Порноинформер!!! Последствия?!

[TimP]

Доброго дня! Поймал на ноут порноинформер (отправить сообщение на 9800) так и не смог найти код его активации, после двух дней войны с ним благодаря вашему форуму и программе combofix (спасибо разработчику) убил эту гадость… после программы остался лог файл , следуя вашему совету вылаживаю его чтоб вы посмотрели не осталось ли чего еще … Заранее благодарен!

ComboFix 10-01-21.08 — Администратор 23.01.2010 0:17.1.1 — x86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.2.1251.7.1049.18.503.369 [GMT 8:00]
Running from: f:softantivircombofixComboFix.exe
AV: Антивирус Касперского *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Антивирус Касперского *enabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:recyclerS-1-5-21-220523388-1788223648-682003330-1003
c:recyclerS-1-5-21-2404759428-818307150-421128549-1003
c:windowssystem32ieuinit.inf
E:Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2009-12-22 to 2010-01-22 )))))))))))))))))))))))))))))))
.

2010-01-22 15:31 . 2010-01-19 13:13 162640 —-a-w- c:windowssystem32driversaswSP.sys
2010-01-22 15:31 . 2010-01-19 11:42 19024 —-a-w- c:windowssystem32driversaswFsBlk.sys
2010-01-22 15:31 . 2010-01-19 11:46 46544 —-a-w- c:windowssystem32driversaswTdi.sys
2010-01-22 15:31 . 2010-01-19 11:43 23248 —-a-w- c:windowssystem32driversaswRdr.sys
2010-01-22 15:31 . 2010-01-19 11:43 100304 —-a-w- c:windowssystem32driversaswmon2.sys
2010-01-22 15:31 . 2010-01-19 11:43 94672 —-a-w- c:windowssystem32driversaswmon.sys
2010-01-22 15:31 . 2010-01-19 11:42 28240 —-a-w- c:windowssystem32driversaavmker4.sys
2010-01-22 15:31 . 2010-01-19 11:57 38848 —-a-w- c:windowssystem32avastSS.scr
2010-01-22 15:31 . 2010-01-19 11:57 152672 —-a-w- c:windowssystem32aswBoot.exe
2010-01-22 15:31 . 2010-01-22 15:31

---

d

---

w- c:program filesAlwil Software
2010-01-22 15:31 . 2010-01-22 15:31

---

d

---

w- c:documents and settingsAll UsersApplication DataAlwil Software
2010-01-22 14:42 . 2010-01-22 14:42

---

d

---

w- c:documents and settingsАдминистраторApplication DataMalwarebytes
2010-01-22 14:41 . 2010-01-07 08:07 38224 —-a-w- c:windowssystem32driversmbamswissarmy.sys
2010-01-22 14:41 . 2010-01-22 14:42

---

d

---

w- c:program filesMalwarebytes’ Anti-Malware
2010-01-22 14:41 . 2010-01-22 14:41

---

d

---

w- c:documents and settingsAll UsersApplication DataMalwarebytes
2010-01-22 14:41 . 2010-01-07 08:07 19160 —-a-w- c:windowssystem32driversmbam.sys
2010-01-22 14:27 . 2010-01-22 14:27

---

d

---

w- c:documents and settingsАдминистраторLocal SettingsApplication DataHelp
2010-01-22 14:09 . 2010-01-22 14:09 11264 —-a-w- c:windowssystem32driversuzi3mzcz.sys
2010-01-22 13:41 . 2010-01-22 13:41

---

d

---

w- c:documents and settingsАдминистраторDoctorWeb
2010-01-20 04:58 . 2010-01-20 04:58 0 —-a-w- c:windowsnsreg.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-22 16:23 . 2009-02-11 00:07 629280 —sha-w- c:windowssystem32driversfidbox2.dat
2010-01-22 16:23 . 2009-02-11 00:07 17183520 —sha-w- c:windowssystem32driversfidbox.dat
2010-01-22 16:22 . 2009-02-11 00:07

---

d

---

w- c:documents and settingsAll UsersApplication DataKaspersky Lab
2010-01-22 15:35 . 2009-02-11 00:07 59852 —sha-w- c:windowssystem32driversfidbox2.idx
2010-01-22 15:35 . 2009-02-11 00:07 231020 —sha-w- c:windowssystem32driversfidbox.idx
2010-01-22 13:48 . 2009-05-20 05:36

---

d

---

w- c:program filesPanda Security
2009-12-15 17:12 . 2009-05-19 07:17

---

d

---

w- c:program filesICQToolbar
2009-11-05 16:57 . 2004-09-08 08:20 66016 —-a-w- c:windowssystem32perfc019.dat
2009-11-05 16:57 . 2004-09-08 08:20 424776 —-a-w- c:windowssystem32perfh019.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2007-01-31 205824]
«swg»=»c:program filesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe» [2009-05-30 68856]
«WMPNSCFG»=»c:program filesWindows Media PlayerWMPNSCFG.exe» [2006-11-02 204288]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«SoundMAXPnP»=»c:program filesAnalog DevicesCoresmax4pnp.exe» [2005-05-20 925696]
«SunJavaUpdateSched»=»c:program filesJavajre1.5.0_06binjusched.exe» [2005-11-10 36975]
«PTHOSTTR»=»c:program filesHPQHP ProtectTools Security ManagerPTHOSTTR.EXE» [2006-02-14 122880]
«HP Software Update»=»c:program filesHpHP Software UpdateHPWuSchd2.exe» [2005-02-16 49152]
«DLA»=»c:windowsSystem32DLADLACTRLW.EXE» [2005-08-31 122940]
«SynTPEnh»=»c:program filesSynapticsSynTPSynTPEnh.exe» [2005-11-10 761945]
«igfxtray»=»c:windowssystem32igfxtray.exe» [2006-03-23 94208]
«igfxhkcmd»=»c:windowssystem32hkcmd.exe» [2006-03-23 77824]
«igfxpers»=»c:windowssystem32igfxpers.exe» [2006-03-23 118784]
«hpWirelessAssistant»=»c:program fileshpqHP Wireless AssistantHP Wireless Assistant.exe» [2006-02-14 454656]
«CognizanceTS»=»c:progra~1HPQIAMBinAsTsVcc.dll» [2003-12-22 17920]
«QlbCtrl»=»c:program filesHewlett-PackardHP Quick Launch ButtonsQlbCtrl.exe» [2006-03-02 131072]
«Cpqset»=»c:program filesHPQDefault Settingscpqset.exe» [2006-02-22 40960]
«Recguard»=»c:windowsSminstRecguard.exe» [2005-12-20 1187840]
«Reminder»=»c:windowsCreatorRemind_XP.exe» [2006-01-23 802816]
«Scheduler»=»c:windowsSMINSTScheduler.exe» [2006-02-15 892928]
«WatchDog»=»c:program filesInterVideoDVD CheckDVDCheck.exe» [2005-11-08 184320]
«HPUsageTracking»=»c:program filesHPHP UTbinhppusg.exe» [2007-05-04 36864]
«avast5″=»c:progra~1ALWILS~1Avast5avastUI.exe» [2010-01-19 2743104]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2004-08-18 15360]

c:documents and settingsAll Usersѓ« ў­®Ґ ¬Ґ­оЏа®Ја ¬¬лЂўв®§ Јаг§Є 
DVD Check.lnk — c:program filesInterVideoDVD CheckDVDCheck.exe [2009-1-16 184320]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotifyOneCard]
2005-07-25 18:41 40960 —-a-w- c:program filesHPQIAMBinAsWlnPkg.dll

[HKLM~startupfolderC:^Documents and Settings^All Users^Главное меню^Программы^Автозагрузка^Adobe Reader Speed Launch.lnk]
path=c:documents and settingsAll UsersГлавное менюПрограммыАвтозагрузкаAdobe Reader Speed Launch.lnk
backup=c:windowspssAdobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregICQ]
2009-05-19 07:18 177400 —-a-w- c:program filesICQ6ICQ.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregswg]
2009-05-30 09:03 68856 —-a-w- c:program filesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringKasperskyAntiVirus]
«DisableMonitoring»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«c:\WINDOWS\SMINST\Scheduler.exe»=
«c:\WINDOWS\system32\spool\drivers\w32x86\3\HP1006MC.EXE»=
«c:\Program Files\ICQ6\ICQ.exe»=

R1 aswSP;aswSP;c:windowssystem32driversaswSP.sys [22.01.2010 23:31 162640]
R1 uzi3mzcz;AVZ-RK Kernel Driver;c:windowssystem32driversuzi3mzcz.sys [22.01.2010 22:09 11264]
R2 2GIS UpdateClientService;2GIS UpdateClientService;c:program files2gisUpdateClientWin32UpdateClientService.exe [17.09.2008 11:03 1134592]
R2 ASChannel;Local Communication Channel;c:windowsSystem32svchost.exe -k Cognizance [18.08.2004 16:00 14336]
R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [22.01.2010 23:31 19024]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:windowssystem32driversklim5.sys [30.05.2007 18:49 24344]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionsvchost]
Cognizance REG_MULTI_SZ ASChannel

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2E]
ShellAutoRuncommand — c:windowssystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{2ab5d213-75b6-11de-93c6-001a7332cac2}]
ShellAutoRuncommand — wscript.exe ..vbs
Shellopencommand — wscript.exe ..vbs

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{2bcb6e9f-3ae0-11de-933b-001a7332cac2}]
ShellAutoRuncommand — f:recyclersEtUp.exe
ShellOpENcOMMaND — f:recyclersEtUp.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{5efa63b8-9b6a-11de-93eb-001a7332cac2}]
ShellAutoRuncommand — wscript.exe ..vbs
Shellopencommand — wscript.exe ..vbs

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{60f320db-a115-11de-93f0-001a7332cac2}]
ShellAutoRuncommand — wscript.exe ..vbs
Shellopencommand — wscript.exe ..vbs

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{ee047885-6b72-11de-93a4-001a7332cac2}]
ShELlAutoRuncommand — f:cachetmp983.exe
ShELloPENcoMmaNd — f:cachetmp983.exe
.
Contents of the ‘Scheduled Tasks’ folder
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://start.icq.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
IE: Google ВикиКомментарии… — c:program filesGoogleGoogle ToolbarComponentGoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: Добавить в Анти-Баннер — c:program filesKaspersky LabKaspersky Anti-Virus 6.0 for Windows Workstationsie_banner_deny.htm
TCP: {FD05540A-0BD7-475F-8922-97509DC3A2B5} = 87.103.161.61,92.124.194.206
FF — ProfilePath — c:documents and settingsХоринский МСОApplication DataMozillaFirefoxProfilesi6400pk1.default
FF — plugin: c:program filesJavajre1.5.0_06binNPJava11.dll
FF — plugin: c:program filesJavajre1.5.0_06binNPJava12.dll
FF — plugin: c:program filesJavajre1.5.0_06binNPJava13.dll
FF — plugin: c:program filesJavajre1.5.0_06binNPJava14.dll
FF — plugin: c:program filesJavajre1.5.0_06binNPJava32.dll
FF — plugin: c:program filesJavajre1.5.0_06binNPJPI150_06.dll
FF — plugin: c:program filesJavajre1.5.0_06binNPOJI610.dll
.
— — — — ORPHANS REMOVED — — — —

BHO-{0258A350-8F7E-48ED-FEE7-D98A7C251E95} — %APPDATA%aMSeu3_S_Ba6heSM.dll
BHO-{257AC351-107B-63EC-1444-5F307B98A298} — %APPDATA%msmedia.dll
BHO-{88888888-8888-8888-8888-888888888888} — (no file)
ShellExecuteHooks-{16664848-0E00-11D2-8059-000000000000} — (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-23 00:22
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLMSoftwareMicrosoftWindowsCurrentVersionRun
Cpqset = c:program filesHPQDefault Settingscpqset.exe?????? ???@???????????????@? ????X??????(?@???????@

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘winlogon.exe'(1024)
c:windowssystem32klogon.dll
c:program filesHPQIAMBinAsWlnPkg.dll

— — — — — — — > ‘explorer.exe'(3896)
c:program filesHPQIAMBinSFSShell.dll
c:program filesHPQIAMbinItMsg.dll
c:windowssystem32msi.dll
c:windowssystem32WPDShServiceObj.dll
c:windowssystem32PortableDeviceTypes.dll
c:windowssystem32PortableDeviceApi.dll
.

---

Other Running Processes

---

.
c:windowssystem32DllHost.exe
c:program filesHPQIAMbinasghost.exe
c:program filesKaspersky LabKaspersky Anti-Virus 6.0 for Windows Workstationsavp.exe
c:program filesCommon FilesLightScribeLSSrvc.exe
c:program filesHewlett-PackardSharedhpqwmiex.exe
c:program filesWindows Media PlayerWMPNetwk.exe
c:windowssystem32wscntfy.exe
c:windowssystem32igfxsrvc.exe
c:program filesKaspersky LabKaspersky Anti-Virus 6.0 for Windows Workstationsavp.exe
c:progra~1HPQSharedHPQTOA~1.EXE
c:windowsSystem32spoolDRIVERSW32X863HP1006MC.EXE
.
**************************************************************************
.
Completion time: 2010-01-23 00:47:36 — machine was rebooted
ComboFix-quarantined-files.txt 2010-01-22 16:26

Pre-Run: 57 510 129 664 байт свободно
Post-Run: 57 642 110 976 байт свободно

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)WINDOWS
[operating systems]
c:cmdconsBOOTSECT.DAT=»Microsoft Windows Recovery Console» /cmdcons
multi(0)disk(0)rdisk(0)partition(1)WINDOWS=»Microsoft Windows XP Home Edition RU» /noexecute=optin /fastdetect

— — End Of File — — 0CE01455899C36DF476C0CECFD5448DF

[TimP]

up

[Автор]

Сообщения