пожалуйста Посмотрите log, кто понимает! Каков вердикт?

[buch_lazy]

ComboFix 10-02-01.05 — Валек 02.02.2010 18:56:01.1.2 — x86
Microsoft Windows 7 Максимальная 6.1.7600.0.1251.7.1049.18.3067.2173 [GMT 3:00]
Running from: c:usersВалекDesktopComboFix.exe
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:program filesMail.RuAgentMradllnewmrasearch.dll
c:programdataMicrosoftNetworkDownloaderqmgr0.dat
c:programdataMicrosoftNetworkDownloaderqmgr1.dat

---

BITS: Possible infected sites

---

hxxp://soft.export.yandex.ru
.
((((((((((((((((((((((((( Files Created from 2010-01-02 to 2010-02-02 )))))))))))))))))))))))))))))))
.

2010-02-01 21:12 . 2010-02-01 21:12

---

d

---

w- c:users1EB6~1AppDataRoamingKikobox
2010-02-01 21:12 . 2010-02-01 21:12

---

d

---

w- c:usersВалекAppDataRoamingKikobox
2010-02-01 21:12 . 2010-02-01 21:12

---

d

---

w- c:program filesВиджет_Ведомости
2010-01-27 06:30 . 2009-10-31 05:45 2614272 —-a-w- c:windowsexplorer.exe
2010-01-27 06:30 . 2009-10-28 06:17 285696 —-a-w- c:windowssystem32winlogon.exe
2010-01-22 17:00 . 2006-11-06 05:00 69632 —-a-w- c:windowssystem32Spoolprtprocsw32x86CNMPP8O.DLL
2010-01-22 17:00 . 2006-11-06 05:00 27136 —-a-w- c:windowssystem32Spoolprtprocsw32x86CNMPD8O.DLL
2010-01-22 17:00 . 2010-01-22 17:00

---

d—h—w- c:windowssystem32CanonIJ Uninstaller Information
2010-01-22 17:00 . 2006-11-06 05:00 198656 —-a-w- c:windowssystem32CNMLM8O.DLL
2010-01-22 17:00 . 2010-01-22 17:00

---

d—h—w- c:program filesCanonBJ
2010-01-22 16:59 . 2010-01-22 16:59

---

d—h—w- c:programdataCanonBJ
2010-01-22 16:59 . 2009-07-14 01:15 71168 —-a-w- c:windowssystem32Spoolprtprocsw32x86CNBPP4.DLL
2010-01-22 10:45 . 2002-11-01 11:29 24576

---

w- c:windowssystem32UleadPhotoExplorer8_Res.dll
2010-01-22 10:45 . 2002-11-01 11:28 24576

---

w- c:windowssystem32Ulead Photo Explorer 8.scr
2010-01-22 10:31 . 2010-01-22 10:45

---

d

---

w- c:program filesCommon FilesUlead Systems
2010-01-22 10:30 . 2010-01-23 17:27

---

d

---

w- c:program filesUlead Systems
2010-01-21 22:24 . 2009-12-19 09:02 977920 —-a-w- c:windowssystem32wininet.dll
2010-01-18 13:54 . 2010-02-02 14:59

---

d

---

w- c:users1EB6~1AppDataRoamingSkype
2010-01-18 13:54 . 2010-02-02 14:59

---

d

---

w- c:usersВалекAppDataRoamingSkype
2010-01-18 13:54 . 2010-01-18 13:54

---

d

---

r- c:program filesSkype
2010-01-16 21:46 . 2010-01-17 02:02

---

d

---

w- c:programdataCA
2010-01-15 16:33 . 2010-01-15 16:33

---

d

---

w- C:Temp
2010-01-13 06:37 . 2009-10-19 14:10 108544 —-a-w- c:windowssystem32t2embed.dll
2010-01-13 06:37 . 2009-10-19 14:10 70656 —-a-w- c:windowssystem32fontsub.dll
2010-01-13 05:17 . 2010-01-13 05:17

---

d

---

w- c:users1EB6~1AppDataRoamingRadmin
2010-01-13 05:17 . 2010-01-13 05:17

---

d

---

w- c:usersВалекAppDataRoamingRadmin
2010-01-13 05:16 . 2010-01-13 05:16

---

d

---

w- c:program filesRadmin Viewer 3
2010-01-13 05:16 . 2010-01-13 05:16

---

d

---

w- c:users1EB6~1AppDataLocalDownloaded Installations
2010-01-13 05:16 . 2010-01-13 05:16

---

d

---

w- c:usersВалекAppDataLocalDownloaded Installations
2010-01-13 05:01 . 2010-01-13 05:02 10562179 —-a-w- c:usersВалекradmin34ru.zip
2010-01-10 22:18 . 2010-01-10 22:18

---

d

---

w- c:program filesGI
2010-01-09 13:03 . 2010-01-09 13:44

---

d

---

w- c:users1EB6~1AppDataLocalApplicationHistory
2010-01-09 13:03 . 2010-01-09 13:44

---

d

---

w- c:usersВалекAppDataLocalApplicationHistory
2010-01-09 13:03 . 2010-01-09 13:03 93 —-a-w- c:users1EB6~1AppDataLocalfusioncache.dat
2010-01-09 13:03 . 2010-01-09 13:03 93 —-a-w- c:usersВалекAppDataLocalfusioncache.dat
2010-01-09 13:02 . 2010-01-09 13:02

---

d

---

w- c:windowssystem32URTTEMP
2010-01-09 13:01 . 2010-01-09 13:01

---

d

---

w- c:windowssystem32QuickTime
2010-01-09 13:00 . 2010-01-09 13:00

---

d

---

w- c:program filesУниверсальная йога для всех
2010-01-08 13:59 . 2010-01-08 13:59

---

d

---

w- c:users1EB6~1AppDataRoamingDaoisoft
2010-01-08 13:59 . 2010-01-08 13:59

---

d

---

w- c:usersВалекAppDataRoamingDaoisoft
2010-01-08 04:27 . 2010-01-29 18:48

---

d

---

w- c:usersВалекОпа!

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-02 16:16 . 2009-11-10 18:15 9437184 —sha-w- c:usersВалекntuser.dat
2010-02-02 14:59 . 2010-01-18 13:54

---

d

---

w- c:usersВалекAppDataRoamingSkype
2010-02-02 14:59 . 2009-11-10 19:12

---

d

---

w- c:users1EB6~1AppDataRoaminguTorrent
2010-02-02 14:59 . 2009-11-10 19:12

---

d

---

w- c:usersВалекAppDataRoaminguTorrent
2010-02-02 14:57 . 2009-11-10 20:01

---

d

---

w- c:program filesSteam
2010-02-02 06:42 . 2009-11-27 15:20

---

d

---

w- c:users1EB6~1AppDataRoamingvlc
2010-02-02 06:42 . 2009-11-27 15:20

---

d

---

w- c:usersВалекAppDataRoamingvlc
2010-02-01 21:12 . 2010-02-01 21:12

---

d

---

w- c:usersВалекAppDataRoamingKikobox
2010-02-01 21:12 . 2010-02-01 21:12

---

d

---

w- c:program filesВиджет_Ведомости
2010-01-29 18:10 . 2009-11-27 15:22

---

d

---

w- c:users1EB6~1AppDataRoamingdvdcss
2010-01-29 18:10 . 2009-11-27 15:22

---

d

---

w- c:usersВалекAppDataRoamingdvdcss
2010-01-28 20:42 . 2009-11-10 19:07

---

d

---

w- c:program filesYandex
2010-01-28 20:42 . 2009-11-10 19:05

---

d

---

w- c:users1EB6~1AppDataRoamingYandex
2010-01-28 20:42 . 2009-11-10 19:05

---

d

---

w- c:usersВалекAppDataRoamingYandex
2010-01-28 20:42 . 2009-11-10 21:51

---

d

---

w- c:users1EB6~1AppDataRoamingSoundSpectrum
2010-01-28 20:42 . 2009-11-10 21:51

---

d

---

w- c:usersВалекAppDataRoamingSoundSpectrum
2010-01-28 20:42 . 2009-11-10 21:50

---

d

---

w- c:program filesSoundSpectrum
2010-01-28 20:22 . 2009-11-10 19:31 120584 —-a-w- c:users1EB6~1AppDataLocalGDIPFONTCACHEV1.DAT
2010-01-28 20:22 . 2009-11-10 19:31 120584 —-a-w- c:usersВалекAppDataLocalGDIPFONTCACHEV1.DAT
2010-01-22 10:45 . 2009-11-12 19:19

---

d—h—w- c:program filesInstallShield Installation Information
2010-01-21 08:21 . 2009-11-13 14:38

---

d

---

w- c:program filesMicrosoft Silverlight
2010-01-18 13:54 . 2009-11-19 22:08

---

d

---

w- c:programdataSkype
2010-01-14 08:12 . 2009-11-10 19:08 181120

---

w- c:windowssystem32MpSigStub.exe
2010-01-13 06:47 . 2009-11-10 18:24

---

d

---

w- c:programdataMicrosoft Help
2010-01-13 05:17 . 2010-01-13 05:17

---

d

---

w- c:usersВалекAppDataRoamingRadmin
2010-01-13 05:02 . 2010-01-13 05:01 10562179 —-a-w- c:usersВалекradmin34ru.zip
2010-01-09 13:03 . 2010-01-09 13:03 93 —-a-w- c:usersВалекAppDataLocalfusioncache.dat
2010-01-09 13:02 . 2009-08-03 16:28 687162 —-a-w- c:windowssystem32perfh019.dat
2010-01-09 13:02 . 2009-08-03 16:28 134692 —-a-w- c:windowssystem32perfc019.dat
2010-01-09 13:00 . 2010-01-09 13:00

---

d

---

w- c:program filesУниверсальная йога для всех
2010-01-08 13:59 . 2010-01-08 13:59

---

d

---

w- c:usersВалекAppDataRoamingDaoisoft
2010-01-01 20:36 . 2010-01-01 20:36

---

d

---

w- c:users1EB6~1AppDataRoamingTouchstone
2010-01-01 20:36 . 2010-01-01 20:36

---

d

---

w- c:usersВалекAppDataRoamingTouchstone
2010-01-01 20:34 . 2009-11-10 22:16

---

d

---

w- c:program filesCommon FilesWise Installation Wizard
2009-12-21 06:29 . 2009-12-21 06:12

---

d

---

w- c:programdataDAEMON Tools Pro
2009-12-21 06:20 . 2009-12-21 06:13

---

d

---

w- c:program filesDAEMON Tools Pro
2009-12-21 06:17 . 2009-12-21 06:12

---

d

---

w- c:users1EB6~1AppDataRoamingDAEMON Tools Pro
2009-12-21 06:17 . 2009-12-21 06:12

---

d

---

w- c:usersВалекAppDataRoamingDAEMON Tools Pro
2009-12-21 06:13 . 2009-12-09 21:23 691696 —-a-w- c:windowssystem32driverssptd.sys
2009-12-16 21:08 . 2009-11-10 18:15

---

d-s—w- c:usersВалекAppDataRoamingMicrosoft
2009-12-12 19:15 . 2009-12-12 19:10

---

d

---

w- c:program filesTweakNow RegCleaner
2009-12-12 19:10 . 2009-12-12 19:10

---

d

---

w- c:users1EB6~1AppDataRoamingTweakNow RegCleaner
2009-12-12 19:10 . 2009-12-12 19:10

---

d

---

w- c:usersВалекAppDataRoamingTweakNow RegCleaner
2009-12-09 19:12 . 2009-12-09 19:12

---

d

---

w- c:users1EB6~1AppDataRoamingAhead
2009-12-09 19:12 . 2009-12-09 19:12

---

d

---

w- c:usersВалекAppDataRoamingAhead
2009-12-09 08:46 . 2009-12-09 08:46

---

d

---

w- c:program filesBRS
2009-12-09 08:46 . 2009-12-09 08:46 445016 —-a-w- c:windowssystem32wrap_oal.dll
2009-12-09 08:46 . 2009-12-09 08:46

---

d

---

w- c:program filesOpenAL
2009-12-09 08:46 . 2009-12-09 08:46 109144 —-a-w- c:windowssystem32OpenAL32.dll
2009-12-07 14:20 . 2009-12-07 14:20

---

d

---

w- c:program filesMicrosoft Games for Windows — LIVE
2009-12-06 16:50 . 2009-12-06 16:50 107888 —-a-w- c:windowssystem32CmdLineExt.dll
2009-11-30 19:41 . 2009-11-30 19:41 319456 —-a-w- c:windowsDIFxAPI.dll
2009-11-30 19:40 . 2009-11-30 19:40 315392 —-a-w- c:windowsHideWin.exe
2009-11-30 15:02 . 2009-11-30 15:02 171144 —-a-w- c:windowssystem32xliveinstall.dll
2009-11-30 15:02 . 2009-11-30 15:02 72840 —-a-w- c:windowssystem32xliveinstallhost.exe
2009-11-18 15:11 . 2009-12-09 08:46 1347584 —-a-w- c:windowssystem32rapture3d_oal.dll
2009-11-16 14:29 . 2009-11-10 18:35 1396400 —-a-w- c:windowssystem32AutoPartNt.exe
2009-11-16 14:16 . 2009-11-10 18:29 114048 —-a-w- c:windowssystem32driverssnapman.sys
2009-11-10 19:04 . 2009-11-10 19:04 0 —-a-w- c:windowsnsreg.dat
2009-11-06 07:59 . 2009-11-06 07:59 15406728 —-a-w- c:windowssystem32xlive.dll
2009-11-06 07:59 . 2009-11-06 07:59 13642888 —-a-w- c:windowssystem32xlivefnt.dll
2009-11-06 06:20 . 2009-11-10 23:14 34112 —-a-w- c:usersВалекAppDataRoamingMozillaFirefoxProfilesht4kyenz.defaultextensions{E2883E8F-472F-4fb0-9522-AC9BF37916A7}chromecontentgetPlusPlus_Adobe_reg_bootstrap.exe
2009-11-06 06:20 . 2009-11-10 23:14 22352 —-a-w- c:usersВалекAppDataRoamingMozillaFirefoxProfilesht4kyenz.defaultextensions{E2883E8F-472F-4fb0-9522-AC9BF37916A7}chromecontentgetPlusPlus_Adobe_reg.exe
2009-06-10 21:26 . 2009-07-14 02:04 9633792 —sha-r- c:windowsFontsStaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 —sha-w- c:windowswinsxsx86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86cWinMail.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«Steam»=»c:program filessteamsteam.exe» [2009-11-24 1217808]
«uTorrent»=»c:program filesuTorrentuTorrent.exe» [2009-11-27 289584]
«Skype»=»c:program filesSkypePhoneSkype.exe» [2009-10-09 25626408]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«GrooveMonitor»=»c:program filesMicrosoft OfficeOffice12GrooveMonitor.exe» [2008-10-25 31072]
«egui»=»c:program filesESETESET NOD32 Antivirusegui.exe» [2009-04-09 2029640]
«MAgent»=»c:program filesMail.RuAgentMAgent.exe» [2009-11-10 7975608]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2009-08-19 13793824]
«TkBellExe»=»c:program filesCommon FilesRealUpdate_OBrealsched.exe» [2009-11-13 198160]
«QuickTime Task»=»c:program filesQuickTimeQTTask.exe» [2009-09-04 417792]
«iTunesHelper»=»c:program filesiTunesiTunesHelper.exe» [2009-10-28 141600]

c:programdataMicrosoftWindowsStart MenuProgramsStartup
Adobe Reader Speed Launch.lnk — c:program filesAdobeAcrobat 7.0Readerreader_sl.exe [2004-12-14 29696]

c:users1EB6~1AppDataRoamingMICROS~1WindowsSTARTM~1ProgramsStartup
‚Ґ¤®¬®бвЁ.lnk — c:program files‚Ё¤¦Ґв_‚Ґ¤®¬®бвЁvedomosti.exe [2010-2-2 88064]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]
«ConsentPromptBehaviorAdmin»= 0 (0x0)
«ConsentPromptBehaviorUser»= 3 (0x3)
«EnableLUA»= 0 (0x0)
«EnableUIADesktopToggle»= 0 (0x0)
«PromptOnSecureDesktop»= 0 (0x0)

R1 ehdrv;ehdrv;c:windowsSystem32driversehdrv.sys [09.04.2009 15:18 107256]
R1 VWiFiFlt;Virtual WiFi Filter Driver;c:windowsSystem32driversvwififlt.sys [14.07.2009 2:52 48128]
R2 cpuz132;cpuz132;c:windowsSystem32driverscpuz132_x32.sys [18.11.2009 0:04 12672]
R2 ekrn;ESET Service;c:program filesESETESET NOD32 Antivirusekrn.exe [09.04.2009 15:19 731840]
R2 epfwwfpr;epfwwfpr;c:windowsSystem32driversepfwwfpr.sys [09.04.2009 15:21 93312]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:windowsSystem32driversnvhda32v.sys [11.05.2009 11:49 64544]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:windowsSystem32driversRtsUStor.sys [03.12.2009 20:06 171520]
R3 SrvHsfHDA;SrvHsfHDA;c:windowsSystem32driversVSTAZL3.SYS [14.07.2009 1:13 207360]
R3 SrvHsfV92;SrvHsfV92;c:windowsSystem32driversVSTDPV3.SYS [14.07.2009 1:13 980992]
R3 SrvHsfWinac;SrvHsfWinac;c:windowsSystem32driversVSTCNXT3.SYS [14.07.2009 1:13 661504]
R3 winbondcir;Winbond IR Transceiver;c:windowsSystem32driverswinbondcir.sys [28.03.2007 7:51 43008]
S0 sptd;sptd;c:windowsSystem32driverssptd.sys [10.12.2009 0:23 691696]
S3 NETw5s32;Драйвер адаптера Intel(R) Wireless WiFi Link для Windows Vista 32 Bit ;c:windowsSystem32driversNETw5s32.sys [15.09.2009 19:40 6114816]
S3 netw5v32;Драйвер адаптера беспроводной связи серии Intel(R) Wireless WiFi Link 5000 для 32-разрядной версии Windows Vista;c:windowsSystem32driversnetw5v32.sys [11.06.2009 0:18 4231168]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:windowsSystem32driversvwifimp.sys [14.07.2009 2:52 14336]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionsvchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.vedomosti.ru/
uInternet Settings,ProxyOverride = *.local
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:program filesMail.RuAgentmagent.exe
FF — ProfilePath — c:users1EB6~1AppDataRoamingMozillaFirefoxProfilesht4kyenz.default
FF — prefs.js: browser.search.defaulturl — hxxp://go.mail.ru/search?fr=fftb&utf8in&q=
FF — prefs.js: browser.search.selectedEngine — mail.ru: РџРѕРёСЃРє РІ Интернете
FF — prefs.js: keyword.URL — hxxp://go.mail.ru/search?utf8in=1&fr=fftbUFix&q=
FF — component: c:program filesRealRealPlayerbrowserrecordfirefoxextcomponentsnprpffbrowserrecordext.dll
FF — plugin: c:program filesMozilla Firefoxpluginsnp-mswmp.dll
.
— — — — ORPHANS REMOVED — — — —

URLSearchHooks-{83821C2B-32A8-4DD7-B6D4-44309A78E668} — c:program filesMail.RuAgentMradllnewmrasearch.dll
AddRemove-{E2883E8F-472F-4fb0-9522-AC9BF37916A7} — c:program filesNOSbingetPlus_Helper.dll

.
Completion time: 2010-02-02 19:18:40
ComboFix-quarantined-files.txt 2010-02-02 16:18

Pre-Run: 152 371 585 024 байт свободно
Post-Run: 163 939 057 664 байт свободно

— — End Of File — — 68DEAE9F91F3B023CB31D389FE8969D3
— В общем комп. тормозит. при работе firefox. При закрытии программы utorrent проводник перестает работать и перезапускается. проверьте log. скажите что делать? счастья всем! 🙂

[Автор]

Сообщения