ненавистная лента с жуткими фотками

[Julia]

Уважаемые ликвидаторы вирусов и троянов))),выполнила ваши указания описаные выше и вот что за лог фаил у меня получился
ComboFix 09-01-21.01 — FBI 2009-01-21 23:57:28.1 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.1.1049.18.1022.414 [GMT 3:00]
Running from: c:documents and settingsFBIРабочий столComboFix.exe
Command switches used :: c:documents and settingsFBIРабочий столCFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:documents and settingsAll UsersApplication Dataxaelib.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:documents and settingsFBILocal SettingsTemporary Internet Files0EB9F12C_6E6B_4c03_AEBA_8C04CFA98AA4.jpg
c:documents and settingsFBILocal SettingsTemporary Internet Files15913497_F86C_4218_8817_F50940D1E1B2.jpg
c:documents and settingsFBILocal SettingsTemporary Internet Files29887DDE_00B9_4011_9CF7_59511F1ECC1B.jpg
c:documents and settingsFBILocal SettingsTemporary Internet Files35B7DFFA_884F_4fbc_8E60_DA601BDC7BF7.gif
c:documents and settingsFBILocal SettingsTemporary Internet Files362FD6E8_8CDA_4c2a_A8AA-BDA22B321711.gif
c:documents and settingsFBILocal SettingsTemporary Internet Files3DF04940_9866_4241_A998_0CDDFAFD147A.jpg
c:documents and settingsFBILocal SettingsTemporary Internet Files426500D7_0FF3_426c_828D_065DBAEA0581.gif
c:documents and settingsFBILocal SettingsTemporary Internet Files478BD4AE_2691_438d_BDCA_3485DC022700.gif
c:documents and settingsFBILocal SettingsTemporary Internet Files5C6C645F_BAA8_4149_BFEB_2031230FF0FD.jpg
c:documents and settingsFBILocal SettingsTemporary Internet Files61EA7D69_19D4_421a_A899_0DF4D58CD119.gif
c:documents and settingsFBILocal SettingsTemporary Internet Files777FDAFB_83CF_4960_AA71_4E5D7BCD8E57.gif
c:documents and settingsFBILocal SettingsTemporary Internet Files8DA878D5_E80B_4721_B75A_17EFFAF1A700.gif
c:documents and settingsFBILocal SettingsTemporary Internet Files98F6DF79_7171_452d_9C26_C0193E12DBDF.gif
c:documents and settingsFBILocal SettingsTemporary Internet FilesA2B240D6_0386_419e_91C5_3F7D90437CD0.gif
c:documents and settingsFBILocal SettingsTemporary Internet FilesC75CEF8D_5AF4_4563_8594_C45A45E14E63.gif
c:documents and settingsFBILocal SettingsTemporary Internet FilesE21285C1_40E6_435c_A69F_3387E7BD89CB.jpg
c:documents and settingsFBILocal SettingsTemporary Internet FilesE9A4D648_ED73_4ea7_88B2_18332DBA4F3E.gif
c:windowsmsauc.exe
c:windowssystem32digeste.dll
c:windowssystem32driversstr.sys
c:windowssystem32shell31.dll
c:windowssystem32uninstall.exe
c:windowssystem32wpv111230374798.cpx
c:windowssystem32wpv141230374735.cpx
c:windowswiaserviv.log

.
((((((((((((((((((((((((( Files Created from 2008-12-21 to 2009-01-21 )))))))))))))))))))))))))))))))
.

2009-01-22 00:01 . 2009-01-22 00:01 0

---

c:windowssystem32driversstr.sys
2009-01-21 19:32 . 2009-01-21 19:32 323,072 —a

---

c:documents and settingsAll UsersApplication Datamvvlib.dll
2009-01-19 22:49 . 2009-01-19 22:49 d

---

c:program filesSymNetDrv
2009-01-16 01:42 . 2003-06-19 01:31 17,920 —a

---

c:windowssystem32mdimon.dll
2009-01-16 01:42 . 2009-01-16 01:42 394 —a

---

c:windowsODBC.INI
2009-01-15 13:45 . 2006-06-03 21:29 48,640 —a

---

c:windowssystem32hpzll4pi.dll
2009-01-15 13:36 . 2006-03-03 21:03 282,680 —a

---

c:windowssystem32HPZidr12.dll
2009-01-15 13:36 . 2006-03-03 21:02 204,800 —a

---

c:windowssystem32HPZipr12.dll
2009-01-15 13:36 . 2006-03-03 21:02 94,208 —a

---

c:windowssystem32HPZipt12.dll
2009-01-15 13:36 . 2006-03-03 21:03 69,632 —a

---

c:windowssystem32HPZipm12.exe
2009-01-15 13:36 . 2006-03-03 21:03 65,536 —a

---

c:windowssystem32HPZinw12.exe
2009-01-15 13:36 . 2006-03-03 21:02 57,344 —a

---

c:windowssystem32HPZisn12.dll
2009-01-15 13:35 . 2009-01-15 13:36 d

---

c:program filesHP
2009-01-15 13:35 . 1998-10-29 16:45 306,688 —a

---

c:windowsIsUninst.exe
2009-01-15 13:33 . 2009-01-15 13:44 124,939 —a

---

c:windowsHPHins12.dat
2009-01-15 13:33 . 2006-05-16 23:25 77,824 —a

---

c:windowssystem32hpzids01.dll
2009-01-15 13:33 . 2006-07-17 22:24 14,916

---

c:windowshphmdl12.dat
2009-01-15 13:30 . 2006-06-22 06:03 56 —a

---

C:ut9x.bat
2009-01-15 13:30 . 2006-06-20 00:08 54 —a

---

C:ut.bat
2009-01-15 13:13 . 2008-05-20 19:42 25,856 —a

---

c:windowssystem32driversusbprint.sys
2009-01-15 13:13 . 2008-05-20 19:42 25,856 —a—c— c:windowssystem32dllcacheusbprint.sys
2009-01-15 01:40 . 2009-01-15 01:40 d

---

c:documents and settingsFBIApplication DataCorel
2009-01-15 01:40 . 2009-01-15 01:40 848 —ahs—- c:windowssystem32KGyGaAvL.sys
2009-01-15 01:39 . 2009-01-15 01:39 d

---

c:documents and settingsFBIApplication DataACD Systems
2009-01-14 22:47 . 2008-05-30 14:11 3,850,760 —a

---

c:windowssystem32D3DX9_38.dll
2009-01-14 22:47 . 2008-05-30 14:11 1,491,992 —a

---

c:windowssystem32D3DCompiler_38.dll
2009-01-14 22:47 . 2008-05-30 14:19 507,400 —a

---

c:windowssystem32XAudio2_1.dll
2009-01-14 22:47 . 2008-05-30 14:11 467,984 —a

---

c:windowssystem32d3dx10_38.dll
2009-01-14 22:47 . 2008-05-30 14:18 238,088 —a

---

c:windowssystem32xactengine3_1.dll
2009-01-14 22:47 . 2008-05-30 14:17 65,032 —a

---

c:windowssystem32XAPOFX1_0.dll
2009-01-14 22:47 . 2008-05-30 14:17 25,608 —a

---

c:windowssystem32X3DAudio1_4.dll
2009-01-14 22:46 . 2009-01-14 22:46 d

---

c:windowssystem32xlive
2009-01-14 22:46 . 2009-01-14 22:46 d

---

c:windowsLogs
2009-01-14 22:46 . 2009-01-14 22:46 d

---

c:program filesMicrosoft Games for Windows — LIVE
2009-01-14 18:03 . 2009-01-14 18:03 279,712 —a

---

c:windowssystem32driversatksgt.sys
2009-01-14 18:03 . 2009-01-14 18:03 25,888 —a

---

c:windowssystem32driverslirsgt.sys
2009-01-14 17:59 . 2009-01-14 17:59 dr-h

---

c:documents and settingsFBIApplication DataSecuROM
2009-01-14 17:59 . 2009-01-14 17:59 107,888 —a

---

c:windowssystem32CmdLineExt.dll
2009-01-14 02:25 . 2009-01-14 02:25 d

---

c:documents and settingsLocalServiceApplication DataSymantec
2009-01-13 18:56 . 2009-01-13 18:56 d

---

c:documents and settingsAdminApplication DataNokia Multimedia Player
2009-01-13 18:55 . 2009-01-19 17:16 54,156 —ah

---

c:windowsQTFont.qfn
2009-01-13 18:55 . 2009-01-13 18:55 1,409 —a

---

c:windowsQTFont.for
2009-01-13 18:14 . 2009-01-13 18:14 d

---

c:documents and settingsAdminApplication DataACD Systems
2009-01-13 18:13 . 2009-01-15 01:53 d

---

c:program filesCommon FilesACD Systems
2009-01-13 15:19 . 2009-01-13 15:19 d

---

c:documents and settingsAll UsersApplication DataFLEXnet
2009-01-13 14:10 . 2009-01-13 14:10 0 —a

---

c:windowsnsreg.dat
2009-01-13 14:02 . 2009-01-13 14:02 0 —a

---

c:windowsoodcnt.INI
2009-01-13 13:58 . 2009-01-13 13:58 d

---

c:documents and settingsAdminApplication DataAuslogics
2009-01-13 13:28 . 2009-01-13 13:28 d

---

c:documents and settingsFBIApplication DataATI
2009-01-13 13:27 . 2009-01-13 13:27 d

---

c:documents and settingsFBIApplication DataPC Suite
2009-01-13 13:27 . 2009-01-12 23:26 d—h

---

c:documents and settingsFBIШаблоны
2009-01-13 13:27 . 2009-01-21 23:57 d

---

c:documents and settingsFBIРабочий стол
2009-01-13 13:27 . 2009-01-21 23:51 dr

---

c:documents and settingsFBIМои документы
2009-01-13 13:27 . 2009-01-13 02:21 dr

---

c:documents and settingsFBIГлавное меню
2009-01-13 13:27 . 2009-01-14 18:27 dr

---

c:documents and settingsFBIИзбранное
2009-01-13 13:27 . 2009-01-13 13:27 d

---

c:documents and settingsFBI
2009-01-13 00:52 . 2009-01-13 00:52 d

---

c:documents and settingsAdminApplication DataATI
2009-01-13 00:19 . 2009-01-13 00:24 d

---

c:documents and settingsAdminApplication DataSymantec
2009-01-13 00:14 . 2009-01-13 00:14 d

---

c:documents and settingsAdminApplication DataPC Suite
2009-01-13 00:14 . 2009-01-13 00:24 d

---

c:documents and settingsAdminApplication DataNokia
2009-01-13 00:12 . 2009-01-13 00:12 d

---

c:documents and settingsAdminApplication DataDAEMON Tools
2009-01-13 00:11 . 2009-01-13 00:11 d

---

c:documents and settingsAdminApplication DataWinamp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-21 17:05

---

d

---

w c:program filesNorton AntiVirus
2009-01-21 17:05

---

d

---

w c:program filesCommon FilesSymantec Shared
2009-01-19 19:50

---

d

---

w c:program filesSymantec
2009-01-17 18:32

---

d—h—w c:program filesInstallShield Installation Information
2009-01-14 18:23

---

d

---

w c:program fileseMule
2009-01-14 16:32

---

d

---

w c:program filesPunto Switcher
2009-01-14 15:43

---

d

---

w c:program filesInno Setup 5
2009-01-14 15:43

---

d

---

w c:program filesDownload Master
2009-01-14 15:34

---

d

---

w c:program filesUninstall Tool
2009-01-14 15:29

---

d

---

w c:program filesWindows Media Connect 2
2009-01-14 15:29

---

d

---

w c:program filesRestorator 2007
2009-01-14 15:29

---

d

---

w c:program filesReal Alternative
2009-01-14 15:29

---

d

---

w c:program filesQuickTime Alternative
2009-01-14 15:29

---

d

---

w c:program filesMotorolaPhoneTools
2009-01-14 15:29

---

d

---

w c:program filesLClock
2009-01-13 17:43

---

d

---

w c:program filesiColorFolder
2009-01-12 23:25

---

d

---

w c:program filesAnalog Devices
2009-01-12 21:52

---

d

---

w c:documents and settingsAll UsersApplication DataATI
2009-01-12 21:46

---

d

---

w c:program filesATI Technologies
2009-01-12 21:43

---

d

---

w c:program filesCommon FilesATI Technologies
2009-01-12 21:40

---

d

---

w c:program filesCommon FilesInstallShield
2009-01-12 21:19 4,608 —-a-w c:windowssystem32driverssymlcbrd.sys
2009-01-12 21:19

---

d

---

w c:documents and settingsAll UsersApplication DataSymantec
2009-01-12 21:14

---

d

---

w c:program filesNokia
2009-01-12 21:14

---

d

---

w c:program filesDIFX
2009-01-12 21:14

---

d

---

w c:program filesCommon FilesPCSuite
2009-01-12 21:14

---

d

---

w c:program filesCommon FilesNokia
2009-01-12 21:14

---

d

---

w c:documents and settingsAll UsersApplication DataPC Suite
2009-01-12 21:13

---

d

---

w c:program filesPC Connectivity Solution
2009-01-12 21:13

---

d

---

w c:program filesMicrosoft ActiveSync
2009-01-12 21:12

---

d

---

w c:program filesWindows Sidebar
2009-01-12 21:12

---

d

---

w c:program filesVista Games
2009-01-12 21:12

---

d

---

w c:program filesUltraISO
2009-01-12 21:12

---

d

---

w c:program filesDAEMON Tools Lite
2009-01-12 21:12

---

d

---

w c:program filesCommon FilesEZB Systems
2009-01-12 21:12

---

d

---

w c:program filesCommon FilesAhead
2009-01-12 21:12

---

d

---

w c:program filesAhead
2009-01-12 21:11

---

d

---

w c:program filesWinamp
2009-01-12 21:11

---

d

---

w c:program filesOO Software
2009-01-12 21:11

---

d

---

w c:program filesAuslogics
2009-01-12 21:11

---

d

---

w c:program files7-Zip
2009-01-12 21:09

---

d

---

w c:program filesMSBuild
2009-01-12 21:08

---

d

---

w c:program filesSmart Install Maker
2009-01-12 21:08

---

d

---

w c:program filesReference Assemblies
2009-01-12 21:07

---

d

---

w c:program filesNeoSmart Technologies
2009-01-12 21:07

---

d

---

w c:program filesEverest
2009-01-12 21:07

---

d

---

w c:program filesEasy Gif Animator
2009-01-12 21:07

---

d

---

w c:program filesDriver-soft
2009-01-12 21:07

---

d

---

w c:program filesCPU-Z
2009-01-12 21:07

---

d

---

w c:program filesCorel
2009-01-12 21:07

---

d

---

w c:program filesCommon FilesCorel
2009-01-12 21:02

---

d

---

w c:program filesCommon FilesMacrovision Shared
2009-01-12 21:01

---

d

---

w c:program filesThe Bat!
2009-01-12 21:01

---

d

---

w c:program filesCommon FilesAdobe
2009-01-12 21:00

---

d

---

w c:program filesXPTweaker
2009-01-12 21:00

---

d

---

w c:program filesRegshot
2009-01-12 21:00

---

d

---

w c:program filesPocketDivXEncoder
2009-01-12 21:00

---

d

---

w c:program filesOpera
2009-01-12 21:00

---

d

---

w c:program filesNo1 DVD Ripper
2009-01-12 21:00

---

d

---

w c:program filesMSECache
2009-01-12 21:00

---

d

---

w c:program filesK-Lite Codec Pack
2009-01-12 21:00

---

d

---

w c:program filesFlash Player Pro
2009-01-12 21:00

---

d

---

w c:program filesCcleaner
2009-01-12 21:00

---

d

---

w c:documents and settingsAll UsersApplication DataApple Computer
2009-01-12 20:59

---

d

---

w c:program filesCommon FilesArsenal Shared
2009-01-12 20:59

---

d

---

w c:program filesArsenal Company
2009-01-12 20:59

---

d

---

w c:documents and settingsAll UsersApplication DataMicrosoft Help
2009-01-12 20:55

---

d

---

w c:program filesMicrosoft.NET
2009-01-12 20:55

---

d

---

w c:program filesMicrosoft Works
2009-01-12 20:53

---

d

---

w c:program filesFoxit Reader
2009-01-12 20:31

---

d

---

w c:program filesVistaDriveIcon
2009-01-12 20:31

---

d

---

w c:program filesmicrosoft frontpage
2009-01-12 20:30 717,296 —-a-w c:windowssystem32driverssptd.sys
2009-01-12 20:30

---

d

---

w c:program filesJava
2009-01-12 20:30

---

d

---

w c:program filesCommon FilesJava
2009-01-12 20:28

---

d—a-w c:program filesAmlMaple
2009-01-12 20:26

---

d

---

w c:program filesPaint.NET
2008-04-07 09:38 67,696 —-a-w c:program filesmozilla firefoxcomponentsjar50.dll
2008-04-07 09:38 54,376 —-a-w c:program filesmozilla firefoxcomponentsjsd3250.dll
2008-04-07 09:38 34,952 —-a-w c:program filesmozilla firefoxcomponentsmyspell.dll
2008-04-07 09:38 46,720 —-a-w c:program filesmozilla firefoxcomponentsspellchk.dll
2008-04-07 09:38 172,144 —-a-w c:program filesmozilla firefoxcomponentsxpinstal.dll
.

---

Sigcheck

---

2008-05-20 18:54 579072 23b7d3f3f5ec8feea75ec381c71cbd5e c:windowssystem32user32.dll

2008-05-20 18:54 952320 7a737e1453d01ff94801272f13497362 c:windowssystem32wininet.dll

2008-05-20 18:52 361344 030dc4d48cc2b894fee2f390d8e66ad5 c:windowssystem32driverstcpip.sys

2008-05-20 18:53 1721344 dc5d73a9809b66026231a9d49de6987f c:windowsexplorer.exe

2008-05-20 18:53 30208 ae0db25ee10900c73d923ad5880564cf c:windowssystem32ctfmon.exe

2008-05-20 18:55 80216 5f38b1b965527c6f5c30dedab0ab0550 c:windowssystem32wuauclt.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE~Browser Helper Objects{1A6F66F8-04C0-414D-881B-91B2253C5960}]
2009-01-21 19:32 323072 —a

---

c:documents and settingsAll UsersApplication Datamvvlib.dll

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2008-05-20 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2007-11-14 201728]
«RGSC»=»d:gamesGTARockstar Games Social ClubRGSCLauncher.exe» [2009-01-14 306088]
«Steam»=»d:program filesSteamSteam.exe» [2009-01-17 1410296]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«SoundMAXPnP»=»c:program filesAnalog DevicesCoresmax4pnp.exe» [2007-03-16 868352]
«AmlMaple»=»c:program filesAmlMapleAmlMaple.exe» [2008-04-24 91648]
«OODefragTray»=»c:windowssystem32oodtray.exe» [2007-05-11 2512392]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2006-01-12 155648]
«ccApp»=»c:program filesCommon FilesSymantec SharedccApp.exe» [2008-01-17 58728]
«StartCCC»=»c:program filesATI TechnologiesATI.ACECore-StaticCLIStart.exe» [2008-07-16 61440]
«Symantec NetDriver Monitor»=»c:progra~1SYMNET~1SNDMon.exe» [2009-01-19 100056]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-05-20 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» [2008-05-20 c:windowssystem32advpack.dll]
«IE7_012″=»advpack.dll» [2008-05-20 c:windowssystem32advpack.dll]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]
«VIDC.ACDV»= ACDV.dll

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetcontrolsession manager]
BootExecute REG_MULTI_SZ autocheck autochk *0OODBS

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesDisableNotify»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusDisableNotify»=dword:00000001
«AntiVirusOverride»=dword:00000001

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringSymantecAntiVirus]
«DisableMonitoring»=dword:00000001

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringSymantecFirewall]
«DisableMonitoring»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:program filesMicrosoft ActiveSyncrapimgr.exe»= c:program filesMicrosoft ActiveSyncrapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
«c:program filesMicrosoft ActiveSyncwcescomm.exe»= c:program filesMicrosoft ActiveSyncwcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
«c:program filesMicrosoft ActiveSyncWCESMgr.exe»= c:program filesMicrosoft ActiveSyncWCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«26675:TCP»= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:windowssystem32driversAtiHdmi.sys [2009-01-13 93696]
R3 USB_RNDIS_51;ZTE USB Remote NDIS Device Driver;c:windowssystem32driversusb8023.sys [2008-04-15 12800]
R4 TTFixerService;NST ToolTipFixer;c:program filesNeoSmart TechnologiesToolTipFixerToolTipFixer.exe [2007-06-27 10240]

— Other Services/Drivers In Memory —

*NewlyCreated* — WUAUSERV

[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled componentsWindows Sidebar]
c:windowssystem32hidec /W c:program filesWindows SidebarVAIOToolsREGTLIB.EXE «c:program filesWindows Sidebarsidebar.exe»

[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled components{34A19196-274E-4D75-9D30-D7A45A0A4178}]
«c:program filesWindows Sidebar.regsvr32.exe» /s wlsrvc.dll

[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled components{6B9228DA-9C15-419e-856C-19E768A13BDC}]
«c:program filesWindows Sidebar.regsvr32.exe» /s sbdrop.dll

[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled components{BADA65A0-86B7-462B-B720-CE66655C73F5}]
regsvr32 /s c:program filesWindows SidebarVAIO.vshellext.dll
.
Contents of the ‘Scheduled Tasks’ folder

2009-01-16 c:windowsTasksNorton AntiVirus — Scan my computer — Admin.job
— c:progra~1NORTON~1Navw32.exe [2005-10-19 12:54]
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.yandex.ru/?clid=40316
uInternet Connection Wizard,ShellNext = hxxp://www.kornet.ru/
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe
IE: {{17FA5CD6-5737-45c2-B194-74C8A4A7F7E7} — {7E1F0737-53A5-4EDC-8734-DD94B50AAF83} — c:program filesArsenal CompanySOCRAT InternetSocratInternet.dll
IE: {{DFDC8970-FD66-4385-B8C0-835A4AA1DA00} — {A3400175-12F9-4220-83BF-A7210CA4003E} — c:program filesArsenal CompanySOCRAT InternetSocratInternet.dll
TCP: {19CD0723-31A7-4F01-B8B2-6BBFE71AC939} = 212.188.4.10,195.34.32.116
FF — ProfilePath — c:documents and settingsFBIApplication DataMozillaFirefoxProfiles4745pir0.default
FF — prefs.js: browser.startup.homepage — hxxp://www.kornet.ru/
FF — component: c:program filesMozilla Firefoxcomponentsxpinstal.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-22 00:02:09
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

c:windowssystem32driverslivciiawwnv.sys 30976 bytes executable

scan completed successfully
hidden files: 1

**************************************************************************

[HKEY_LOCAL_MACHINESystemControlSet001Servicesarhknappwe]
«ImagePath»=»??c:windowssystem32driverslivciiawwnv.sys»
.

---

LOCKED REGISTRY KEYS

---

[HKEY_USERSS-1-5-21-220523388-688789844-1801674531-1004SoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{738FF577-6DAC-3359-94B2-0C67E031B894}*]
«jafimdoilblhfbghpeam»=hex:62,61,6f,68,00,00
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘winlogon.exe'(1092)
c:windowssystem32SETUPAPI.dll
c:windowssystem32Ati2evxx.dll
c:windowssystem32cscui.dll
c:windowssystem32COMRes.dll

— — — — — — — > ‘lsass.exe'(1148)
c:windowssystem32setupapi.dll
.

---

Other Running Processes

---

.
c:windowssystem32ati2evxx.exe
c:windowssystem32ati2evxx.exe
c:program filesCommon FilesSymantec SharedCCSETMGR.EXE
c:program filesCommon FilesSymantec SharedSNDSrvc.exe
c:program filesCommon FilesSymantec SharedSPBBCSPBBCSvc.exe
c:program filesCommon FilesSymantec SharedCCEVTMGR.EXE
c:program filesSymantecLiveUpdateAluSchedulerSvc.exe
c:program filesNorton AntiVirusIWPNPFMNTOR.EXE
c:windowssystem32oodag.exe
c:windowssystem32HPZipm12.exe
c:program filesCommon FilesSymantec SharedCCPD-LCsymlcsvc.exe
c:program filesATI TechnologiesATI.ACECore-StaticMOM.exe
c:program filesATI TechnologiesATI.ACECore-StaticCCC.exe
c:windowsMicrosoft.NETFrameworkv3.0WPFPresentationFontCache.exe
c:windowssystem32taskmgr.exe
.
**************************************************************************
.
Completion time: 2009-01-22 0:05:24 — machine was rebooted [FBI]
ComboFix-quarantined-files.txt 2009-01-21 21:05:21

Pre-Run: 12,402,040,832 байт свободно
Post-Run: 12,954,828,800 байт свободно

334

Не могли бы вы подсказать ,что делать дальше,несчитая уже описаных вами выше завершающих действий,чтобы пропала эта ненавистная лента с жуткими фотками)))
Заранее спасибо,с нетерпением жду вашего ответа)))

[Admin]

Здравствуйте, добро пожаловать на Spyware-ru форум.

Откройте блокнот (Кликните Пуск, Выполнить, в строке ввода введите notepad и нажмите Enter) и вставьте в него следующий текст:

Registry::

[-HKEY_LOCAL_MACHINE~Browser Helper Objects{1A6F66F8-04C0-414D-881B-91B2253C5960}]

[-HKEY_LOCAL_MACHINESystemControlSet001Servicesarhknappwe]

[-HKEY_USERSS-1-5-21-220523388-688789844-1801674531-1004SoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{738FF577-6DAC-3359-94B2-0C67E031B894}]



Files::

c:windowssystem32driverslivciiawwnv.sys

c:documents and settingsAll UsersApplication Datamvvlib.dll

Запишите получившийся файл на ваш рабочий стол под именем CFScript
Далее перетащите получившийся файл на иконку Combofix, как показано на картинке ниже.

Сombofix запуститься и выполнит процедуры описанные в созданном нами файле.
По результатам работы Combofix будет создан новый лог, его и вставьте в свой следующий ответ.
И конечно-же проверьте InternetExplorer в работе.

[Julia]

ComboFix 09-01-21.01 — FBI 2009-01-24 18:46:36.2 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.1.1049.18.1022.472 [GMT 3:00]
Running from: c:documents and settingsFBIРабочий столComboFix.exe
Command switches used :: c:documents and settingsFBIРабочий столCFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:documents and settingsFBILocal SettingsTemporary Internet Files0EB9F12C_6E6B_4c03_AEBA_8C04CFA98AA4.jpg
c:documents and settingsFBILocal SettingsTemporary Internet Files15913497_F86C_4218_8817_F50940D1E1B2.jpg
c:documents and settingsFBILocal SettingsTemporary Internet Files29887DDE_00B9_4011_9CF7_59511F1ECC1B.jpg
c:documents and settingsFBILocal SettingsTemporary Internet Files35B7DFFA_884F_4fbc_8E60_DA601BDC7BF7.gif
c:documents and settingsFBILocal SettingsTemporary Internet Files362FD6E8_8CDA_4c2a_A8AA-BDA22B321711.gif
c:documents and settingsFBILocal SettingsTemporary Internet Files3DF04940_9866_4241_A998_0CDDFAFD147A.jpg
c:documents and settingsFBILocal SettingsTemporary Internet Files426500D7_0FF3_426c_828D_065DBAEA0581.gif
c:documents and settingsFBILocal SettingsTemporary Internet Files478BD4AE_2691_438d_BDCA_3485DC022700.gif
c:documents and settingsFBILocal SettingsTemporary Internet Files5C6C645F_BAA8_4149_BFEB_2031230FF0FD.jpg
c:documents and settingsFBILocal SettingsTemporary Internet Files61EA7D69_19D4_421a_A899_0DF4D58CD119.gif
c:documents and settingsFBILocal SettingsTemporary Internet Files777FDAFB_83CF_4960_AA71_4E5D7BCD8E57.gif
c:documents and settingsFBILocal SettingsTemporary Internet Files8DA878D5_E80B_4721_B75A_17EFFAF1A700.gif
c:documents and settingsFBILocal SettingsTemporary Internet Files98F6DF79_7171_452d_9C26_C0193E12DBDF.gif
c:documents and settingsFBILocal SettingsTemporary Internet FilesA2B240D6_0386_419e_91C5_3F7D90437CD0.gif
c:documents and settingsFBILocal SettingsTemporary Internet FilesC75CEF8D_5AF4_4563_8594_C45A45E14E63.gif
c:documents and settingsFBILocal SettingsTemporary Internet FilesE21285C1_40E6_435c_A69F_3387E7BD89CB.jpg
c:documents and settingsFBILocal SettingsTemporary Internet FilesE9A4D648_ED73_4ea7_88B2_18332DBA4F3E.gif
c:windowssystem32driversstr.sys

.
((((((((((((((((((((((((( Files Created from 2008-12-24 to 2009-01-24 )))))))))))))))))))))))))))))))
.

2009-01-21 19:32 . 2009-01-21 19:32 323,072 —a

---

c:documents and settingsAll UsersApplication Datamvvlib.dll
2009-01-21 19:30 . 2009-01-21 19:30 30,976 —a

---

c:windowssystem32driverslivciiawwnv.sys
2009-01-19 22:49 . 2009-01-19 22:49 d

---

c:program filesSymNetDrv
2009-01-16 01:42 . 2003-06-19 01:31 17,920 —a

---

c:windowssystem32mdimon.dll
2009-01-16 01:42 . 2009-01-16 01:42 394 —a

---

c:windowsODBC.INI
2009-01-15 13:45 . 2006-06-03 21:29 48,640 —a

---

c:windowssystem32hpzll4pi.dll
2009-01-15 13:36 . 2006-03-03 21:03 282,680 —a

---

c:windowssystem32HPZidr12.dll
2009-01-15 13:36 . 2006-03-03 21:02 204,800 —a

---

c:windowssystem32HPZipr12.dll
2009-01-15 13:36 . 2006-03-03 21:02 94,208 —a

---

c:windowssystem32HPZipt12.dll
2009-01-15 13:36 . 2006-03-03 21:03 69,632 —a

---

c:windowssystem32HPZipm12.exe
2009-01-15 13:36 . 2006-03-03 21:03 65,536 —a

---

c:windowssystem32HPZinw12.exe
2009-01-15 13:36 . 2006-03-03 21:02 57,344 —a

---

c:windowssystem32HPZisn12.dll
2009-01-15 13:35 . 2009-01-15 13:36 d

---

c:program filesHP
2009-01-15 13:35 . 1998-10-29 16:45 306,688 —a

---

c:windowsIsUninst.exe
2009-01-15 13:33 . 2009-01-15 13:44 124,939 —a

---

c:windowsHPHins12.dat
2009-01-15 13:33 . 2006-05-16 23:25 77,824 —a

---

c:windowssystem32hpzids01.dll
2009-01-15 13:33 . 2006-07-17 22:24 14,916

---

c:windowshphmdl12.dat
2009-01-15 13:30 . 2006-06-22 06:03 56 —a

---

C:ut9x.bat
2009-01-15 13:30 . 2006-06-20 00:08 54 —a

---

C:ut.bat
2009-01-15 13:13 . 2008-05-20 19:42 25,856 —a

---

c:windowssystem32driversusbprint.sys
2009-01-15 13:13 . 2008-05-20 19:42 25,856 —a—c— c:windowssystem32dllcacheusbprint.sys
2009-01-15 01:40 . 2009-01-15 01:40 d

---

c:documents and settingsFBIApplication DataCorel
2009-01-15 01:40 . 2009-01-15 01:40 848 —ahs—- c:windowssystem32KGyGaAvL.sys
2009-01-15 01:39 . 2009-01-15 01:39 d

---

c:documents and settingsFBIApplication DataACD Systems
2009-01-14 22:47 . 2008-05-30 14:11 3,850,760 —a

---

c:windowssystem32D3DX9_38.dll
2009-01-14 22:47 . 2008-05-30 14:11 1,491,992 —a

---

c:windowssystem32D3DCompiler_38.dll
2009-01-14 22:47 . 2008-05-30 14:19 507,400 —a

---

c:windowssystem32XAudio2_1.dll
2009-01-14 22:47 . 2008-05-30 14:11 467,984 —a

---

c:windowssystem32d3dx10_38.dll
2009-01-14 22:47 . 2008-05-30 14:18 238,088 —a

---

c:windowssystem32xactengine3_1.dll
2009-01-14 22:47 . 2008-05-30 14:17 65,032 —a

---

c:windowssystem32XAPOFX1_0.dll
2009-01-14 22:47 . 2008-05-30 14:17 25,608 —a

---

c:windowssystem32X3DAudio1_4.dll
2009-01-14 22:46 . 2009-01-14 22:46 d

---

c:windowssystem32xlive
2009-01-14 22:46 . 2009-01-14 22:46 d

---

c:windowsLogs
2009-01-14 22:46 . 2009-01-14 22:46 d

---

c:program filesMicrosoft Games for Windows — LIVE
2009-01-14 18:03 . 2009-01-14 18:03 279,712 —a

---

c:windowssystem32driversatksgt.sys
2009-01-14 18:03 . 2009-01-14 18:03 25,888 —a

---

c:windowssystem32driverslirsgt.sys
2009-01-14 17:59 . 2009-01-14 17:59 dr-h

---

c:documents and settingsFBIApplication DataSecuROM
2009-01-14 17:59 . 2009-01-14 17:59 107,888 —a

---

c:windowssystem32CmdLineExt.dll
2009-01-14 02:25 . 2009-01-14 02:25 d

---

c:documents and settingsLocalServiceApplication DataSymantec
2009-01-13 18:56 . 2009-01-13 18:56 d

---

c:documents and settingsAdminApplication DataNokia Multimedia Player
2009-01-13 18:55 . 2009-01-19 17:16 54,156 —ah

---

c:windowsQTFont.qfn
2009-01-13 18:55 . 2009-01-13 18:55 1,409 —a

---

c:windowsQTFont.for
2009-01-13 18:14 . 2009-01-13 18:14 d

---

c:documents and settingsAdminApplication DataACD Systems
2009-01-13 18:13 . 2009-01-15 01:53 d

---

c:program filesCommon FilesACD Systems
2009-01-13 15:19 . 2009-01-13 15:19 d

---

c:documents and settingsAll UsersApplication DataFLEXnet
2009-01-13 14:10 . 2009-01-13 14:10 0 —a

---

c:windowsnsreg.dat
2009-01-13 14:02 . 2009-01-13 14:02 0 —a

---

c:windowsoodcnt.INI
2009-01-13 13:58 . 2009-01-13 13:58 d

---

c:documents and settingsAdminApplication DataAuslogics
2009-01-13 13:28 . 2009-01-13 13:28 d

---

c:documents and settingsFBIApplication DataATI
2009-01-13 13:27 . 2009-01-13 13:27 d

---

c:documents and settingsFBIApplication DataPC Suite
2009-01-13 13:27 . 2009-01-12 23:26 d—h

---

c:documents and settingsFBIШаблоны
2009-01-13 13:27 . 2009-01-24 18:46 d

---

c:documents and settingsFBIРабочий стол
2009-01-13 13:27 . 2009-01-21 23:51 dr

---

c:documents and settingsFBIМои документы
2009-01-13 13:27 . 2009-01-13 02:21 dr

---

c:documents and settingsFBIГлавное меню
2009-01-13 13:27 . 2009-01-14 18:27 dr

---

c:documents and settingsFBIИзбранное
2009-01-13 13:27 . 2009-01-13 13:27 d

---

c:documents and settingsFBI
2009-01-13 00:52 . 2009-01-13 00:52 d

---

c:documents and settingsAdminApplication DataATI
2009-01-13 00:19 . 2009-01-13 00:24 d

---

c:documents and settingsAdminApplication DataSymantec
2009-01-13 00:14 . 2009-01-13 00:14 d

---

c:documents and settingsAdminApplication DataPC Suite
2009-01-13 00:14 . 2009-01-13 00:24 d

---

c:documents and settingsAdminApplication DataNokia
2009-01-13 00:12 . 2009-01-13 00:12 d

---

c:documents and settingsAdminApplication DataDAEMON Tools
2009-01-13 00:11 . 2009-01-13 00:11 d

---

c:documents and settingsAdminApplication DataWinamp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-24 15:12

---

d

---

w c:program filesCommon FilesSymantec Shared
2009-01-21 17:05

---

d

---

w c:program filesNorton AntiVirus
2009-01-19 19:50

---

d

---

w c:program filesSymantec
2009-01-17 18:32

---

d—h—w c:program filesInstallShield Installation Information
2009-01-14 18:23

---

d

---

w c:program fileseMule
2009-01-14 16:32

---

d

---

w c:program filesPunto Switcher
2009-01-14 15:43

---

d

---

w c:program filesInno Setup 5
2009-01-14 15:43

---

d

---

w c:program filesDownload Master
2009-01-14 15:34

---

d

---

w c:program filesUninstall Tool
2009-01-14 15:29

---

d

---

w c:program filesWindows Media Connect 2
2009-01-14 15:29

---

d

---

w c:program filesRestorator 2007
2009-01-14 15:29

---

d

---

w c:program filesReal Alternative
2009-01-14 15:29

---

d

---

w c:program filesQuickTime Alternative
2009-01-14 15:29

---

d

---

w c:program filesMotorolaPhoneTools
2009-01-14 15:29

---

d

---

w c:program filesLClock
2009-01-13 17:43

---

d

---

w c:program filesiColorFolder
2009-01-12 23:25

---

d

---

w c:program filesAnalog Devices
2009-01-12 21:52

---

d

---

w c:documents and settingsAll UsersApplication DataATI
2009-01-12 21:46

---

d

---

w c:program filesATI Technologies
2009-01-12 21:43

---

d

---

w c:program filesCommon FilesATI Technologies
2009-01-12 21:40

---

d

---

w c:program filesCommon FilesInstallShield
2009-01-12 21:19 4,608 —-a-w c:windowssystem32driverssymlcbrd.sys
2009-01-12 21:19

---

d

---

w c:documents and settingsAll UsersApplication DataSymantec
2009-01-12 21:14

---

d

---

w c:program filesNokia
2009-01-12 21:14

---

d

---

w c:program filesDIFX
2009-01-12 21:14

---

d

---

w c:program filesCommon FilesPCSuite
2009-01-12 21:14

---

d

---

w c:program filesCommon FilesNokia
2009-01-12 21:14

---

d

---

w c:documents and settingsAll UsersApplication DataPC Suite
2009-01-12 21:13

---

d

---

w c:program filesPC Connectivity Solution
2009-01-12 21:13

---

d

---

w c:program filesMicrosoft ActiveSync
2009-01-12 21:12

---

d

---

w c:program filesWindows Sidebar
2009-01-12 21:12

---

d

---

w c:program filesVista Games
2009-01-12 21:12

---

d

---

w c:program filesUltraISO
2009-01-12 21:12

---

d

---

w c:program filesDAEMON Tools Lite
2009-01-12 21:12

---

d

---

w c:program filesCommon FilesEZB Systems
2009-01-12 21:12

---

d

---

w c:program filesCommon FilesAhead
2009-01-12 21:12

---

d

---

w c:program filesAhead
2009-01-12 21:11

---

d

---

w c:program filesWinamp
2009-01-12 21:11

---

d

---

w c:program filesOO Software
2009-01-12 21:11

---

d

---

w c:program filesAuslogics
2009-01-12 21:11

---

d

---

w c:program files7-Zip
2009-01-12 21:09

---

d

---

w c:program filesMSBuild
2009-01-12 21:08

---

d

---

w c:program filesSmart Install Maker
2009-01-12 21:08

---

d

---

w c:program filesReference Assemblies
2009-01-12 21:07

---

d

---

w c:program filesNeoSmart Technologies
2009-01-12 21:07

---

d

---

w c:program filesEverest
2009-01-12 21:07

---

d

---

w c:program filesEasy Gif Animator
2009-01-12 21:07

---

d

---

w c:program filesDriver-soft
2009-01-12 21:07

---

d

---

w c:program filesCPU-Z
2009-01-12 21:07

---

d

---

w c:program filesCorel
2009-01-12 21:07

---

d

---

w c:program filesCommon FilesCorel
2009-01-12 21:02

---

d

---

w c:program filesCommon FilesMacrovision Shared
2009-01-12 21:01

---

d

---

w c:program filesThe Bat!
2009-01-12 21:01

---

d

---

w c:program filesCommon FilesAdobe
2009-01-12 21:00

---

d

---

w c:program filesXPTweaker
2009-01-12 21:00

---

d

---

w c:program filesRegshot
2009-01-12 21:00

---

d

---

w c:program filesPocketDivXEncoder
2009-01-12 21:00

---

d

---

w c:program filesOpera
2009-01-12 21:00

---

d

---

w c:program filesNo1 DVD Ripper
2009-01-12 21:00

---

d

---

w c:program filesMSECache
2009-01-12 21:00

---

d

---

w c:program filesK-Lite Codec Pack
2009-01-12 21:00

---

d

---

w c:program filesFlash Player Pro
2009-01-12 21:00

---

d

---

w c:program filesCcleaner
2009-01-12 21:00

---

d

---

w c:documents and settingsAll UsersApplication DataApple Computer
2009-01-12 20:59

---

d

---

w c:program filesCommon FilesArsenal Shared
2009-01-12 20:59

---

d

---

w c:program filesArsenal Company
2009-01-12 20:59

---

d

---

w c:documents and settingsAll UsersApplication DataMicrosoft Help
2009-01-12 20:55

---

d

---

w c:program filesMicrosoft.NET
2009-01-12 20:55

---

d

---

w c:program filesMicrosoft Works
2009-01-12 20:53

---

d

---

w c:program filesFoxit Reader
2009-01-12 20:31

---

d

---

w c:program filesVistaDriveIcon
2009-01-12 20:31

---

d

---

w c:program filesmicrosoft frontpage
2009-01-12 20:30 717,296 —-a-w c:windowssystem32driverssptd.sys
2009-01-12 20:30

---

d

---

w c:program filesJava
2009-01-12 20:30

---

d

---

w c:program filesCommon FilesJava
2009-01-12 20:28

---

d—a-w c:program filesAmlMaple
2009-01-12 20:26

---

d

---

w c:program filesPaint.NET
2008-04-07 09:38 67,696 —-a-w c:program filesmozilla firefoxcomponentsjar50.dll
2008-04-07 09:38 54,376 —-a-w c:program filesmozilla firefoxcomponentsjsd3250.dll
2008-04-07 09:38 34,952 —-a-w c:program filesmozilla firefoxcomponentsmyspell.dll
2008-04-07 09:38 46,720 —-a-w c:program filesmozilla firefoxcomponentsspellchk.dll
2008-04-07 09:38 172,144 —-a-w c:program filesmozilla firefoxcomponentsxpinstal.dll
.

---

Sigcheck

---

2008-05-20 18:54 579072 23b7d3f3f5ec8feea75ec381c71cbd5e c:windowssystem32user32.dll

2008-05-20 18:54 952320 7a737e1453d01ff94801272f13497362 c:windowssystem32wininet.dll

2008-05-20 18:52 361344 030dc4d48cc2b894fee2f390d8e66ad5 c:windowssystem32driverstcpip.sys

2008-05-20 18:53 1721344 dc5d73a9809b66026231a9d49de6987f c:windowsexplorer.exe

2008-05-20 18:53 30208 ae0db25ee10900c73d923ad5880564cf c:windowssystem32ctfmon.exe

2008-05-20 18:55 80216 5f38b1b965527c6f5c30dedab0ab0550 c:windowssystem32wuauclt.exe
.
((((((((((((((((((((((((((((( snapshot@2009-01-22_ 0.03.49.00 )))))))))))))))))))))))))))))))))))))))))
.
— 2009-01-21 21:01:39 16,384 —sha-w c:windowssystem32configsystemprofileCookiesindex.dat
+ 2009-01-24 15:01:22 16,384 —sha-w c:windowssystem32configsystemprofileCookiesindex.dat
— 2009-01-21 21:01:39 16,384 —sha-w c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5index.dat
+ 2009-01-24 15:01:22 16,384 —sha-w c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5index.dat
— 2009-01-21 21:01:39 32,768 —sha-w c:windowssystem32configsystemprofileLocal SettingsTemporary Internet FilesContent.IE5index.dat
+ 2009-01-24 15:01:22 32,768 —sha-w c:windowssystem32configsystemprofileLocal SettingsTemporary Internet FilesContent.IE5index.dat
— 2009-01-15 22:50:50 72,152 —-a-w c:windowssystem32perfc009.dat
+ 2009-01-21 21:06:02 72,152 —-a-w c:windowssystem32perfc009.dat
— 2009-01-15 22:50:50 85,314 —-a-w c:windowssystem32perfc019.dat
+ 2009-01-21 21:06:02 85,314 —-a-w c:windowssystem32perfc019.dat
— 2009-01-15 22:50:50 444,528 —-a-w c:windowssystem32perfh009.dat
+ 2009-01-21 21:06:02 444,528 —-a-w c:windowssystem32perfh009.dat
— 2009-01-15 22:50:50 488,014 —-a-w c:windowssystem32perfh019.dat
+ 2009-01-21 21:06:02 488,014 —-a-w c:windowssystem32perfh019.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]
«{95289393-33EA-4F8D-B952-483415B9C955}»= «c:documents and settingsFBIApplication DataMicrosoftInternet Explorerqipsearchbar.dll» [2009-01-20 131072]

[HKEY_CLASSES_ROOTclsid{95289393-33ea-4f8d-b952-483415b9c955}]
[HKEY_CLASSES_ROOTqipbar.QIPBHO.1]
[HKEY_CLASSES_ROOTTypeLib{45FF696B-5284-4781-B2CA-ECF3A742A17B}]
[HKEY_CLASSES_ROOTqipbar.QIPBHO]

[HKEY_LOCAL_MACHINE~Browser Helper Objects{95289393-33EA-4F8D-B952-483415B9C955}]
2009-01-20 13:09 131072 —a

---

c:documents and settingsFBIApplication DataMicrosoftInternet Explorerqipsearchbar.dll

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2008-05-20 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2007-11-14 201728]
«RGSC»=»d:gamesGTARockstar Games Social ClubRGSCLauncher.exe» [2009-01-14 306088]
«Steam»=»d:program filesSteamSteam.exe» [2009-01-17 1410296]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«SoundMAXPnP»=»c:program filesAnalog DevicesCoresmax4pnp.exe» [2007-03-16 868352]
«AmlMaple»=»c:program filesAmlMapleAmlMaple.exe» [2008-04-24 91648]
«OODefragTray»=»c:windowssystem32oodtray.exe» [2007-05-11 2512392]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2006-01-12 155648]
«ccApp»=»c:program filesCommon FilesSymantec SharedccApp.exe» [2008-01-17 58728]
«StartCCC»=»c:program filesATI TechnologiesATI.ACECore-StaticCLIStart.exe» [2008-07-16 61440]
«Symantec NetDriver Monitor»=»c:progra~1SYMNET~1SNDMon.exe» [2009-01-19 100056]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-05-20 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» [2008-05-20 c:windowssystem32advpack.dll]
«IE7_012″=»advpack.dll» [2008-05-20 c:windowssystem32advpack.dll]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]
«VIDC.ACDV»= ACDV.dll

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetcontrolsession manager]
BootExecute REG_MULTI_SZ autocheck autochk *0OODBS

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesDisableNotify»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusDisableNotify»=dword:00000001
«AntiVirusOverride»=dword:00000001

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringSymantecAntiVirus]
«DisableMonitoring»=dword:00000001

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringSymantecFirewall]
«DisableMonitoring»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:program filesMicrosoft ActiveSyncrapimgr.exe»= c:program filesMicrosoft ActiveSyncrapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
«c:program filesMicrosoft ActiveSyncwcescomm.exe»= c:program filesMicrosoft ActiveSyncwcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
«c:program filesMicrosoft ActiveSyncWCESMgr.exe»= c:program filesMicrosoft ActiveSyncWCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«26675:TCP»= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:windowssystem32driversAtiHdmi.sys [2009-01-13 93696]
R3 USB_RNDIS_51;ZTE USB Remote NDIS Device Driver;c:windowssystem32driversusb8023.sys [2008-04-15 12800]
R4 TTFixerService;NST ToolTipFixer;c:program filesNeoSmart TechnologiesToolTipFixerToolTipFixer.exe [2007-06-27 10240]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled componentsWindows Sidebar]
c:windowssystem32hidec /W c:program filesWindows SidebarVAIOToolsREGTLIB.EXE «c:program filesWindows Sidebarsidebar.exe»

[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled components{34A19196-274E-4D75-9D30-D7A45A0A4178}]
«c:program filesWindows Sidebar.regsvr32.exe» /s wlsrvc.dll

[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled components{6B9228DA-9C15-419e-856C-19E768A13BDC}]
«c:program filesWindows Sidebar.regsvr32.exe» /s sbdrop.dll

[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled components{BADA65A0-86B7-462B-B720-CE66655C73F5}]
regsvr32 /s c:program filesWindows SidebarVAIO.vshellext.dll
.
Contents of the ‘Scheduled Tasks’ folder

2009-01-16 c:windowsTasksNorton AntiVirus — Scan my computer — Admin.job
— c:progra~1NORTON~1Navw32.exe [2005-10-19 12:54]
.
.

---

Supplementary Scan

---

.
uStart Page = start.qip.ru
uDefault_Search_URL = hxxp://search.qip.ru
uInternet Connection Wizard,ShellNext = hxxp://www.kornet.ru/
uSearchURL,(Default) = hxxp://search.qip.ru/search?query=%s&from=IE
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe
IE: {{17FA5CD6-5737-45c2-B194-74C8A4A7F7E7} — {7E1F0737-53A5-4EDC-8734-DD94B50AAF83} — c:program filesArsenal CompanySOCRAT InternetSocratInternet.dll
IE: {{DFDC8970-FD66-4385-B8C0-835A4AA1DA00} — {A3400175-12F9-4220-83BF-A7210CA4003E} — c:program filesArsenal CompanySOCRAT InternetSocratInternet.dll
TCP: {19CD0723-31A7-4F01-B8B2-6BBFE71AC939} = 212.188.4.10,195.34.32.116
FF — ProfilePath — c:documents and settingsFBIApplication DataMozillaFirefoxProfiles4745pir0.default
FF — prefs.js: browser.search.selectedEngine — QIP Search
FF — prefs.js: browser.startup.homepage — hxxp://www.yandex.ru/?clid=40795
FF — prefs.js: keyword.URL — hxxp://search.qip.ru/search?from=FF&query=
FF — component: c:program filesMozilla Firefoxcomponentsxpinstal.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-24 18:50:29
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

LOCKED REGISTRY KEYS

---

[HKEY_USERSS-1-5-21-220523388-688789844-1801674531-1004SoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{738FF577-6DAC-3359-94B2-0C67E031B894}*]
«jafimdoilblhfbghpeam»=hex:62,61,6f,68,00,00
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘winlogon.exe'(1096)
c:windowssystem32SETUPAPI.dll
c:windowssystem32Ati2evxx.dll
c:windowssystem32cscui.dll
c:windowssystem32COMRes.dll

— — — — — — — > ‘lsass.exe'(1152)
c:windowssystem32setupapi.dll
.

---

Other Running Processes

---

.
c:windowssystem32ati2evxx.exe
c:windowssystem32ati2evxx.exe
c:program filesCommon FilesSymantec SharedCCSETMGR.EXE
c:program filesCommon FilesSymantec SharedSNDSrvc.exe
c:program filesCommon FilesSymantec SharedSPBBCSPBBCSvc.exe
c:program filesCommon FilesSymantec SharedCCEVTMGR.EXE
c:program filesSymantecLiveUpdateAluSchedulerSvc.exe
c:program filesNorton AntiVirusIWPNPFMNTOR.EXE
c:windowssystem32oodag.exe
c:windowssystem32HPZipm12.exe
c:program filesCommon FilesSymantec SharedCCPD-LCsymlcsvc.exe
c:program filesATI TechnologiesATI.ACECore-StaticMOM.exe
c:program filesATI TechnologiesATI.ACECore-StaticCCC.exe
c:windowsMicrosoft.NETFrameworkv3.0WPFPresentationFontCache.exe
c:windowssystem32taskmgr.exe
.
**************************************************************************
.
Completion time: 2009-01-24 18:53:00 — machine was rebooted
ComboFix-quarantined-files.txt 2009-01-24 15:52:58
ComboFix2.txt 2009-01-21 21:05:25

Pre-Run: 12 888 686 592 байт свободно
Post-Run: 12,894,679,040 байт свободно

348

[Julia]

Лента новостей пропала,спасибо большое)))
Нужно ли делать что-то ещё?

[Admin]

Нужно немножко ещё реестр подредактировать.
Откройте блокнот (Кликните Пуск, Выполнить, в строке ввода введите notepad и нажмите Enter) и вставьте в него следующий текст:

Registry::

[HKEY_USERSS-1-5-21-220523388-688789844-1801674531-1004SoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{738FF577-6DAC-3359-94B2-0C67E031B894}*]

"jafimdoilblhfbghpeam"=-

Запишите получившийся файл на ваш рабочий стол под именем CFScript
Далее перетащите получившийся файл на иконку Combofix, как показано на картинке ниже.

Сombofix запуститься и выполнит процедуры описанные в созданном нами файле.
По результатам работы Combofix будет создан новый лог, его и вставьте в свой следующий ответ.

[Автор]

Сообщения