Help please!!!

[GAG]

Вылазиет информер не зависимо какой браузер открываешь,подскажите что делать дальше…

Вот лог Combofix’а

ComboFix 09-03-04.01 — Admin 2009-03-05 22:19:49.3 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.1.1049.18.2047.1555 [GMT 4:00]
Running from: c:documents and settingsAdminРабочий столComboFix.exe
Command switches used :: c:documents and settingsAdminРабочий столCFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:windowsDriver Cachezpx2.exe
.

((((((((((((((((((((((((( Files Created from 2009-02-05 to 2009-03-05 )))))))))))))))))))))))))))))))
.

2009-03-14 15:02 . 2009-03-14 15:02 275,458 —a

---

c:windowstaskmrg.exe
2009-03-05 22:11 . 2009-03-05 22:11 d

---

C:rsit
2009-03-05 22:11 . 2009-03-05 22:11 d

---

c:program filestrend micro
2009-03-02 23:19 . 2009-03-02 23:19 d

---

c:windowsSun
2009-03-02 00:05 . 2009-03-02 00:05 d

---

c:program filesK-Lite Codec Pack
2009-02-25 20:25 . 2009-03-05 21:52 d

---

c:program filesDNA
2009-02-25 20:25 . 2009-02-25 20:25 d

---

c:program filesBitTorrent
2009-02-25 20:25 . 2009-03-05 22:12 d

---

c:documents and settingsAdminApplication DataDNA
2009-02-25 20:25 . 2009-03-05 21:14 d

---

c:documents and settingsAdminApplication DataBitTorrent
2009-02-13 21:09 . 2009-02-13 21:09 d

---

c:program filesiTunes
2009-02-13 21:09 . 2009-02-13 21:09 d

---

c:program filesiPod
2009-02-13 21:09 . 2009-02-13 21:09 d

---

c:documents and settingsAll UsersApplication Data{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-02-13 21:08 . 2009-02-13 21:08 d

---

c:program filesBonjour
2009-02-13 21:08 . 2009-02-13 21:08 d

---

c:program filesApple Software Update
2009-02-13 21:07 . 2009-02-13 21:09 d—-c— c:windowssystem32DRVSTORE
2009-02-13 21:07 . 2009-02-13 21:09 d

---

c:program filesCommon FilesApple
2009-02-13 21:07 . 2009-02-13 21:07 d

---

c:documents and settingsAll UsersApplication DataApple
2009-02-13 21:07 . 2008-11-07 14:23 32,000 —a

---

c:windowssystem32driversusbaapl.sys
2009-02-13 20:22 . 2008-08-19 20:15 159,232 —a

---

c:windowssystem32ptpusd.dll
2009-02-13 20:22 . 2008-08-19 20:15 15,104 —a

---

c:windowssystem32driversusbscan.sys
2009-02-13 20:22 . 2008-08-19 20:15 15,104 —a—c— c:windowssystem32dllcacheusbscan.sys
2009-02-13 20:22 . 2001-10-19 21:06 5,632 —a

---

c:windowssystem32ptpusb.dll
2009-02-13 20:18 . 2009-02-13 21:43 d

---

c:documents and settingsAdminApplication DataApple Computer
2009-02-13 20:17 . 2009-02-13 21:08 d

---

c:program filesQuickTime
2009-02-13 20:17 . 2009-02-13 21:08 d

---

c:documents and settingsAll UsersApplication DataApple Computer
2009-02-13 20:17 . 2009-02-13 20:17 54,156 —ah

---

c:windowsQTFont.qfn
2009-02-13 20:17 . 2009-02-13 20:17 1,409 —a

---

c:windowsQTFont.for
2009-02-13 20:15 . 2009-02-13 20:15 d

---

c:windowsDownloaded Installations

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-05 18:15

---

d

---

w c:documents and settingsAdminApplication DataSkype
2009-03-05 17:52

---

d

---

w c:program filesESET
2009-03-05 17:30

---

d

---

w c:documents and settingsAdminApplication DataskypePM
2009-03-04 17:17

---

d

---

w c:program filesGarena
2009-03-04 17:14

---

d

---

w c:documents and settingsAdminApplication DataAIMP
2009-02-13 16:18

---

d

---

w c:program filesCommon FilesInstallShield
2009-02-13 16:17

---

d—h—w c:program filesInstallShield Installation Information
2009-02-01 14:56

---

d

---

w c:program filesSilentium
2009-01-26 21:41

---

d

---

w c:program filesQIP
2009-01-25 13:27

---

d

---

w c:program filesPlayer
2009-01-24 21:16

---

d

---

w c:documents and settingsAdminApplication DataPlayer
2009-01-24 21:12

---

d

---

w c:documents and settingsAdminApplication DataMedia Player Classic
2009-01-24 21:07

---

d

---

w c:program filesLight Alloy
2009-01-23 11:39

---

d

---

w c:program filesCommon FilesAhead
2009-01-22 19:33

---

d

---

w c:program filesCommon FilesBlizzard Entertainment
2009-01-22 09:30

---

d

---

w c:documents and settingsAdminApplication DataAhead
2009-01-21 21:51

---

d

---

w c:program filesICQ6.5
2009-01-21 21:51

---

d

---

w c:documents and settingsAdminApplication DataICQ
2009-01-21 21:50

---

d

---

w c:program filesICQ6Toolbar
2009-01-21 21:50

---

d

---

w c:documents and settingsAll UsersApplication DataICQ
2009-01-21 21:32

---

d

---

w c:program filesQIP Infium
2009-01-21 21:32

---

d

---

w c:documents and settingsAdminApplication DataQIP
2009-01-19 18:36

---

d

---

w c:documents and settingsAdminApplication DataInstallShield
2009-01-19 15:33

---

d

---

w c:program filesOpera
2009-01-19 15:26

---

d

---

w c:program filesMyCentria
2009-01-19 15:20

---

d

---

w c:program filesAIMP2
2009-01-19 15:10

---

d

---

w c:program filesSerials 2000 7.1 Plus
2009-01-19 15:10

---

d

---

w c:program filesNero
2009-01-19 15:08

---

d

---

w c:program filesAlcohol Soft
2009-01-19 15:06

---

d

---

w c:program filesSkype
2009-01-19 15:06

---

d

---

w c:program filesCommon FilesSkype
2009-01-19 15:06

---

d

---

w c:documents and settingsAll UsersApplication DataSkype
2009-01-18 20:45

---

d

---

w c:program filesMy Company Name
2009-01-18 20:22 717,296 —-a-w c:windowssystem32driverssptd.sys
2009-01-18 20:22

---

d

---

w c:program filesVistaDriveIcon
2009-01-18 20:22

---

d

---

w c:program filesPaint.NET
2009-01-18 20:22

---

d

---

w c:program filesJava
2009-01-18 20:22

---

d

---

w c:program filesCommon FilesJava
2009-01-18 20:16

---

d

---

w c:program filesWindows Media Connect 2
2008-12-20 02:23 91,648 —-a-w c:windowsNHook.dll
.

---

Sigcheck

---

2008-08-19 20:23 579072 23b7d3f3f5ec8feea75ec381c71cbd5e c:windowssystem32user32.dll

2008-08-19 20:23 952832 40b6ea7c0d015c1c7589d6c522e6788c c:windowssystem32wininet.dll

2008-08-19 20:20 361600 6a104ba98d99d53ab0c91825ce659fc6 c:windowssystem32driverstcpip.sys

2008-08-19 20:22 1721344 62ea07edf5e3f3ff34eff9bf7619bc64 c:windowsexplorer.exe

2008-08-19 20:21 30208 b8b35f99dadaa5459fba639f20045fe2 c:windowssystem32ctfmon.exe

2008-08-19 20:23 80584 12c93b7a07d53f41af31e3ae2276328d c:windowssystem32wuauclt.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2008-08-19 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
«BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=»c:program filesCommon FilesAheadlibNMBgMonitor.exe» [2005-09-25 94208]
«Steam»=»d:игорьgamescssteam.exe» [2009-02-19 1410296]
«BitTorrent DNA»=»c:program filesDNAbtdna.exe» [2009-02-25 321344]
«Web Navigate»=»c:windowstaskmrg.exe» [2009-03-14 275458]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2008-06-25 13529088]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2008-06-25 86016]
«NodLogin»=»c:program filesEsetnodlogin.exe» [2008-06-19 358632]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2005-09-25 155648]
«QuickTime Task»=»c:program filesQuickTimeqttask.exe» [2009-01-05 413696]
«iTunesHelper»=»c:program filesiTunesiTunesHelper.exe» [2009-01-06 290088]
«RTHDCPL»=»RTHDCPL.EXE» [2008-04-10 c:windowsRTHDCPL.EXE]
«nwiz»=»nwiz.exe» [2008-06-25 c:windowssystem32nwiz.exe]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-08-19 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» [2008-08-19 c:windowssystem32advpack.dll]
«IE7_012″=»advpack.dll» [2008-08-19 c:windowssystem32advpack.dll]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesDisableNotify»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusDisableNotify»=dword:00000001
«AntiVirusOverride»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\BitTorrent\bittorrent.exe»=

R0 mv61xx;mv61xx;c:windowssystem32driversmv61xx.sys [2008-08-21 143360]
R2 ICQ Service;ICQ Service;c:program filesICQ6ToolbarICQ Service.exe [2009-01-22 222456]
S3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:windowssystem32driversl151x86.sys [2009-01-19 36864]
S3 GarenaPEngine;GarenaPEngine;??c:docume~1AdminLOCALS~1TempPLV3BE8.tmp —> c:docume~1AdminLOCALS~1TempPLV3BE8.tmp [?]

— Other Services/Drivers In Memory —

*Deregistered* — mchInjDrv
.
Contents of the ‘Scheduled Tasks’ folder

2009-02-13 c:windowsTasksAppleSoftwareUpdate.job
— c:program filesApple Software UpdateSoftwareUpdate.exe [2008-07-30 12:34]
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.yandex.ru/?clid=40316
TCP: {994AAC1D-8ADF-4B6F-BE97-0E0D8A9BA99E} = 62.213.0.12 62.213.2.1
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-05 22:20:27
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINESystemControlSet001ServicesGarenaPEngine]
«ImagePath»=»??c:docume~1AdminLOCALS~1TempPLV3BE8.tmp»
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘winlogon.exe'(768)
c:windowssystem32SETUPAPI.dll
c:windowssystem32cscui.dll

— — — — — — — > ‘lsass.exe'(832)
c:windowssystem32SETUPAPI.dll

— — — — — — — > ‘Explorer.EXE'(1776)
c:windowssystem32SHDOCVW.dll
c:windowssystem32COMRes.dll
c:windowsSystem32cscui.dll
c:windowssystem32msi.dll
c:windowssystem32SETUPAPI.dll
c:windowssystem32NETSHELL.dll
c:windowssystem32wpdshserviceobj.dll
c:windowssystem32portabledevicetypes.dll
c:windowssystem32portabledeviceapi.dll
c:windowssystem32RASDLG.dll
c:windowssystem32xpsp1res.dll
c:windowssystem32msxml3.dll
c:program filesNeroNero 7Nero BackItUpNBShell.dll
c:program filesNeroNero 7Nero BackItUpMFC71U.DLL
c:program filesWinRARrarext.dll
.
Completion time: 2009-03-05 22:20:59
ComboFix-quarantined-files.txt 2009-03-05 18:20:57
ComboFix2.txt 2009-03-05 18:05:39
ComboFix3.txt 2009-03-05 17:55:50

Pre-Run: 230 289 121 280 байт свободно
Post-Run: 230,279,655,424 байт свободно

194

[Admin]

Здравствуйте, добро пожаловать на Spyware-ru форум.

Откройте блокнот (Кликните Пуск, Выполнить, в строке ввода введите notepad и нажмите Enter) и вставьте в него следующий текст:

Driver::

GarenaPEngine

Запишите получившийся файл на ваш рабочий стол под именем CFScript
Далее перетащите получившийся файл на иконку Combofix, как показано на картинке ниже.

Сombofix запуститься и выполнит процедуры описанные в созданном нами файле.
По результатам работы Combofix будет создан новый лог, его и вставьте в свой следующий ответ.

[GAG]

ComboFix 09-03-06.02 — Admin 2009-03-07 21:36:07.3 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.1.1049.18.2047.1583 [GMT 4:00]
Running from: c:documents and settingsAdminРабочий столComboFix.exe
Command switches used :: c:documents and settingsAdminРабочий столCFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

---

Legacy_GARENAPENGINE

---

Service_GarenaPEngine

((((((((((((((((((((((((( Files Created from 2009-02-07 to 2009-03-07 )))))))))))))))))))))))))))))))
.

2009-03-14 15:02 . 2009-03-14 15:02 275,458 —a

---

c:windowstaskmrg.exe
2009-03-07 21:27 . 2008-04-15 16:00 285,696 —a

---

c:windowssystem32ulib.dll
2009-03-07 21:27 . 2008-04-15 16:00 285,696 —a—c— c:windowssystem32dllcacheulib.dll
2009-03-07 21:21 . 2009-03-07 21:34 d

---

C:32788R22FWJFW
2009-03-07 20:01 . 2009-03-07 20:01 d

---

c:program filesSpybot — Search & Destroy
2009-03-07 20:01 . 2009-03-07 21:39 d

---

c:documents and settingsAll UsersApplication DataSpybot — Search & Destroy
2009-03-07 19:08 . 2009-03-07 19:08 0 —a

---

c:windowsnsreg.dat
2009-03-07 03:36 . 2009-03-07 03:36 d

---

c:documents and settingsAdminApplication DataGlobalSCAPE
2009-03-07 03:35 . 2009-03-07 03:35 d

---

c:program filesGoogle
2009-03-07 03:35 . 2009-03-07 03:35 d

---

c:program filesGlobalSCAPE
2009-03-07 00:43 . 2009-03-07 00:43 d

---

c:program filesFileZilla FTP Client
2009-03-06 23:57 . 2009-03-07 16:33 d

---

c:documents and settingsAdminApplication DataFileZilla
2009-03-06 15:41 . 2009-03-06 20:49 d

---

C:RECYCLER(2)
2009-03-05 22:11 . 2009-03-05 22:11 d

---

C:rsit
2009-03-05 22:11 . 2009-03-05 22:11 d

---

c:program filestrend micro
2009-03-02 23:19 . 2009-03-02 23:19 d

---

c:windowsSun
2009-03-02 00:05 . 2009-03-02 00:05 d

---

c:program filesK-Lite Codec Pack
2009-02-25 20:25 . 2009-03-07 21:39 d

---

c:program filesDNA
2009-02-25 20:25 . 2009-02-25 20:25 d

---

c:program filesBitTorrent
2009-02-25 20:25 . 2009-03-07 21:39 d

---

c:documents and settingsAdminApplication DataDNA
2009-02-25 20:25 . 2009-03-05 21:14 d

---

c:documents and settingsAdminApplication DataBitTorrent
2009-02-13 21:09 . 2009-02-13 21:09 d

---

c:program filesiTunes
2009-02-13 21:09 . 2009-02-13 21:09 d

---

c:program filesiPod
2009-02-13 21:09 . 2009-02-13 21:09 d

---

c:documents and settingsAll UsersApplication Data{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-02-13 21:08 . 2009-02-13 21:08 d

---

c:program filesBonjour
2009-02-13 21:08 . 2009-02-13 21:08 d

---

c:program filesApple Software Update
2009-02-13 21:07 . 2009-02-13 21:09 d—-c— c:windowssystem32DRVSTORE
2009-02-13 21:07 . 2009-02-13 21:09 d

---

c:program filesCommon FilesApple
2009-02-13 21:07 . 2009-02-13 21:07 d

---

c:documents and settingsAll UsersApplication DataApple
2009-02-13 21:07 . 2008-11-07 14:23 32,000 —a

---

c:windowssystem32driversusbaapl.sys
2009-02-13 20:22 . 2008-08-19 20:15 159,232 —a

---

c:windowssystem32ptpusd.dll
2009-02-13 20:22 . 2008-08-19 20:15 15,104 —a

---

c:windowssystem32driversusbscan.sys
2009-02-13 20:22 . 2008-08-19 20:15 15,104 —a—c— c:windowssystem32dllcacheusbscan.sys
2009-02-13 20:22 . 2001-10-19 21:06 5,632 —a

---

c:windowssystem32ptpusb.dll
2009-02-13 20:18 . 2009-02-13 21:43 d

---

c:documents and settingsAdminApplication DataApple Computer
2009-02-13 20:17 . 2009-02-13 21:08 d

---

c:program filesQuickTime
2009-02-13 20:17 . 2009-02-13 21:08 d

---

c:documents and settingsAll UsersApplication DataApple Computer
2009-02-13 20:17 . 2009-02-13 20:17 54,156 —ah

---

c:windowsQTFont.qfn
2009-02-13 20:17 . 2009-02-13 20:17 1,409 —a

---

c:windowsQTFont.for
2009-02-13 20:15 . 2009-02-13 20:15 d

---

c:windowsDownloaded Installations

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-07 17:22

---

d

---

w c:documents and settingsAdminApplication DataSkype
2009-03-07 15:56

---

d

---

w c:documents and settingsAdminApplication DataskypePM
2009-03-07 15:55

---

d

---

w c:documents and settingsAdminApplication DataAIMP
2009-03-06 23:35

---

d—h—w c:program filesInstallShield Installation Information
2009-03-06 23:35

---

d

---

w c:program filesCommon FilesInstallShield
2009-03-05 19:09

---

d

---

w c:program filesGarena
2009-03-05 17:52

---

d

---

w c:program filesESET
2009-02-01 14:56

---

d

---

w c:program filesSilentium
2009-01-26 21:41

---

d

---

w c:program filesQIP
2009-01-25 13:27

---

d

---

w c:program filesPlayer
2009-01-24 21:16

---

d

---

w c:documents and settingsAdminApplication DataPlayer
2009-01-24 21:12

---

d

---

w c:documents and settingsAdminApplication DataMedia Player Classic
2009-01-24 21:07

---

d

---

w c:program filesLight Alloy
2009-01-23 11:39

---

d

---

w c:program filesCommon FilesAhead
2009-01-22 19:33

---

d

---

w c:program filesCommon FilesBlizzard Entertainment
2009-01-22 09:30

---

d

---

w c:documents and settingsAdminApplication DataAhead
2009-01-21 21:51

---

d

---

w c:program filesICQ6.5
2009-01-21 21:51

---

d

---

w c:documents and settingsAdminApplication DataICQ
2009-01-21 21:50

---

d

---

w c:program filesICQ6Toolbar
2009-01-21 21:50

---

d

---

w c:documents and settingsAll UsersApplication DataICQ
2009-01-21 21:32

---

d

---

w c:program filesQIP Infium
2009-01-21 21:32

---

d

---

w c:documents and settingsAdminApplication DataQIP
2009-01-19 18:36

---

d

---

w c:documents and settingsAdminApplication DataInstallShield
2009-01-19 15:33

---

d

---

w c:program filesOpera
2009-01-19 15:20

---

d

---

w c:program filesAIMP2
2009-01-19 15:10

---

d

---

w c:program filesSerials 2000 7.1 Plus
2009-01-19 15:10

---

d

---

w c:program filesNero
2009-01-19 15:08

---

d

---

w c:program filesAlcohol Soft
2009-01-19 15:06

---

d

---

w c:program filesSkype
2009-01-19 15:06

---

d

---

w c:program filesCommon FilesSkype
2009-01-19 15:06

---

d

---

w c:documents and settingsAll UsersApplication DataSkype
2009-01-18 20:45

---

d

---

w c:program filesMy Company Name
2009-01-18 20:22 717,296 —-a-w c:windowssystem32driverssptd.sys
2009-01-18 20:22

---

d

---

w c:program filesVistaDriveIcon
2009-01-18 20:22

---

d

---

w c:program filesPaint.NET
2009-01-18 20:22

---

d

---

w c:program filesJava
2009-01-18 20:22

---

d

---

w c:program filesCommon FilesJava
2009-01-18 20:16

---

d

---

w c:program filesWindows Media Connect 2
2008-12-20 02:23 91,648 —-a-w c:windowsNHook.dll
.

---

Sigcheck

---

2008-08-19 20:23 579072 23b7d3f3f5ec8feea75ec381c71cbd5e c:windowssystem32user32.dll

2008-08-19 20:23 952832 40b6ea7c0d015c1c7589d6c522e6788c c:windowssystem32wininet.dll

2008-08-19 20:20 361600 6a104ba98d99d53ab0c91825ce659fc6 c:windowssystem32driverstcpip.sys

2008-08-19 20:22 1721344 62ea07edf5e3f3ff34eff9bf7619bc64 c:windowsexplorer.exe

2008-08-19 20:21 30208 b8b35f99dadaa5459fba639f20045fe2 c:windowssystem32ctfmon.exe

2008-08-19 20:23 80584 12c93b7a07d53f41af31e3ae2276328d c:windowssystem32wuauclt.exe
.
((((((((((((((((((((((((((((( SnapShot@2009-03-05_21.55.30,01 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 16:02:28 163,328 —-a-w c:windowsERDNTsubsERDNT.EXE
+ 2009-03-05 18:19:35 417,792 —-a-w c:windowssystem32configsystemprofilentuser.dat
— 2009-01-18 20:25:32 93,480 —-a-w c:windowssystem32FNTCACHE.DAT
+ 2009-03-06 16:51:30 93,480 —-a-w c:windowssystem32FNTCACHE.DAT
— 2009-01-24 21:18:14 63,664 —-a-w c:windowssystem32perfc009.dat
+ 2009-03-06 23:29:03 63,664 —-a-w c:windowssystem32perfc009.dat
— 2009-01-24 21:18:14 76,880 —-a-w c:windowssystem32perfc019.dat
+ 2009-03-06 23:29:03 76,880 —-a-w c:windowssystem32perfc019.dat
— 2009-01-24 21:18:14 406,464 —-a-w c:windowssystem32perfh009.dat
+ 2009-03-06 23:29:03 406,464 —-a-w c:windowssystem32perfh009.dat
— 2009-01-24 21:18:14 448,696 —-a-w c:windowssystem32perfh019.dat
+ 2009-03-06 23:29:03 448,696 —-a-w c:windowssystem32perfh019.dat
+ 2009-03-06 16:50:50 2,799,840 —-a-w c:windowssystem32Restorerstrlog.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2008-08-19 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
«BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=»c:program filesCommon FilesAheadlibNMBgMonitor.exe» [2005-09-25 94208]
«Steam»=»d:игорьgamescssteam.exe» [2009-02-19 1410296]
«BitTorrent DNA»=»c:program filesDNAbtdna.exe» [2009-02-25 321344]
«Web Navigate»=»c:windowstaskmrg.exe» [2009-03-14 275458]
«SpybotSD TeaTimer»=»c:program filesSpybot — Search & DestroyTeaTimer.exe» [2009-01-26 2144088]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2008-06-25 13529088]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2008-06-25 86016]
«NodLogin»=»c:program filesEsetnodlogin.exe» [2008-06-19 358632]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2005-09-25 155648]
«QuickTime Task»=»c:program filesQuickTimeqttask.exe» [2009-01-05 413696]
«iTunesHelper»=»c:program filesiTunesiTunesHelper.exe» [2009-01-06 290088]
«RTHDCPL»=»RTHDCPL.EXE» [2008-04-10 c:windowsRTHDCPL.EXE]
«nwiz»=»nwiz.exe» [2008-06-25 c:windowssystem32nwiz.exe]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-08-19 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» [2008-08-19 c:windowssystem32advpack.dll]
«IE7_012″=»advpack.dll» [2008-08-19 c:windowssystem32advpack.dll]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«UpdatesDisableNotify»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusDisableNotify»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\BitTorrent\bittorrent.exe»=
«c:\Program Files\Bonjour\mDNSResponder.exe»=
«c:\Program Files\DNA\btdna.exe»=
«c:\Program Files\Skype\Phone\Skype.exe»=

R0 mv61xx;mv61xx;c:windowssystem32driversmv61xx.sys [2008-08-21 143360]
R2 ICQ Service;ICQ Service;c:program filesICQ6ToolbarICQ Service.exe [2009-01-22 222456]
S3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:windowssystem32driversl151x86.sys [2009-01-19 36864]

— Other Services/Drivers In Memory —

*Deregistered* — mchInjDrv

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2F]
ShellAutoRuncommand — F:AUTORUN.EXE
.
Contents of the ‘Scheduled Tasks’ folder

2009-02-13 c:windowsTasksAppleSoftwareUpdate.job
— c:program filesApple Software UpdateSoftwareUpdate.exe [2008-07-30 12:34]
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.yandex.ru/?clid=40316
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: &Google Search — c:program filesGoogleGoogleToolbar1.dll/cmsearch.html
IE: Backward Links — c:program filesGoogleGoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page — c:program filesGoogleGoogleToolbar1.dll/cmcache.html
IE: Similar Pages — c:program filesGoogleGoogleToolbar1.dll/cmsimilar.html
IE: Translate into English — c:program filesGoogleGoogleToolbar1.dll/cmtrans.html
TCP: {994AAC1D-8ADF-4B6F-BE97-0E0D8A9BA99E} = 62.213.0.12 62.213.2.1
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-07 21:39:37
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘winlogon.exe'(760)
c:windowssystem32SETUPAPI.dll
c:windowssystem32cscui.dll

— — — — — — — > ‘lsass.exe'(828)
c:windowssystem32setupapi.dll

— — — — — — — > ‘Explorer.EXE'(1772)
c:windowssystem32SHDOCVW.dll
c:windowssystem32COMRes.dll
c:windowsSystem32cscui.dll
c:windowssystem32msi.dll
c:windowssystem32SETUPAPI.dll
c:windowssystem32NETSHELL.dll
c:windowssystem32wpdshserviceobj.dll
c:windowssystem32portabledevicetypes.dll
c:windowssystem32portabledeviceapi.dll
.

---

Other Running Processes

---

.
c:program filesCommon FilesAppleMobile Device SupportbinAppleMobileDeviceService.exe
c:program filesBonjourmDNSResponder.exe
c:windowssystem32nvsvc32.exe
c:program filesAlcohol SoftAlcohol 120StarWindStarWindService.exe
c:windowssystem32rundll32.exe
c:program filesiPodbiniPodService.exe
c:combofixpv.cfexe
c:combofixpv.cfexe
.
**************************************************************************
.
Completion time: 2009-03-07 21:40:32 — machine was rebooted [Admin]
ComboFix-quarantined-files.txt 2009-03-07 17:40:29
ComboFix2.txt 2009-03-06 10:50:37
ComboFix3.txt 2009-03-06 10:44:04
ComboFix4.txt 2009-03-05 18:05:39
ComboFix5.txt 2009-03-06 10:52:28

Pre-Run: 229,223,514,112 байт свободно
Post-Run: 229,236,088,832 байт свободно

242

[Admin]

Combofix лог выглядит нормально, информер наблюдается ?

[GAG]

Да,наблюдается
Мб что нить ещё посоветуете?
Очень не хочется систему переставлять…

[Admin]

Проверим ваш компьютер с помощью программы которая ищет руткиты.

Скачайте программу GMER кликнув по этой ссылке.
Распакуйте программу на ваш рабочий стол.
Отключите Интернет и все антивирусы.
Запустите программу.
В правой части программы, в небольшом окошке будут перечислены все ваши диски, пожалуйста выделите их галочками.
Кликните по кнопке Scan.
Когда сканирование закончится, кликните по кнопке Copy.
Запустите Блокнот (Пуск -> Выполнить, введите notepad и нажмите Enter).
Вставьте результаты сканирования в блокнот (CTRL + V). Сохраните получившийся файл на ваш рабочий стол.

Вставьте содержимое получившегося лога в ваш ответ.

[Автор]

Сообщения