Пресловутый баннер сексшопа…

[lorik]

Мучил он и меня. После использования комбитфих исчез. Что приятно. Спасибо.
Вот запись:
сComboFix 09-07-07.05 — Лена 09.07.2009 0:15.1 — NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1251.7.1049.18.246.61 [GMT 4:00]
Running from: c:documents and settingsЛенаРабочий столComboFix.exe
Command switches used :: c:documents and settingsЛенаРабочий столWindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:docume~1AC0D~1LOCALS~1Tempcatchme.dll
c:docume~1AC0D~1LOCALS~1Tempwinlogon.exe
c:documents and settingsЛенаLocal SettingsTempcatchme.dll
c:windowssystem32digeste.dll
c:windowssystem32test.dll
c:windowssystem32wsnpoem
c:windowssystem32wsnpoemaudio.dll
c:windowssystem32wsnpoemaudio.dll.cla
c:windowssystem32wsnpoemvideo.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

---

Legacy_MSUPDATE

---

Legacy_SYSLIBRARY

---

Service_msupdate

---

Service_SysLibrary

((((((((((((((((((((((((( Files Created from 2009-06-08 to 2009-07-08 )))))))))))))))))))))))))))))))
.

2009-07-06 18:43 . 2009-07-06 18:43 806400 —-a-w- c:documents and settingsЛенаApplication DataAdSubscribeUninstall.exe
2009-07-06 18:43 . 2009-07-06 18:43

---

d

---

w- c:documents and settingsЛенаApplication DataAdSubscribe
2009-07-06 18:43 . 2009-07-06 18:43 748544 —-a-w- c:documents and settingsЛенаApplication DataAdSubscribeAdSubscribe.dll
2009-07-04 13:23 . 2009-07-04 13:23

---

d

---

w- c:documents and settingsAll UsersApplication DataAlawar Stargaze
2009-07-04 13:20 . 2009-07-04 16:41

---

d

---

w- C:Игры

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-08 20:35 . 2007-01-14 11:43

---

d

---

w- c:program filesCommon FilesSymantec Shared
2009-07-08 19:30 . 2007-01-19 20:11

---

d

---

w- c:program filesICQ
2009-07-08 17:00 . 2008-12-09 21:52 87863 —-a-w- c:documents and settingsЛенаApplication Datafieryads.dat
2009-07-07 16:51 . 2008-12-09 21:52

---

d

---

w- c:program filesFieryAds
2009-05-27 19:03 . 2009-05-27 19:03

---

d

---

w- c:program filesAxis Communications
2009-05-07 15:44 . 2004-08-18 12:00 345088 —-a-w- c:windowssystem32localspl.dll
2009-04-29 04:47 . 2004-08-18 12:00 827392 —-a-w- c:windowssystem32wininet.dll
2009-04-29 04:47 . 2004-08-18 12:00 78336 —-a-w- c:windowssystem32ieencode.dll
2009-04-23 09:14 . 2004-08-18 12:00 49750 —-a-w- c:windowssystem32perfc019.dat
2009-04-23 09:14 . 2004-08-18 12:00 346690 —-a-w- c:windowssystem32perfh019.dat
2009-04-19 20:11 . 2004-08-18 12:00 1846784 —-a-w- c:windowssystem32win32k.sys
2009-04-15 15:18 . 2004-08-18 12:00 584192 —-a-w- c:windowssystem32rpcrt4.dll
2007-01-14 11:32 . 2007-01-14 11:32 527 —-a-w- c:program filesSoftwareList.ini
2006-04-11 06:33 . 2007-01-27 19:15 29184 —-a-w- c:program filesWinDjView-0.4.1-RU.dll
2006-04-10 22:28 . 2007-01-27 19:15 506368 —-a-w- c:program filesWinDjView-0.4.1.exe
1999-03-16 00:00 . 1999-03-16 00:00 99840 —-a-w- c:program filesCommon FilesIRAABOUT.DLL
1998-12-09 08:53 . 1998-12-09 08:53 70144 —-a-w- c:program filesCommon FilesIRAMDMTR.DLL
1998-12-09 08:53 . 1998-12-09 08:53 48640 —-a-w- c:program filesCommon FilesIRALPTTR.DLL
1998-12-09 08:53 . 1998-12-09 08:53 31744 —-a-w- c:program filesCommon FilesIRAWEBTR.DLL
1998-12-09 08:53 . 1998-12-09 08:53 186368 —-a-w- c:program filesCommon FilesIRAREG.DLL
1998-12-09 08:53 . 1998-12-09 08:53 17920 —-a-w- c:program filesCommon FilesIRASRIAL.DLL
2007-01-14 11:44 . 2007-01-14 11:44 32 —sha-w- c:windows{148D86FD-7F35-480B-AC78-0061CBD2A724}.dat
2007-01-14 11:44 . 2007-01-14 11:44 32 —sha-w- c:windowssystem32{327B7943-6301-456E-AD6A-5DE5B06B3A8C}.dat
.

---

Sigcheck

---

[-] 2008-04-14 16:11 14336 E948A9079D0E6350BE92D4D3E0077F81 c:windowsSoftwareDistributionDownloadf0863ff04d4c2c949d9b79bc2578502bsvchost.exe
[-] 2004-08-18 12:00 14336 5DB0AE95BF08D5A63C167648F1314C07 c:windowssystem32svchost.exe
[-] 2004-08-18 12:00 14336 5DB0AE95BF08D5A63C167648F1314C07 c:windowssystem32dllcachesvchost.exe

[-] 2008-04-14 16:10 82432 5E2915645A0D139519A99F0F95437D96 c:windowsSoftwareDistributionDownloadf0863ff04d4c2c949d9b79bc2578502bws2_32.dll
[-] 2004-08-18 12:00 82944 0B6185E58290D4E5944F6FB9BF6562A1 c:windowssystem32ws2_32.dll
[-] 2004-08-18 12:00 82944 0B6185E58290D4E5944F6FB9BF6562A1 c:windowssystem32dllcachews2_32.dll

[7] 2007-10-30 16:53 360832 64798ECFA43D78C7178375FCDD16D8C8 c:windows$hf_mig$KB941644SP2QFEtcpip.sys
[7] 2008-06-20 10:44 360960 744E57C99232201AE98C49168B918F48 c:windows$hf_mig$KB951748SP2QFEtcpip.sys
[7] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:windows$hf_mig$KB951748SP3GDRtcpip.sys
[7] 2008-06-20 11:59 361600 AD978A1B783B5719720CFF204B666C8E c:windows$hf_mig$KB951748SP3QFEtcpip.sys
[-] 2004-08-18 12:00 359040 9F4B36614A0FC234525BA224957DE55C c:windows$NtUninstallKB941644$tcpip.sys
[7] 2007-10-30 17:20 360064 90CAFF4B094573449A0872A0F919B178 c:windows$NtUninstallKB951748$tcpip.sys
[-] 2008-04-13 19:20 361344 93EA8D04EC73A85DB02EB8805988F733 c:windowsSoftwareDistributionDownloadf0863ff04d4c2c949d9b79bc2578502btcpip.sys
[-] 2008-11-06 10:32 360320 3ADCE4790F591BF160A94F6F08039577 c:windowssystem32dllcacheTCPIP.SYS
[-] 2008-11-06 10:32 360320 3ADCE4790F591BF160A94F6F08039577 c:windowssystem32driversTCPIP.SYS

[-] 2008-04-14 16:11 509440 B3B5D5855127E240C88451030AAEE76E c:windowsSoftwareDistributionDownload67b1773c6e2b1714211e802c0bd6f6b8winlogon.exe
[-] 2004-08-18 12:00 503808 BA9DF5930B2582C31C0C8E52C94DDA48 c:windowssystem32winlogon.exe
[-] 2004-08-18 12:00 503808 BA9DF5930B2582C31C0C8E52C94DDA48 c:windowssystem32dllcachewinlogon.exe

[-] 2008-04-13 19:20 182656 1DF7F42665C94B825322FAE71721130D c:windowsSoftwareDistributionDownloadf0863ff04d4c2c949d9b79bc2578502bndis.sys
[-] 2004-08-18 12:00 182912 558635D3AF1C7546D26067D5D9B6959E c:windowssystem32dllcachendis.sys
[-] 2004-08-18 12:00 182912 558635D3AF1C7546D26067D5D9B6959E c:windowssystem32driversndis.sys

[-] 2008-04-13 18:53 36608 3BB22519A194418D5FEC05D800A19AD0 c:windowsSoftwareDistributionDownloadf0863ff04d4c2c949d9b79bc2578502bip6fw.sys
[-] 2004-08-18 12:00 29056 4448006B6BC60E6C027932CFC38D6855 c:windowssystem32dllcacheip6fw.sys
[-] 2004-08-18 12:00 29056 4448006B6BC60E6C027932CFC38D6855 c:windowssystem32driversip6fw.sys

[-] 2008-04-14 16:10 13312 17C1AC326238EFADF17A0612AFD822AD c:windowsSoftwareDistributionDownloadf0863ff04d4c2c949d9b79bc2578502blsass.exe
[-] 2004-08-18 12:00 13312 1952DDC36E60C313CD6ACBD07D4548D6 c:windowssystem32lsass.exe
[-] 2004-08-18 12:00 13312 1952DDC36E60C313CD6ACBD07D4548D6 c:windowssystem32dllcachelsass.exe

[-] 2008-04-14 16:10 15360 B5DC70BB43A14093E00C5A735CC5DFD4 c:windowsSoftwareDistributionDownloadf0863ff04d4c2c949d9b79bc2578502bctfmon.exe
[-] 2004-08-18 12:00 15360 CDC69C55CF6C39162451685020CF6F06 c:windowssystem32ctfmon.exe
[-] 2004-08-18 12:00 15360 CDC69C55CF6C39162451685020CF6F06 c:windowssystem32dllcachectfmon.exe

[-] 2008-04-14 16:11 26624 4F88778DD0CD6B99FCDA408E16B36AE7 c:windowsSoftwareDistributionDownloadf0863ff04d4c2c949d9b79bc2578502buserinit.exe
[-] 2004-08-18 12:00 25088 B5F1A73EDAB83FA2DB9662E10E027587 c:windowssystem32userinit.exe
[-] 2004-08-18 12:00 25088 B5F1A73EDAB83FA2DB9662E10E027587 c:windowssystem32dllcacheuserinit.exe

[-] 2008-04-14 16:10 295936 804A741E1806E8C33C8C642781896C0D c:windowsSoftwareDistributionDownloadf0863ff04d4c2c949d9b79bc2578502btermsrv.dll
[-] 2004-08-18 12:00 295936 FBE10ED076D1E87782778A6CD2AB7085 c:windowssystem32termsrv.dll
[-] 2004-08-18 12:00 295936 FBE10ED076D1E87782778A6CD2AB7085 c:windowssystem32dllcachetermsrv.dll

[-] 2008-04-14 16:10 17408 DDDB63DB4C327CA3996AD326C1A8B8D4 c:windowsSoftwareDistributionDownloadf0863ff04d4c2c949d9b79bc2578502bpowrprof.dll
[-] 2004-08-18 12:00 17408 604F22705C12080012968D72D97C6D64 c:windowssystem32powrprof.dll
[-] 2004-08-18 12:00 17408 604F22705C12080012968D72D97C6D64 c:windowssystem32dllcachepowrprof.dll

[-] 2008-04-14 16:10 110080 A9690FD601E9F5102F0D3388DF6081BD c:windowsSoftwareDistributionDownloadf0863ff04d4c2c949d9b79bc2578502bimm32.dll
[-] 2004-08-18 12:00 110080 318492C9327EDBBD7FAD35FB3DF65CC3 c:windowssystem32imm32.dll
[-] 2004-08-18 12:00 110080 318492C9327EDBBD7FAD35FB3DF65CC3 c:windowssystem32dllcacheimm32.dll

[-] 2008-04-14 16:10 1571840 4379CA978CB35BB2458156B2B6CB35DF c:windowsSoftwareDistributionDownloadf0863ff04d4c2c949d9b79bc2578502bsfcfiles.dll
[-] 2004-08-18 12:00 1548288 01C8786B1DDB91D5D40044DED8864EDC c:windowssystem32sfcfiles.dll
[-] 2004-08-18 12:00 1548288 01C8786B1DDB91D5D40044DED8864EDC c:windowssystem32dllcachesfcfiles.dll

[-] 2008-04-14 15:47 24832 2B0018DE01BFB628D0A49A301F34B46F c:windowsSoftwareDistributionDownloadf0863ff04d4c2c949d9b79bc2578502bkbdclass.sys
[-] 2004-08-18 12:00 24832 84C85813DDB595F97A9F95DA3EDBF81B c:windowssystem32driverskbdclass.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiersAdSubscribe]
@=»{82C885EE-6B87-4D51-9EF4-0CFE9FADA900}»
[HKEY_CLASSES_ROOTCLSID{82C885EE-6B87-4D51-9EF4-0CFE9FADA900}]
2009-07-06 18:43 748544 —-a-w- c:documents and settingsЛенаApplication DataAdSubscribeAdSubscribe.dll

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2004-08-18 15360]
«MSMSGS»=»c:program filesMessengermsmsgs.exe» [2004-10-13 1694208]
«OM_Monitor»=»c:program filesOLYMPUSOLYMPUS MasterMonitor.exe» [2005-11-29 57344]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«SunJavaUpdateSched»=»c:program filesJavajre1.5.0binjusched.exe» [2007-01-14 36972]
«IgfxTray»=»c:windowssystem32igfxtray.exe» [2003-07-09 155648]
«HotKeysCmds»=»c:windowssystem32hkcmd.exe» [2003-07-09 114688]
«LtMoh»=»c:program filesltmohLtmoh.exe» [2002-11-25 172032]
«SynTPLpr»=»c:program filesSynapticsSynTPSynTPLpr.exe» [2003-01-03 126976]
«SynTPEnh»=»c:program filesSynapticsSynTPSynTPEnh.exe» [2003-01-03 577536]
«SENS Keyboard V4 Launcher»=»c:program filesSAMSUNGSENS Keyboard V4 LauncherSENSKBD.EXE» [2003-08-19 49152]
«ccApp»=»c:program filesCommon FilesSymantec SharedccApp.exe» [2002-11-14 54976]
«ccRegVfy»=»c:program filesCommon FilesSymantec SharedccRegVfy.exe» [2002-11-14 59072]
«Mirabilis ICQ»=»c:program filesICQNDetect.exe» [2002-03-17 36943]
«FineReader7NewsReaderPro»=»c:program filesABBYY FineReader 7.0 Professional EditionAbbyyNewsReader.exe» [2003-08-19 278528]
«RemoteControl»=»c:program filesCyberLinkPowerDVDPDVDServ.exe» [2004-03-16 32768]
«QuickTime Task»=»c:program filesQuickTimeqttask.exe» [2008-03-19 77824]
«OM_Monitor»=»c:program filesOLYMPUSOLYMPUS MasterFirstStart.exe» [2005-11-29 40960]
«NevoDRM»=»c:игрыNevoDRMNevoDRM.exe» [2008-12-11 41984]
«AGRSMMSG»=»AGRSMMSG.exe» — c:windowsAGRSMMSG.exe [2002-11-21 87751]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2004-08-18 15360]

c:documents and settingsAll Usersѓ« ў­®Ґ ¬Ґ­оЏа®Ја ¬¬лЂўв®§ Јаг§Є 
Microsoft Office.lnk — c:program filesMicrosoft OfficeOfficeOSA9.EXE [1999-2-18 65588]
Џ®ав Symantec Fax Starter Edition.lnk — c:program filesMicrosoft OfficeOffice1049OLFSNT40.EXE [1999-3-16 45568]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«AntiVirusOverride»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«c:\WINDOWS\system32\dplaysvr.exe»=
«c:\Program Files\ICQ\Icq.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«c:\Program Files\uTorrent\utorrent.exe»=

R1 VFILT;Outpost Firewall Kernel Driver;c:progra~1AgnitumOUTPOS~1kernel2000FILTNT.SYS [20.01.2007 0:31 89440]
R2 DOSMEMIO;MEMIO;c:windowssystem32MEMIO.SYS [14.01.2007 15:37 4300]
R3 ADBLOCK.DLL;Outpost Firewall PlugIn (ADBLOCK.DLL);c:progra~1AgnitumOUTPOS~1kernelADBLOCK.DLL [20.01.2007 0:31 28352]
R3 CONTENT.DLL;Outpost Firewall PlugIn (CONTENT.DLL);c:progra~1AgnitumOUTPOS~1kernelCONTENT.DLL [20.01.2007 0:31 3968]
R3 DNSCACHE.DLL;Outpost Firewall PlugIn (DNSCACHE.DLL);c:progra~1AgnitumOUTPOS~1kernelDNSCACHE.DLL [20.01.2007 0:31 8352]
R3 FTPFILT.DLL;Outpost Firewall PlugIn (FTPFILT.DLL);c:progra~1AgnitumOUTPOS~1kernelFTPFILT.DLL [20.01.2007 0:31 8608]
R3 HTMLFILT.DLL;Outpost Firewall PlugIn (HTMLFILT.DLL);c:progra~1AgnitumOUTPOS~1kernelHTMLFILT.DLL [20.01.2007 0:31 8928]
R3 HTTPFILT.DLL;Outpost Firewall PlugIn (HTTPFILT.DLL);c:progra~1AgnitumOUTPOS~1kernelHTTPFILT.DLL [20.01.2007 0:31 11744]
R3 IMAPFILT.DLL;Outpost Firewall PlugIn (IMAPFILT.DLL);c:progra~1AgnitumOUTPOS~1kernelIMAPFILT.DLL [20.01.2007 0:31 7136]
R3 MAILFILT.DLL;Outpost Firewall PlugIn (MAILFILT.DLL);c:progra~1AgnitumOUTPOS~1kernelMAILFILT.DLL [20.01.2007 0:31 10784]
R3 NNTPFILT.DLL;Outpost Firewall PlugIn (NNTPFILT.DLL);c:progra~1AgnitumOUTPOS~1kernelNNTPFILT.DLL [20.01.2007 0:31 6720]
R3 POP3FILT.DLL;Outpost Firewall PlugIn (POP3FILT.DLL);c:progra~1AgnitumOUTPOS~1kernelPOP3FILT.DLL [20.01.2007 0:31 9728]
R3 PROTECT.DLL;Outpost Firewall PlugIn (PROTECT.DLL);c:progra~1AgnitumOUTPOS~1kernelPROTECT.DLL [20.01.2007 0:31 15808]
.
Contents of the ‘Scheduled Tasks’ folder

2009-05-22 c:windowsTasksNorton AntiVirus — Scan my computer.job
— c:progra~1NORTON~1NAVW32.exe [2002-11-14 16:31]

2009-07-08 c:windowsTasksSymantec NetDetect.job
— c:program filesSymantecLiveUpdateNDETECT.EXE [2007-01-14 06:04]
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.rambler.ru/
uInternet Settings,ProxyServer = 192.168.0.1:8080
DPF: {33331111-1111-1111-1111-615111193427}
DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} — hxxp://83.239.32.123/activex/AMC.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-09 00:34
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘explorer.exe'(4768)
c:documents and settingsЛенаApplication DataAdSubscribeAdSubscribe.dll
.

---

Other Running Processes

---

.
c:program filesNorton AntiVirusNavapsvc.exe
c:progra~1AgnitumOUTPOS~1outpost.exe
c:windowssystem32wdfmgr.exe
c:c:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
.
**************************************************************************
.
Completion time: 2009-07-08 0:43 — machine was rebooted
ComboFix-quarantined-files.txt 2009-07-08 20:43

Pre-Run: 4 161 966 080 байт свободно
Post-Run: 5 243 052 032 байт свободно

206 — E O F — 2009-06-13 17:50

[lorik]

В общем, баннер на месте и все вирусы, которые комбофикс выявил и якобы удалил продолжают работать.
Не помогло…

[Admin]

Здравствуйте, добро пожаловать на Spyware-ru форум.

Откройте блокнот (Кликните Пуск, Выполнить, в строке ввода введите notepad и нажмите Enter) и вставьте в него следующий текст:

Registry::

[-HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiersAdSubscribe]

[-HKEY_CLASSES_ROOTCLSID{82C885EE-6B87-4D51-9EF4-0CFE9FADA900}]



Folder::

c:documents and settingsЛенаApplication DataAdSubscribe

Запишите получившийся файл на ваш рабочий стол под именем CFScript
Далее перетащите получившийся файл на иконку Combofix, как показано на картинке ниже.

Сombofix запуститься и выполнит процедуры описанные в созданном нами файле.
По результатам работы Combofix будет создан новый лог, его и вставьте в свой следующий ответ.

[Автор]

Сообщения