: HKCU; Subkey: SoftwareMicrosoftInternet ExplorerSearchUrl; ValueType: string; ValueName: ‘; ValueData: ‘; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
Trusted Zone: uralsibbank.ru
DPF: {884DFC1F-0E2A-48ED-8A93-FF60C0BF76B1} — hxxps://dbo.uralsib.ru/cab700/bssural.cab
DPF: {FB80FA57-8C28-4E02-BE2D-42C08E69A2E1} — hxxps://dbo.uralsib.ru/cab700/InstLib.cab
FF — ProfilePath — c:documents and settingsАдминистраторApplication DataMozillaFirefoxProfilesqfb7zuy3.default
FF — prefs.js: browser.search.selectedEngine — QIP Search
FF — prefs.js: browser.startup.homepage — hxxp://mail.ru/
FF — prefs.js: keyword.URL — hxxp://search.qip.ru/search?from=FF&query=
FF — component: c:program filesMozilla Firefoxcomponentsqippipe.dll
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnppl3260.dll
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnprpjplug.dll

—- FIREFOX POLICIES —-
FF — user.js: network.http.max-persistent-connections-per-server — 4
FF — user.js: nglayout.initialpaint.delay — 600
FF — user.js: content.notify.interval — 600000
FF — user.js: content.max.tokenizing.time — 1800000
FF — user.js: content.switch.threshold — 600000
.
— — — — ORPHANS REMOVED — — — —

HKCU-Run-restorer32_a — c:documents and settingsАдминистраторrestorer32_a.exe
HKCU-Run-mserv — c:documents and settingsАдминистраторApplication Dataseres.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-04 18:06
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘winlogon.exe'(1156)
c:program filesSUPERAntiSpywareSASWINLO.dll
c:windowssystem32WININET.dll
c:windowssystem32COMRes.dll
c:program filesCommon FilesAdobeAdobe Drive CS4AdobeDriveCS4_NP.dll
c:windowssystem32cscui.dll

— — — — — — — > ‘explorer.exe'(3184)
c:windowssystem32WININET.dll
c:windowssystem32COMRes.dll
c:windowsSystem32cscui.dll
c:program filesPunto Switcherpshook.dll
c:program filesXemiComputersActive Desktop CalendarMouseHook.dll
c:windowssystem32msi.dll
c:windowssystem32NETSHELL.dll
c:windowssystem32credui.dll
c:windowssystem32wpdshserviceobj.dll
c:windowssystem32webcheck.dll
c:windowssystem32portabledevicetypes.dll
c:windowssystem32portabledeviceapi.dll
.

---

Other Running Processes

---

.
c:program filesTGTSoftStyleXPStyleXPService.exe
c:program filesAviraAntiVir Desktopavguard.exe
c:program filesBonjourmDNSResponder.exe
c:program filesCommon FilesProtexisLicense ServicePsiService_2.exe
.
**************************************************************************
.
Completion time: 2009-10-04 18:09 — machine was rebooted
ComboFix-quarantined-files.txt 2009-10-04 14:09

Pre-Run: 12 215 967 744 байт свободно
Post-Run: 12 124 999 680 байт свободно

361 — E O F — 2009-09-25 17:43

[Admin]

Откройте блокнот (Кликните Пуск, Выполнить, в строке ввода введите notepad и нажмите Enter) и вставьте в него следующий текст:

File::

c:windowsanuso.com

c:windowsijusalynu.dat

c:windowsymoneb.com

c:documents and settingsАдминистраторLocal SettingsApplication Dataipojadaz.vbs

c:windowsvybolerako.dat

c:documents and settingsАдминистраторLocal SettingsApplication Dataamuqiniqux.reg

c:program filesCommon Fileskubopypu.dat

Запишите получившийся файл на ваш рабочий стол под именем CFScript
Далее перетащите получившийся файл на иконку Combofix, как показано на картинке ниже.

Сombofix запуститься и выполнит процедуры описанные в созданном нами файле.
По результатам работы Combofix будет создан новый лог, его и вставьте в свой следующий ответ.

[Ryjik-r]

ComboFix 09-10-04.01 — Администратор 06.10.2009 0:19.2.1 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.1014.589 [GMT 4:00]
Running from: c:documents and settingsАдминистраторРабочий столComboFix.exe
Command switches used :: c:documents and settingsАдминистраторРабочий столCFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
«c:documents and settingsАдминистраторLocal SettingsApplication Dataamuqiniqux.reg»
«c:documents and settingsАдминистраторLocal SettingsApplication Dataipojadaz.vbs»
«c:program filesCommon Fileskubopypu.dat»
«c:windowsanuso.com»
«c:windowsijusalynu.dat»
«c:windowsvybolerako.dat»
«c:windowsymoneb.com»
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:documents and settingsАдминистраторLocal SettingsApplication Dataamuqiniqux.reg
c:documents and settingsАдминистраторLocal SettingsApplication Dataipojadaz.vbs
c:documents and settingsAll Users„®Єг¬Ґ­влepafuromuz.inf
c:documents and settingsAll Users„®Єг¬Ґ­влorocy.bat
c:documents and settingsAll Users„®Єг¬Ґ­влpiqih.bat
c:documents and settingsAll Users„®Єг¬Ґ­влsonelex.reg
c:documents and settingsЂ¤¬Ё­Ёбва в®аLocal SettingsApplication Dataamuqiniqux.reg
c:documents and settingsЂ¤¬Ё­Ёбва в®аLocal SettingsApplication Dataipojadaz.vbs
c:documents and settingsЂ¤¬Ё­Ёбва в®аLocal SettingsApplication Dataodoc.inf
c:program filesCommon Fileskubopypu.dat
c:windowsanuso.com
c:windowsijusalynu.dat
c:windowsvybolerako.dat
c:windowsymoneb.com

.
((((((((((((((((((((((((( Files Created from 2009-09-05 to 2009-10-05 )))))))))))))))))))))))))))))))
.

2009-10-05 16:07 . 2009-10-05 16:07

---

d

---

w- c:documents and settingsАдминистраторTempYota
2009-10-04 13:15 . 2009-10-04 13:15

---

d

---

w- c:documents and settingsAll UsersApplication DataSUPERAntiSpyware.com
2009-10-04 13:15 . 2009-10-04 13:15

---

d

---

w- c:program filesSUPERAntiSpyware
2009-10-04 13:15 . 2009-10-04 13:15

---

d

---

w- c:documents and settingsАдминистраторApplication DataSUPERAntiSpyware.com
2009-10-04 13:15 . 2009-10-04 13:15

---

d

---

w- c:program filesCommon FilesWise Installation Wizard
2009-10-02 19:22 . 2009-10-04 13:48

---

d

---

w- c:documents and settingsАдминистраторLocal SettingsApplication Datantias64
2009-10-01 08:46 . 2009-10-04 13:51

---

d—a-w- c:documents and settingsAll UsersApplication DataTEMP
2009-10-01 08:45 . 2009-10-01 08:45

---

d

---

w- c:documents and settingsAll UsersApplication DataSimply Super Software
2009-10-01 08:45 . 2009-10-01 08:45

---

d

---

w- c:documents and settingsАдминистраторApplication DataSimply Super Software
2009-10-01 07:40 . 2009-10-01 07:41

---

d

---

w- c:program filesRegCleaner4.3
2009-10-01 07:34 . 2009-10-05 20:05

---

d

---

w- c:program filesKerish Doctor 2008
2009-09-30 19:52 . 2009-09-30 19:52

---

d

---

w- c:windowsSun
2009-09-30 06:02 . 2008-07-16 18:18 21504 —-a-w- c:windowssystem32hidserv.dll
2009-09-30 06:02 . 2008-07-16 18:18 14720 —-a-w- c:windowssystem32driverskbdhid.sys
2009-09-29 08:09 . 2009-09-29 08:09

---

d

---

w- c:documents and settingsАдминистраторApplication DataQIP
2009-09-29 08:07 . 2009-09-29 08:07

---

d

---

w- c:program filesQIP Infium
2009-09-29 07:53 . 2009-09-29 07:53

---

d

---

r- c:documents and settingsLocalServiceИзбранное
2009-09-29 07:53 . 2009-09-29 07:53

---

d-sh—w- c:documents and settingsLocalServiceIETldCache
2009-09-29 07:43 . 2009-07-28 12:33 55656 —-a-w- c:windowssystem32driversavgntflt.sys
2009-09-29 07:43 . 2009-03-30 06:33 96104 —-a-w- c:windowssystem32driversavipbb.sys
2009-09-29 07:43 . 2009-02-13 08:29 22360 —-a-w- c:windowssystem32driversavgntmgr.sys
2009-09-29 07:43 . 2009-02-13 08:17 45416 —-a-w- c:windowssystem32driversavgntdd.sys
2009-09-29 07:11 . 2009-09-29 08:40

---

d

---

w- c:program filesAvira
2009-09-29 06:38 . 2009-09-29 07:42

---

d

---

w- c:documents and settingsAll UsersApplication DataAvira
2009-09-28 21:33 . 2009-09-28 21:33

---

d

---

w- c:documents and settingsLocalServiceLocal SettingsApplication DataESET
2009-09-28 17:07 . 2009-09-29 07:01

---

d

---

w- c:program filesSamsung Electronics
2009-09-28 16:55 . 2009-09-28 16:55

---

d

---

w- C:CanonMF
2009-09-28 15:50 . 2009-09-28 15:50

---

d

---

w- c:documents and settingsАдминистраторDoctorWeb
2009-09-27 16:56 . 2009-09-27 16:56

---

d

---

w- c:documents and settingsАдминистраторLocal SettingsApplication DataESET
2009-09-27 15:54 . 2009-09-27 15:54

---

d

---

w- c:documents and settingsAll UsersApplication DataESET
2009-09-25 20:33 . 2005-06-10 09:39 53248 —-a-w- c:windowssystem32CNAS0MMK.DLL
2009-09-25 18:30 . 2009-09-25 19:56

---

d

---

w- c:program filescanon
2009-09-25 17:11 . 2009-06-25 08:42 54272 -c—-w- c:windowssystem32dllcachewdigest.dll
2009-09-25 17:11 . 2009-06-25 08:42 301568 -c—-w- c:windowssystem32dllcachekerberos.dll
2009-09-25 17:11 . 2009-06-25 08:42 136704 -c—-w- c:windowssystem32dllcachemsv1_0.dll
2009-09-25 17:11 . 2009-06-24 10:28 92928 -c—-w- c:windowssystem32dllcacheksecdd.sys
2009-09-25 15:46 . 2009-06-15 11:10 80896 -c—-w- c:windowssystem32dllcachetlntsess.exe
2009-09-25 15:46 . 2009-06-15 10:45 79872 -c—-w- c:windowssystem32dllcachetelnet.exe
2009-09-25 15:46 . 2009-07-29 04:36 81920 -c—-w- c:windowssystem32dllcachefontsub.dll
2009-09-25 15:46 . 2009-07-29 04:36 119808 -c—-w- c:windowssystem32dllcachet2embed.dll
2009-09-25 15:46 . 2009-06-10 06:17 134144 -c—-w- c:windowssystem32dllcachewkssvc.dll
2009-09-25 15:45 . 2009-06-10 14:14 85504 -c—-w- c:windowssystem32dllcacheavifil32.dll
2009-09-25 15:44 . 2009-07-17 19:03 58880 -c—-w- c:windowssystem32dllcacheatl.dll
2009-09-25 15:41 . 2009-08-05 09:01 204800 -c—-w- c:windowssystem32dllcachemswebdvd.dll
2009-09-25 15:29 . 2009-06-21 21:48 153088 -c—-w- c:windowssystem32dllcachetriedit.dll
2009-09-25 15:29 . 2009-07-10 13:28 1315328 -c—-w- c:windowssystem32dllcachemsoe.dll
2009-09-25 10:02 . 2009-09-25 10:02

---

d

---

w- c:documents and settingsАдминистраторApplication DataYahoo!
2009-09-25 09:54 . 2009-09-29 07:31

---

d

---

w- c:program filesCommon FilesScanner
2009-09-25 09:54 . 2002-02-21 14:56 24576 —-a-w- c:windowssystem32msxml3a.dll
2009-09-25 09:54 . 2009-09-29 07:32

---

d

---

w- c:program filesYahoo!
2009-09-25 09:50 . 2007-04-11 11:33 79376 —-a-w- c:windowssystem32driversLMouKE.Sys
2009-09-25 09:50 . 2007-04-11 11:32 63248 —-a-w- c:windowssystem32driversL8042mou.Sys
2009-09-25 09:50 . 2007-04-11 11:32 20496 —-a-w- c:windowssystem32driversL8042Kbd.sys
2009-09-25 09:50 . 2007-04-11 11:32 36112 —-a-w- c:windowssystem32driversLMouFilt.Sys
2009-09-25 09:50 . 2007-04-11 11:32 34832 —-a-w- c:windowssystem32driversLHidFilt.Sys
2009-09-25 09:50 . 2007-04-11 11:32 56080 —-a-w- c:windowsKHALMNPR.Exe
2009-09-25 09:50 . 2007-04-11 11:33 1419024 —-a-w- c:windowssystem32WdfCoInstaller01005.dll
2009-09-25 09:50 . 2007-04-11 11:33 28688 —-a-w- c:windowssystem32driversLUsbFilt.sys
2009-09-25 09:48 . 2009-09-25 09:48

---

d

---

w- c:documents and settingsAll UsersApplication DataLogiShrd
2009-09-24 18:53 . 2009-10-01 17:46

---

d

---

w- c:documents and settingsАдминистраторApplication DataCanon
2009-09-24 06:33 . 2009-09-24 06:33

---

d

---

w- c:documents and settingsAll UsersApplication DataSeoAdministrator
2009-09-24 06:33 . 2009-09-01 08:53 639488 —-a-w- c:windowssystem32semtempl.dll
2009-09-24 06:33 . 2005-05-19 23:26 343040 —-a-w- c:windowssystem32arcdll.dll
2009-09-24 06:33 . 2004-06-14 11:19 3072 —-a-w- c:windowssystem32hashfunc.dll
2009-09-24 06:33 . 2000-01-31 01:00 25600 —-a-w- c:windowssystem32BORLNDMM.DLL
2009-09-24 06:33 . 2000-01-31 01:00 219648 —-a-w- c:windowssystem32cg32.dll
2009-09-24 06:33 . 2000-01-31 01:00 1496064 —-a-w- c:windowssystem32cc3250mt.dll
2009-09-15 06:44 . 2008-07-16 18:17 12928 —-a-w- c:windowssystem32driversDot4Prt.sys
2009-09-15 06:44 . 2008-07-16 18:18 206976 —-a-w- c:windowssystem32driversDot4.sys
2009-09-15 06:44 . 2008-07-16 18:17 23936 —-a-w- c:windowssystem32driversDot4usb.sys
2009-09-15 06:43 . 2009-09-15 06:43

---

d

---

w- c:program filesHewlett-Packard
2009-09-15 06:39 . 2009-09-15 06:39

---

d

---

w- C:lj1010seriesprintsys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-04 17:43 . 2008-04-15 12:00 65160 —-a-w- c:windowssystem32perfc019.dat
2009-10-04 17:43 . 2008-04-15 12:00 421696 —-a-w- c:windowssystem32perfh019.dat
2009-10-04 04:54 . 2009-10-04 04:54 14686 —-a-w- c:documents and settingsAll UsersApplication Dataokus.dat
2009-09-30 07:23 . 2009-07-07 08:09

---

d

---

w- c:documents and settingsАдминистраторApplication DatauTorrent
2009-09-29 12:42 . 2007-07-02 14:45

---

d

---

w- c:program filesSystem
2009-09-29 07:31 . 2007-07-02 15:26

---

d

---

w- c:program filesUnlocker
2009-09-29 07:30 . 2009-07-02 17:05

---

d

---

w- c:program filesTuneUp Utilities 2009
2009-09-29 07:25 . 2009-07-02 18:09

---

d

---

w- c:program filesAd Muncher
2009-09-27 06:11 . 2009-07-21 13:49

---

d

---

w- c:program filesCommon FilesInstallShield
2009-09-27 06:10 . 2009-07-21 13:49

---

d—h—w- c:program filesInstallShield Installation Information
2009-09-25 14:53 . 2007-07-02 15:08 62640 —-a-w- c:documents and settingsАдминистраторLocal SettingsApplication DataGDIPFONTCACHEV1.DAT
2009-09-25 09:52 . 2009-09-25 09:52 0 —ha-w- c:windowssystem32driversMsft_Kernel_LMouFilt_01005.Wdf
2009-09-25 09:52 . 2009-09-25 09:52 0 —ha-w- c:windowssystem32driversMsft_Kernel_LUsbFilt_01005.Wdf
2009-09-25 09:52 . 2009-09-25 09:52 0 —ha-w- c:windowssystem32driversMsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-09-24 18:53 . 2009-07-02 16:46

---

d

---

w- c:documents and settingsAll UsersApplication DataABBYY
2009-08-26 06:31 . 2009-07-02 19:20

---

d

---

w- c:program filesTotal Commander
2009-08-19 05:46 . 2009-08-19 05:46 6656 —-a-w- c:windowssystem32haspvdd.dll
2009-08-19 05:46 . 2009-08-19 05:46 47616 —-a-w- c:windowssystem32driversHaspnt.sys
2009-08-19 05:46 . 2009-08-19 05:46 453632 —-a-w- c:windowssystem32drivershardlock.sys
2009-08-19 05:46 . 2009-08-19 05:46 383 —-a-w- c:windowssystem32haspdos.sys
2009-08-19 05:46 . 2009-07-21 15:25

---

d

---

w- c:program files1Cv77
2009-08-19 05:45 . 2009-08-19 05:45 5967580 —-a-w- c:program files1CSetup27.exe
2009-08-17 12:54 . 2009-07-02 18:03 2828 —sha-w- c:documents and settingsAll UsersApplication DataKGyGaAvL.sys
2009-08-05 09:01 . 2008-04-15 12:00 204800 —-a-w- c:windowssystem32mswebdvd.dll
2009-07-30 05:12 . 2009-05-19 07:31 36352 —-a-w- c:windowssystem32driversC7xUSBX3.sys
2009-07-29 04:36 . 2008-04-15 12:00 81920 —-a-w- c:windowssystem32fontsub.dll
2009-07-29 04:36 . 2008-04-15 12:00 119808 —-a-w- c:windowssystem32t2embed.dll
2009-07-17 19:03 . 2008-04-15 12:00 58880 —-a-w- c:windowssystem32atl.dll
2009-07-13 19:43 . 2008-07-16 18:16 286208 —-a-w- c:windowssystem32wmpdxm.dll
2009-07-07 08:08 . 2009-07-07 08:08 629686 —-a-w- c:program filesuTorrent-1.6.1-install.rar
2008-07-02 00:31 . 2009-07-02 14:41 53142888 —-a-w- c:program filesLingvo.exe
2009-08-31 13:55 . 2009-09-29 08:08 118000 —-a-w- c:program filesmozilla firefoxcomponentsqippipe.dll
.

---

Sigcheck

---

[-] 2008-07-16 . 4378CDCD0EDB9BA360B44591B09A50E7 . 691200 . . [5.82] . . c:windowssystem32comctl32.dll
[7] 2008-04-15 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:windowsWinSxSx86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70acomctl32.dll
[7] 2008-04-15 . FF63BB56C05EA817124D4E18162FCE46 . 1054208 . . [6.0] . . c:windowsWinSxSx86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83comctl32.dll

[-] 2008-07-16 . 371C41F777924F3EA3BFAD18C6A04502 . 584192 . . [5.1.2600.5512] . . c:windowssystem32user32.dll

[-] 2008-07-16 . 5116FC3994DF129F40B9DDBCCC394195 . 1597952 . . [6.00.2900.5512] . . c:windowsexplorer.exe

[-] 2008-07-16 . A20D3430A2FF4E619FE9FAA1D2FD2970 . 1571840 . . [5.1.2600.5512] . . c:windowssystem32sfcfiles.dll

[-] 2008-07-16 . 17A73D46CA1D681CEE05658A2F4419DA . 17408 . . [5.1.2600.5512] . . c:windowssystem32ctfmon.exe
.
((((((((((((((((((((((((((((( SnapShot@2009-10-04_14.06.18 )))))))))))))))))))))))))))))))))))))))))
.
— 2008-04-15 12:00 . 2009-10-04 13:53 53098 c:windowssystem32perfc009.dat
+ 2008-04-15 12:00 . 2009-10-04 17:43 53098 c:windowssystem32perfc009.dat
+ 2008-04-15 12:00 . 2009-10-04 17:43 380684 c:windowssystem32perfh009.dat
— 2008-04-15 12:00 . 2009-10-04 13:53 380684 c:windowssystem32perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-03-23 132096]
«Punto Switcher»=»c:program filesPunto Switcherpunto.exe» [2008-10-16 735016]
«Active Desktop Calendar»=»c:program filesXemiComputersActive Desktop CalendarADC.exe» [2009-02-02 4483584]
«swg»=»c:program filesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe» [2009-07-07 39408]
«ccleaner»=»c:program filesCCleanerCCleaner.exe» [2009-06-25 1578736]
«YotaAccess_U200″=»c:program filesSamsung ElectronicsmWiMAX U200YotaAccess.exe» [2009-09-15 280440]
«SUPERAntiSpyware»=»c:program filesSUPERAntiSpywareSUPERAntiSpyware.exe» [2009-09-15 1998576]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«StatusClient»=»c:program filesHewlett-PackardToolbox2.0Apache Tomcat 4.0webappsToolboxStatusClientStatusClient.exe» [2002-12-16 36864]
«TomcatStartup»=»c:program filesHewlett-PackardToolbox2.0hpbpsttp.exe» [2003-03-31 155648]
«YotaAccess_U200″=»c:program filesSamsung ElectronicsmWiMAX U200YotaAccess.exe» [2009-09-15 280440]
«avgnt»=»c:program filesAviraAntiVir Desktopavgnt.exe» [2009-03-02 209153]
«Kerish Doctor 2006″=»c:program filesKerish Doctor 2008Doctor.exe» [2008-04-10 1593344]
«Kernel and Hardware Abstraction Layer»=»KHALMNPR.EXE» — c:windowsKHALMNPR.Exe [2007-04-11 56080]
«Logitech Hardware Abstraction Layer»=»KHALMNPR.EXE» — c:windowsKHALMNPR.Exe [2007-04-11 56080]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-07-16 17408]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-03-23 132096]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«IE7_012″=»advpack.dll» — c:windowssystem32advpack.dll [2009-03-08 128512]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoThumbnailCache»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)
«ForceClassicControlPanel»= 1 (0x1)

[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoThumbnailCache»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)
«NoSMHelp»= 1 (0x1)

[hkey_local_machinesoftwaremicrosoftwindowscurrentversionexplorerShellExecuteHooks]
«{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}»= «c:program filesSUPERAntiSpywareSASSEH.DLL» [2008-05-13 77824]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotify!SASWinLogon]
2009-09-03 11:21 548352 —-a-w- c:program filesSUPERAntiSpywareSASWINLO.dll

[HKLM~startupfolderC:^Documents and Settings^All Users^Главное меню^Программы^Автозагрузка^Total Commander.lnk]
path=c:documents and settingsAll UsersГлавное менюПрограммыАвтозагрузкаTotal Commander.lnk
backup=c:windowspssTotal Commander.lnkCommon Startup

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionrun-]
«ctfmon.exe»=c:windowssystem32ctfmon.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionrun-]
«HotKeysCmds»=c:windowssystem32hkcmd.exe
«IgfxTray»=c:windowssystem32igfxtray.exe
«Persistence»=c:windowssystem32igfxpers.exe
«Alcmtr»=ALCMTR.EXE
«RTHDCPL»=RTHDCPL.EXE

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesDisableNotify»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusOverride»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\Bonjour\mDNSResponder.exe»=
«c:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe»=
«c:\Program Files\uTorrent\utorrent.exe»=
«c:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe»=
«c:\Program Files\Samsung Electronics\mWiMAX U200\YotaAccess.exe»=

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«5353:TCP»= 5353:TCP:*:Disabled:Adobe CSI CS4

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileIcmpSettings]
«AllowInboundEchoRequest»= 1 (0x1)

R1 SASDIFSV;SASDIFSV;c:program filesSUPERAntiSpywaresasdifsv.sys [15.09.2009 11:42 9968]
R1 SASKUTIL;SASKUTIL;c:program filesSUPERAntiSpywareSASKUTIL.SYS [15.09.2009 11:42 74480]
R2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 Licensing Service;c:program filesABBYY FineReader 9.0NetworkLicenseServer.exe [02.11.2007 18:58 566560]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:program filesAviraAntiVir Desktopsched.exe [29.09.2009 11:43 108289]
R3 C7xxUSB;Samsung CMC7xx USB Network Driver;c:windowssystem32driversC7xUSBX3.sys [19.05.2009 11:31 36352]
R3 SASENUM;SASENUM;c:program filesSUPERAntiSpywareSASENUM.SYS [15.09.2009 11:42 7408]
S3 adusbser;AnyDATA USB Device for Legacy Serial Communication;c:windowssystem32driversadusbser.sys [27.07.2009 9:44 93440]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled components>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
«c:windowssystem32rundll32.exe» «c:windowssystem32iedkcs32.dll»,BrandIEActiveSetup SIGNUP
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://yandex.ru/
uDefault_Search_URL = hxxp://search.qip.ru
uInternet Settings,ProxyOverride = *.local;
uSearchURL,(Default) = Root: HKCU; Subkey: SoftwareMicrosoftInternet ExplorerSearchUrl; ValueType: string; ValueName: ‘; ValueData: ‘; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
Trusted Zone: uralsibbank.ru
DPF: {884DFC1F-0E2A-48ED-8A93-FF60C0BF76B1} — hxxps://dbo.uralsib.ru/cab700/bssural.cab
DPF: {FB80FA57-8C28-4E02-BE2D-42C08E69A2E1} — hxxps://dbo.uralsib.ru/cab700/InstLib.cab
FF — ProfilePath — c:documents and settingsАдминистраторApplication DataMozillaFirefoxProfilesqfb7zuy3.default
FF — prefs.js: browser.search.selectedEngine — QIP Search
FF — prefs.js: browser.startup.homepage — hxxp://mail.ru/
FF — prefs.js: keyword.URL — hxxp://search.qip.ru/search?from=FF&query=
FF — component: c:program filesMozilla Firefoxcomponentsqippipe.dll
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnppl3260.dll
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnprpjplug.dll

—- FIREFOX POLICIES —-
FF — user.js: network.http.max-persistent-connections-per-server — 4
FF — user.js: nglayout.initialpaint.delay — 600
FF — user.js: content.notify.interval — 600000
FF — user.js: content.max.tokenizing.time — 1800000
FF — user.js: content.switch.threshold — 600000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-06 00:25
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘winlogon.exe'(892)
c:program filesSUPERAntiSpywareSASWINLO.dll
c:windowssystem32WININET.dll
c:windowssystem32COMRes.dll
c:program filesCommon FilesAdobeAdobe Drive CS4AdobeDriveCS4_NP.dll
c:windowssystem32cscui.dll
.
Completion time: 2009-10-05 0:26
ComboFix-quarantined-files.txt 2009-10-05 20:26
ComboFix2.txt 2009-10-04 14:09

Pre-Run: 12 304 674 816 байт свободно
Post-Run: 12 321 914 880 байт свободно

284 — E O F — 2009-09-25 17:43

[Admin]

Лог выглядит нормально. Как работает компьютер ?

[Ryjik-r]

Pro 2010 пропало:)) спасибо огромное.
Но super anty free edition и авира постоянно находят какие то трояны. после полного скана и удаления, повторный скан все чисто. наутро опять трояны по 10 штук. И вылетают usb порты. У меня теперь вместе не работают принтер и yota-модем. Либо одно либо другое иначе система говрит неизвестное устройство а в диспетчере оборудования невозможен запуск устройства:(((

[Admin]

super anty free edition и авира постоянно находят какие то трояны. после полного скана и удаления, повторный скан все чисто. наутро опять трояны по 10 штук.

А что конкретно они находят, вставьте лог SuperAntispyware в ваше следующее сообщение.

[Автор]

Сообщения