Посмотрите лог после работы Combofix

[Аноним]

ComboFix 09-02-17.02 — Andrew 2009-02-19 12:54:56.4 — NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1251.1.1049.18.2047.1534 [GMT 5:00]
Running from: c:!андрейComboFix.exe
Command switches used :: c:documents and settingsAndrewРабочий столCFScript.txt
AV: avast! antivirus 4.8.1335 [VPS 090218-0] *On-access scanning disabled* (Updated)
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2009-01-19 to 2009-02-19 )))))))))))))))))))))))))))))))
.

2009-02-19 03:39 . 2009-02-19 04:01

d

---

C:Диск Е
2009-02-19 02:41 . 2009-02-19 02:41 d

---

c:program filesBurnAware Free
2009-02-19 02:41 . 2004-05-04 11:53 1,645,320 —a

---

c:windowssystem32gdiplus.dll
2009-02-19 02:34 . 2009-02-19 02:34 d

---

c:program filesMSXML 4.0
2009-02-18 21:20 . 2009-02-18 21:20 d

---

c:documents and settingsAndrewApplication DataNero
2009-02-18 21:18 . 2009-02-19 02:31 d

---

c:documents and settingsAll Users.WINDOWSApplication DataNero
2009-02-18 20:22 . 2009-02-18 20:22 d

---

c:program filesCommon FilesArsenal Shared
2009-02-18 19:50 . 2009-02-18 19:50 d

---

c:documents and settingsAndrewWINDOWS
2009-02-18 19:46 . 2005-03-30 18:08 16,343 -ra

---

C:exe4jlib.jar
2009-02-18 19:46 . 2005-04-10 21:14 4,141 —a

---

C:meerkatRun.jar
2009-02-18 15:08 . 2009-02-18 15:15 d

---

c:program filesSWAT 4
2009-02-18 02:35 . 2009-02-18 02:35 d

---

c:documents and settingsAndrewApplication DataPokiPokerDemo
2009-02-18 01:41 . 2009-02-18 01:41 d

---

c:documents and settingsAndrewApplication DataWindows Search
2009-02-17 21:13 . 2005-04-10 20:10 d

---

c:program filesPokiPoker
2009-02-17 21:12 . 2009-02-17 21:12 239 —a

---

c:windowspokerwin.ini
2009-02-17 21:10 . 2009-02-17 21:10 d

---

c:program filesPokiPokerDemo
2009-02-15 03:16 . 2009-02-15 03:18 d

---

c:windowsNV3188948.TMP
2009-02-15 03:16 . 2008-09-17 23:55 201,050 —a

---

c:windowssystem32nvapps.nvb
2009-02-15 03:15 . 2009-02-19 09:44 d

---

c:program filesWindows Desktop Search
2009-02-15 03:14 . 2009-02-15 03:14 d

---

c:windowssystem32URTTEMP
2009-02-15 03:14 . 2008-03-07 22:02 192,000

---

c— c:windowssystem32dllcacheofffilt.dll
2009-02-15 03:14 . 2008-03-07 22:02 98,304

---

c— c:windowssystem32dllcachenlhtml.dll
2009-02-15 03:14 . 2008-03-07 22:02 29,696

---

c— c:windowssystem32dllcachemimefilt.dll
2009-02-15 00:17 . 2009-02-19 03:13 dr-hs—- C:SYSTEM
2009-02-11 20:13 . 2009-02-11 20:13 90,640 —a

---

c:windowssystem32launchinie.dll
2009-02-11 13:30 . 2009-02-11 13:30 d

---

c:program filesFree DVD MP3 Ripper
2009-02-08 23:18 . 2009-02-08 23:18 d

---

c:program filesCommon FilesVbox
2009-02-08 23:18 . 2009-02-08 23:18 d

---

c:program filesBradbury
2009-02-06 11:50 . 2009-02-06 11:50 d

---

c:program filesNOS
2009-02-06 11:50 . 2009-02-06 11:50 d

---

c:documents and settingsAll Users.WINDOWSApplication DataNOS
2009-02-06 09:16 . 2009-02-06 09:17 d

---

c:windowssystem32Adobe
2009-02-06 04:37 . 2009-02-06 04:37 d

---

c:documents and settingsAll Users.WINDOWSApplication DataMacrovision
2009-02-06 04:32 . 2009-02-06 04:32 d

---

c:program filesCommon FilesMacromedia Shared
2009-02-06 04:32 . 2009-02-08 23:17 d

---

c:program filesCommon FilesMacromedia
2009-02-06 04:32 . 2003-07-30 18:28 974,848 —a

---

c:windowssystem32mfc70.dll
2009-02-06 04:32 . 2003-07-30 18:28 487,424 —a

---

c:windowssystem32msvcp70.dll
2009-02-06 04:32 . 2003-07-30 18:28 344,064 —a

---

c:windowssystem32msvcr70.dll
2009-02-06 04:31 . 2009-02-08 23:17 d

---

c:program filesMacromedia
2009-02-05 21:54 . 2009-02-15 08:29 d

---

c:documents and settingsAndrewApplication DataskypePM
2009-02-05 21:54 . 2009-02-05 21:54 56 —ah

---

c:windowssystem32ezsidmv.dat
2009-02-05 21:51 . 2009-02-15 08:30 d

---

c:documents and settingsAndrewApplication DataSkype
2009-02-05 10:17 . 2009-02-05 10:17 d

---

c:program files7-Zip
2009-01-31 13:16 . 2009-01-31 13:34 38 —a

---

c:windowsavisplitter.INI
2009-01-31 08:25 . 2009-01-31 08:25 55,702 —a

---

C:Системная ошибка copy.jpg
2009-01-30 18:53 . 2009-01-30 18:56 d

---

c:documents and settingsAndrewApplication DataZepsoft
2009-01-30 18:53 . 2009-01-30 18:53 724,992 —a

---

c:windowsiun6002.exe
2009-01-30 18:53 . 2009-01-30 18:53 16 —a

---

c:windowstcpdt2k.dat
2009-01-29 21:58 . 2009-01-30 12:42 d

---

c:program filesOlympus VLC Lite
2009-01-29 01:09 . 2009-01-29 01:09 d

---

c:documents and settingsAndrewApplication DataOlympus ICQ Corp
2009-01-29 00:44 . 2009-01-29 00:55 d

---

c:windowsSxsCaPendDel
2009-01-29 00:44 . 2009-01-29 00:44 d

---

C:ff5cede1565a708d7a4801a58857c573
2009-01-29 00:44 . 2009-01-29 00:44 224 —a

---

c:windowssystem32spupdsvc.inf
2009-01-28 22:59 . 2009-01-28 22:59 38 —a

---

c:windowssystem32driversSbCtri.exe
2009-01-28 20:48 . 2009-01-28 20:48 d

---

c:program filesPlay+Smile
2009-01-28 16:10 . 2008-05-09 15:56 512,000

---

c— c:windowssystem32dllcachejscript.dll
2009-01-28 16:10 . 2008-05-09 15:56 430,080

---

c— c:windowssystem32dllcachevbscript.dll
2009-01-28 16:10 . 2008-05-09 15:56 180,224

---

c— c:windowssystem32dllcachescrobj.dll
2009-01-28 16:10 . 2008-05-09 15:56 172,032

---

c— c:windowssystem32dllcachescrrun.dll
2009-01-28 16:10 . 2008-05-08 16:24 155,648

---

c— c:windowssystem32dllcachewscript.exe
2009-01-28 16:10 . 2008-05-09 13:45 135,168

---

c— c:windowssystem32dllcachecscript.exe
2009-01-28 16:10 . 2008-05-09 15:56 90,112

---

c— c:windowssystem32dllcachewshext.dll
2009-01-28 12:53 . 2009-01-28 12:53 d

---

c:documents and settingsAll Users.WINDOWSApplication DataLavasoft
2009-01-28 08:47 . 2006-12-29 00:31 19,569 —a

---

c:windows000001_.tmp
2009-01-27 21:38 . 2009-01-27 21:38 d

---

c:documents and settingsAndrewApplication DataEbkReader
2009-01-27 21:34 . 2009-01-27 22:04 d

---

c:program filesStraighthold Trader
2009-01-27 19:41 . 2008-04-13 23:53 1,309,184

---

c:windowssystem32driversmtlstrm.sys
2009-01-27 19:40 . 2006-12-29 00:31 19,569 —a

---

c:windows002744_.tmp
2009-01-27 04:28 . 2006-06-29 13:07 14,048

---

c:windowssystem32spmsg2.dll
2009-01-27 04:23 . 2008-12-21 04:03 6,066,688

---

c— c:windowssystem32dllcacheieframe.dll
2009-01-27 04:23 . 2007-04-17 14:32 2,455,488

---

c— c:windowssystem32dllcacheieapfltr.dat
2009-01-27 04:23 . 2007-03-08 10:12 1,060,864

---

c— c:windowssystem32dllcacheieframe.dll.mui
2009-01-27 04:23 . 2008-12-21 04:03 459,264

---

c— c:windowssystem32dllcachemsfeeds.dll
2009-01-27 04:23 . 2008-12-21 04:03 383,488

---

c— c:windowssystem32dllcacheieapfltr.dll
2009-01-27 04:23 . 2008-12-21 04:03 267,776

---

c— c:windowssystem32dllcacheiertutil.dll
2009-01-27 04:23 . 2008-12-21 04:03 63,488

---

c— c:windowssystem32dllcacheicardie.dll
2009-01-27 04:23 . 2008-12-21 04:03 52,224

---

c— c:windowssystem32dllcachemsfeedsbs.dll
2009-01-27 04:23 . 2008-12-19 14:10 13,824

---

c— c:windowssystem32dllcacheieudinit.exe
2009-01-27 04:18 . 2007-04-09 12:23 28,040 —a

---

c:windowssystem32mdimon.dll
2009-01-26 23:56 . 2008-12-11 15:57 333,952

---

c— c:windowssystem32dllcachesrv.sys
2009-01-26 22:07 . 2009-01-26 22:07 d

---

c:program filesPokerStrategy
2009-01-26 21:19 . 2005-04-14 16:33 3,638 —ah

---

c:windowsps.ico
2009-01-26 15:23 . 2008-10-15 21:37 337,408

---

c— c:windowssystem32dllcachenetapi32.dll
2009-01-26 15:21 . 2008-10-23 17:42 286,720

---

c— c:windowssystem32dllcachegdi32.dll
2009-01-26 15:19 . 2009-01-26 23:35 d

---

c:program filesKyodai Mahjongg
2009-01-26 01:22 . 2009-01-26 01:22 394 —a

---

c:windowsODBC.INI
2009-01-26 01:19 . 2009-01-26 01:19 dr-h

---

C:MSOCache
2009-01-26 00:54 . 2006-10-26 19:56 32,592 —a

---

c:windowssystem32msonpmon.dll
2009-01-25 22:38 . 2009-01-26 01:08 d

---

c:documents and settingsAll Users.WINDOWSApplication DataMicrosoft Help
2009-01-24 13:48 . 2009-01-24 13:48 0 —a

---

c:windowsnsreg.dat
2009-01-24 13:38 . 2009-01-24 13:38 d

---

c:program filesOpera
2009-01-24 13:16 . 2008-10-16 14:08 27,672 —a

---

c:windowssystem32wuapi.dll.mui
2009-01-24 13:14 . 2009-01-24 13:14 d—hs—- c:documents and settingsAndrewUserData
2009-01-23 23:18 . 2009-01-23 23:18 dr-h

---

c:documents and settingsAndrewApplication DataSecuROM
2009-01-23 23:18 . 2009-01-23 23:18 107,888 —a

---

c:windowssystem32CmdLineExt.dll
2009-01-23 23:16 . 2006-11-29 13:06 3,426,072 —a

---

c:windowssystem32d3dx9_32.dll
2009-01-23 23:16 . 2006-12-08 12:02 251,672 —a

---

c:windowssystem32xactengine2_5.dll
2009-01-23 23:16 . 2006-11-15 11:38 15,128 —a

---

c:windowssystem32x3daudio1_1.dll
2009-01-23 17:11 . 2009-01-26 23:20 35,976 —a

---

c:windowsFontData.fdb
2009-01-21 20:14 . 2009-01-21 20:14 d

---

c:documents and settingsAndrewDoctorWeb
2009-01-19 01:29 . 2009-02-16 01:12 151 —a

---

c:windowsPhotoSnapViewer.INI

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-18 22:57

---

d

---

w c:program filesOlympus P2P
2009-02-18 21:31

---

d

---

w c:program filesNero
2009-02-18 16:00

---

d—h—w c:program filesInstallShield Installation Information
2009-02-13 22:11

---

d

---

w c:program filesQIP Infium
2009-02-12 04:13

---

d

---

w c:program filesCommon FilesStardock
2009-02-05 23:29

---

d

---

w c:program filesCommon FilesAdobe
2009-02-05 16:51

---

d

---

w c:documents and settingsAll Users.WINDOWSApplication DataSkype
2009-02-04 12:40

---

d

---

w c:program filesQIP
2009-01-28 08:25 2,828 —sha-w c:documents and settingsAll Users.WINDOWSApplication DataKGyGaAvL.sys
2009-01-26 23:15

---

d

---

w c:program filesMicrosoft Silverlight
2009-01-25 20:07

---

d

---

w c:program filesMSBuild
2009-01-21 15:20

---

d

---

w c:program filesCommon FilesWise Installation Wizard
2009-01-18 17:42

---

d

---

w c:program filesQIP.Online
2009-01-18 15:12

---

d

---

w c:documents and settingsAndrewApplication DataMra
2009-01-18 14:30

---

d

---

w c:documents and settingsAndrewApplication DataMail.Ru
2009-01-16 15:49

---

d

---

w c:documents and settingsAndrewApplication DataAhead
2009-01-13 14:38

---

d

---

w c:documents and settingsAndrewApplication Datavlc
2009-01-13 09:32

---

d

---

w c:program filesRealtek
2009-01-11 18:30

---

d

---

w c:documents and settingsAndrewApplication DataGrym
2009-01-11 16:17

---

d

---

w c:documents and settingsAll Users.WINDOWSApplication DataFreeRIP
2009-01-11 14:17

---

d

---

w c:program filesWinDjView 0.4.1 (Mlg)
2009-01-10 15:28

---

d

---

w c:program filesTotal Commander
2009-01-10 15:24

---

d

---

w c:program filesOlympus WinTray
2009-01-10 14:51

---

d

---

w c:documents and settingsAndrewApplication DataAdobeUM
2009-01-10 14:50

---

d

---

w c:documents and settingsAll Users.WINDOWSApplication DataAdobe Systems
2009-01-10 14:49

---

d

---

w c:program filesCommon FilesAdobe Systems Shared
2009-01-10 14:32 315,392 —-a-w c:windowsHideWin.exe
2009-01-10 14:31

---

d

---

w c:documents and settingsAll Users.WINDOWSApplication DatanView_Profiles
2009-01-10 13:30 14,656 —-a-w c:windowsgdrv.sys
2009-01-10 11:34

---

d

---

w c:documents and settingsAndrewApplication DataMedia Player Classic
2009-01-10 11:33

---

d

---

w c:program filesK-Lite Codec Pack
2009-01-10 11:29 8 —sh—r c:documents and settingsAll Users.WINDOWSApplication DataE9A3C1816A.sys
2009-01-10 11:29

---

d

---

w c:documents and settingsAndrewApplication DataCorel
2009-01-10 11:28

---

d

---

w c:documents and settingsAll Users.WINDOWSApplication DataCorel
2009-01-07 12:51

---

d

---

w c:documents and settings1Application DataskypePM
2009-01-07 12:51

---

d

---

w c:documents and settings1Application DataSkype
2009-01-02 06:37

---

d

---

w c:documents and settings1Application DataQIP.Online
2009-01-01 16:03

---

d

---

w c:program filesCCleaner
2008-12-26 11:06

---

d

---

w c:program filesCommon FilesEasyInfo
2008-12-25 20:43

---

d

---

w c:program filesWindows Media Connect 2
2008-12-24 19:35

---

d

---

w c:program filesAlwil Software
2008-12-20 23:03 826,368 —-a-w c:windowssystem32wininet.dll
2008-12-11 16:07 2,185 —-a-w c:program filesCommon Filesunins000.dat
2008-12-11 16:05 729,520 —-a-w c:program filesCommon Filesunins000.exe
2008-03-09 02:25 236 —ha-w c:program filesCommon Filesdx.reg
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2008-04-14 15360]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2008-09-17 13574144]
«Acrobat Assistant 7.0″=»c:program filesAdobeAcrobat 7.0DistillrAcrotray.exe» [2004-12-14 483328]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2008-09-17 86016]
«avast!»=»c:progra~1ALWILS~1Avast4ashDisp.exe» [2009-02-06 81000]
«nwiz»=»nwiz.exe» [2008-09-17 c:windowssystem32nwiz.exe]
«RTHDCPL»=»RTHDCPL.EXE» [2008-05-07 c:windowsRTHDCPL.exe]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-14 15360]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«TSClientMSIUninstaller»=»c:windowsInstallerTSClientMsiTranstscuinst.vbs» [2007-10-30 13801]
«TSClientAXDisabler»=»c:windowsInstallerTSClientMsiTranstscdsbl.bat» [2008-01-18 2247]

c:documents and settingsAndrewѓ« ў­®Ґ ¬Ґ­оЏа®Ја ¬¬лЂўв®§ Јаг§Є 
Olympus P2P v4.0RC3.lnk — c:program filesOlympus P2PStrongDC.exe [2005-09-10 3002368]

c:documents and settingsAll Users.WINDOWSѓ« ў­®Ґ ¬Ґ­оЏа®Ја ¬¬лЂўв®§ Јаг§Є 
Adobe Acrobat Speed Launcher.lnk — c:windowsInstaller{AC76BA86-1033-0000-7760-000000000002}SC_Acrobat.exe [2009-01-10 25214]
Olympus Wintray.lnk — c:program filesOlympus WinTraywintray.exe [2008-03-07 2251264]

[HKLM~startupfolderC:^Documents and Settings^All Users.WINDOWS^Главное меню^Программы^Автозагрузка^Windows Search.lnk]
path=c:documents and settingsAll Users.WINDOWSГлавное менюПрограммыАвтозагрузкаWindows Search.lnk
backup=c:windowspssWindows Search.lnkCommon Startup

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSkype]
-ra

---

2008-09-23 13:17 21755688 c:program filesSkypePhoneSkype.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«AntiVirusDisableNotify»=dword:00000001
«UpdatesDisableNotify»=dword:00000001
«FirewallOverride»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«c:\WINDOWS\system32\usmt\migwiz.exe»=
«c:\Program Files\Olympus WinTray\wintray.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«c:\Program Files\Skype\Phone\Skype.exe»=
«c:\Program Files\Olympus P2P\StrongDC.exe»=

R1 aswSP;avast! Self Protection;c:windowssystem32driversaswSP.sys [2009-02-19 114768]
R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [2009-02-19 20560]
S3 getPlus(R) Helper;getPlus(R) Helper;c:program filesNOSbingetPlus_HelperSvc.exe [2009-02-06 33752]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{2c59127b-a403-11dd-ac94-001a4d96ee7d}]
ShellAutoRuncommand — SYSTEMS-1-5-21-1482476501-1644491937-682003330-1013USB.exe
Shellopencommand — SYSTEMS-1-5-21-1482476501-1644491937-682003330-1013USB.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{4fd76119-c41d-11dd-ad13-001a4d96ee7d}]
ShellAutoRuncommand — SYSTEMS-1-5-21-1482476501-1644491937-682003330-1013USB.exe
Shellopencommand — SYSTEMS-1-5-21-1482476501-1644491937-682003330-1013USB.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{95c55631-fe69-11dc-98e3-001a4d96ee7d}]
ShellAutoRuncommand — igscqf.exe
ShellexploreCommand — igscqf.exe
ShellopenCommand — igscqf.exe
.
.

---

Supplementary Scan

---

.
uStart Page = start.qip.ru
uDefault_Search_URL = hxxp://search.qip.ru
uSearchURL,(Default) = hxxp://search.qip.ru/search?query=%s&from=IE
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
IE: Convert link target to Adobe PDF — c:program filesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF — c:program filesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF — c:program filesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF — c:program filesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF — c:program filesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF — c:program filesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF — c:program filesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF — c:program filesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
IE: Олимпус: Определить &тип трафика — c:program filesInternet ExplorerSIGNUPchecker.htm
TCP: {93C193B1-08F8-45C9-92DD-0EE677979D26} = 217.76.183.36 217.76.183.38
TCP: {CC2518A5-0FB9-4E54-90A0-44B7AC9237BC} = 10.0.0.1,10.0.0.2
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-19 12:55:28
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

LOCKED REGISTRY KEYS

---

[HKEY_USERSS-1-5-21-2025429265-920026266-839522115-1004SoftwareMicrosoftWindowsCurrentVersionExplorerCLSID]
@Denied: (Full) (LocalSystem)
.
Completion time: 2009-02-19 12:56:22
ComboFix-quarantined-files.txt 2009-02-19 07:56:18
ComboFix2.txt 2009-02-19 07:49:18

Pre-Run: 34 305 118 208 байт свободно
Post-Run: 34,291,912,704 байт свободно

252 — E O F — 2009-02-16 04:18:30

[Admin]

Здравствуйте, добро пожаловать на Spyware-ru форум.

Ваш компьютер заражён autorun.inf трояном.
Прочитайте эту инструкцию Flash_Disinfector ещё одно оружие против autorun.inf троянов.

* Отключите ваш антивирус.
* Скачайте и запустите Flash_Disinfector.
* По требованию программы вставьте ваш флэш диск или подключите другие внешние устройства хранения информации.

Примечание: запускайте программу столько раз, сколько нужно чтобы очистить все ваши подключаемые диски.

Откройте блокнот (Кликните Пуск, Выполнить, в строке ввода введите notepad и нажмите Enter) и вставьте в него следующий текст:

Registry::

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{2c59127b-a403-11dd-ac94-001a4d96ee7d}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{4fd76119-c41d-11dd-ad13-001a4d96ee7d}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{95c55631-fe69-11dc-98e3-001a4d96ee7d}]



RegLock::

[HKEY_USERSS-1-5-21-2025429265-920026266-839522115-1004SoftwareMicrosoftWindowsCurrentVersionExplorerCLSID]



Folder::

c:SYSTEMS-1-5-21-1482476501-1644491937-682003330-1013

Запишите получившийся файл на ваш рабочий стол под именем CFScript
Далее перетащите получившийся файл на иконку Combofix, как показано на картинке ниже.

Сombofix запуститься и выполнит процедуры описанные в созданном нами файле.
По результатам работы Combofix будет создан новый лог, его и вставьте в свой следующий ответ.

[Автор]

Сообщения