Обнаружены вирусы…..

This topic has 2 ответа, 2 участника, and was last updated 15 years, 6 months назад by Mazya.

Просмотр 3 сообщений - с 1 по 3 (из 3 всего)

Автор

Сообщения
5 марта, 2010 в 12:50 пп #18105
Mazya
Participant
- Темы:1
- Сообщений:2
привет всем. люди помогите.
В браузере мозилла выскочила вкладка сообщение центра обеспечения безопасности. пишет что комп заражен. надо отправить смс …
обнаружены вирусы и трояны. установил касперский. но он ничего не обнаружил кроме 2 нежелательных программ.
комп потихоньку тормозит начал.
имена вирусов:
W32.Yaha.B@mm
аdware.Win32.Look2me.ab
W32.Mypics.Worm.36352
Trojan.Fakealert.355
Trojan-Downloader.Win32.Small.fxf

Logfile of random’s system information tool 1.06 (written by random/random)
Run by Maz at 2010-03-05 18:31:47
Microsoft Windows XP Professional Service Pack 3
System drive D: has 200 GB (66%) free of 305 GB
Total RAM: 2046 MB (62% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:31:48, on 05.03.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20900)
Boot mode: Normal

Running processes:
D:WINDOWS.0System32smss.exe
D:WINDOWS.0system32winlogon.exe
D:WINDOWS.0system32services.exe
D:WINDOWS.0system32lsass.exe
D:WINDOWS.0system32Ati2evxx.exe
D:WINDOWS.0system32svchost.exe
D:WINDOWS.0System32svchost.exe
D:WINDOWS.0system32Ati2evxx.exe
D:WINDOWS.0system32spoolsv.exe
D:Program FilesKaspersky LabKaspersky Anti-Virus 2010avp.exe
D:Program FilesGigabyteEasySaverESSVR.EXE
D:Program FilesNeroNero8InCDInCDsrv.exe
D:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
D:Program FilesNeroNero8InCDNBHRegInCDSrv.exe
D:WINDOWS.0system32PnkBstrA.exe
D:Program FilesCyberLinkShared FilesRichVideo.exe
D:WINDOWS.0system32svchost.exe
D:WINDOWS.0Explorer.EXE
D:Program FilesATI TechnologiesATI.ACECore-StaticMOM.exe
D:WINDOWS.0RTHDCPL.EXE
D:Program FilesCyberLinkPowerDVDPDVDServ.exe
D:Program Fileslg_fwupdatefwupdate.exe
D:Program FilesNeroNero8InCDNBHGui.exe
D:GeniusioCentregTaskBar.exe
D:Program FilesABBYY Lingvo 12Lvagent.exe
D:Program FilesMail.RuAgentMAgent.exe
D:GeniusioCentregMouseTask.exe
D:GeniusioCentregKbdTask.exe
D:GeniusioCentregAutoPan.exe
D:GeniusioCentregAutoScroll.exe
D:GeniusioCentregZoom.exe
D:GeniusioCentregMGlass.exe
D:GeniusioCentregIMMgm.exe
D:GeniusioCentregDeskMgm.exe
D:GeniusioCentregTaskSwitch.exe
D:Program FilesKaspersky LabKaspersky Anti-Virus 2010avp.exe
D:WINDOWS.0system32ctfmon.exe
D:Program FilesVistaDriveIconVistaDrv.exe
D:Program FilesATI TechnologiesATI.ACECore-Staticccc.exe
D:Program FilesMozilla Firefoxfirefox.exe
D:Program FilesKaspersky LabKaspersky Anti-Virus 2010klwtblfs.exe
D:Program FilesInternet Exploreriexplore.exe
D:WINDOWS.0system32wuauclt.exe
D:WINDOWS.0system32wuauclt.exe
D:Documents and SettingsMazМои документыЗагрузкиRSIT.exe
D:Program Filestrend microMaz.exe

R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.yandex.ru
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://www.yahoo.com
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.yahoo.com
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =
R1 — HKCUSoftwareMicrosoftInternet Connection Wizard,ShellNext = http://www.yandex.ru/
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
O2 — BHO: Yahoo! Companion BHO — {02478D38-C3F9-4efb-9B51-7695ECA05670} — D:Program FilesYahoo!CompanionInstallscpn0ycomp5_6_2_0.dll
O2 — BHO: Adobe PDF Reader Link Helper — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — D:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 — BHO: IEVkbdBHO — {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} — D:Program FilesKaspersky LabKaspersky Anti-Virus 2010ievkbd.dll
O2 — BHO: Java(tm) Plug-In SSV Helper — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — D:Program FilesJavajre6binssv.dll
O2 — BHO: Спутник@Mail.Ru — {8984B388-A5BB-4DF7-B274-77B879E179DB} — d:program filesmail.rusputnikMailRuSputnik.dll
O2 — BHO: Java(tm) Plug-In 2 SSV Helper — {DBC80044-A445-435b-BC74-9C25C1C588A9} — D:Program FilesJavajre6binjp2ssv.dll
O2 — BHO: link filter bho — {E33CF602-D945-461A-83F0-819F76A199F8} — D:Program FilesKaspersky LabKaspersky Anti-Virus 2010klwtbbho.dll
O2 — BHO: JQSIEStartDetectorImpl Class — {E7E6F031-17CE-4C07-BC86-EABFE594F69C} — D:Program FilesJavajre6libdeployjqsiejqs_plugin.dll
O3 — Toolbar: &Yahoo! Companion — {EF99BD32-C1FB-11D2-892F-0090271D4F88} — D:Program FilesYahoo!CompanionInstallscpn0ycomp5_6_2_0.dll
O3 — Toolbar: (no name) — {CCC7A320-B3CA-4199-B1A6-9F516DD69829} — (no file)
O3 — Toolbar: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — d:program filesmail.rusputnikMailRuSputnik.dll
O3 — Toolbar: Яндекс.Бар — {91397D20-1446-11D4-8AF4-0040CA1127B6} — D:Program FilesYandexYandexBarIEyndbar.dll
O4 — HKLM..Run: [StartCCC] «D:Program FilesATI TechnologiesATI.ACECore-StaticCLIStart.exe» MSRun
O4 — HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 — HKLM..Run: [Alcmtr] ALCMTR.EXE
O4 — HKLM..Run: [UpdateLBPShortCut] «D:Program FilesCyberLinkLabelPrintMUITransferMUIStartMenu.exe» «D:Program FilesCyberLinkLabelPrint» UpdateWithCreateOnce «SoftwareCyberLinkLabelPrint2.0»
O4 — HKLM..Run: [RemoteControl] «D:Program FilesCyberLinkPowerDVDPDVDServ.exe»
O4 — HKLM..Run: [LanguageShortcut] «D:Program FilesCyberLinkPowerDVDLanguageLanguage.exe»
O4 — HKLM..Run: [UCam_Menu] «D:Program FilesCyberLinkYouCamMUITransferMUIStartMenu.exe» «D:Program FilesCyberLinkYouCam» UpdateWithCreateOnce «SoftwareCyberLinkYouCam1.0»
O4 — HKLM..Run: [NeroFilterCheck] D:WINDOWS.0system32NeroCheck.exe
O4 — HKLM..Run: [LGODDFU] «D:Program Fileslg_fwupdatefwupdate.exe» blrun
O4 — HKLM..Run: [SecurDisc] D:Program FilesNeroNero8InCDNBHGui.exe
O4 — HKLM..Run: [UpdatePSTShortCut] «D:Program FilesCyberLinkDVD SuiteMUITransferMUIStartMenu.exe» «D:Program FilesCyberLinkDVD Suite» UpdateWithCreateOnce «SoftwareCyberLinkPowerStarter»
O4 — HKLM..Run: [ioCentre] D:GeniusioCentregTaskBar.exe
O4 — HKLM..Run: [Adobe Reader Speed Launcher] «D:Program FilesAdobeReader 8.0ReaderReader_sl.exe»
O4 — HKLM..Run: [Lingvo Launcher] «D:Program FilesABBYY Lingvo 12Lvagent.exe» /STARTUP
O4 — HKLM..Run: [MAgent] D:Program FilesMail.RuAgentMAgent.exe -LM
O4 — HKLM..Run: [AVP] «D:Program FilesKaspersky LabKaspersky Anti-Virus 2010avp.exe»
O4 — HKCU..Run: [CTFMON.EXE] D:WINDOWS.0system32ctfmon.exe
O4 — HKCU..Run: [VistaIcon] D:Program FilesVistaDriveIconVistaDrv.exe
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] D:WINDOWS.0system32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..Run: [VistaIcon] D:Program FilesVistaDriveIconVistaDrv.exe (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..RunOnce: [ZZZZ1_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection D:WINDOWS.0INFcustom.inf,OnceFirstLogonInstall,0 (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..RunOnce: [IE7_012] rundll32 advpack.dll,LaunchINFSectionEx IE7int.inf,AfterUserStart,,4,N (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] D:WINDOWS.0system32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-20..RunOnce: [ZZZZ1_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection D:WINDOWS.0INFcustom.inf,OnceFirstLogonInstall,0 (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] D:WINDOWS.0system32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection D:WINDOWS.0INFcustom.inf,NewUserFirstLogonInstall,0 (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] D:WINDOWS.0system32CTFMON.EXE (User ‘Default user’)
O4 — HKUS.DEFAULT..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection D:WINDOWS.0INFcustom.inf,NewUserFirstLogonInstall,0 (User ‘Default user’)
O9 — Extra button: &Виртуальная клавиатура — {4248FE82-7FCB-46AC-B270-339F08212110} — D:Program FilesKaspersky LabKaspersky Anti-Virus 2010klwtbbho.dll
O9 — Extra button: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — D:Program FilesMail.RuAgentmagent.exe
O9 — Extra ‘Tools’ menuitem: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — D:Program FilesMail.RuAgentmagent.exe
O9 — Extra button: Справочные материалы — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — D:PROGRA~1MICROS~3OFFICE11REFIEBAR.DLL
O9 — Extra button: Проверка ссы&лок — {CCF151D8-D089-449F-A5A4-D9909053F20F} — D:Program FilesKaspersky LabKaspersky Anti-Virus 2010klwtbbho.dll
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — D:WINDOWS.0Network Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — D:WINDOWS.0Network Diagnosticxpnetdiag.exe
O17 — HKLMSystemCCSServicesTcpip..{00934340-B8B7-4E3E-B430-6D4532E360E9}: NameServer = 95.56.237.24 92.46.53.241
O17 — HKLMSystemCS1ServicesTcpip..{00934340-B8B7-4E3E-B430-6D4532E360E9}: NameServer = 95.56.237.24 92.46.53.241
O20 — AppInit_DLLs: D:PROGRA~1KASPER~1KASPER~1mzvkbd3.dll
O23 — Service: Application Driver Auto Removal Service (01) (appdrvrem01) — Protection Technology — D:WINDOWS.0System32appdrvrem01.exe
O23 — Service: Ati HotKey Poller — ATI Technologies Inc. — D:WINDOWS.0system32Ati2evxx.exe
O23 — Service: ATI Smart — Unknown owner — D:WINDOWS.0system32ati2sgag.exe
O23 — Service: Kaspersky Anti-Virus (AVP) — Kaspersky Lab — D:Program FilesKaspersky LabKaspersky Anti-Virus 2010avp.exe
O23 — Service: ES lite Service for program management. (ES lite Service) — Unknown owner — D:Program FilesGigabyteEasySaverESSVR.EXE
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — D:WINDOWS.0system32services.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — D:WINDOWS.0system32imapi.exe
O23 — Service: InCD Helper (InCDsrvR) — Nero AG — D:Program FilesNeroNero8InCDInCDsrv.exe
O23 — Service: Nero Registry InCD Service (NeroRegInCDSrv) — Nero AG — D:Program FilesNeroNero8InCDNBHRegInCDSrv.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — D:WINDOWS.0system32services.exe
O23 — Service: PnkBstrA — Unknown owner — D:WINDOWS.0system32PnkBstrA.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — D:WINDOWS.0system32sessmgr.exe
O23 — Service: Cyberlink RichVideo Service(CRVS) (RichVideo) — Unknown owner — D:Program FilesCyberLinkShared FilesRichVideo.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — D:WINDOWS.0System32SCardSvr.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — D:WINDOWS.0system32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — D:WINDOWS.0System32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — D:WINDOWS.0system32wbemwmiapsrv.exe

—
End of file — 11005 bytes

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{02478D38-C3F9-4efb-9B51-7695ECA05670}]
Yahoo! Companion BHO — D:Program FilesYahoo!CompanionInstallscpn0ycomp5_6_2_0.dll [2005-04-22 328275]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper — D:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll [2006-10-23 62080]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class — D:Program FilesKaspersky LabKaspersky Anti-Virus 2010ievkbd.dll [2009-10-20 68112]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper — D:Program FilesJavajre6binssv.dll [2010-01-28 320920]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{8984B388-A5BB-4DF7-B274-77B879E179DB}]
MailRuBHO Class — d:program filesmail.rusputnikMailRuSputnik.dll [2010-03-03 1029296]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper — D:Program FilesJavajre6binjp2ssv.dll [2010-01-28 34816]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{E33CF602-D945-461A-83F0-819F76A199F8}]
FilterBHO Class — D:Program FilesKaspersky LabKaspersky Anti-Virus 2010klwtbbho.dll [2009-10-20 268816]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class — D:Program FilesJavajre6libdeployjqsiejqs_plugin.dll [2010-01-28 73728]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} — &Yahoo! Companion — D:Program FilesYahoo!CompanionInstallscpn0ycomp5_6_2_0.dll [2005-04-22 328275]
{CCC7A320-B3CA-4199-B1A6-9F516DD69829}
{09900DE8-1DCA-443F-9243-26FF581438AF} — Спутник@Mail.Ru — d:program filesmail.rusputnikMailRuSputnik.dll [2010-03-03 1029296]
{91397D20-1446-11D4-8AF4-0040CA1127B6} — Яндекс.Бар — D:Program FilesYandexYandexBarIEyndbar.dll [2009-12-24 8729864]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«StartCCC»=D:Program FilesATI TechnologiesATI.ACECore-StaticCLIStart.exe [2008-08-29 61440]
«RTHDCPL»=D:WINDOWS.0RTHDCPL.EXE [2009-01-13 18084864]
«Alcmtr»=D:WINDOWS.0ALCMTR.EXE [2008-06-19 57344]
«UpdateLBPShortCut»=D:Program FilesCyberLinkLabelPrintMUITransferMUIStartMenu.exe [2008-12-04 218408]
«RemoteControl»=D:Program FilesCyberLinkPowerDVDPDVDServ.exe [2007-03-15 71216]
«LanguageShortcut»=D:Program FilesCyberLinkPowerDVDLanguageLanguage.exe [2007-01-09 52256]
«UCam_Menu»=D:Program FilesCyberLinkYouCamMUITransferMUIStartMenu.exe [2008-12-04 218408]
«NeroFilterCheck»=D:WINDOWS.0system32NeroCheck.exe [2006-01-12 155648]
«LGODDFU»=D:Program Fileslg_fwupdatefwupdate.exe [2008-10-01 548864]
«SecurDisc»=D:Program FilesNeroNero8InCDNBHGui.exe [2008-02-28 2049320]
«UpdatePSTShortCut»=D:Program FilesCyberLinkDVD SuiteMUITransferMUIStartMenu.exe [2009-05-07 210216]
«ioCentre»=D:GeniusioCentregTaskBar.exe [2006-12-09 241664]
«Adobe Reader Speed Launcher»=D:Program FilesAdobeReader 8.0ReaderReader_sl.exe [2007-05-11 40048]
«»= []
«Lingvo Launcher»=D:Program FilesABBYY Lingvo 12Lvagent.exe [2006-12-13 258048]
«MAgent»=D:Program FilesMail.RuAgentMAgent.exe [2010-03-03 8746680]
«AVP»=D:Program FilesKaspersky LabKaspersky Anti-Virus 2010avp.exe [2009-10-20 340456]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=D:WINDOWS.0system32ctfmon.exe [2008-10-25 30208]
«VistaIcon»=D:Program FilesVistaDriveIconVistaDrv.exe [2008-01-02 132096]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWindows]
«AppInit_DLLS»=»D:PROGRA~1KASPER~1KASPER~1mzvkbd3.dll»

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyAtiExtEvent]
D:WINDOWS.0system32Ati2evxx.dll [2008-12-02 143360]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyklogon]
D:WINDOWS.0system32klogon.dll [2009-10-20 219664]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — D:WINDOWS.0system32wpdshserviceobj.dll [2008-03-02 133632]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=145
«NoSharedDocuments»=1
«NoSMConfigurePrograms»=1

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«D:Program FilesElectronic ArtsEADMCore.exe»=»D:Program FilesElectronic ArtsEADMCore.exe:*:Enabled:EA Download Manager»
«D:Program FilesGarenaGarena.exe»=»D:Program FilesGarenaGarena.exe:*:Enabled:Garena»
«D:Program FilesOperaopera.exe»=»D:Program FilesOperaopera.exe:*:Enabled:Opera Internet Browser»
«D:Program FilesuTorrentuTorrent.exe»=»D:Program FilesuTorrentuTorrent.exe:*:Enabled:µTorrent»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»

======List of files/folders created in the last 1 months======

2010-03-05 18:27:58 —-D—- D:rsit
2010-03-05 18:27:58 —-D—- D:Program Filestrend micro
2010-03-05 18:19:35 —-D—- D:WINDOWS.0system32SoftwareDistribution
2010-03-05 18:19:31 —-D—- D:WINDOWS.0LastGood
2010-03-05 17:11:49 —-D—- D:Documents and SettingsMazApplication DataDivX
2010-03-05 17:11:30 —-D—- D:Documents and SettingsMazApplication DataMedia Player Classic
2010-03-05 17:08:14 —-D—- D:Documents and SettingsMazApplication DataAIMP
2010-03-05 15:59:07 —-SHD—- D:Config.Msi
2010-03-05 15:49:07 —-D—- D:Documents and SettingsMazApplication DataWinRAR
2010-03-05 13:02:31 —-D—- D:Documents and SettingsMazApplication DataMacromedia
2010-03-05 13:02:31 —-D—- D:Documents and SettingsMazApplication DataAdobe
2010-03-05 12:53:40 —-D—- D:Documents and SettingsMazApplication DataMozilla
2010-03-05 12:26:29 —-D—- D:Documents and SettingsMazApplication DatauTorrent
2010-03-05 12:22:22 —-D—- D:Documents and SettingsMazApplication DataCorel
2010-03-05 12:21:08 —-D—- D:Documents and SettingsMazApplication DataMRA
2010-03-05 12:20:46 —-D—- D:Documents and SettingsMazApplication DataATI
2010-03-05 12:20:07 —-D—- D:Documents and SettingsMazApplication DataIdentities
2010-03-05 12:19:46 —-ASH—- D:Documents and SettingsMazApplication Datadesktop.ini
2010-03-05 12:19:45 —-SD—- D:Documents and SettingsMazApplication DataMicrosoft
2010-03-05 12:19:44 —-D—- D:Documents and SettingsMazApplication DataSun
2010-03-05 03:21:41 —-A—- D:WINDOWS.0system32unrar.dll
2010-03-05 03:21:41 —-A—- D:WINDOWS.0system32rmoc3260.dll
2010-03-05 03:21:41 —-A—- D:WINDOWS.0system32pndx5032.dll
2010-03-05 03:21:41 —-A—- D:WINDOWS.0system32pndx5016.dll
2010-03-05 03:21:41 —-A—- D:WINDOWS.0system32pncrt.dll
2010-03-05 03:21:40 —-A—- D:WINDOWS.0avisplitter.ini
2010-03-05 03:21:39 —-A—- D:WINDOWS.0system32yv12vfw.dll
2010-03-05 03:21:39 —-A—- D:WINDOWS.0system32xvidvfw.dll
2010-03-05 03:21:39 —-A—- D:WINDOWS.0system32xvidcore.dll
2010-03-05 03:21:39 —-A—- D:WINDOWS.0system32qt-dx331.dll
2010-03-05 03:21:39 —-A—- D:WINDOWS.0system32dpl100.dll
2010-03-05 03:21:39 —-A—- D:WINDOWS.0system32divx.dll
2010-03-05 03:21:38 —-A—- D:WINDOWS.0system32ff_vfw.dll.manifest
2010-03-05 03:21:38 —-A—- D:WINDOWS.0system32ff_vfw.dll
2010-03-04 04:13:10 —-D—- D:Documents and SettingsAll Users.WINDOWS.0Application DataYandex
2010-03-04 04:13:07 —-D—- D:Program FilesYandex
2010-03-04 04:12:33 —-D—- D:Program FilesuTorrent
2010-03-03 20:26:27 —-D—- D:Program FilesKaspersky Lab
2010-03-03 20:26:27 —-D—- D:Documents and SettingsAll Users.WINDOWS.0Application DataKaspersky Lab
2010-03-03 20:25:05 —-D—- D:Documents and SettingsAll Users.WINDOWS.0Application DataKaspersky Lab Setup Files
2010-03-03 20:22:52 —-D—- D:Program FilesMail.Ru
2010-03-02 14:53:33 —-D—- D:Program FilesGarena
2010-03-02 12:36:22 —-HD—- D:$AVG
2010-03-02 12:35:49 —-D—- D:Program FilesAVG
2010-03-02 12:35:47 —-D—- D:Documents and SettingsAll Users.WINDOWS.0Application Dataavg9
2010-03-02 11:28:33 —-D—- D:Program FilesMozilla Firefox
2010-03-02 10:41:54 —-D—- D:Program FilesOpera
2010-02-25 18:03:25 —-D—- D:Program FilesCS16
2010-02-19 21:47:33 —-A—- D:WINDOWS.0capture.ini
2010-02-19 21:30:52 —-D—- D:Program FilesCommon FilesCorel
2010-02-19 21:30:20 —-D—- D:Program FilesCorel
2010-02-19 05:25:32 —-D—- D:WINDOWS.0Sun
2010-02-15 00:56:53 —-D—- D:Documents and SettingsAll Users.WINDOWS.0Application DataElectronic Arts
2010-02-14 22:22:01 —-A—- D:WINDOWS.0system32ptpusd.dll
2010-02-14 22:22:01 —-A—- D:WINDOWS.0system32ptpusb.dll
2010-02-14 22:17:19 —-D—- D:Documents and SettingsAll Users.WINDOWS.0Application DataDAEMON Tools Lite
2010-02-14 21:53:17 —-D—- D:WINDOWS.0Logs
2010-02-07 15:34:19 —-A—- D:WINDOWS.0system32appdrvrem01.exe
2010-02-06 22:02:02 —-A—- D:WINDOWS.0ModemLog_LGE CDMA USB Modem #3.txt

======List of files/folders modified in the last 1 months======

2010-03-05 18:27:58 —-AD—- D:Program Files
2010-03-05 18:19:40 —-RSHDC—- D:WINDOWS.0system32dllcache
2010-03-05 18:19:37 —-D—- D:WINDOWS.0Temp
2010-03-05 18:19:36 —-AD—- D:WINDOWS.0system32
2010-03-05 18:19:35 —-HD—- D:WINDOWS.0inf
2010-03-05 18:19:35 —-D—- D:WINDOWS.0Help
2010-03-05 18:19:33 —-D—- D:WINDOWS.0system32CatRoot2
2010-03-05 18:19:31 —-D—- D:WINDOWS.0
2010-03-05 18:18:00 —-D—- D:WINDOWS.0SoftwareDistribution
2010-03-05 17:40:15 —-A—- D:WINDOWS.0system32PerfStringBackup.INI
2010-03-05 17:36:36 —-D—- D:Program Fileslg_fwupdate
2010-03-05 17:36:34 —-A—- D:WINDOWS.0lgfwup.ini
2010-03-05 17:34:22 —-A—- D:WINDOWS.0SchedLgU.Txt
2010-03-05 17:13:06 —-A—- D:WINDOWS.0NeroDigital.ini
2010-03-05 17:09:07 —-D—- D:Program FilesAIMP2
2010-03-05 16:38:11 —-SHD—- D:System Volume Information
2010-03-05 16:01:09 —-D—- D:WINDOWS.0system32CatRoot
2010-03-05 16:00:32 —-SHD—- D:WINDOWS.0Installer
2010-03-05 16:00:23 —-D—- D:WINDOWS.0system32drivers
2010-03-05 15:53:39 —-SHD—- D:RECYCLER
2010-03-05 12:29:49 —-A—- D:WINDOWS.0OEWABLog.txt
2010-03-05 12:29:36 —-D—- D:Documents and Settings
2010-03-05 03:22:09 —-D—- D:Program FilesK-Lite Codec Pack
2010-03-05 03:14:44 —-A—- D:WINDOWS.0setuplog.txt
2010-03-02 14:33:44 —-HD—- D:Program FilesInstallShield Installation Information
2010-03-02 12:23:14 —-D—- D:WINDOWS.0WinSxS
2010-03-02 00:34:56 —-A—- D:WINDOWS.0ModemLog_LGE CDMA USB Modem #2.txt
2010-02-24 02:07:49 —-A—- D:WINDOWS.0ModemLog_LGE CDMA USB Modem.txt
2010-02-22 08:25:51 —-A—- D:WINDOWS.0system32PnkBstrB.exe
2010-02-20 07:58:33 —-D—- D:WINDOWS.0system32appmgmt
2010-02-20 07:58:28 —-D—- D:Program FilesElectronic Arts
2010-02-19 21:31:00 —-RSD—- D:WINDOWS.0Fonts
2010-02-19 21:30:52 —-AD—- D:Program FilesCommon Files
2010-02-19 21:30:47 —-D—- D:Program FilesCommon FilesInstallShield
2010-02-19 07:24:07 —-D—- D:Program FilesCoD6
2010-02-14 22:14:01 —-SD—- D:Documents and SettingsAll Users.WINDOWS.0Application DataMicrosoft
2010-02-14 21:54:14 —-D—- D:WINDOWS.0system32DirectX

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 appdrv01;Application Driver (01); D:WINDOWS.0System32Driversappdrv01.sys [2010-02-07 2915944]
R1 InCDPass;Nero InCDPass; D:WINDOWS.0system32driversInCDPass.sys [2008-02-28 38952]
R1 incdrm;Nero InCD MRW Remapper; D:WINDOWS.0system32driversInCDRm.sys [2008-02-28 40360]
R1 intelppm;Драйвер Intel процессора; D:WINDOWS.0system32DRIVERSintelppm.sys [2008-04-15 40704]
R1 kl1;Kl1; ??D:WINDOWS.0system32driverskl1.sys []
R1 KLIF;Kaspersky Lab Driver; D:WINDOWS.0system32DRIVERSklif.sys [2009-11-11 315408]
R2 rspndr;Ответчик обнаружения топологии уровня связи; D:WINDOWS.0system32DRIVERSrspndr.sys [2008-10-11 62848]
R3 ati2mtag;ati2mtag; D:WINDOWS.0system32DRIVERSati2mtag.sys [2008-12-02 3452928]
R3 AtiHdmiService;ATI Function Driver for HDMI Service; D:WINDOWS.0system32driversAtiHdmi.sys [2008-11-01 93184]
R3 gdrv;gdrv; ??D:WINDOWS.0gdrv.sys []
R3 gMouPS2;PS2 Scroll Mouse Device; D:WINDOWS.0system32DRIVERSgMouPS2.sys [2006-07-12 17408]
R3 HDAudBus;Драйвер шины Microsoft UAA для High Definition Audio; D:WINDOWS.0system32DRIVERSHDAudBus.sys [2008-04-15 144384]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); D:WINDOWS.0system32driversRtkHDAud.sys [2009-01-20 5027840]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; D:WINDOWS.0system32DRIVERSklim5.sys [2009-09-14 32272]
R3 klmouflt;Kaspersky Lab KLMOUFLT; D:WINDOWS.0system32DRIVERSklmouflt.sys [2009-10-02 19472]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller; D:WINDOWS.0system32DRIVERSl1c51x86.sys [2009-03-31 39424]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; D:WINDOWS.0system32DRIVERSusbehci.sys [2008-04-15 30208]
R3 usbhub;USB2 концентратор; D:WINDOWS.0system32DRIVERSusbhub.sys [2008-04-14 59520]
R3 usbstor;Драйвер запоминающих устройств для USB; D:WINDOWS.0system32DRIVERSUSBSTOR.SYS [2008-04-15 26368]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; D:WINDOWS.0system32DRIVERSusbuhci.sys [2008-04-14 20608]
R4 InCDfs;Nero InCD File System; D:WINDOWS.0system32driversInCDFs.sys [2008-02-28 128424]
S3 GarenaPEngine;GarenaPEngine; ??D:DOCUME~1AdminLOCALS~1TempBTH366.tmp []
S3 RTHDMIAzAudService;Service for HDMI; D:WINDOWS.0system32driversRtHDMI.sys [2007-05-14 3526464]
S3 usbbus;LGE CDMA Composite USB Device; D:WINDOWS.0system32DRIVERSlgusbbus.sys [2006-06-20 21312]
S3 UsbDiag;LGE CDMA USB Serial Port; D:WINDOWS.0system32DRIVERSlgusbdiag.sys [2006-06-20 38144]
S3 USBModem;LGE CDMA USB Modem; D:WINDOWS.0system32DRIVERSlgusbmodem.sys [2006-06-20 39248]
S3 usbscan;Драйвер USB-сканера; D:WINDOWS.0system32DRIVERSusbscan.sys [2008-04-14 15104]
S3 WudfPf;Windows Driver Foundation — User-mode Driver Framework Platform Driver; D:WINDOWS.0system32DRIVERSWudfPf.sys [2008-03-02 77568]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; D:WINDOWS.0system32DRIVERSwudfrd.sys [2008-03-02 82944]
S4 IntelIde;IntelIde; D:WINDOWS.0system32driversIntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; D:WINDOWS.0system32Ati2evxx.exe [2008-12-02 598016]
R2 AVP;Kaspersky Anti-Virus; D:Program FilesKaspersky LabKaspersky Anti-Virus 2010avp.exe [2009-10-20 340456]
R2 ES lite Service;ES lite Service for program management.; D:Program FilesGigabyteEasySaverESSVR.EXE [2009-03-02 68136]
R2 InCDsrvR;InCD Helper; D:Program FilesNeroNero8InCDInCDsrv.exe [2008-02-28 1440552]
R2 MDM;Machine Debug Manager; D:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE [2003-06-20 322120]
R2 NeroRegInCDSrv;Nero Registry InCD Service; D:Program FilesNeroNero8InCDNBHRegInCDSrv.exe [2008-02-28 53032]
R2 PnkBstrA;PnkBstrA; D:WINDOWS.0system32PnkBstrA.exe [2010-01-30 66872]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); D:Program FilesCyberLinkShared FilesRichVideo.exe [2007-05-14 272024]
S1 InCDRec;Nero InCD File System Recognizer; D:WINDOWS.0system32driversInCDRec.sys [2008-02-28 17448]
S2 appdrvrem01;Application Driver Auto Removal Service (01); D:WINDOWS.0System32appdrvrem01.exe [2010-02-07 304528]
S2 ATI Smart;ATI Smart; D:WINDOWS.0system32ati2sgag.exe [2008-12-01 593920]
S3 aspnet_state;ASP.NET State Service; D:WINDOWS.0Microsoft.NETFrameworkv2.0.50727aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; D:WINDOWS.0Microsoft.NETFrameworkv2.0.50727mscorsvw.exe [2007-10-24 70144]
S3 ose;Office Source Engine; D:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2003-07-28 89136]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; D:Program FilesWindows Media Playerwmpnetwk.exe [2006-10-19 913408]
S3 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; D:WINDOWS.0system32svchost.exe [2008-04-15 14336]
S4 JavaQuickStarterService;Java Quick Starter; D:Program FilesJavajre6binjqs.exe [2010-01-28 152984]

EOF

SOS. Help plz
заранее спасибо.
5 марта, 2010 в 6:00 пп #28931
Admin
Keymaster
- Темы:40
- Сообщений:5676
Здравствуйте, добро пожаловать на Spyware-ru форум.

Необходимо выполнить дополнительную проверку.
Скачайте программу Combofix. Закройте все открытые окна и запустите эту программу.
После выполнения будет создан лог файл, пожалуйста вставьте его в ваш ответ.

Примечание: перед использованием Combofix обязательно установите Recovery console. Как это сделать будет описано на странице, ссылку на которую я привёл выше.
6 марта, 2010 в 6:57 дп #28932
Mazya
Participant
- Темы:1
- Сообщений:2
Здравствуйте Valeri.
просканировал комп.
вот результаты:
ComboFix 10-03-05.03 — Maz 06.03.2010 12:35:55.1.2 — x86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.2046.1665 [GMT 6:00]
Running from: d:documents and settingsMazРабочий столComboFix.exe
AV: Антивирус Касперского *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

d:documents and settingsAll Users.WINDOWS.0Application DataMicrosoftNetworkDownloaderqmgr0.dat
d:documents and settingsAll Users.WINDOWS.0Application DataMicrosoftNetworkDownloaderqmgr1.dat
d:program filesINSTALL.LOG
d:program filesMail.RuAgentMradllnewmrasearch.dll
d:recyclerS-1-5-21-789336058-1844823847-682003330-1003
d:windows.0Delete.bat
d:windows.0system32Пузыри.scr
d:windows.0system32ssField Lines.scr
d:windows.0system32ssRibbons.scr
d:windows.0system32SYSINTERNALS_BLUESCREEN.SCR
d:windows.0system32Vb40016.dll
d:windows.0system32Vb40032.dll
d:windows.0system32VB6KO.DLL
d:windows.0system32vbrun100.dll

BITS: Possible infected sites

hxxp://soft.export.yandex.ru
.
((((((((((((((((((((((((( Files Created from 2010-02-06 to 2010-03-06 )))))))))))))))))))))))))))))))
.

2010-03-05 22:04 . 2010-03-05 22:04

d

w- d:documents and settingsMazLocal SettingsApplication DataABBYY
2010-03-05 16:01 . 2010-03-05 20:37

d

w- d:documents and settingsEmelyaApplication DatauTorrent
2010-03-05 14:22 . 2010-03-05 14:31

d

w- d:documents and settingsEmelyaApplication DataAIMP
2010-03-05 13:59 . 2010-03-05 13:59

d

w- d:documents and settingsEmelyaApplication DataCorel
2010-03-05 13:57 . 2010-03-05 13:57

d

w- d:documents and settingsEmelyaLocal SettingsApplication DataMozilla
2010-03-05 13:55 . 2010-03-05 13:55

d

w- d:documents and settingsEmelyaApplication DataCyberLink
2010-03-05 13:09 . 2010-03-05 13:09

d

w- d:documents and settingsEmelyaLocal SettingsApplication DataOpera
2010-03-05 13:06 . 2008-07-09 07:58 26488 —-a-w- d:windows.0system32spupdsvc.exe
2010-03-05 13:05 . 2007-04-09 10:23 28552 —-a-w- d:windows.0system32Spoolprtprocsw32x86mdippr.dll
2010-03-05 13:05 . 2007-04-09 10:23 28040 —-a-w- d:windows.0system32mdimon.dll
2010-03-05 12:57 . 2010-03-05 12:57

d

w- d:program filesMSXML 4.0
2010-03-05 12:54 . 2010-03-05 21:01

d—h—w- d:windows.0$hf_mig$
2010-03-05 12:41 . 2009-06-15 10:45 79872 -c—-w- d:windows.0system32dllcachetelnet.exe
2010-03-05 12:41 . 2009-12-08 09:25 474112 -c—-w- d:windows.0system32dllcacheshlwapi.dll
2010-03-05 12:40 . 2009-11-27 17:13 17920 -c—-w- d:windows.0system32dllcachemsyuv.dll
2010-03-05 12:40 . 2009-11-27 17:13 1293312 -c—-w- d:windows.0system32dllcachequartz.dll
2010-03-05 12:40 . 2009-11-27 16:09 8704 -c—-w- d:windows.0system32dllcachetsbyuv.dll
2010-03-05 12:40 . 2009-11-27 16:09 48128 -c—-w- d:windows.0system32dllcacheiyuv_32.dll
2010-03-05 12:33 . 2009-12-04 18:22 455424 -c—-w- d:windows.0system32dllcachemrxsmb.sys
2010-03-05 12:29 . 2009-08-04 17:23 2147328 -c—-w- d:windows.0system32dllcachentkrnlmp.exe
2010-03-05 12:29 . 2009-08-04 17:23 2191104 -c—-w- d:windows.0system32dllcachentoskrnl.exe
2010-03-05 12:29 . 2009-08-04 17:23 2025984 -c—-w- d:windows.0system32dllcachentkrpamp.exe
2010-03-05 12:29 . 2009-07-31 04:35 1172480 -c—-w- d:windows.0system32dllcachemsxml3.dll
2010-03-05 12:28 . 2008-04-21 21:15 218624 -c—-w- d:windows.0system32dllcachewordpad.exe
2010-03-05 12:27 . 2010-03-05 12:46

d

w- d:program filestrend micro
2010-03-05 12:27 . 2010-03-05 12:28

d

w- D:rsit
2010-03-05 11:14 . 2010-03-05 11:14 80400 —-a-w- d:documents and settingsAll Users.WINDOWS.0Application DataKaspersky LabAVP9DataUpdaterTemporary FilesrollbackpatchAutoPatcheskav9exec9.0.0.736fssync.dll
2010-03-05 11:14 . 2010-03-05 11:14 80400 —-a-w- d:documents and settingsAll Users.WINDOWS.0Application DataKaspersky LabAVP9DataUpdaterTemporary FilestemporaryFolderAutoPatcheskav9exec9.0.0.736fssync.dll
2010-03-05 11:11 . 2010-03-05 11:11

d

w- d:documents and settingsMazApplication DataDivX
2010-03-05 11:11 . 2010-03-05 11:11

d

w- d:documents and settingsMazApplication DataMedia Player Classic
2010-03-05 11:08 . 2010-03-06 06:04

d

w- d:documents and settingsMazApplication DataAIMP
2010-03-05 06:53 . 2010-03-05 06:53

d

w- d:documents and settingsMazLocal SettingsApplication DataMozilla
2010-03-05 06:26 . 2010-03-05 06:30

d

w- d:documents and settingsMazApplication DatauTorrent
2010-03-05 06:22 . 2010-03-05 06:22

d

w- d:documents and settingsMazApplication DataCorel
2010-03-05 06:21 . 2010-03-05 20:41 65360 —-a-w- d:documents and settingsMazLocal SettingsApplication DataGDIPFONTCACHEV1.DAT
2010-03-05 06:21 . 2010-03-05 11:14

d

w- d:documents and settingsMazApplication DataMRA
2010-03-05 06:19 . 2010-01-28 20:20

d

r- d:documents and settingsMazГлавное меню
2010-03-05 06:19 . 2010-01-28 17:28

d—h—w- d:documents and settingsMazШаблоны
2010-03-05 06:19 . 2010-03-05 06:19

d

w- d:documents and settingsMaz
2010-03-04 21:21 . 2009-12-12 14:15 178176 —-a-w- d:windows.0system32unrar.dll
2010-03-04 21:21 . 2009-07-14 00:15 90112 —-a-w- d:windows.0system32dpl100.dll
2010-03-04 21:21 . 2009-07-14 00:15 685056 —-a-w- d:windows.0system32divx.dll
2010-03-04 21:21 . 2009-05-29 21:37 205824 —-a-w- d:windows.0system32xvidvfw.dll
2010-03-04 21:21 . 2009-05-29 21:31 881664 —-a-w- d:windows.0system32xvidcore.dll
2010-03-04 21:21 . 2008-11-06 16:37 3596288 —-a-w- d:windows.0system32qt-dx331.dll
2010-03-04 21:21 . 2004-01-25 16:18 217088 —-a-w- d:windows.0system32yv12vfw.dll
2010-03-04 21:21 . 2010-02-02 18:00 85504 —-a-w- d:windows.0system32ff_vfw.dll
2010-03-03 22:13 . 2010-03-03 22:13

d

w- d:documents and settingsAdminLocal SettingsApplication DataYandex
2010-03-03 22:13 . 2010-03-03 22:13

d

w- d:documents and settingsAll Users.WINDOWS.0Application DataYandex
2010-03-03 22:13 . 2010-03-04 15:03

d

w- d:documents and settingsAdminApplication DataYandex
2010-03-03 22:13 . 2010-03-03 22:13

d

w- d:program filesYandex
2010-03-03 22:13 . 2010-03-03 22:13

d

w- d:documents and settingsAdminLocal SettingsApplication DataGoogle
2010-03-03 22:12 . 2010-03-05 16:01

d

w- d:program filesuTorrent
2010-03-03 22:12 . 2010-03-05 06:17

d

w- d:documents and settingsAdminApplication DatauTorrent
2010-03-03 14:26 . 2010-03-03 14:26 95259 —-a-w- d:windows.0system32driversklick.dat
2010-03-03 14:26 . 2010-03-03 14:26 108059 —-a-w- d:windows.0system32driversklin.dat
2010-03-03 14:26 . 2010-03-06 06:45

d

w- d:documents and settingsAll Users.WINDOWS.0Application DataKaspersky Lab
2010-03-03 14:26 . 2010-03-03 14:26

d

w- d:program filesKaspersky Lab
2010-03-03 14:25 . 2010-03-03 14:25

d

w- d:documents and settingsAll Users.WINDOWS.0Application DataKaspersky Lab Setup Files
2010-03-03 14:22 . 2010-03-03 16:35

d

w- d:documents and settingsAdminApplication DataMra
2010-03-03 14:22 . 2010-03-03 14:22

d

w- d:program filesMail.Ru
2010-03-03 12:42 . 2010-03-03 12:42

d

w- d:documents and settingsAdminApplication DataAVG8
2010-03-02 08:53 . 2010-03-05 22:05

d

w- d:program filesGarena
2010-03-02 06:36 . 2010-03-02 06:36

d

w- D:$AVG
2010-03-02 06:35 . 2010-03-02 06:35

d

w- d:program filesAVG
2010-03-02 06:35 . 2010-03-02 09:51

d

w- d:documents and settingsAll Users.WINDOWS.0Application Dataavg9
2010-03-02 05:28 . 2010-03-02 05:28 0 —-a-w- d:windows.0nsreg.dat
2010-03-02 05:28 . 2010-03-02 05:28

d

w- d:documents and settingsAdminLocal SettingsApplication DataMozilla
2010-03-02 04:41 . 2010-03-02 04:41

d

w- d:documents and settingsAdminLocal SettingsApplication DataOpera
2010-03-02 04:41 . 2010-03-02 04:41

d

w- d:program filesOpera
2010-02-25 12:03 . 2010-03-03 12:22

d

w- d:program filesCS16
2010-02-19 15:47 . 2010-02-19 15:47

d

w- d:documents and settingsAdminApplication DataCorel
2010-02-19 15:30 . 2010-02-19 15:30

d

w- d:program filesCommon FilesCorel
2010-02-19 15:30 . 2010-02-19 15:30

d

w- d:program filesCorel
2010-02-19 14:41 . 2007-10-23 06:27 110592 —-a-w- d:documents and settingsAdminApplication DataU3tempcleanup.exe
2010-02-19 14:41 . 2007-10-23 06:22 3350528 —ha-w- d:documents and settingsAdminApplication DataU3tempLaunchpad Removal.exe
2010-02-19 14:41 . 2010-02-20 17:19

d

w- d:documents and settingsAdminApplication DataU3
2010-02-18 23:25 . 2010-02-18 23:25

d

w- d:windows.0Sun
2010-02-14 18:56 . 2010-02-14 18:56

d

w- d:documents and settingsAll Users.WINDOWS.0Application DataElectronic Arts
2010-02-14 16:22 . 2008-04-14 18:40 159232 —-a-w- d:windows.0system32ptpusd.dll
2010-02-14 16:22 . 2008-04-13 21:15 15104 -c—a-w- d:windows.0system32dllcacheusbscan.sys
2010-02-14 16:22 . 2008-04-13 21:15 15104 —-a-w- d:windows.0system32driversusbscan.sys
2010-02-14 16:22 . 2001-10-19 18:06 5632 —-a-w- d:windows.0system32ptpusb.dll
2010-02-14 16:17 . 2010-02-14 16:17

d

w- d:documents and settingsAll Users.WINDOWS.0Application DataDAEMON Tools Lite
2010-02-14 15:53 . 2010-02-14 15:53

d

w- d:windows.0Logs
2010-02-07 09:34 . 2010-02-07 09:34 2915944 —-a-w- d:windows.0system32driversappdrv01.sys
2010-02-07 09:34 . 2010-02-07 09:34 304528 —-a-w- d:windows.0system32appdrvrem01.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-06 06:46 . 2008-04-15 12:00 76880 —-a-w- d:windows.0system32perfc019.dat
2010-03-06 06:46 . 2008-04-15 12:00 448696 —-a-w- d:windows.0system32perfh019.dat
2010-03-06 06:45 . 2010-01-28 21:05

d

w- d:program fileslg_fwupdate
2010-03-06 06:43 . 2010-01-28 21:19 17488 —-a-w- d:windows.0gdrv.sys
2010-03-06 06:26 . 2010-01-28 21:23

d

w- d:program filesdistr
2010-03-05 13:37 . 2010-03-05 06:29

d

w- d:documents and settingsEmelyaApplication DataMRA
2010-03-05 13:09 . 2010-03-05 06:29 65360 —-a-w- d:documents and settingsEmelyaLocal SettingsApplication DataGDIPFONTCACHEV1.DAT
2010-03-05 11:09 . 2009-12-29 10:46

d

w- d:program filesAIMP2
2010-03-05 06:29 . 2010-03-05 06:29

d

w- d:documents and settingsEmelyaApplication DataATI
2010-03-05 06:20 . 2010-03-05 06:20

d

w- d:documents and settingsMazApplication DataATI
2010-03-05 05:56 . 2010-01-30 15:40

d

w- d:documents and settingsAdminApplication DataAIMP
2010-03-04 21:22 . 2010-01-15 15:12

d

w- d:program filesK-Lite Codec Pack
2010-03-02 08:33 . 2009-12-29 10:29

d—h—w- d:program filesInstallShield Installation Information
2010-02-22 02:25 . 2010-01-30 14:12 138184 —-a-w- d:windows.0system32driversPnkBstrK.sys
2010-02-22 02:25 . 2010-01-30 14:12 183112 —-a-w- d:windows.0system32PnkBstrB.exe
2010-02-20 01:58 . 2009-12-30 08:57

d

w- d:program filesElectronic Arts
2010-02-19 15:47 . 2010-01-28 19:03 65360 —-a-w- d:documents and settingsAdminLocal SettingsApplication DataGDIPFONTCACHEV1.DAT
2010-02-19 15:30 . 2009-12-29 10:28

d

w- d:program filesCommon FilesInstallShield
2010-02-19 01:24 . 2009-12-29 10:43

d

w- d:program filesCoD6
2010-02-02 05:45 . 2010-01-28 19:19

d

w- d:program filesLight Alloy
2010-01-30 19:43 . 2010-01-28 17:32 86339 —-a-w- d:windows.0pchealthhelpctrOfflineCacheindex.dat
2010-01-30 15:15 . 2010-01-30 15:15

d

w- d:documents and settingsAdminApplication DataNero
2010-01-30 15:14 . 2010-01-30 15:14

d

w- d:program filesAhead
2010-01-30 15:14 . 2010-01-30 15:14

d

w- d:program filesCommon FilesAhead
2010-01-30 14:12 . 2010-01-30 14:12 66872 —-a-w- d:windows.0system32PnkBstrA.exe
2010-01-29 10:14 . 2010-01-29 10:14

d

w- d:program filesDirectX
2010-01-29 10:08 . 2010-01-29 10:08

d

w- d:documents and settingsAdminApplication DataeCity2_1
2010-01-28 21:59 . 2010-01-28 21:59

d

w- d:documents and settingsAdminApplication DataMedia Player Classic
2010-01-28 21:54 . 2010-01-28 21:49

d

w- d:program filesABBYY Lingvo 12
2010-01-28 21:51 . 2010-01-28 21:51

d

w- d:documents and settingsAll Users.WINDOWS.0Application DataABBYY
2010-01-28 21:41 . 2010-01-28 20:59

d

w- d:documents and settingsAdminApplication DataCyberLink
2010-01-28 21:30 . 2010-01-28 20:57

d

w- d:documents and settingsAll Users.WINDOWS.0Application DataCyberLink
2010-01-28 21:27 . 2010-01-28 21:27

d

w- d:program filesCommon FilesAdobe
2010-01-28 21:14 . 2010-01-28 21:14 53319 —-a-w- d:documents and settingsAll Users.WINDOWS.0Application DataTemp{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}PostBuild.exe
2010-01-28 21:13 . 2010-01-28 21:13

d

w- d:documents and settingsAll Users.WINDOWS.0Application DataNorton
2010-01-28 21:12 . 2010-01-28 21:12

d

w- d:documents and settingsAll Users.WINDOWS.0Application DataNortonInstaller
2010-01-28 21:03 . 2010-01-28 21:03

d

w- d:program filesNero
2010-01-28 21:03 . 2010-01-28 21:03

d

w- d:documents and settingsAll Users.WINDOWS.0Application DataNero
2010-01-28 21:01 . 2010-01-28 21:01 36864 —-a-w- d:documents and settingsAll Users.WINDOWS.0Application DataTemp{01FB4998-33C4-4431-85ED-079E3EEFE75D}PostBuild.exe
2010-01-28 20:56 . 2010-01-28 20:56

d

w- d:documents and settingsAll Users.WINDOWS.0Application DataTemp
2010-01-28 20:56 . 2010-01-28 20:56 53319 —-a-w- d:documents and settingsAll Users.WINDOWS.0Application DataTemp{5DB1DF0C-AABC-4362-8A6D-CEFDFB036E41}PostBuild.exe
2010-01-28 19:59 . 2010-01-28 19:59 8854 —-a-r- d:documents and settingsAdminApplication DataMicrosoftInstaller{8FE4D086-63BD-44EB-882C-C7EA5A1EF016}UNINST_Uninstall_Gam_8FE4D08663BD44EB882CC7EA5A1EF016.exe
2010-01-28 19:59 . 2010-01-28 19:59 40960 —-a-r- d:documents and settingsAdminApplication DataMicrosoftInstaller{8FE4D086-63BD-44EB-882C-C7EA5A1EF016}NewShortcut1_8FE4D08663BD44EB882CC7EA5A1EF016.exe
2010-01-28 19:59 . 2010-01-28 19:59 40960 —-a-r- d:documents and settingsAdminApplication DataMicrosoftInstaller{8FE4D086-63BD-44EB-882C-C7EA5A1EF016}HUD.exe_8FE4D08663BD44EB882CC7EA5A1EF016.exe
2010-01-28 19:59 . 2010-01-28 19:59 1150 —-a-r- d:documents and settingsAdminApplication DataMicrosoftInstaller{8FE4D086-63BD-44EB-882C-C7EA5A1EF016}ARPPRODUCTICON.exe
2010-01-28 19:03 . 2010-01-28 19:03

d

w- d:documents and settingsAll Users.WINDOWS.0Application DataATI
2010-01-28 19:03 . 2010-01-28 19:03

d

w- d:documents and settingsAdminApplication DataATI
2010-01-28 19:02 . 2010-01-28 19:02 0 —-a-w- d:windows.0ativpsrm.bin
2010-01-28 18:54 . 2010-01-28 18:54 9158 —-a-r- d:documents and settingsAdminApplication DataMicrosoftInstaller{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}ARPPRODUCTICON.exe
2010-01-28 17:44 . 2010-01-28 17:44 552 —-a-w- d:windows.0system32d3d8caps.dat
2010-01-28 17:36 . 2010-01-28 17:36

d

w- d:program filesVistaDriveIcon
2010-01-28 17:36 . 2010-01-28 17:36 717296 —-a-w- d:windows.0system32driverssptd.sys
2010-01-28 17:36 . 2010-01-28 17:36

d—a-w- d:program filesPaint.NET
2010-01-28 17:35 . 2010-01-28 17:35 410976 —-a-w- d:windows.0system32deploytk.dll
2010-01-28 17:35 . 2010-01-28 17:35

d

w- d:program filesJava
2010-01-28 17:29 . 2010-01-28 17:29 22564 —-a-w- d:windows.0system32emptyregdb.dat
2010-01-28 17:29 . 2010-01-28 17:28

d

w- d:program filesWindows Media Connect 2
2010-01-17 18:21 . 2010-01-17 18:21

d

w- d:program filesBuka
2010-01-12 15:10 . 2010-01-12 15:10

d

w- d:program filesPES 2009
2010-01-12 09:35 . 2010-01-12 09:35

d

w- d:program filesМои документы
2010-01-12 08:37 . 2010-01-12 08:37

d

w- d:program filesMicrosoft Works
2010-01-12 08:37 . 2010-01-12 08:37

d

w- d:program filesMicrosoft.NET
2010-01-08 00:48 . 2009-12-29 12:59

d

w- d:program filesCommon FilesNero
2010-01-06 19:20 . 2010-01-06 19:20

d

w- d:program filesPCGAME
2010-01-06 19:16 . 2010-01-06 19:16

d

w- d:program filesLG Electronics
2010-01-05 09:48 . 2008-10-24 20:38 841216 —-a-w- d:windows.0system32wininet.dll
2010-01-05 09:48 . 2008-04-15 12:00 78336 —-a-w- d:windows.0system32ieencode.dll
2010-01-05 09:48 . 2008-10-24 20:32 17408 —-a-w- d:windows.0system32corpol.dll
2010-01-01 07:58 . 2008-10-24 20:27 353792 —-a-w- d:windows.0system32driverssrv.sys
2009-12-14 07:10 . 2008-04-15 12:00 33280 —-a-w- d:windows.0system32csrsrv.dll
.

Sigcheck

[-] 2008-10-24 . 6A104BA98D99D53AB0C91825CE659FC6 . 361600 . . [5.1.2600.5625] . . d:windows.0system32driverstcpip.sys

[-] 2008-10-24 . 23B7D3F3F5EC8FEEA75EC381C71CBD5E . 579072 . . [5.1.2600.5512] . . d:windows.0system32user32.dll

[-] 2008-10-24 . 89F87645A856F6712E6225079B7931F4 . 1721344 . . [6.00.2900.5512] . . d:windows.0explorer.exe

[-] 2008-10-24 . E52BB415E3A7106E0308A6EE75219F30 . 1571840 . . [5.1.2600.5512] . . d:windows.0system32sfcfiles.dll

[-] 2008-10-24 . 08DD489E663B992B188166951AD131E0 . 30208 . . [5.1.2600.5512] . . d:windows.0system32ctfmon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «d:program filesYandexYandexBarIEyndbar.dll» [2009-12-24 8729864]

[HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiersNBHShellExt]
@=»{8D2223A2-B3C6-4e32-B096-CDD11F628C60}»
[HKEY_CLASSES_ROOTCLSID{8D2223A2-B3C6-4e32-B096-CDD11F628C60}]
2008-02-28 14:39 97064 —-a-w- d:program filesNeroNero8InCDNBHShx.dll

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«VistaIcon»=»d:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«StartCCC»=»d:program filesATI TechnologiesATI.ACECore-StaticCLIStart.exe» [2008-08-29 61440]
«RTHDCPL»=»RTHDCPL.EXE» [2009-01-13 18084864]
«UpdateLBPShortCut»=»d:program filesCyberLinkLabelPrintMUITransferMUIStartMenu.exe» [2008-12-03 218408]
«RemoteControl»=»d:program filesCyberLinkPowerDVDPDVDServ.exe» [2007-03-14 71216]
«LanguageShortcut»=»d:program filesCyberLinkPowerDVDLanguageLanguage.exe» [2007-01-08 52256]
«UCam_Menu»=»d:program filesCyberLinkYouCamMUITransferMUIStartMenu.exe» [2008-12-03 218408]
«NeroFilterCheck»=»d:windows.0system32NeroCheck.exe» [2006-01-12 155648]
«LGODDFU»=»d:program fileslg_fwupdatefwupdate.exe» [2008-10-01 548864]
«SecurDisc»=»d:program filesNeroNero8InCDNBHGui.exe» [2008-02-28 2049320]
«UpdatePSTShortCut»=»d:program filesCyberLinkDVD SuiteMUITransferMUIStartMenu.exe» [2009-05-07 210216]
«ioCentre»=»d:geniusioCentregTaskBar.exe» [2006-12-08 241664]
«Adobe Reader Speed Launcher»=»d:program filesAdobeReader 8.0ReaderReader_sl.exe» [2007-05-11 40048]
«Lingvo Launcher»=»d:program filesABBYY Lingvo 12Lvagent.exe» [2006-12-13 258048]
«MAgent»=»d:program filesMail.RuAgentMAgent.exe» [2010-03-03 8746680]
«AVP»=»d:program filesKaspersky LabKaspersky Anti-Virus 2010avp.exe» [2009-10-20 340456]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»d:windows.0system32CTFMON.EXE» [2008-10-24 30208]
«VistaIcon»=»d:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» [2010-01-05 124928]
«IE7_012″=»advpack.dll» [2010-01-05 124928]

d:documents and settingsAdminѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
GIGABYTE Gamer HUD Lite.lnk — d:program filesGigabyteGamer HUD LiteHUD.exe [2009-1-9 1687552]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusOverride»=dword:00000001

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringKasperskyAntiVirus]
«DisableMonitoring»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«d:\Program Files\Electronic Arts\EADM\Core.exe»=
«d:\Program Files\Garena\Garena.exe»=
«d:\Program Files\Opera\opera.exe»=
«d:\Program Files\uTorrent\uTorrent.exe»=
«d:\Program Files\CS16\hl.exe»=

R0 klbg;Kaspersky Lab Boot Guard Driver;d:windows.0system32driversklbg.sys [14.10.2009 20:18 36880]
R0 sptd;sptd;d:windows.0system32driverssptd.sys [28.01.2010 23:36 717296]
R1 appdrv01;Application Driver (01);d:windows.0system32driversappdrv01.sys [07.02.2010 15:34 2915944]
R2 ES lite Service;ES lite Service for program management.;d:program filesGigabyteEasySaveressvr.exe [29.12.2009 16:36 68136]
R2 NeroRegInCDSrv;Nero Registry InCD Service;d:program filesNeroNero8InCDNBHRegInCDSrv.exe [28.02.2008 20:39 53032]
R3 gMouPS2;PS2 Scroll Mouse Device;d:windows.0system32driversgMouPS2.sys [29.01.2010 3:16 17408]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;d:windows.0system32driversklim5.sys [14.09.2009 13:42 32272]
R3 klmouflt;Kaspersky Lab KLMOUFLT;d:windows.0system32driversklmouflt.sys [02.10.2009 18:39 19472]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;d:windows.0system32driversl1c51x86.sys [29.01.2010 2:13 39424]
S2 appdrvrem01;Application Driver Auto Removal Service (01);d:windows.0System32appdrvrem01.exe svc —> d:windows.0System32appdrvrem01.exe svc [?]
S3 GarenaPEngine;GarenaPEngine;??d:docume~1MazLOCALS~1TempTZZD5.tmp —> d:docume~1MazLOCALS~1TempTZZD5.tmp [?]
.
.

Supplementary Scan

.
uStart Page = hxxp://www.yandex.ru
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://www.yahoo.com
uInternet Connection Wizard,ShellNext = hxxp://www.yandex.ru/
IE: &Экспорт в Microsoft Excel — d:progra~1MICROS~3OFFICE11EXCEL.EXE/3000
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — d:program filesMail.RuAgentmagent.exe
FF — ProfilePath — d:documents and settingsMazApplication DataMozillaFirefoxProfiles8n7zz0wm.default
FF — component: d:program filesMozilla Firefoxextensionslinkfilter@kaspersky.rucomponentsKavLinkFilter.dll
FF — plugin: d:program filesK-Lite Codec PackRealbrowserpluginsnppl3260.dll
FF — plugin: d:program filesK-Lite Codec PackRealbrowserpluginsnprpjplug.dll
FF — plugin: d:program filesOperaprogrampluginsnppl3260.dll
FF — plugin: d:program filesOperaprogrampluginsnppl3260.dll
FF — plugin: d:program filesOperaprogrampluginsnprpjplug.dll
FF — plugin: d:program filesOperaprogrampluginsnprpjplug.dll

—- FIREFOX POLICIES —-
d:program filesMozilla Firefoxgreprefsall.js — pref(«ui.use_native_colors», true);
d:program filesMozilla Firefoxgreprefsall.js — pref(«ui.use_native_popup_windows», false);
d:program filesMozilla Firefoxgreprefsall.js — pref(«browser.enable_click_image_resizing», true);
d:program filesMozilla Firefoxgreprefsall.js — pref(«accessibility.browsewithcaret_shortcut.enabled», true);
d:program filesMozilla Firefoxgreprefsall.js — pref(«javascript.options.mem.high_water_mark», 32);
d:program filesMozilla Firefoxgreprefsall.js — pref(«javascript.options.mem.gc_frequency», 1600);
d:program filesMozilla Firefoxgreprefsall.js — pref(«network.auth.force-generic-ntlm», false);
d:program filesMozilla Firefoxgreprefsall.js — pref(«svg.smil.enabled», false);
d:program filesMozilla Firefoxgreprefsall.js — pref(«ui.trackpoint_hack.enabled», -1);
d:program filesMozilla Firefoxgreprefsall.js — pref(«browser.formfill.debug», false);
d:program filesMozilla Firefoxgreprefsall.js — pref(«browser.formfill.agedWeight», 2);
d:program filesMozilla Firefoxgreprefsall.js — pref(«browser.formfill.bucketSize», 1);
d:program filesMozilla Firefoxgreprefsall.js — pref(«browser.formfill.maxTimeGroupings», 25);
d:program filesMozilla Firefoxgreprefsall.js — pref(«browser.formfill.timeGroupingSize», 604800);
d:program filesMozilla Firefoxgreprefsall.js — pref(«browser.formfill.boundaryWeight», 25);
d:program filesMozilla Firefoxgreprefsall.js — pref(«browser.formfill.prefixWeight», 5);
d:program filesMozilla Firefoxgreprefsall.js — pref(«html5.enable», false);
d:program filesMozilla Firefoxdefaultspreffirefox-branding.js — pref(«app.update.download.backgroundInterval», 600);
d:program filesMozilla Firefoxdefaultspreffirefox-branding.js — pref(«app.update.url.manual», «http://www.firefox.com»);
d:program filesMozilla Firefoxdefaultspreffirefox-branding.js — pref(«browser.search.param.yahoo-fr-ja», «mozff»);
d:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name», «chrome://browser/locale/browser.properties»);
d:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description», «chrome://browser/locale/browser.properties»);
d:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«xpinstall.whitelist.add», «addons.mozilla.org»);
d:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«xpinstall.whitelist.add.36», «getpersonas.com»);
d:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«lightweightThemes.update.enabled», true);
d:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«browser.allTabs.previews», false);
d:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«plugins.hide_infobar_for_outdated_plugin», false);
d:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«plugins.update.notifyUser», false);
d:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«toolbar.customization.usesheet», false);
d:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«browser.taskbar.previews.enable», false);
d:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«browser.taskbar.previews.max», 20);
d:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«browser.taskbar.previews.cachetime», 20);
.
— — — — ORPHANS REMOVED — — — —

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} — (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-06 12:44
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spak.sys >>UNKNOWN [0x89BC1938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
DriverDisk -> CLASSPNP.SYS @ 0xf763bf28
DriverACPI -> ACPI.sys @ 0xf7496cb8
Driveratapi -> atapi.sys @ 0xf7978b40
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805e66b2
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1
DeviceHarddisk0DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805e66b2
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1
NDIS: Atheros AR8131 PCI-E Gigabit Ethernet Controller -> SendCompleteHandler -> NDIS.sys @ 0xf7b3abb0
PacketIndicateHandler -> NDIS.sys @ 0xf7b47a21
SendHandler -> NDIS.sys @ 0xf7b2587b
user & kernel MBR OK

**************************************************************************
.

DLLs Loaded Under Running Processes

— — — — — — — > ‘winlogon.exe'(1072)
d:windows.0system32SETUPAPI.dll
d:windows.0system32Ati2evxx.dll
d:windows.0system32COMRes.dll
d:windows.0system32cscui.dll

— — — — — — — > ‘lsass.exe'(1128)
d:windows.0system32setupapi.dll

— — — — — — — > ‘explorer.exe'(832)
d:windows.0system32SHDOCVW.dll
d:windows.0system32WININET.dll
d:windows.0system32COMRes.dll
d:program filesNeroNero8InCDNBHShx.dll
d:program filesNeroNero8InCDNBHStr.dll
d:program filesCommon FilesNeroSharedNL3AdvrCntr3.dll
d:windows.0system32SETUPAPI.dll
d:windows.0System32cscui.dll
d:program filesABBYY Lingvo 12LvHook.dll
d:windows.0system32msi.dll
d:windows.0system32NETSHELL.dll
d:windows.0system32wpdshserviceobj.dll
d:windows.0system32portabledevicetypes.dll
d:windows.0system32portabledeviceapi.dll
.

Other Running Processes

.
d:windows.0system32Ati2evxx.exe
d:windows.0system32Ati2evxx.exe
d:program filesNeroNero8InCDInCDsrv.exe
d:program filesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
d:windows.0system32PnkBstrA.exe
d:program filesCyberLinkShared FilesRichVideo.exe
d:windows.0system32wscntfy.exe
d:windows.0RTHDCPL.EXE
d:program filesATI TechnologiesATI.ACECore-StaticMOM.exe
d:geniusioCentregMouseTask.exe
d:geniusioCentregKbdTask.exe
d:geniusioCentregAutoPan.exe
d:geniusioCentregAutoScroll.exe
d:geniusioCentregZoom.exe
d:geniusioCentregMGlass.exe
d:geniusioCentregIMMgm.exe
d:geniusioCentregDeskMgm.exe
d:geniusioCentregTaskSwitch.exe
d:program filesATI TechnologiesATI.ACECore-Staticccc.exe
.
**************************************************************************
.
Completion time: 2010-03-06 12:49:50 — machine was rebooted
ComboFix-quarantined-files.txt 2010-03-06 06:49

Pre-Run: 203 929 952 256 байт свободно
Post-Run: 205 002 059 776 байт свободно

— — End Of File — — F1858747AC594D416AB8C30C1814E956
Автор

Сообщения

Просмотр 3 сообщений - с 1 по 3 (из 3 всего)

Для ответа в этой теме необходимо авторизоваться.

Обнаружены вирусы…..

Добро пожаловать

Поиск

Последние темы

СПАЙВАРЕ РУ

Нужна помощь?

Ссылки