помогите пожалуйста!!!!!

[Аноним]

здравствуйте.помогите пожалуйста разобраться.стоял антивирусник аваст.брат скачал игру,на след день вылез порнобаннер с просьбой прислать смс на номер 9880,удалила с помощью ввода кодов(нашла на форумах),через день появился новый вирус-интернет секьюрити,мол эта прога,хотя у меня ее и не было,нашла вредоносные программы и чтобы их удалить надо отправить смс,удалила с помощью комбофикса,но теперь не запускается аваст. при запуске пишет «невозможно открыть данную программу из-за политики ограничения применения программного обеспечения.за дополнительной информацией обратиться к системному администратору или открыть окно «просмотр событий»». попыталась удалить аваст через панель управления,при удалении выдал какую-то ошибку,написал что аваст уже был удален,удалить снова? удалила,в панели управления исчез,но во всех программах еще остался.установила касперского,не запускается,пишет тоже самое-«невозможно открыть данную программу из-за политики ограничения применения программного обеспечения.за дополнительной информацией обратиться к системному администратору или открыть окно «просмотр событий»». что делать??? комбофикс вроде удалила.вот лог:

ComboFix 10-01-04.01 — Admin 03.01.2010 20:45:07.2.2 — x86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.2047.1486 [GMT 3:00]
Running from: G:ComboFix.exe
AV: avast! antivirus 4.8.1296 [VPS 090109-0] *On-access scanning enabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
ADS — win32k.sys: deleted 68 bytes in 1 streams.
ADS — netcfgx.dll: deleted 68 bytes in 1 streams.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:docume~1AdminLOCALS~1Tempedajiozlz.dll
c:documents and settingsAdminApplication Datawiaservg.log
c:documents and settingsAdminLocal Settingstempedajiozlz.dll
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr0.dat
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr1.dat
c:program filesMail.RuAgentMradllnewmrasearch.dll
c:recyclerS-1-5-21-3530428468-4334846886-122573160-8969
c:recyclerS-1-5-21-7738606242-8412975180-652985318-5000
c:windowssystem32CNCFLdNL.DLL
c:windowssystem32netprotocol.dll
c:windowssystem32vbrun100.dll
c:windowssystem32wbemgrpconv.exe

---

BITS: Possible infected sites

---

hxxp://soft.export.yandex.ru
c:windowssystem32grpconv.exe . . . is missing!!

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

---

Legacy_NETPROTOCOL

---

Service_Netprotocol

((((((((((((((((((((((((( Files Created from 2009-12-03 to 2010-01-03 )))))))))))))))))))))))))))))))
.

2010-03-02 20:47 . 2010-03-02 20:47

---

d

---

w- c:documents and settingsAdminApplication DataMedia Player Classic
2010-03-02 20:37 . 2010-03-02 20:37

---

d

---

w- c:documents and settingsAdminLocal SettingsApplication DataABBYY
2010-03-02 20:37 . 2010-03-02 20:37

---

d

---

w- c:documents and settingsAdminApplication DataABBYY
2010-03-02 20:37 . 2010-03-02 20:37

---

d

---

w- c:documents and settingsAll UsersApplication DataABBYY
2010-03-02 20:35 . 2010-03-02 20:40

---

d

---

w- c:program filesABBYY FineReader 7.0 Professional Edition
2010-03-02 20:33 . 2010-03-02 20:33

---

d

---

w- C:FR70PRO
2010-03-02 20:30 . 2010-03-02 20:33

---

d

---

w- c:documents and settingsAdminApplication DataMra
2010-03-02 20:30 . 2010-03-02 20:30

---

d

---

w- c:program filesMail.Ru
2010-03-02 20:30 . 2010-03-02 20:30

---

d

---

w- c:documents and settingsAdminApplication DataQIP
2010-03-02 20:29 . 2009-10-05 15:34 150768 —-a-w- c:documents and settingsAdminApplication DataMicrosoftInternet Explorerqipsearchbar.dll
2010-03-02 20:29 . 2010-03-02 20:29

---

d

---

w- c:program filesQIP Infium
2010-03-01 20:38 . 2010-03-01 20:38

---

d

---

w- c:documents and settingsAdminLocal SettingsApplication DataAKSoftware
2010-03-01 19:01 . 2008-04-15 12:00 26624 —-a-w- c:documents and settingsLocalServiceApplication DataMicrosoftUPnP Device Hostupnphostudhisapi.dll
2010-03-01 17:30 . 2010-03-01 17:32

---

d

---

w- c:windowssystem32NtmsData
2010-03-01 17:05 . 2008-11-26 17:16 50864 —-a-w- c:windowssystem32driversaswTdi.sys
2010-03-01 17:05 . 2008-11-26 17:16 23152 —-a-w- c:windowssystem32driversaswRdr.sys
2010-03-01 17:05 . 2008-11-26 17:15 26944 —-a-w- c:windowssystem32driversaavmker4.sys
2010-03-01 17:05 . 2008-11-26 17:15 97480 —-a-w- c:windowssystem32AvastSS.scr
2010-03-01 17:05 . 2008-11-26 17:18 93296 —-a-w- c:windowssystem32driversaswmon.sys
2010-03-01 17:05 . 2008-11-26 17:18 94032 —-a-w- c:windowssystem32driversaswmon2.sys
2010-03-01 17:05 . 2008-11-26 17:17 111184 —-a-w- c:windowssystem32driversaswSP.sys
2010-03-01 17:05 . 2008-11-26 17:17 20560 —-a-w- c:windowssystem32driversaswFsBlk.sys
2010-03-01 17:05 . 2008-11-26 17:21 1236208 —-a-w- c:windowssystem32aswBoot.exe
2010-03-01 17:05 . 2010-03-01 17:05

---

d

---

w- c:program filesAlwil Software
2010-03-01 16:58 . 2010-03-01 16:58

---

d

---

w- c:documents and settingsAdminLocal SettingsApplication DataCyberlink
2010-03-01 16:58 . 2010-03-01 16:58

---

d

---

w- c:documents and settingsAdminApplication DataCyberLink
2010-03-01 16:58 . 2010-03-01 16:58

---

d

---

w- c:documents and settingsAll UsersApplication DataCyberLink
2010-03-01 16:57 . 2010-03-01 16:57

---

d

---

w- c:program filesCommon FilesCyberLink
2010-03-01 16:57 . 2010-01-05 20:46

---

d—h—w- c:program filesInstallShield Installation Information
2010-03-01 16:57 . 2010-03-01 16:58

---

d

---

w- c:program filesCyberLink
2010-03-01 16:57 . 2010-03-01 16:56 29480 —-a-w- c:windowssystem32msxml3a.dll
2010-03-01 16:56 . 2010-03-01 16:56

---

d

---

w- c:documents and settingsAll UsersApplication DataTemp
2010-03-01 16:56 . 2010-03-01 16:56 53319 —-a-w- c:documents and settingsAll UsersApplication DataTemp{8C20787A-7402-4FA7-BF25-6E5750930FDC}PostBuild.exe
2010-03-01 16:51 . 2010-01-06 09:59

---

d

---

w- c:windowssystem32oodag
2010-03-01 16:47 . 2010-03-01 16:47

---

d

---

w- c:documents and settingsAdminLocal SettingsApplication DataO&O
2010-03-01 16:47 . 2010-03-01 16:47

---

d

---

w- c:program filesOO Software
2010-03-01 16:45 . 2010-03-01 16:45

---

d

---

w- c:documents and settingsAdminLocal SettingsApplication DataYandex
2010-03-01 16:45 . 2010-01-08 14:11

---

d

---

w- c:documents and settingsAdminApplication DataYandex
2010-03-01 16:45 . 2010-03-01 16:45

---

d

---

w- c:program filesWinDjView
2010-03-01 16:42 . 2010-03-01 16:42 68456 —-a-w- c:documents and settingsAdminLocal SettingsApplication DataGDIPFONTCACHEV1.DAT
2010-03-01 16:36 . 2010-03-02 19:45

---

d

---

w- c:documents and settingsAdminLocal SettingsApplication DataAhead
2010-03-01 16:36 . 2010-03-01 16:36

---

d

---

w- c:program filesNeroInstall.bak
2010-03-01 16:36 . 2010-03-01 16:36

---

d

---

w- c:documents and settingsAdminApplication DataNero
2010-03-01 16:35 . 2010-03-01 16:35

---

d

---

w- c:program filesCommon FilesNero
2010-03-01 16:35 . 2010-03-01 16:35

---

d

---

w- c:documents and settingsAll UsersApplication DataNero
2010-03-01 16:35 . 2010-03-01 16:35

---

d

---

w- c:program filesNero
2010-03-01 16:29 . 2010-03-01 16:29

---

d

---

w- c:documents and settingsAdminLocal SettingsApplication DataAdobe
2010-03-01 16:28 . 2010-03-01 16:28

---

d

---

w- c:program filesCommon FilesAdobe
2010-03-01 16:26 . 2010-03-01 16:26

---

d

---

w- c:program filesCommon FilesL&H
2010-03-01 16:25 . 2010-03-01 16:25

---

d

---

w- c:program filesMicrosoft ActiveSync
2010-03-01 16:19 . 2006-10-26 16:56 33104 —-a-w- c:windowssystem32Spoolprtprocsw32x86msonpppr.dll
2010-03-01 16:19 . 2006-10-26 16:56 32592 —-a-w- c:windowssystem32msonpmon.dll
2010-03-01 16:18 . 2010-03-01 16:18

---

d

---

w- c:program filesMicrosoft Works
2010-03-01 16:18 . 2010-03-01 16:18

---

d

---

w- c:program filesMSBuild
2010-03-01 16:18 . 2010-03-01 16:18

---

d

---

w- c:program filesMicrosoft.NET
2010-03-01 16:17 . 2010-03-01 16:17

---

d

---

w- c:program filesMicrosoft Visual Studio 8
2010-03-01 16:16 . 2010-03-01 16:18

---

d

---

w- c:windowsSHELLNEW
2010-03-01 16:16 . 2010-03-01 16:16

---

d

---

w- c:documents and settingsAdminLocal SettingsApplication DataMicrosoft Help
2010-03-01 16:16 . 2010-03-01 16:22

---

d

---

w- c:documents and settingsAll UsersApplication DataMicrosoft Help
2010-03-01 16:16 . 2010-03-01 16:16

---

d

---

r- C:MSOCache
2010-03-01 14:24 . 2001-10-19 17:33 12160 —-a-w- c:windowssystem32driversmouhid.sys
2010-03-01 14:23 . 2008-04-13 21:15 10368 —-a-w- c:windowssystem32drivershidusb.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-01 16:31 . 2010-03-01 16:31

---

d

---

w- c:program filesK-Lite Codec Pack
2010-02-28 22:45 . 2010-02-28 22:45

---

d

---

w- c:program filesmicrosoft frontpage
2010-02-28 22:45 . 2010-02-28 22:45

---

d

---

w- c:program filesVistaDriveIcon
2010-02-28 22:45 . 2010-02-28 22:45 717296 —-a-w- c:windowssystem32driverssptd.sys
2010-02-28 22:45 . 2008-04-15 12:00 76880 —-a-w- c:windowssystem32perfc019.dat
2010-02-28 22:45 . 2008-04-15 12:00 448696 —-a-w- c:windowssystem32perfh019.dat
2010-02-28 22:44 . 2010-02-28 22:44 410976 —-a-w- c:windowssystem32deploytk.dll
2010-02-28 22:44 . 2010-02-28 22:44

---

d

---

w- c:program filesJava
2010-02-28 22:39 . 2010-02-28 22:39 22564 —-a-w- c:windowssystem32emptyregdb.dat
2010-02-28 22:38 . 2010-02-28 22:38

---

d

---

w- c:program filesWindows Media Connect 2
2010-01-10 11:12 . 2010-01-10 11:12 131072 —-a-w- c:windowssystem32ftwvadzw.dll
2010-01-10 08:56 . 2010-01-10 08:56 131072 —-a-w- c:windowssystem32vxhm.dll
2010-01-10 08:40 . 2010-01-10 08:40 131072 —-a-w- c:windowssystem32raon.dll
2010-01-09 15:51 . 2010-01-09 15:51 131072 —-a-w- c:windowssystem32ikfjaxbzu.dll
2010-01-09 10:50 . 2010-01-06 13:14

---

d

---

w- c:documents and settingsAdminApplication DatauTorrent
2010-01-09 09:16 . 2010-01-08 08:10

---

d

---

w- c:program filesSuperCleaner
2010-01-08 08:17 . 2010-01-08 08:17 0 —-a-w- c:windowsativpsrm.bin
2010-01-07 12:03 . 2010-01-06 09:49

---

d

---

w- c:program filesDAEMON Tools
2010-01-07 10:00 . 2010-02-28 22:41 86327 —-a-w- c:windowspchealthhelpctrOfflineCacheindex.dat
2010-01-07 09:37 . 2010-01-07 09:37

---

d

---

w- c:documents and settingsAdminApplication DataTalkback
2010-01-07 09:37 . 2010-01-07 09:37 2821 —-a-w- c:windowsmozver.dat
2010-01-07 09:24 . 2010-01-07 09:24

---

d

---

w- c:program filesKaspersky Lab
2010-01-06 17:19 . 2010-01-06 17:19

---

d

---

w- c:program filesQIP
2010-01-06 16:39 . 2010-01-06 16:39

---

d

---

w- c:program filesMiranda
2010-01-06 16:37 . 2010-01-06 16:37

---

d

---

w- c:documents and settingsAdminApplication DataICQ Toolbar
2010-01-06 16:37 . 2010-01-06 16:36

---

d

---

w- c:program filesICQToolbar
2010-01-06 16:36 . 2010-01-06 16:36

---

d

---

w- c:documents and settingsAdminApplication DataICQLite
2010-01-06 13:14 . 2010-01-06 13:14

---

d

---

w- c:program filesuTorrent
2010-01-06 09:53 . 2010-01-06 09:53 223128 —-a-w- c:windowssystem32driversdtscsi.sys
2010-01-05 20:58 . 2010-01-05 20:58

---

d

---

w- c:program filesPunto Switcher
2010-01-05 20:53 . 2010-01-05 20:53

---

d

---

w- c:program filesMedia Key
2010-01-05 20:47 . 2010-01-05 20:47

---

d

---

w- c:program filesCommon FilesNewSoft
2010-01-05 20:46 . 2010-01-05 20:46

---

d

---

w- c:program filesCommon FilesPDFView
2010-01-05 20:46 . 2010-01-05 20:46

---

d

---

w- c:program filesNewSoft
2010-01-05 20:45 . 2010-01-05 20:41

---

d

---

w- c:program filesCommon FilesInstallShield
2010-01-05 20:45 . 2010-01-05 20:45

---

d

---

w- c:documents and settingsAll UsersApplication DataInstallShield
2010-01-05 20:45 . 2010-01-05 20:45

---

d

---

w- c:documents and settingsAdminApplication DataScanSoft
2010-01-05 20:44 . 2010-01-05 20:44

---

d

---

w- c:documents and settingsAll UsersApplication DataScanSoft
2010-01-05 20:44 . 2010-01-05 20:44

---

d

---

w- c:program filesCommon FilesScanSoft Shared
2010-01-05 20:44 . 2010-01-05 20:44

---

d

---

w- c:program filesScanSoft
2010-01-05 20:39 . 2010-01-05 20:39

---

d

---

w- c:documents and settingsAll UsersApplication DataCanonIJPLM
2010-01-05 20:39 . 2010-01-05 20:31

---

d

---

w- c:program filesCanon
2010-01-05 20:36 . 2010-01-05 20:36

---

d

---

w- c:program filesCommon FilesCANON
2010-01-05 20:32 . 2010-01-05 20:32

---

d—h—w- c:documents and settingsAll UsersApplication DataCanonBJ
2010-01-05 20:32 . 2010-01-05 20:32

---

d—h—w- c:program filesCanonBJ
2009-12-15 21:39 . 2009-12-15 21:39 131072 —-a-w- c:windowssystem32g.dll
2009-12-15 11:29 . 2009-12-15 11:29 131072 —-a-w- c:windowssystem32ddpyy.dll
.

---

Sigcheck

---

[-] 2008-12-13 . EC936BB945F789C0B4DAE06397334430 . 361600 . . [5.1.2600.5625] . . c:windowssystem32driverstcpip.sys

[-] 2008-12-19 . 4B7E0EBEF4BAD0E08DFB26885EDF5AA7 . 652800 . . [5.82] . . c:windowssystem32comctl32.dll

[-] 2009-02-10 . 5BA788BE01A673A0A5176486CE432DF2 . 2190976 . . [5.1.2600.5755] . . c:windowsSoftwareDistributionDownload72b4accc3943a6593ebd29eec90ab68dSP3QFEntoskrnl.exe
[-] 2009-02-09 . 13A34A1918FA051E48B1B04762EC9D7A . 2182272 . . [5.1.2600.3520] . . c:windowsSoftwareDistributionDownload72b4accc3943a6593ebd29eec90ab68dSP2GDRntoskrnl.exe
[-] 2009-02-09 . EABDFA661A9EE8C96C79CC8452F20267 . 2187904 . . [5.1.2600.3520] . . c:windowsSoftwareDistributionDownload72b4accc3943a6593ebd29eec90ab68dSP2QFEntoskrnl.exe
[-] 2009-02-09 . 71724D6DC686B1597DE3631F09B3E5C7 . 2190848 . . [5.1.2600.5755] . . c:windowsSoftwareDistributionDownload72b4accc3943a6593ebd29eec90ab68dSP3GDRntoskrnl.exe
[-] 2008-12-19 . CFFB5804D6C42B37941F654DF656DDB6 . 2286592 . . [5.1.2600.5657] . . c:windowssystem32ntoskrnl.exe

[-] 2008-12-19 . A46326FFE00FF90CB9A372B94E571438 . 631808 . . [5.1.2600.5512] . . c:windowssystem32user32.dll

[-] 2009-10-29 . B7E141060C49C2A1474052CC29A3EBC1 . 832512 . . [7.00.6000.16945] . . c:windowsSoftwareDistributionDownloada0d23c15118dfa40e545c28537c961b5SP3GDRwininet.dll
[-] 2009-10-29 . B769B916C201B53B9E3C8FEF84E43811 . 841216 . . [7.00.6000.21148] . . c:windowsSoftwareDistributionDownloada0d23c15118dfa40e545c28537c961b5SP3QFEwininet.dll
[-] 2008-12-19 . 9CA2A8437D6C26D64FCD860A94006401 . 884224 . . [7.00.6000.20935] . . c:windowssystem32wininet.dll

[-] 2008-12-19 . E448E5836FEA2DE06AE6EE1D05874B3C . 1926144 . . [6.00.2900.5512] . . c:windowsexplorer.exe

[-] 2008-12-19 . 9C8FB3912BB3A20E7A9A079960EEC0A2 . 1571840 . . [5.1.2600.5512] . . c:windowssystem32sfcfiles.dll

[-] 2008-12-19 . 0DE18690E4223998E471048889F09B8B . 37376 . . [5.1.2600.5512] . . c:windowssystem32ctfmon.exe

[-] 2009-02-10 . 32136AF697E44465D73FA014F459C037 . 2067840 . . [5.1.2600.5755] . . c:windowsSoftwareDistributionDownload72b4accc3943a6593ebd29eec90ab68dSP3GDRntkrnlpa.exe
[-] 2009-02-09 . 591AE94857DB52ADEAC47B4DD1493C1C . 2059520 . . [5.1.2600.3520] . . c:windowsSoftwareDistributionDownload72b4accc3943a6593ebd29eec90ab68dSP2GDRntkrnlpa.exe
[-] 2009-02-09 . B4EA0C0C7C93C0DC75263F962E3AE2D9 . 2064768 . . [5.1.2600.3520] . . c:windowsSoftwareDistributionDownload72b4accc3943a6593ebd29eec90ab68dSP2QFEntkrnlpa.exe
[-] 2009-02-09 . F94532F9047E2D94B5CC2125487EBB8D . 2067968 . . [5.1.2600.5755] . . c:windowsSoftwareDistributionDownload72b4accc3943a6593ebd29eec90ab68dSP3QFEntkrnlpa.exe
[-] 2008-12-19 . C5B4D14012A98BFC02CDFA81B8EAD2DB . 2165248 . . [5.1.2600.5657] . . c:windowssystem32ntkrnlpa.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-03-23 132096]
«IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=»c:program filesCommon FilesNeroLibNMIndexStoreSvr.exe» [2008-02-28 1828136]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2004-11-13 205824]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«RTHDCPL»=»RTHDCPL.EXE» [2008-08-26 16851456]
«GrooveMonitor»=»c:program filesMicrosoft OfficeOffice12GrooveMonitor.exe» [2007-08-24 33648]
«NeroFilterCheck»=»c:program filesCommon FilesNeroLibNeroCheck.exe» [2008-02-28 570664]
«OODefragTray»=»c:windowssystem32oodtray.exe» [2009-02-25 2553088]
«RemoteControl9″=»c:program filesCyberLinkPowerDVD9PDVD9Serv.exe» [2009-09-22 87336]
«BDRegion»=»c:program filesCyberlinkShared Filesbrs.exe» [2009-08-28 75048]
«avast!»=»c:progra~1ALWILS~1Avast4ashDisp.exe» [2008-11-26 81000]
«MAgent»=»c:program filesMail.RuAgentMAgent.exe» [2010-03-02 5600952]
«FineReader7NewsReaderPro»=»c:program filesABBYY FineReader 7.0 Professional EditionAbbyyNewsReader.exe» [2003-08-19 278528]
«CanonSolutionMenu»=»c:program filesCanonSolutionMenuCNSLMAIN.exe» [2007-05-14 644696]
«CanonMyPrinter»=»c:program filesCanonMyPrinterBJMyPrt.exe» [2007-04-03 1603152]
«SSBkgdUpdate»=»c:program filesCommon FilesScansoft SharedSSBkgdUpdateSSBkgdupdate.exe» [2006-10-25 210472]
«OpwareSE4″=»c:program filesScanSoftOmniPageSE4OpwareSE4.exe» [2007-02-04 79400]
«DAEMON Tools»=»c:program filesDAEMON Toolsdaemon.exe» [2005-12-10 133016]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-12-19 37376]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-03-23 132096]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» [2008-12-19 124928]
«IE7_012″=»advpack.dll» [2008-12-19 124928]

c:documents and settingsAll Usersѓ« ў­®Ґ ¬Ґ­оЏа®Ја ¬¬лЂўв®§ Јаг§Є
Media Key.lnk — c:program filesMedia KeyMagicKey.exe [2010-1-5 159744]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)
«NoSMHelp»= 1 (0x1)

[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)
«NoSMHelp»= 1 (0x1)

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetcontrolsession manager]
BootExecute REG_MULTI_SZ autocheck autochk *OODBS

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusOverride»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\CyberLink\PowerDVD9\PowerDVD9.exe»=
«c:\Program Files\uTorrent\uTorrent.exe»=

R0 sptd;sptd;c:windowssystem32driverssptd.sys [01.03.2010 1:45 717296]
R1 aswSP;avast! Self Protection;c:windowssystem32driversaswSP.sys [01.03.2010 20:05 111184]
R1 kbfilter;Keyboard Filter Driver;c:windowssystem32driverskbfilter.sys [05.01.2010 23:53 12856]
R1 UsbFltr;WayTechUSBFilterDriver;c:windowssystem32driversUsbFltr.sys [05.01.2010 23:53 9291]
R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2010/03/01 19:58];c:program filesCyberLinkPowerDVD900.fcl [22.09.2009 18:14 87536]
R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [01.03.2010 20:05 20560]
R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:windowssystem32driversl151x86.sys [01.03.2010 4:23 37376]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionsvchost]
DcomLaunch REG_MULTI_SZ DcomLaunch TermService Netprotocol

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{aff5f62f-faa4-11de-b82f-001fc633d6a4}]
ShellAutoRuncommand — F:setup.exe
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.mail.ru
uDefault_Search_URL = hxxp://search.qip.ru
uSearchURL,(Default) = Root: HKCU; Subkey: SoftwareMicrosoftInternet ExplorerSearchUrl; ValueType: string; ValueName: ‘; ValueData: ‘; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
IE: &ICQ Toolbar Search — c:program filesICQToolbartoolbaru.dll/SEARCH.HTML
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:program filesMail.RuAgentmagent.exe
.
— — — — ORPHANS REMOVED — — — —

AddRemove-Microsoft .NET Framework 2.0 Language Pack — RUS — c:windowsMicrosoft.NETFrameworkv2.0.50727Microsoft .NET Framework 2.0 Language Pack — RUSinstall.exe
AddRemove-Recover My Files_is1 — c:program filesGetDataRecover My Filesunins000.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-03 20:48
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spdi.sys >>UNKNOWN [0x89BC1938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
DriverDisk -> CLASSPNP.SYS @ 0xf765bf28
DriverACPI -> ACPI.sys @ 0xf7496cb8
Driveratapi -> atapi.sys @ 0xf7978b40
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805e66aa
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1
DeviceHarddisk0DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805e66aa
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1
NDIS: Atheros L1 Gigabit Ethernet 10/100/1000Base-T Controller -> SendCompleteHandler -> NDIS.sys @ 0xba724bb0
PacketIndicateHandler -> NDIS.sys @ 0xba731a21
SendHandler -> NDIS.sys @ 0xba70f87b
user & kernel MBR OK

**************************************************************************
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘winlogon.exe'(788)
c:windowssystem32SETUPAPI.dll
c:windowssystem32Ati2evxx.dll
c:windowssystem32cscui.dll
c:windowssystem32COMRes.dll

— — — — — — — > ‘lsass.exe'(844)
c:windowssystem32setupapi.dll

— — — — — — — > ‘explorer.exe'(5584)
c:windowssystem32SHDOCVW.dll
c:program filesScanSoftOmniPageSE4OpHookSE4.dll
c:windowssystem32COMRes.dll
c:windowsSystem32cscui.dll
c:windowssystem32wpdshext.dll
c:windowssystem32portabledeviceapi.dll
c:windowssystem32SETUPAPI.dll
c:windowssystem32audiodev.dll
c:windowssystem32WMVCore.DLL
c:windowssystem32WMASF.DLL
c:windowssystem32msi.dll
c:windowssystem32wpdshserviceobj.dll
c:windowssystem32portabledevicetypes.dll
c:windowssystem32credui.dll
c:windowssystem32MSVCP60.dll
.

---

Other Running Processes

---

.
c:windowssystem32Ati2evxx.exe
c:program filesAlwil SoftwareAvast4aswUpdSv.exe
c:program filesAlwil SoftwareAvast4ashServ.exe
c:windowssystem32Ati2evxx.exe
c:program filesCanonIJPLMIJPLMSVC.EXE
c:program filesJavajre6binjqs.exe
c:program filesNeroNero8Nero BackItUpNBService.exe
c:windowssystem32oodag.exe
c:windowssystem32IoctlSvc.exe
c:windowsRTHDCPL.EXE
c:program filesAlwil SoftwareAvast4ashMaiSv.exe
c:program filesAlwil SoftwareAvast4ashWebSv.exe
c:program filesCommon FilesNeroLibNMIndexingService.exe
c:program filesMedia KeyOSD.EXE
c:windowssystem32wbemwmiapsrv.exe
.
**************************************************************************
.
Completion time: 2010-01-03 20:49:50 — machine was rebooted
ComboFix-quarantined-files.txt 2010-01-03 17:49
ComboFix2.txt 2010-01-08 14:04

Pre-Run: 20 081 573 888 байт свободно
Post-Run: 20 041 240 576 байт свободно

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)WINDOWS
[operating systems]
c:cmdconsBOOTSECT.DAT=»Microsoft Windows Recovery Console» /cmdcons
multi(0)disk(0)rdisk(0)partition(1)WINDOWS=»Microsoft Windows XP Professional RU» /execute /fastdetect

— — End Of File — — 1F733EAB7A538D58A879EB4E5DFF066D

[Admin]

Здравствуйте, добро пожаловать на Spyware-ru форум.

Откройте блокнот (Кликните Пуск, Выполнить, в строке ввода введите notepad и нажмите Enter) и вставьте в него следующий текст:

MBR::

Запишите получившийся файл на ваш рабочий стол под именем CFScript
Далее перетащите получившийся файл на иконку Combofix, как показано на картинке ниже.

Сombofix запуститься и выполнит процедуры описанные в созданном нами файле.
По результатам работы Combofix будет создан новый лог, его и вставьте в свой следующий ответ.

[Аноним]

спасибо большое за внимание))))все сделала как вы сказали.кстати,мне посоветовали попробовать установить антивирусник Авира.я установила и он даже запустился!!!нашел 57 вирусов,но почему то их не удалил,а только поместил в карантин…что-то не доверяю я этому антивируснику… прежде чем запустить комбофикс я не забыла остановить работу авиры)))вот лог:

ComboFix 08-12-14.05 — Admin 2010-01-19 19:51:29.6 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.1.1049.18.2047.1231 [GMT 3:00]
Running from: c:documents and settingsAdminРабочий столCombofix(http://www.ho24me.ru)ComboFix.exe
Command switches used :: c:documents and settingsAdminРабочий столCFScript.txt
* Created a new restore point
.
— REDUCED FUNCTIONALITY MODE —
.

((((((((((((((((((((((((( Files Created from 2009-12-19 to 2010-01-19 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-02 20:47

---

d

---

w c:documents and settingsAdminApplication DataMedia Player Classic
2010-03-02 20:40

---

d

---

w c:program filesABBYY FineReader 7.0 Professional Edition
2010-03-02 20:37

---

d

---

w c:documents and settingsAll UsersApplication DataABBYY
2010-03-02 20:37

---

d

---

w c:documents and settingsAdminApplication DataABBYY
2010-03-02 20:30

---

d

---

w c:program filesMail.Ru
2010-03-02 20:30

---

d

---

w c:documents and settingsAdminApplication DataQIP
2010-03-02 20:29

---

d

---

w c:program filesQIP Infium
2010-03-01 17:05

---

d

---

w c:program filesAlwil Software
2010-03-01 16:58

---

d

---

w c:program filesCyberLink
2010-03-01 16:58

---

d

---

w c:documents and settingsAll UsersApplication DataCyberLink
2010-03-01 16:58

---

d

---

w c:documents and settingsAdminApplication DataCyberLink
2010-03-01 16:57

---

d

---

w c:program filesCommon FilesCyberLink
2010-03-01 16:56 29,480 —-a-w c:windowssystem32msxml3a.dll
2010-03-01 16:56

---

d

---

w c:documents and settingsAll UsersApplication DataTemp
2010-03-01 16:47

---

d

---

w c:program filesOO Software
2010-03-01 16:45

---

d

---

w c:program filesWinDjView
2010-03-01 16:36

---

d

---

w c:program filesNeroInstall.bak
2010-03-01 16:36

---

d

---

w c:documents and settingsAdminApplication DataNero
2010-03-01 16:35

---

d

---

w c:program filesNero
2010-03-01 16:35

---

d

---

w c:program filesCommon FilesNero
2010-03-01 16:35

---

d

---

w c:documents and settingsAll UsersApplication DataNero
2010-03-01 16:31

---

d

---

w c:program filesK-Lite Codec Pack
2010-03-01 16:28

---

d

---

w c:program filesCommon FilesAdobe
2010-03-01 16:26

---

d

---

w c:program filesCommon FilesL&H
2010-03-01 16:25

---

d

---

w c:program filesMicrosoft ActiveSync
2010-03-01 16:18

---

d

---

w c:program filesMicrosoft.NET
2010-03-01 16:17

---

d

---

w c:program filesMicrosoft Visual Studio 8
2010-02-28 22:45 717,296 —-a-w c:windowssystem32driverssptd.sys
2010-02-28 22:45

---

d

---

w c:program filesVistaDriveIcon
2010-02-28 22:45

---

d

---

w c:program filesmicrosoft frontpage
2010-02-28 22:44 410,976 —-a-w c:windowssystem32deploytk.dll
2010-02-28 22:44

---

d

---

w c:program filesJava
2010-02-28 22:38

---

d

---

w c:program filesWindows Media Connect 2
2010-01-18 16:42

---

d

---

w c:documents and settingsAdminApplication DataMra
2010-01-18 14:49

---

d

---

w c:documents and settingsAdminApplication DatauTorrent
2010-01-18 12:42

---

d

---

w c:program filesJetAudio
2010-01-18 12:42

---

d

---

w c:documents and settingsAdminApplication DataCOWON
2010-01-18 12:41

---

d—h—w c:program filesInstallShield Installation Information
2010-01-18 12:41

---

d

---

w c:program filesCommon FilesCOWON
2010-01-17 22:45

---

d

---

w c:documents and settingsAll UsersApplication DataMicrosoft Help
2010-01-17 22:44

---

d

---

w c:program filesMicrosoft Works
2010-01-17 14:18

---

d

---

w c:program filesAvira
2010-01-17 14:18

---

d

---

w c:documents and settingsAll UsersApplication DataAvira
2010-01-17 09:33

---

d

---

w c:documents and settingsAdminApplication DataYandex
2010-01-16 18:22

---

d

---

w c:program filesMSBuild
2010-01-16 18:21

---

d

---

w c:program filesReference Assemblies
2010-01-16 14:02

---

d

---

w c:program filesMicrosoft CAPICOM 2.1.0.2
2010-01-16 13:54

---

d

---

w c:program filesMSXML 4.0
2010-01-16 10:35

---

d

---

w c:program filesKaspersky Lab
2010-01-13 09:51

---

d

---

w c:program filesGetData
2010-01-09 09:16

---

d

---

w c:program filesSuperCleaner
2010-01-07 12:03

---

d

---

w c:program filesDAEMON Tools
2010-01-07 09:37

---

d

---

w c:documents and settingsAdminApplication DataTalkback
2010-01-06 16:39

---

d

---

w c:program filesMiranda
2010-01-06 16:37

---

d

---

w c:program filesICQToolbar
2010-01-06 16:37

---

d

---

w c:documents and settingsAdminApplication DataICQ Toolbar
2010-01-06 16:36

---

d

---

w c:documents and settingsAdminApplication DataICQLite
2010-01-06 13:14

---

d

---

w c:program filesuTorrent
2010-01-06 09:53 223,128 —-a-w c:windowssystem32driversdtscsi.sys
2010-01-05 20:58

---

d

---

w c:program filesPunto Switcher
2010-01-05 20:53

---

d

---

w c:program filesMedia Key
2010-01-05 20:47

---

d

---

w c:program filesCommon FilesNewSoft
2010-01-05 20:46

---

d

---

w c:program filesNewSoft
2010-01-05 20:46

---

d

---

w c:program filesCommon FilesPDFView
2010-01-05 20:45

---

d

---

w c:program filesCommon FilesInstallShield
2010-01-05 20:45

---

d

---

w c:documents and settingsAll UsersApplication DataInstallShield
2010-01-05 20:45

---

d

---

w c:documents and settingsAdminApplication DataScanSoft
2010-01-05 20:44

---

d

---

w c:program filesScanSoft
2010-01-05 20:44

---

d

---

w c:program filesCommon FilesScanSoft Shared
2010-01-05 20:44

---

d

---

w c:documents and settingsAll UsersApplication DataScanSoft
2010-01-05 20:39

---

d

---

w c:program filesCanon
2010-01-05 20:39

---

d

---

w c:documents and settingsAll UsersApplication DataCanonIJPLM
2010-01-05 20:36

---

d

---

w c:program filesCommon FilesCANON
2010-01-05 20:32

---

d—h—w c:program filesCanonBJ
2010-01-05 20:32

---

d—h—w c:documents and settingsAll UsersApplication DataCanonBJ
2009-11-25 08:19 56,816 —-a-w c:windowssystem32driversavgntflt.sys
2009-11-21 16:03 471,552 —-a-w c:windowsAppPatchaclayers.dll
2009-10-29 07:43 916,480 —-a-w c:windowssystem32wininet.dll
2009-10-21 05:40 75,776 —-a-w c:windowssystem32strmfilt.dll
2009-10-21 05:40 25,088 —-a-w c:windowssystem32httpapi.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-03-23 132096]
«IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=»c:program filesCommon FilesNeroLibNMIndexStoreSvr.exe» [2008-02-28 1828136]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2004-11-13 205824]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«GrooveMonitor»=»c:program filesMicrosoft OfficeOffice12GrooveMonitor.exe» [2008-10-25 31072]
«NeroFilterCheck»=»c:program filesCommon FilesNeroLibNeroCheck.exe» [2008-02-28 570664]
«OODefragTray»=»c:windowssystem32oodtray.exe» [2009-02-25 2553088]
«RemoteControl9″=»c:program filesCyberLinkPowerDVD9PDVD9Serv.exe» [2009-09-22 87336]
«BDRegion»=»c:program filesCyberlinkShared Filesbrs.exe» [2009-08-28 75048]
«avast!»=»c:progra~1ALWILS~1Avast4ashDisp.exe» [2008-11-26 81000]
«MAgent»=»c:program filesMail.RuAgentMAgent.exe» [2010-03-02 5600952]
«FineReader7NewsReaderPro»=»c:program filesABBYY FineReader 7.0 Professional EditionAbbyyNewsReader.exe» [2003-08-20 278528]
«CanonSolutionMenu»=»c:program filesCanonSolutionMenuCNSLMAIN.exe» [2007-05-14 644696]
«CanonMyPrinter»=»c:program filesCanonMyPrinterBJMyPrt.exe» [2007-04-03 1603152]
«SSBkgdUpdate»=»c:program filesCommon FilesScansoft SharedSSBkgdUpdateSSBkgdupdate.exe» [2006-10-25 210472]
«OpwareSE4″=»c:program filesScanSoftOmniPageSE4OpwareSE4.exe» [2007-02-04 79400]
«DAEMON Tools»=»c:program filesDAEMON Toolsdaemon.exe» [2005-12-10 133016]
«avgnt»=»c:program filesAviraAntiVir Desktopavgnt.exe» [2009-03-02 209153]
«RTHDCPL»=»RTHDCPL.EXE» [2008-08-26 c:windowsRTHDCPL.EXE]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-03-23 132096]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» [2009-03-08 c:windowssystem32advpack.dll]
«IE7_012″=»advpack.dll» [2009-03-08 c:windowssystem32advpack.dll]

c:documents and settingsAll Usersѓ« ў­®Ґ ¬Ґ­оЏа®Ја ¬¬лЂўв®§ Јаг§Є 
Media Key.lnk — c:program filesMedia KeyMagicKey.exe [2010-01-05 159744]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)
«NoSMHelp»= 1 (0x1)

[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)
«NoSMHelp»= 1 (0x1)

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]
«vidc.I420″= i420vfw.dll
«VIDC.X264″= x264vfw.dll
«VIDC.HFYU»= huffyuv.dll
«vidc.i263″= i263_32.drv
«msacm.l3fhg»= mp3fhg.acm
«msacm.divxa32″= divxa32.acm
«msacm.imc»= imc32.acm

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusOverride»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\CyberLink\PowerDVD9\PowerDVD9.exe»=
«c:\Program Files\uTorrent\uTorrent.exe»=
«d:\Мои документы\Для ИГР\Games\S.T.A.L.K.E.R\bin\XR_3DA.exe»=
«d:\Мои документы\Для ИГР\Games\S.T.A.L.K.E.R\bin\dedicated\XR_3DA.exe»=

R1 aswSP;avast! Self Protection;c:windowssystem32driversaswSP.sys [2010-03-01 111184]
R1 kbfilter;Keyboard Filter Driver;c:windowssystem32driverskbfilter.sys [2010-01-05 12856]
R1 UsbFltr;WayTechUSBFilterDriver;c:windowssystem32driversUsbFltr.sys [2010-01-05 9291]
R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2010/03/01 19:58:06];??c:program filesCyberLinkPowerDVD9000.fcl [2009-09-22 18:14:42 87536]
R2 AntiVirSchedulerService;Avira AntiVir Планировщик;»c:program filesAviraAntiVir Desktopsched.exe» [2010-01-17 108289]
R2 aswFsBlk;aswFsBlk;c:windowssystem32DRIVERSaswFsBlk.sys [2010-03-01 20560]
R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:windowssystem32DRIVERSl151x86.sys [2010-03-01 37376]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionsvchost]
DcomLaunch REG_MULTI_SZ DcomLaunch TermService Netprotocol

[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled components>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
«c:windowssystem32rundll32.exe» «c:windowssystem32iedkcs32.dll»,BrandIEActiveSetup SIGNUP
.
— — — — ORPHANS REMOVED — — — —

HKCU-Run-ctfmon.exe — c:windowssystem32ctfmon.exe
HKU-Default-Run-CTFMON.EXE — c:windowssystem32CTFMON.EXE

.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.mail.ru
uDefault_Search_URL = hxxp://search.qip.ru
uSearchURL,(Default) = Root: HKCU; Subkey: SoftwareMicrosoftInternet ExplorerSearchUrl; ValueType: string; ValueName: ‘; ValueData: ‘; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
IE: &ICQ Toolbar Search — c:program filesICQToolbartoolbaru.dll/SEARCH.HTML
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:program filesMail.RuAgentmagent.exe
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:program filesMail.RuAgentmagent.exe —
FF — ProfilePath — c:documents and settingsAdminApplication DataMozillaFirefoxProfilesnahd6ha2.default
FF — prefs.js: browser.search.selectedEngine — Google
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-19 19:51:36
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘winlogon.exe'(780)
c:windowssystem32SETUPAPI.dll
c:windowssystem32Ati2evxx.dll
c:windowssystem32cscui.dll
c:windowssystem32COMRes.dll

— — — — — — — > ‘lsass.exe'(844)
c:windowssystem32setupapi.dll
.
Completion time: 2010-01-19 19:52:17
ComboFix-quarantined-files.txt 2010-01-19 16:52:01
ComboFix2.txt 2010-01-16 11:59:28

Pre-Run: 15 939 170 304 байт свободно
Post-Run: 16,012,652,544 байт свободно

208 — E O F — 2010-01-17 22:48:54

[Аноним]

Валерий,ну куда же вы пропали??(((((( 😥

[Автор]

Сообщения