- This topic has 1 ответ, 2 участника, and was last updated 16 years, 7 months назад by
.
-
Сообщения
-
Здравствуйте, еще раз о пропаже папок и иконок на рабочем столе. После пропажи ничего на рабочем столе нет но программы запущены, это видно в деспетчере задач. Просканировал комп как Вы и говорили, передаю результат. Заранене благодарен.
ComboFix 08-11-12.01 — Admin 2008-11-13 21:42:33.1 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.1.1049.18.622 [GMT 2:00]
Running from: d:instalComboFix.exe
* Created a new restore point
* Resident AV is activeWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.((((((((((((((((((((((((( Files Created from 2008-10-13 to 2008-11-13 )))))))))))))))))))))))))))))))
.2008-11-12 21:18 . 2008-11-12 21:18
d
c:program filesTrend Micro
2008-11-04 10:59 . 2005-07-07 16:25 89,872 -ra
c:windowssystem32driversk750mdm.sys
2008-11-04 10:59 . 2005-07-07 16:25 81,728 -ra
c:windowssystem32driversk750mgmt.sys
2008-11-04 10:59 . 2005-07-07 16:25 79,488 -ra
c:windowssystem32driversk750obex.sys
2008-11-04 10:59 . 2005-07-07 16:26 6,576 -ra
c:windowssystem32driversk750mdfl.sys
2008-11-04 10:59 . 2005-07-07 16:26 6,144 -ra
c:windowssystem32driversk750cmnt.sys
2008-11-04 10:59 . 2005-07-07 16:26 6,144 -ra
c:windowssystem32driversk750cm.sys
2008-11-04 10:58 . 2005-07-07 16:26 55,216 -ra
c:windowssystem32driversk750bus.sys
2008-11-04 10:58 . 2005-07-07 16:25 5,744 -ra
c:windowssystem32driversk750whnt.sys
2008-11-04 10:58 . 2005-07-07 16:25 5,744 -ra
c:windowssystem32driversk750wh.sys
2008-11-04 10:51 . 2008-11-04 10:51d
c:documents and settingsAdminApplication DataAhead
2008-10-27 20:28 . 2008-10-27 20:28d
c:program filesCommon FilesCyberLink
2008-10-27 20:27 . 2008-10-27 20:27d
c:program filesCyberLink
2008-10-27 15:43 . 2008-10-27 15:43d
c:program filesMyCentria
2008-10-26 20:32 . 2008-10-26 20:32d
c:documents and settingsAll UsersApplication DataTemp
2008-10-26 20:32 . 2008-10-27 20:27 29,480 —a
c:windowssystem32msxml3a.dll
2008-10-26 16:43 . 2008-10-26 16:43d
c:documents and settingsAdminApplication DataCyberLink
2008-10-26 16:35 . 2008-10-26 16:35d
c:documents and settingsAll UsersApplication DataCyberLink
2008-10-26 15:46 . 2008-04-25 19:41 218,624 —a—c— c:windowssystem32dllcacheuxtheme.dll
2008-10-26 15:45 . 2008-10-26 15:45 716,720 —a
c:program filesCommon Filesunins000.exe
2008-10-26 15:45 . 2008-10-26 15:46 10,872 —a
c:program filesCommon Filesunins000.dat.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-13 19:44
d
w c:program filesDrWeb
2008-11-12 19:13
d
w c:documents and settingsAdminApplication DataThe Bat!
2008-10-27 18:08
d
w c:documents and settingsAdminApplication DataAuslogics
2008-10-27 18:06
d—h—w c:program filesInstallShield Installation Information
2008-10-26 15:07
d
w c:program filesNeed for Speed Most Wanted
2008-10-07 07:21
d
w c:program filesCommon FilesAdobe
2008-10-07 07:20
d
w c:program filesCommon FilesAdobe Systems Shared
2008-10-07 07:20
d
w c:documents and settingsAll UsersApplication DataAdobe Systems
2008-09-25 17:41
d
w c:documents and settingsAdminApplication DataMobipocket
2008-09-21 16:24
d
w c:program filesThe Bat!
2008-09-21 15:09
d
w c:program filesQIP
2008-09-21 07:45
d
w c:program filesCommon FilesDirectX
2008-09-18 11:45
d
w c:program filesid Software
2008-09-17 15:41
d
w c:program filesCommon FilesInstallShield
2008-09-15 16:03
d
w c:program filesVolumecontrol2
2008-09-15 16:03
d
w c:program filesVisualTaskTips
2008-09-15 15:30
d
w c:program filesMI6
2008-09-15 15:17
d
w c:program filesAuslogics
2008-09-14 13:15 223,128 —-a-w c:windowssystem32driversdtscsi.sys
2008-09-14 13:15
d
w c:program filesDAEMON Tools
2008-09-14 13:00
d
w c:program filesfree-downloads.net
2008-09-14 13:00
d
w c:program filesAlcohol Soft
2008-09-14 12:33
d
w c:program filesTotal Commander
2008-09-14 11:46
d
w c:program filesLClock
2008-09-14 11:26
d
w c:program filesCommon FilesArsenal Shared
2008-09-14 06:53
d
w c:program filesOperaAC
.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]
«{ecdee021-0d17-467f-a1ff-c7a115230949}»= «c:program filesfree-downloads.nettbfre0.dll» [2008-02-14 1555480][HKEY_CLASSES_ROOTclsid{ecdee021-0d17-467f-a1ff-c7a115230949}]
[HKEY_LOCAL_MACHINE~Browser Helper Objects{ecdee021-0d17-467f-a1ff-c7a115230949}]
2008-02-14 13:54 1555480 —a
c:program filesfree-downloads.nettbfre0.dll[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{ecdee021-0d17-467f-a1ff-c7a115230949}»= «c:program filesfree-downloads.nettbfre0.dll» [2008-02-14 1555480][HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{ECDEE021-0D17-467F-A1FF-C7A115230949}»= «c:program filesfree-downloads.nettbfre0.dll» [2008-02-14 1555480][HKEY_CLASSES_ROOTclsid{ecdee021-0d17-467f-a1ff-c7a115230949}]
[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2008-05-20 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2007-11-14 201728]
«AtiTrayTools»=»c:program filesRay AdamsATI Tray Toolsatitray.exe» [2007-05-22 521128]
«BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=»c:program filesCommon FilesNeroLibNMBgMonitor.exe» [2007-10-23 202024]
«LClock»=»c:program filesLClocklclock.exe» [2007-12-14 86016]
«AlcoholAutomount»=»c:program filesAlcohol SoftAlcohol 120axcmd.exe» [2008-09-14 4608]
«louderit.exe»=»c:program filesVolumecontrol2LouderIt.exe» [2008-02-19 41472]
«VisualTaskTips»=»c:program filesVisualTaskTipsVisualTaskTips.exe» [2008-06-23 65536][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«AmlMaple»=»c:program filesAmlMapleAmlMaple.exe» [2008-04-24 91648]
«SpIDerNT»=»c:progra~1DrWebspiderui.exe» [2008-03-31 230936]
«NeroFilterCheck»=»c:program filesCommon FilesNeroLibNeroCheck.exe» [2007-03-01 153136]
«NBKeyScan»=»c:program filesNeroNero8Nero BackItUpNBKeyScan.exe» [2007-09-20 1836328]
«DAEMON Tools»=»c:program filesDAEMON Toolsdaemon.exe» [2005-11-09 128920]
«RemoteControl8″=»c:program filesCyberLinkPowerDVD8PDVD8Serv.exe» [2008-03-20 83240]
«PDVD8LanguageShortcut»=»c:program filesCyberLinkPowerDVD8LanguageLanguage.exe» [2007-12-14 50472]
«SoundMan»=»SOUNDMAN.EXE» [2007-04-16 c:windowsSOUNDMAN.EXE][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-05-20 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
«VisualTaskTips»=»c:program filesVisualTaskTipsVisualTaskTips.exe» [2008-06-23 65536][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» [2008-05-20 c:windowssystem32advpack.dll]
«IE7_012″=»advpack.dll» [2008-05-20 c:windowssystem32advpack.dll]c:documents and settingsAdminѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
Adobe Gamma.lnk — c:program filesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe [2005-03-16 113664][HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]
«DisableStatusMessages»= 1 (0x1)[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)
«NoStartMenuSubFolders»= 0 (0x0)
«NoCommonGroups»= 0 (0x0)
«NoPrinterTabs»= 0 (0x0)
«NoDeletePrinter»= 0 (0x0)
«NoAddPrinter»= 0 (0x0)
«NoPrinters»= 0 (0x0)
«NoFavoritesMenu»= 0 (0x0)
«NoRecentDocsNetHood»= 0 (0x0)
«NoChangeAnimation»= 0 (0x0)
«NoChangeKeyboardNavigationIndicators»= 0 (0x0)[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesDisableNotify»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusDisableNotify»=dword:00000001
«AntiVirusOverride»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=R0 nvcchflt;NVIDIA Disk Cache Filter Driver;c:windowssystem32DRIVERSnvcchflt.sys [2006-02-26 16640]
R1 atitray;atitray;c:program filesRay AdamsATI Tray Toolsatitray.sys [2007-05-22 18088]
R2 SPIDER;SpIDer Guard File System Monitor;c:progra~1DrWebspider.sys [2008-03-31 343480]
R2 SPIDERNT;SpIDer Guard for Windows;c:progra~1DrWebspidernt.exe [2008-03-31 226840][HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{5594a8e0-ae65-11dd-8f44-0013d35efd1f}]
ShellAutoRuncommand — H:
ShellExploreCommand — «.Nokia Music ManagerN-1-5-21-1895552279-3129831955-389522551-6003INFO2Playlist» Control: Select music location
ShellFindCommand — «.Nokia Music ManagerN-1-5-21-1895552279-3129831955-389522551-6003INFO2Playlist» Control: Search music (radio-stations)
ShellOpenCommand — «.Nokia Music ManagerN-1-5-21-1895552279-3129831955-389522551-6003INFO2Playlist» Playback: Play music*Newly Created Service* — PROCEXP90
*Newly Created Service* — SRSERVICE
.
.
Supplementary Scan
.
R0 -: HKCU-Main,Start Page = hxxp://www.i.ua
O8 -: &Перевести — c:program filesArsenal CompanySOCRAT InternetHTMLWSocrat.js
O8 -: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
O9 -: {17FA5CD6-5737-45c2-B194-74C8A4A7F7E7} — {7E1F0737-53A5-4EDC-8734-DD94B50AAF83} — c:program filesArsenal CompanySOCRAT InternetSocratInternet.dll
O9 -: {DFDC8970-FD66-4385-B8C0-835A4AA1DA00} — {A3400175-12F9-4220-83BF-A7210CA4003E} — c:program filesArsenal CompanySOCRAT InternetSocratInternet.dll
O17 -: HKLMCCSInterface{C6A6B463-14B5-438D-A16D-303DBA52D0EE}: NameServer = 192.168.100.1 195.60.175.1
.**************************************************************************
catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-13 21:44:08
Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
DLLs Loaded Under Running Processes
PROCESS: c:windowsexplorer.exe
-> c:program filesRay AdamsATI Tray Toolsraphook.dll
-> c:program filesVisualTaskTipsVttHooks.dll
-> c:program filesPunto Switchercorrect.dll
-> c:program filesVolumecontrol2LHook.dll
.
Completion time: 2008-11-13 21:44:42
ComboFix-quarantined-files.txt 2008-11-13 19:44:38Pre-Run: 7 243 800 576 байт свободно
Post-Run: 7,235,440,640 байт свободно175
- Для ответа в этой теме необходимо авторизоваться.
