Никак не могу обнаружить вирус!!!!

[Happening]

Загрузка ЦП на 30 % если даже ничем не занимаешь систему.

вот логи combofixa:

ComboFix 10-01-11.04 — Admin 12.01.2010 17:59:09.2.4 — x86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.3327.2828 [GMT 3:00]
Running from: d:torrentTorrentsComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 100111-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2009-12-12 to 2010-01-12 )))))))))))))))))))))))))))))))
.

2010-01-12 14:30 . 2010-01-12 14:30

---

d—h—w- i:windowsPIF
2010-01-12 12:02 . 2010-01-12 12:06

---

d

---

w- i:documents and settingsAdminDoctorWeb
2010-01-12 09:26 . 2010-01-12 09:26

---

d

---

w- i:documents and settingsAdminApplication DataMedia Player Classic
2010-01-10 16:10 . 2010-01-10 16:10

---

d

---

w- i:documents and settingsAdminLocal SettingsApplication DataAspyr
2010-01-09 13:18 . 2010-01-09 13:18

---

d

---

w- i:documents and settingsAdminLocal SettingsApplication DataWMTools Downloaded Files
2010-01-09 08:34 . 2010-01-09 08:34

---

d

---

w- i:documents and settingsAdminLocal SettingsApplication DataMozilla
2010-01-07 17:13 . 2010-01-07 17:15

---

d

---

w- i:documents and settingsAdminLocal SettingsApplication Datasalvation
2010-01-07 17:13 . 2010-01-07 17:13

---

d

---

w- i:documents and settingsAll UsersApplication Datasalvation
2010-01-07 17:12 . 2008-10-10 01:52 452440 —-a-w- i:windowssystem32d3dx10_40.dll
2010-01-07 17:12 . 2008-10-10 01:52 4379984 —-a-w- i:windowssystem32D3DX9_40.dll
2010-01-07 17:12 . 2008-10-10 01:52 2036576 —-a-w- i:windowssystem32D3DCompiler_40.dll
2010-01-07 17:12 . 2008-10-27 07:04 235856 —-a-w- i:windowssystem32xactengine3_3.dll
2010-01-07 17:12 . 2010-01-07 17:12

---

d

---

w- i:program filesOpenAL
2010-01-07 16:59 . 2010-01-07 16:59

---

d

---

w- i:documents and settingsAdminApplication DataАлексей Рэйн
2010-01-07 16:59 . 2010-01-07 16:58 702925 —-a-w- i:documents and settingsAdminApplication DataАлексей РэйнTerminator Salvationunins000.exe
2010-01-06 14:39 . 2010-01-06 14:39

---

d

---

w- i:documents and settingsLocalServiceApplication DataAhead
2010-01-06 12:07 . 2010-01-06 12:07

---

d

---

w- i:documents and settingsAdminApplication DataFriday’s games
2010-01-06 10:22 . 2010-01-06 10:23

---

d

---

w- i:documents and settingsAdminLocal SettingsApplication DataAdobe
2010-01-06 09:16 . 2010-01-06 09:16 24352 —-a-w- i:documents and settingsAdminLocal SettingsApplication DataGDIPFONTCACHEV1.DAT
2010-01-04 16:41 . 2010-01-04 16:41

---

d

---

w- i:program filesLapster
2010-01-04 09:03 . 2010-01-04 09:03

---

d

---

w- i:documents and settingsAll UsersApplication DataAlawar Stargaze
2010-01-04 09:03 . 2010-01-04 09:03

---

d

---

w- i:documents and settingsAdminLocal SettingsApplication DataSTARGAZE_IMAGE_CACHE
2010-01-04 09:03 . 2010-01-10 16:17

---

d

---

w- i:documents and settingsAll UsersApplication DataAlawarWrapper
2010-01-04 09:02 . 2010-01-04 09:02

---

d

---

w- i:program filesBloginform.RU
2010-01-04 09:02 . 2010-01-07 10:43

---

d

---

w- i:program filesAlawar
2010-01-04 08:39 . 2010-01-04 08:39

---

d

---

w- i:documents and settingsAll UsersApplication DataTrymedia
2010-01-01 18:42 . 2008-04-15 12:00 26624 —-a-w- i:documents and settingsLocalServiceApplication DataMicrosoftUPnP Device Hostupnphostudhisapi.dll
2009-12-30 07:38 . 2009-12-30 07:38

---

d

---

w- i:windowsLogs
2009-12-30 07:35 . 2009-12-30 07:35

---

d

---

w- i:program filesABBYY FineReader 8.0 Professional Edition
2009-12-30 07:33 . 2010-01-06 09:17

---

d

---

w- i:documents and settingsAdminLocal SettingsApplication DataAhead
2009-12-30 07:30 . 2009-12-30 07:33

---

d

---

w- i:program filesCommon FilesAhead
2009-12-30 07:30 . 2009-12-30 07:30

---

d

---

w- i:program filesNero
2009-12-30 07:25 . 2010-01-09 14:16

---

d

---

w- i:documents and settingsAdminLocal SettingsApplication DataABBYY
2009-12-30 07:25 . 2009-12-30 07:25

---

d

---

w- i:documents and settingsAdminApplication DataABBYY
2009-12-30 07:15 . 2009-12-30 07:15

---

d

---

w- i:documents and settingsAdminLocal SettingsApplication Dataid Software
2009-12-30 06:38 . 2009-12-30 06:38

---

d

---

w- i:windowsProfiles
2009-12-30 06:38 . 2010-01-01 19:05

---

d

---

w- i:program filesCommon FilesAdobe
2009-12-30 06:37 . 1998-10-29 12:45 306688 —-a-w- i:windowsIsUninst.exe
2009-12-30 06:37 . 2009-12-30 06:37

---

d

---

w- i:documents and settingsAdminWINDOWS
2009-12-30 06:36 . 2009-12-30 06:36 82380 —-a-w- i:windowssystem32driversAFS2K.SYS
2009-12-30 06:36 . 2009-12-30 06:36

---

d

---

w- i:documents and settingsAdminApplication DataПапка выгрузки Share-to-Web
2009-12-30 06:36 . 2010-01-09 14:17

---

d

---

w- I:UniScan
2009-12-30 06:36 . 2008-05-20 16:42 15104 -c—a-w- i:windowssystem32dllcacheusbscan.sys
2009-12-30 06:36 . 2008-05-20 16:42 15104 —-a-w- i:windowssystem32driversusbscan.sys
2009-12-30 06:35 . 2009-12-30 06:35

---

d

---

w- i:program filesCommon FilesHewlett-Packard
2009-12-30 06:35 . 2009-12-30 06:36

---

d

---

w- i:program filesHewlett-Packard
2009-12-30 05:57 . 2009-12-30 05:57

---

d

---

w- i:documents and settingsAdminLocal SettingsApplication DataYandex
2009-12-30 05:57 . 2010-01-09 08:34

---

d

---

w- i:documents and settingsAdminApplication DataYandex
2009-12-30 05:56 . 2009-12-30 06:00

---

d

---

w- i:documents and settingsAdminApplication DataDAEMON Tools Lite
2009-12-30 05:56 . 2009-12-30 05:56

---

d

---

w- i:documents and settingsAll UsersApplication DataDAEMON Tools Lite
2009-12-30 05:53 . 2009-12-30 05:53

---

d

---

w- i:program filesWinamp
2009-12-30 05:52 . 2009-12-30 05:52

---

d

---

w- i:program filesuTorrent
2009-12-30 05:43 . 2009-12-30 05:43

---

d

---

w- i:documents and settingsAdminLocal SettingsApplication DataOpera
2009-12-30 05:42 . 2009-12-30 05:42

---

d

---

w- i:program filesCanon
2009-12-30 05:42 . 2009-12-30 05:42

---

d

---

w- i:documents and settingsAll UsersApplication DataDAEMON Tools Pro
2009-12-30 05:41 . 2008-05-20 16:42 25856 -c—a-w- i:windowssystem32dllcacheusbprint.sys
2009-12-30 05:41 . 2008-05-20 16:42 25856 —-a-w- i:windowssystem32driversusbprint.sys
2009-12-30 05:29 . 2009-12-30 05:29

---

d

---

w- i:documents and settingsAdminApplication DataDAEMON Tools Pro
2009-12-30 05:28 . 2009-02-05 21:06 51376 —-a-w- i:windowssystem32driversaswTdi.sys
2009-12-30 05:28 . 2009-02-05 21:06 23152 —-a-w- i:windowssystem32driversaswRdr.sys
2009-12-30 05:28 . 2009-02-05 21:05 26944 —-a-w- i:windowssystem32driversaavmker4.sys
2009-12-30 05:28 . 2009-02-05 21:08 93296 —-a-w- i:windowssystem32driversaswmon.sys
2009-12-30 05:28 . 2009-02-05 21:08 94032 —-a-w- i:windowssystem32driversaswmon2.sys
2009-12-30 05:28 . 2009-02-05 21:07 114768 —-a-w- i:windowssystem32driversaswSP.sys
2009-12-30 05:28 . 2009-02-05 21:07 20560 —-a-w- i:windowssystem32driversaswFsBlk.sys
2009-12-30 05:28 . 2009-02-05 21:04 97480 —-a-w- i:windowssystem32AvastSS.scr
2009-12-30 05:28 . 2009-02-05 21:11 1256296 —-a-w- i:windowssystem32aswBoot.exe
2009-12-30 05:28 . 2009-12-30 05:28

---

d

---

w- i:program filesAlwil Software
2009-12-29 18:02 . 2008-05-20 19:42 146048 —-a-w- i:windowssystem32driversportcls.sys
2009-12-29 18:02 . 2008-05-20 19:42 60160 —-a-w- i:windowssystem32driversdrmk.sys
2009-12-29 18:02 . 2008-05-20 19:42 4096 —-a-w- i:windowssystem32ksuser.dll
2009-12-29 18:02 . 2008-05-20 19:42 21504 —-a-w- i:windowssystem32hidserv.dll
2009-12-29 18:02 . 2008-05-20 19:42 58368 —-a-w- i:windowssystem32driversredbook.sys
2009-12-29 18:00 . 2008-05-20 19:42 76800 —-a-w- i:windowssystem32usbui.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-12 15:03 . 2009-12-29 15:33

---

d

---

w- i:documents and settingsAdminApplication DatauTorrent
2010-01-12 12:57 . 2008-04-15 12:00 76678 —-a-w- i:windowssystem32perfc019.dat
2010-01-12 12:57 . 2008-04-15 12:00 448388 —-a-w- i:windowssystem32perfh019.dat
2010-01-11 16:52 . 2009-12-29 15:09 418480 —-a-w- i:windowssystem32wrap_oal.dll
2010-01-11 16:52 . 2009-12-29 15:09 115432 —-a-w- i:windowssystem32OpenAL32.dll
2010-01-06 09:18 . 2009-12-30 07:32

---

d

---

w- i:documents and settingsAdminApplication DataAhead
2010-01-04 15:29 . 2009-12-29 15:08 86327 —-a-w- i:windowspchealthhelpctrOfflineCacheindex.dat
2009-12-31 06:52 . 2009-12-29 15:23

---

d

---

w- i:documents and settingsAll UsersApplication DataMicrosoft Help
2009-12-30 07:33 . 2009-12-30 07:32

---

d

---

w- i:program filesK-Lite Codec Pack
2009-12-30 05:56 . 2009-12-29 15:12 691696 —-a-w- i:windowssystem32driverssptd.sys
2009-12-29 15:34 . 2009-12-29 15:34

---

d

---

w- i:program filesOpera
2009-12-29 15:33 . 2009-12-29 15:33

---

d

---

w- i:documents and settingsAdminApplication DataWinamp
2009-12-29 15:30 . 2009-12-29 15:29

---

d

---

w- i:program filestotalcmd
2009-12-29 15:29 . 2009-12-29 15:29

---

d

---

w- i:documents and settingsAdminApplication DataGHISLER
2009-12-29 15:24 . 2009-12-29 15:24

---

d

---

w- i:program filesMicrosoft Works
2009-12-29 15:24 . 2009-12-29 15:24

---

d

---

w- i:program filesMicrosoft.NET
2009-12-29 15:12 . 2009-12-29 15:12

---

d

---

w- i:program filesmicrosoft frontpage
2009-12-29 15:12 . 2009-12-29 15:12

---

d

---

w- i:program filesVistaDriveIcon
2009-12-29 15:12 . 2009-12-29 15:12

---

d

---

w- i:program filesJava
2009-12-29 15:12 . 2009-12-29 15:12

---

d

---

w- i:program filesCommon FilesJava
2009-12-29 15:09 . 2009-12-29 15:09

---

d—a-w- i:program filesAmlMaple
2009-12-29 15:06 . 2009-12-29 15:06 22564 —-a-w- i:windowssystem32emptyregdb.dat
2009-12-29 15:06 . 2009-12-29 15:06

---

d

---

w- i:program filesWindows Media Connect 2
2009-12-29 15:06 . 2009-12-29 15:06

---

d

---

w- i:program filesPaint.NET
2009-12-11 18:00 . 2009-12-30 07:32 85504 —-a-w- i:windowssystem32ff_vfw.dll
.

---

Sigcheck

---

[-] 2008-05-20 . 030DC4D48CC2B894FEE2F390D8E66AD5 . 361344 . . [5.1.2600.5512] . . i:windowssystem32driverstcpip.sys

[-] 2008-05-20 . 5F38B1B965527C6F5C30DEDAB0AB0550 . 80216 . . [7.0.6000.381] . . i:windowssystem32wuauclt.exe

[-] 2008-05-20 . 23B7D3F3F5EC8FEEA75EC381C71CBD5E . 579072 . . [5.1.2600.5512] . . i:windowssystem32user32.dll

[-] 2008-05-20 . 7A737E1453D01FF94801272F13497362 . 952320 . . [7.00.6000.20772] . . i:windowssystem32wininet.dll

[-] 2008-05-20 . DC5D73A9809B66026231A9D49DE6987F . 1721344 . . [6.00.2900.5512] . . i:windowsexplorer.exe

[-] 2008-05-20 . 46D60730EE2DF438750B38370425BC74 . 1571840 . . [5.1.2600.5512] . . i:windowssystem32sfcfiles.dll

[-] 2008-05-20 . AE0DB25EE10900C73D923AD5880564CF . 30208 . . [5.1.2600.5512] . . i:windowssystem32ctfmon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«VistaIcon»=»i:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
«uTorrent»=»i:program filesuTorrentuTorrent.exe» [2009-12-30 289584]
«BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=»i:program filesCommon FilesAheadLibNMBgMonitor.exe» [2006-09-13 139264]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NvCplDaemon»=»i:windowssystem32NvCpl.dll» [2007-12-05 8523776]
«nwiz»=»nwiz.exe» [2007-12-05 1626112]
«NvMediaCenter»=»i:windowssystem32NvMcTray.dll» [2007-12-05 81920]
«RTHDCPL»=»RTHDCPL.EXE» [2008-04-10 16861184]
«AmlMaple»=»i:program filesAmlMapleAmlMaple.exe» [2008-04-24 91648]
«avast!»=»i:progra~1ALWILS~1Avast4ashDisp.exe» [2009-02-05 81000]
«Share-to-Web Namespace Daemon»=»i:program filesHewlett-PackardHP Share-to-Webhpgs2wnd.exe» [2002-04-17 69632]
«NeroFilterCheck»=»i:program filesCommon FilesAheadLibNeroCheck.exe» [2006-01-12 155648]
«Adobe Reader Speed Launcher»=»i:program filesAdobeReader 9.0ReaderReader_sl.exe» [2009-10-03 35696]
«Adobe ARM»=»i:program filesCommon FilesAdobeARM1.0AdobeARM.exe» [2009-09-04 935288]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»i:windowssystem32CTFMON.EXE» [2008-05-20 30208]
«VistaIcon»=»i:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» [2008-05-20 124928]
«IE7_012″=»advpack.dll» [2008-05-20 124928]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusOverride»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«i:\Program Files\Opera\opera.exe»=

R1 aswSP;avast! Self Protection;i:windowssystem32driversaswSP.sys [30.12.2009 8:28 114768]
R2 aswFsBlk;aswFsBlk;i:windowssystem32driversaswFsBlk.sys [30.12.2009 8:28 20560]
S4 sptd;sptd;i:windowssystem32driverssptd.sys [29.12.2009 18:12 691696]
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.apeha.ru
IE: &Экспорт в Microsoft Excel — i:progra~1MICROS~2Office12EXCEL.EXE/3000
FF — ProfilePath — i:documents and settingsAdminApplication DataMozillaFirefoxProfilesnahd6ha2.default
FF — prefs.js: browser.startup.homepage — hxxp://www.apeha.ru
FF — plugin: i:program filesK-Lite Codec PackRealbrowserpluginsnppl3260.dll
FF — plugin: i:program filesK-Lite Codec PackRealbrowserpluginsnprpjplug.dll
FF — plugin: i:program filesOperaprogrampluginsnppdf32.dll
FF — plugin: i:program filesOperaprogrampluginsnppl3260.dll
FF — plugin: i:program filesOperaprogrampluginsnprpjplug.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-12 18:05
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘winlogon.exe'(604)
i:windowssystem32SETUPAPI.dll
i:windowssystem32cscui.dll

— — — — — — — > ‘lsass.exe'(660)
i:windowssystem32setupapi.dll

— — — — — — — > ‘explorer.exe'(3496)
i:program filesAmlMapleAmlMaple.dll
i:windowssystem32COMRes.dll
i:windowsSystem32cscui.dll
i:windowssystem32msi.dll
i:windowssystem32SETUPAPI.dll
i:windowssystem32NETSHELL.dll
i:windowssystem32wpdshserviceobj.dll
i:windowssystem32portabledevicetypes.dll
i:windowssystem32portabledeviceapi.dll
.
Completion time: 2010-01-12 18:08:40
ComboFix-quarantined-files.txt 2010-01-12 15:08
ComboFix2.txt 2010-01-12 14:11

Pre-Run: 46 270 074 880 байт свободно
Post-Run: 46 246 572 032 байт свободно

— — End Of File — — E81D553C8E3C69DF8362406CE22AA592

[Admin]

Здравствуйте, добро пожаловать на Spyware-ru форум.

Лог выглядит нормально.

Загрузка ЦП на 30 % если даже ничем не занимаешь систему.

У вас автоматически запускается uTorrent, пробовали его удалять из автоматической загрузки ?

[Happening]

спасибо… вообщем все вроде оказалось из-за винчестера, он вроде не много по битый.
и еще предлагали эту ошибку исправить вот так: вообщем в диспетчере задач удалить оборудование первичного и вторичного IDE. помогло только на определенное время. вот

[Автор]

Сообщения