- This topic has 3 ответа, 2 участника, and was last updated 16 years, 2 months назад by
.
-
Сообщения
-
- Темы:532
- Сообщений:1553
- ☆☆☆☆☆
Добрый вечер, вот проблемка не большая, точнее большая…. порно реклама выскакивает постоянно призапуске интренета….вот название ссылки 0EB9F12C_6E6B_4c03_AEBA_8C04CFA98AA4.gif. помогите пожалуйста, следовала так же вашей инструкции… но не получилось, запускала Комбо фикс и создавала блокнот, ничего не помогло….. 😥
вот
Logfile of random’s system information tool 1.05 (written by random/random)
Run by аня at 2009-02-26 21:10:52
Microsoft Windows XP Professional Service Pack 2
System drive C: has 106 GB (70%) free of 153 GB
Total RAM: 1022 MB (57% free)Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:11:02, on 26.02.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: NormalRunning processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:Program FilesPortrait DisplaysforteManagerDTHtml.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:WINDOWSRTHDCPL.EXE
C:Program FilesiTunesiTunesHelper.exe
C:Program FilesWinampwinampa.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesMicrosoft ActiveSyncwcescomm.exe
C:Program FilesMessengermsmsgs.exe
C:Program FilesCommon FilesYandexYupdateyupdate.exe
C:PROGRA~1MI3AA1~1rapimgr.exe
C:Program FilesCommon FilesAppleMobile Device SupportbinAppleMobileDeviceService.exe
C:Program FilesPortrait DisplaysforteManagerdtsslsrv.exe
C:Program FilesKaspersky LabKaspersky Anti-Virus 6.0 for Windows Workstationsavp.exe
C:Program FilesBonjourmDNSResponder.exe
C:Program FilesPortrait DisplaysforteManagerDTSRVC.exe
C:Program FilesICQ6ToolbarICQ Service.exe
C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
C:Program FilesCommon FilesNeroNero BackItUp 4NBService.exe
C:WINDOWSsystem32nvsvc32.exe
C:Program FilesAlcohol SoftAlcohol 120StarWindStarWindServiceAE.exe
C:WINDOWSsystem32wscntfy.exe
C:Program FilesiPodbiniPodService.exe
C:WINDOWSsystem32wuauclt.exe
C:Program FilesMail.RuAgentmagent.exe
C:Program FilesInternet ExplorerIEXPLORE.EXE
C:Documents and SettingsаняРабочий столRSIT.exe
C:Program Filestrend microаня.exeR1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerSearch,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=10168&gct=&gc=1&q=
R1 — HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirect?o=10168&gct=&gc=1&q=%s
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: (no name) — {83821C2B-32A8-4DD7-B6D4-44309A78E668} — C:Program FilesMail.RuAgentMradllnewmrasearch.dll
R3 — URLSearchHook: (no name) — — (no file)
R3 — URLSearchHook: ICQToolBar — {855F3B16-6D32-4fe6-8A56-BBB695989046} — C:Program FilesICQ6ToolbarICQToolBar.dll
R3 — URLSearchHook: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O2 — BHO: AcroIEHelperStub — {18DF081C-E8AD-4283-A596-FA578C2EBDC3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelperShim.dll
O2 — BHO: AskBar BHO — {201f27d4-3704-41d6-89c1-aa35e39143ed} — C:Program FilesAskBarDisbarbinaskBar.dll
O2 — BHO: yzdlibP — {3802F364-62DD-4112-BF89-D8E6454FD755} — C:Documents and SettingsAll UsersApplication Datayzdlib.dll
O2 — BHO: Спутник@Mail.Ru — {8984B388-A5BB-4DF7-B274-77B879E179DB} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O2 — BHO: IE 4.x-6.x BHO for Download Master — {9961627E-4059-41B4-8E0E-A7D6B3854ADF} — C:PROGRA~1DOWNLO~1dmiehlp.dll
O2 — BHO: ibylibP — {BA3D8793-CB77-4C54-9F21-7D1E5F51B902} — C:Documents and SettingsAll UsersApplication Dataibylib.dll
O3 — Toolbar: ICQToolBar — {855F3B16-6D32-4fe6-8A56-BBB695989046} — C:Program FilesICQ6ToolbarICQToolBar.dll
O3 — Toolbar: Ask Toolbar — {3041d03e-fd4b-44e0-b742-2d9b88305f98} — C:Program FilesAskBarDisbarbinaskBar.dll
O3 — Toolbar: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O3 — Toolbar: Яндекс.Бар — {91397D20-1446-11D4-8AF4-0040CA1127B6} — C:Program FilesYandexYandexBarIEyndbar.dll
O3 — Toolbar: DM Bar — {0E1230F8-EA50-42A9-983C-D22ABC2EED3C} — C:Program FilesDownload Masterdmbar.dll
O4 — HKLM..Run: [Adobe Reader Speed Launcher] «C:Program FilesAdobeReader 9.0ReaderReader_sl.exe»
O4 — HKLM..Run: [QuickTime Task] «C:Program FilesQuickTimeqttask.exe» -atboottime
O4 — HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 — HKLM..Run: [nwiz] nwiz.exe /install
O4 — HKLM..Run: [DT Task] C:Program FilesPortrait DisplaysforteManagerDTHtml.exe -startup_folder
O4 — HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 — HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 — HKLM..Run: [iTunesHelper] «C:Program FilesiTunesiTunesHelper.exe»
O4 — HKLM..Run: [MAgent] C:Program FilesMail.RuAgentMAgent.exe -LM
O4 — HKLM..Run: [Synchronization Manager] %SystemRoot%system32mobsync.exe /logon
O4 — HKLM..Run: [NevoDRM] «C:Игры от NevoSoftNevoDRMNevoDRM.exe»
O4 — HKLM..Run: [WinampAgent] «C:Program FilesWinampwinampa.exe»
O4 — HKLM..Run: [AVP] «C:Program FilesKaspersky LabKaspersky Anti-Virus 6.0 for Windows Workstationsavp.exe»
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [SetDefaultMIDI] MIDIDef.exe
O4 — HKCU..Run: [H/PC Connection Agent] «C:Program FilesMicrosoft ActiveSyncwcescomm.exe»
O4 — HKCU..Run: [MSMSGS] «C:Program FilesMessengermsmsgs.exe» /background
O4 — HKCU..Run: [AlcoholAutomount] «C:Program FilesAlcohol SoftAlcohol 120axcmd.exe» /automount
O4 — HKCU..Run: [Yupdate!] «C:Program FilesCommon FilesYandexYupdateyupdate.exe»
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 — Extra context menu item: Закачать ВСЕ при помощи Download Master — C:Program FilesDownload Masterdmieall.htm
O8 — Extra context menu item: Закачать при помощи Download Master — C:Program FilesDownload Masterdmie.htm
O8 — Extra context menu item: Поиск@Mail.Ru — res://C:Program FilesMail.RuSputnikMailRuSputnik.dll/282
O8 — Extra context menu item: Словари@Mail.Ru — res://C:Program FilesMail.RuSputnikMailRuSputnik.dll/283
O9 — Extra button: Cтатистика Веб-Антивируса — {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} — C:Program FilesKaspersky LabKaspersky Anti-Virus 6.0 for Windows WorkstationsSCIEPlgn.dll
O9 — Extra button: Create Mobile Favorite — {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} — C:PROGRA~1MI3AA1~1INetRepl.dll
O9 — Extra button: (no name) — {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} — C:PROGRA~1MI3AA1~1INetRepl.dll
O9 — Extra ‘Tools’ menuitem: Добавить в избранное мобильного устройства… — {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} — C:PROGRA~1MI3AA1~1INetRepl.dll
O9 — Extra button: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra ‘Tools’ menuitem: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra button: Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe (file missing)
O9 — Extra ‘Tools’ menuitem: &Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe (file missing)
O9 — Extra button: Справочные материалы — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 — Extra button: ICQ6 — {E59EB121-F339-4851-A3BA-FE49C35617C2} — C:Program FilesICQ6.5ICQ.exe
O9 — Extra ‘Tools’ menuitem: ICQ6 — {E59EB121-F339-4851-A3BA-FE49C35617C2} — C:Program FilesICQ6.5ICQ.exe
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O16 — DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) — http://go.microsoft.com/fwlink/?linkid=39204
O16 — DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) — http://video.yarnet.ru:81/activex/AxisCamControl.cab
O17 — HKLMSystemCCSServicesTcpip..{2A32FE11-A620-4B63-8E8C-83BE1434B600}: NameServer = 85.158.48.34 85.158.50.50
O17 — HKLMSystemCCSServicesTcpip..{63A57C90-0036-4EA2-9548-06AA808CD5FB}: NameServer = 85.158.48.34,85.158.50.50
O17 — HKLMSystemCS1ServicesTcpip..{2A32FE11-A620-4B63-8E8C-83BE1434B600}: NameServer = 85.158.48.34 85.158.50.50
O23 — Service: Apple Mobile Device — Apple Inc. — C:Program FilesCommon FilesAppleMobile Device SupportbinAppleMobileDeviceService.exe
O23 — Service: Asset Management Daemon — Unknown owner — C:Program FilesPortrait DisplaysforteManagerdtsslsrv.exe
O23 — Service: Kaspersky Anti-Virus 6.0 (AVP) — Kaspersky Lab — C:Program FilesKaspersky LabKaspersky Anti-Virus 6.0 for Windows Workstationsavp.exe
O23 — Service: Bonjour Service — Apple Inc. — C:Program FilesBonjourmDNSResponder.exe
O23 — Service: Portrait Displays Display Tune Service (DTSRVC) — Unknown owner — C:Program FilesPortrait DisplaysforteManagerDTSRVC.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: ICQ Service — Unknown owner — C:Program FilesICQ6ToolbarICQ Service.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: Сервис iPod (iPod Service) — Apple Inc. — C:Program FilesiPodbiniPodService.exe
O23 — Service: NetMeeting Remote Desktop Sharing (mnmsrvc) — Корпорация Майкрософт — C:WINDOWSsystem32mnmsrvc.exe
O23 — Service: Nero BackItUp Scheduler 4.0 — Nero AG — C:Program FilesCommon FilesNeroNero BackItUp 4NBService.exe
O23 — Service: NVIDIA Display Driver Service (NVSvc) — NVIDIA Corporation — C:WINDOWSsystem32nvsvc32.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Top Spin 2 Drivers Auto Removal (pr2aje6b) (pr2aje6b) — Buka — C:WINDOWSsystem32pr2aje6b.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: StarWind AE Service (StarWindServiceAE) — Rocket Division Software — C:Program FilesAlcohol SoftAlcohol 120StarWindStarWindServiceAE.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe—
End of file — 11254 bytes======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelperShim.dll [2008-06-11 75128][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{201f27d4-3704-41d6-89c1-aa35e39143ed}]
AskBar BHO — C:Program FilesAskBarDisbarbinaskBar.dll [2008-07-17 279944][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{3802F364-62DD-4112-BF89-D8E6454FD755}]
RKAU Video Provider — C:Documents and SettingsAll UsersApplication Datayzdlib.dll [2009-02-25 506368][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{8984B388-A5BB-4DF7-B274-77B879E179DB}]
MailRuBHO Class — C:Program FilesMail.RuSputnikMailRuSputnik.dll [2009-01-22 676704][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9961627E-4059-41B4-8E0E-A7D6B3854ADF}]
IE 4.x-6.x BHO for Download Master — C:PROGRA~1DOWNLO~1dmiehlp.dll [2008-10-24 157696][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{BA3D8793-CB77-4C54-9F21-7D1E5F51B902}]
RKAU Data Feeder — C:Documents and SettingsAll UsersApplication Dataibylib.dll [2009-02-25 506880][HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{855F3B16-6D32-4fe6-8A56-BBB695989046} — ICQToolBar — C:Program FilesICQ6ToolbarICQToolBar.dll [2008-06-12 958712]
{3041d03e-fd4b-44e0-b742-2d9b88305f98} — Ask Toolbar — C:Program FilesAskBarDisbarbinaskBar.dll [2008-07-17 279944]
{09900DE8-1DCA-443F-9243-26FF581438AF} — Спутник@Mail.Ru — C:Program FilesMail.RuSputnikMailRuSputnik.dll [2009-01-22 676704]
{91397D20-1446-11D4-8AF4-0040CA1127B6} — Яндекс.Бар — C:Program FilesYandexYandexBarIEyndbar.dll [2008-12-03 1561864]
{0E1230F8-EA50-42A9-983C-D22ABC2EED3C} — DM Bar — C:Program FilesDownload Masterdmbar.dll [2007-11-26 180224][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«Adobe Reader Speed Launcher»=C:Program FilesAdobeReader 9.0ReaderReader_sl.exe [2008-06-12 34672]
«QuickTime Task»=C:Program FilesQuickTimeqttask.exe [2008-09-06 413696]
«NvCplDaemon»=C:WINDOWSsystem32NvCpl.dll [2007-04-20 8429568]
«nwiz»=nwiz.exe /install []
«DT Task»=C:Program FilesPortrait DisplaysforteManagerDTHtml.exe [2006-09-08 282624]
«NvMediaCenter»=C:WINDOWSsystem32NvMcTray.dll [2007-04-20 81920]
«RTHDCPL»=C:WINDOWSRTHDCPL.EXE [2007-06-13 16377344]
«iTunesHelper»=C:Program FilesiTunesiTunesHelper.exe [2008-11-20 290088]
«MAgent»=C:Program FilesMail.RuAgentMAgent.exe [2009-01-22 5600952]
«Synchronization Manager»=C:WINDOWSsystem32mobsync.exe [2004-08-17 143360]
«NevoDRM»=C:Игры от NevoSoftNevoDRMNevoDRM.exe [2008-12-11 41984]
«WinampAgent»=C:Program FilesWinampwinampa.exe [2008-07-10 36352]
«AVP»=C:Program FilesKaspersky LabKaspersky Anti-Virus 6.0 for Windows Workstationsavp.exe [2009-01-21 211568][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=C:WINDOWSsystem32ctfmon.exe [2004-08-17 15360]
«SetDefaultMIDI»=C:WINDOWSMIDIDef.exe [2002-12-03 49152]
«H/PC Connection Agent»=C:Program FilesMicrosoft ActiveSyncwcescomm.exe [2006-11-13 1289000]
«MSMSGS»=C:Program FilesMessengermsmsgs.exe [2004-08-17 1667584]
«AlcoholAutomount»=C:Program FilesAlcohol SoftAlcohol 120axcmd.exe [2008-02-22 217544]
«Yupdate!»=C:Program FilesCommon FilesYandexYupdateyupdate.exe [2008-10-20 479496][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyklogon]
C:WINDOWSsystem32klogon.dll [2007-06-29 206088][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32WPDShServiceObj.dll [2006-10-18 133632][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=323
«NoDriveAutoRun»=67108863
«NoDrives»=0[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«HonorAutoRunSetting»=
«NoDriveAutoRun»=
«NoDriveTypeAutoRun»=
«NoDrives»=[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesICQ6.5ICQ.exe»=»C:Program FilesICQ6.5ICQ.exe:*:Enabled:ICQ6»
«C:Program FilesBonjourmDNSResponder.exe»=»C:Program FilesBonjourmDNSResponder.exe:*:Enabled:Bonjour»
«C:Program FilesMicrosoft ActiveSyncrapimgr.exe»=»C:Program FilesMicrosoft ActiveSyncrapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager»
«C:Program FilesMicrosoft ActiveSyncwcescomm.exe»=»C:Program FilesMicrosoft ActiveSyncwcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager»
«C:Program FilesMicrosoft ActiveSyncWCESMgr.exe»=»C:Program FilesMicrosoft ActiveSyncWCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application»
«C:Program FilesiTunesiTunes.exe»=»C:Program FilesiTunesiTunes.exe:*:Enabled:iTunes»
«C:Program FilesuTorrentutorrent.exe»=»C:Program FilesuTorrentutorrent.exe:*:Enabled:µTorrent»[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesMicrosoft ActiveSyncrapimgr.exe»=»C:Program FilesMicrosoft ActiveSyncrapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager»
«C:Program FilesMicrosoft ActiveSyncwcescomm.exe»=»C:Program FilesMicrosoft ActiveSyncwcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager»
«C:Program FilesMicrosoft ActiveSyncWCESMgr.exe»=»C:Program FilesMicrosoft ActiveSyncWCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application»======List of files/folders created in the last 1 months======
2009-02-26 21:10:52 —-D—- C:rsit
2009-02-26 21:10:52 —-D—- C:Program Filestrend micro
2009-02-26 20:45:13 —-SHD—- C:RECYCLER
2009-02-25 23:08:28 —-D—- C:WINDOWStemp
2009-02-25 23:03:19 —-A—- C:ComboFix.txt
2009-02-25 22:37:29 —-D—- C:Qoobox
2009-02-25 22:20:04 —-A—- C:WINDOWSzip.exe
2009-02-25 22:20:04 —-A—- C:WINDOWSVFIND.exe
2009-02-25 22:20:04 —-A—- C:WINDOWSSWXCACLS.exe
2009-02-25 22:20:04 —-A—- C:WINDOWSSWSC.exe
2009-02-25 22:20:04 —-A—- C:WINDOWSSWREG.exe
2009-02-25 22:20:04 —-A—- C:WINDOWSsed.exe
2009-02-25 22:20:04 —-A—- C:WINDOWSgrep.exe
2009-02-25 22:20:04 —-A—- C:WINDOWSfdsv.exe
2009-02-25 21:49:13 —-A—- C:WINDOWSNIRCMD.exe
2009-02-25 18:12:25 —-A—- C:Documents and SettingsAll UsersApplication Dataibylib.dll
2009-02-25 18:11:11 —-A—- C:Documents and SettingsAll UsersApplication Datayzdlib.dll
2009-02-25 15:22:21 —-HDC—- C:WINDOWS$NtUninstallKB967715$
2009-02-22 20:46:54 —-A—- C:WINDOWSfshset.ini
2009-02-21 21:55:22 —-D—- C:Downloads
2009-02-21 21:54:57 —-D—- C:Documents and SettingsаняApplication DataDownload Master
2009-02-21 21:53:55 —-D—- C:Program FilesDownload Master
2009-02-21 12:15:50 —-D—- C:Program FilesWinZip
2009-02-15 19:57:59 —-D—- C:Program FilesMPC HomeCinema
2009-02-15 19:40:32 —-D—- C:Documents and SettingsаняApplication DataXBMC
2009-02-15 19:39:54 —-D—- C:Program FilesXBMC
2009-02-15 19:37:02 —-D—- C:Program FilesCookRecepts
2009-02-14 23:17:05 —-D—- C:Program FilesKaraoke GALAXY
2009-02-13 13:41:05 —-D—- C:Documents and SettingsаняApplication DatauTorrent
2009-02-13 13:41:03 —-D—- C:Program FilesuTorrent
2009-02-11 00:10:43 —-HDC—- C:WINDOWS$NtUninstallKB960715$
2009-02-09 19:09:41 —-D—- C:Program FilesРНИВЦ
2009-02-09 19:09:26 —-D—- C:Program FilesДекларация 2008
2009-02-08 14:02:54 —-D—- C:Documents and SettingsAll UsersApplication DataEscapeTheMuseum
2009-02-08 11:56:36 —-D—- C:Program FilesCommon FilesYandex
2009-02-08 11:56:36 —-D—- C:Documents and SettingsаняApplication DataYandex
2009-02-08 11:56:35 —-D—- C:Program FilesYandex
2009-02-08 11:04:30 —-D—- C:Program FilesAdobe Media Player
2009-02-08 11:04:27 —-D—- C:Program FilesCommon FilesAdobe AIR
2009-02-08 01:16:38 —-HDC—- C:WINDOWS$NtUninstallKB941569$
2009-02-08 01:16:26 —-HDC—- C:WINDOWS$NtUninstallKB929399$
2009-02-08 01:16:14 —-HDC—- C:WINDOWS$NtUninstallKB939683$
2009-02-08 01:14:16 —-HDC—- C:WINDOWS$NtUninstallKB954154_WM11$
2009-02-08 01:14:06 —-HDC—- C:WINDOWS$NtUninstallKB936782_WMP11$
2009-02-07 23:10:13 —-D—- C:Documents and SettingsAll UsersApplication DataPlayrix Entertainment
2009-02-07 23:00:00 —-D—- C:Documents and SettingsAll UsersApplication DataDivoGames
2009-02-07 22:59:34 —-D—- C:Program FilesMyRealGames.com
2009-02-07 22:59:01 —-D—- C:Documents and SettingsаняApplication DataEncyclopedia of Patience
2009-02-07 22:56:27 —-D—- C:Program FilesMyPlayCity.ru
2009-02-07 22:51:18 —-D—- C:Documents and SettingsаняApplication DataPlayrix Entertainment
2009-02-07 22:50:18 —-D—- C:Игры от NevoSoft
2009-02-07 18:46:28 —-A—- C:WINDOWSsystem32muweb.dll
2009-02-07 18:46:28 —-A—- C:WINDOWSsystem32mucltui.dll.mui
2009-02-07 18:46:27 —-A—- C:WINDOWSsystem32mucltui.dll
2009-02-07 17:19:19 —-D—- C:Program FilesFieryAds
2009-02-07 17:19:19 —-A—- C:WINDOWSsystem32borlndmm.dll
2009-02-07 16:13:53 —-HDC—- C:WINDOWS$NtUninstallKB926239$
2009-02-07 16:13:33 —-N—- C:WINDOWSsystem32spmsg.dll
2009-02-07 16:13:32 —-HDC—- C:WINDOWS$NtUninstallMSCompPackV1$
2009-02-07 16:13:16 —-D—- C:Program FilesWindows Media Connect 2
2009-02-07 16:13:03 —-HDC—- C:WINDOWS$NtUninstallwmp11$
2009-02-07 16:12:30 —-HDC—- C:WINDOWS$NtUninstallWMFDist11$
2009-02-07 16:12:14 —-D—- C:WINDOWSsystem32LogFiles
2009-02-07 16:12:09 —-HDC—- C:WINDOWS$NtUninstallWudf01000$
2009-02-07 16:00:41 —-D—- C:WINDOWSRegisteredPackages
2009-02-07 14:54:43 —-D—- C:Documents and SettingsAll UsersApplication DataWindows Genuine Advantage
2009-02-07 13:06:04 —-D—- C:Program FilesMicrosoft Silverlight
2009-02-07 12:49:33 —-D—- C:Documents and SettingsаняApplication DataSlimBrowser
2009-02-07 12:49:26 —-D—- C:Program FilesSlimBrowser
2009-02-04 23:31:36 —-D—- C:Program FilesДекларация 2007
2009-02-04 11:40:02 —-A—- C:WINDOWSNeroDigital.ini
2009-02-02 23:29:35 —-HDC—- C:WINDOWS$NtUninstallKB925720$
2009-02-02 23:29:27 —-D—- C:Program FilesMSXML 4.0
2009-02-01 23:24:15 —-D—- C:Documents and SettingsаняApplication DataNero
2009-02-01 21:10:21 —-A—- C:WINDOWSPoolemup.ini
2009-02-01 21:10:20 —-D—- C:Program FilesPool ‘m Up
2009-02-01 20:25:18 —-A—- C:WINDOWSIrremote.ini
2009-02-01 20:23:14 —-D—- C:Program FilesWindows Sidebar
2009-02-01 20:12:51 —-D—- C:Program FilesNero
2009-02-01 20:12:25 —-D—- C:Program FilesCommon FilesNero
2009-02-01 20:12:25 —-D—- C:Documents and SettingsAll UsersApplication DataNero
2009-02-01 15:33:15 —-D—- C:Program FilesИгры
2009-02-01 15:10:33 —-D—- C:Program FilesAlcohol Soft
2009-02-01 00:36:56 —-HDC—- C:WINDOWS$NtUninstallXPSEPSCLP$
2009-02-01 00:35:24 —-D—- C:Program FilesMSBuild
2009-02-01 00:35:19 —-D—- C:WINDOWSsystem32XPSViewer
2009-02-01 00:35:16 —-D—- C:WINDOWSsystem32en-us
2009-02-01 00:35:16 —-D—- C:Program FilesReference Assemblies
2009-02-01 00:34:50 —-N—- C:WINDOWSsystem32spmsg2.dll
2009-02-01 00:34:11 —-RSD—- C:WINDOWSassembly
2009-02-01 00:33:50 —-D—- C:WINDOWSMicrosoft.NET
2009-02-01 00:33:05 —-HDC—- C:WINDOWS$NtUninstallWIC$
2009-02-01 00:32:56 —-D—- C:Program FilesMSXML 6.0
2009-02-01 00:23:39 —-HDC—- C:WINDOWS$MSI31Uninstall_KB893803v2$
2009-02-01 00:16:44 —-D—- C:Program FilesInstallPlay65
2009-01-31 23:14:11 —-D—- C:Documents and SettingsAll UsersApplication DataPlayFirst
2009-01-31 23:13:53 —-D—- C:Documents and SettingsAll UsersApplication DataAlawarWrapper
2009-01-31 23:02:50 —-D—- C:Program FilesAlawar.ru
2009-01-28 14:43:07 —-RD—- C:Алекса======List of files/folders modified in the last 1 months======
2009-02-26 21:10:52 —-RD—- C:Program Files
2009-02-26 20:24:21 —-D—- C:WINDOWSsystem32CatRoot2
2009-02-25 23:17:21 —-A—- C:WINDOWSSchedLgU.Txt
2009-02-25 23:08:32 —-D—- C:WINDOWSsystem32
2009-02-25 23:08:28 —-D—- C:WINDOWS
2009-02-25 23:01:11 —-A—- C:WINDOWSsystem.ini
2009-02-25 23:00:02 —-D—- C:WINDOWSsystem32drivers
2009-02-25 23:00:02 —-D—- C:WINDOWSAppPatch
2009-02-25 22:59:58 —-D—- C:Program FilesCommon Files
2009-02-25 22:52:56 —-D—- C:Documents and SettingsAll UsersApplication DataKaspersky Lab
2009-02-25 22:25:16 —-D—- C:Documents and Settings
2009-02-25 21:51:53 —-D—- C:WINDOWSsystem32config
2009-02-25 21:51:47 —-D—- C:WINDOWSERDNT
2009-02-25 21:35:10 —-D—- C:WINDOWSPrefetch
2009-02-25 19:27:47 —-HD—- C:WINDOWSinf
2009-02-25 18:14:34 —-D—- C:WINDOWSDriver Cache
2009-02-25 15:22:25 —-RSHDC—- C:WINDOWSsystem32dllcache
2009-02-25 10:31:59 —-HD—- C:WINDOWS$hf_mig$
2009-02-25 00:27:33 —-D—- C:Documents and SettingsаняApplication DataAdobe
2009-02-21 21:55:23 —-D—- C:Program FilesOpera
2009-02-21 21:34:55 —-D—- C:Program FilesMicrosoft ActiveSync
2009-02-21 15:30:16 —-D—- C:Documents and SettingsAll UsersApplication DataWinZip
2009-02-21 15:30:13 —-SHD—- C:WINDOWSInstaller
2009-02-21 15:30:13 —-SHD—- C:Config.Msi
2009-02-21 11:44:23 —-A—- C:WINDOWSsystem32PerfStringBackup.INI
2009-02-15 10:09:49 —-D—- C:Documents and SettingsаняApplication DataMra
2009-02-13 17:02:48 —-D—- C:фото
2009-02-12 21:38:12 —-D—- C:Documents and SettingsаняApplication DataWinamp
2009-02-11 00:10:47 —-A—- C:WINDOWSimsins.BAK
2009-02-09 19:09:27 —-RSD—- C:WINDOWSFonts
2009-02-08 11:04:39 —-D—- C:Documents and SettingsAll UsersApplication DataAdobe
2009-02-08 01:16:43 —-D—- C:WINDOWSsystem32CatRoot
2009-02-07 19:07:24 —-D—- C:WINDOWSsystem32CatRoot_bak
2009-02-07 17:53:11 —-SD—- C:WINDOWSDownloaded Program Files
2009-02-07 16:13:22 —-A—- C:WINDOWSwin.ini
2009-02-07 16:13:16 —-D—- C:Program FilesWindows Media Player
2009-02-07 16:13:12 —-D—- C:WINDOWSHelp
2009-02-07 16:01:14 —-D—- C:WINDOWSsecurity
2009-02-04 20:44:09 —-SD—- C:Documents and SettingsаняApplication DataMicrosoft
2009-02-04 02:21:12 —-A—- C:WINDOWSsystem32MRT.exe
2009-02-02 23:29:27 —-D—- C:WINDOWSWinSxS
2009-02-01 20:12:09 —-D—- C:Program FilesCommon FilesMicrosoft Shared
2009-02-01 00:36:46 —-D—- C:WINDOWSsystem32ru-ru
2009-02-01 00:34:58 —-D—- C:WINDOWSsystem32spool
2009-02-01 00:33:56 —-D—- C:Program FilesInternet Explorer
2009-01-31 23:14:11 —-D—- C:Documents and SettingsаняApplication DataPlayFirst
2009-01-28 14:44:00 —-D—- C:музыка======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2004-08-17 40448]
R1 kbdhid;Драйвер клавиатуры HID; C:WINDOWSsystem32DRIVERSkbdhid.sys [2004-08-17 14848]
R1 klif;Klif; ??C:WINDOWSsystem32driversklif.sys []
R3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet адаптер, драйвер для NT; C:WINDOWSsystem32DRIVERSfetnd5.sys [2001-08-17 27165]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:WINDOWSsystem32DRIVERSGEARAspiWDM.sys [2008-04-17 15464]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:WINDOWSsystem32DRIVERSHDAudBus.sys [2005-01-07 138752]
R3 hidusb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2001-10-20 9600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:WINDOWSsystem32driversRtkHDAud.sys [2007-06-22 4432384]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:WINDOWSsystem32DRIVERSklim5.sys [2007-04-04 24344]
R3 mouhid;Драйвер мыши HID; C:WINDOWSsystem32DRIVERSmouhid.sys [2001-10-20 12160]
R3 nv;nv; C:WINDOWSsystem32DRIVERSnv4_mini.sys [2007-04-20 6739168]
R3 PdiPorts;Portrait Displays low level device driver; C:WINDOWSSystem32DriversPdiPorts.sys [2006-09-08 8960]
R3 usbccgp;Драйвер универсального родительского устройства USB (Microsoft); C:WINDOWSsystem32DRIVERSusbccgp.sys [2004-08-03 31616]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2004-08-03 26624]
R3 usbhub;Драйвер стандартного концентратора USB (Microsoft); C:WINDOWSsystem32DRIVERSusbhub.sys [2004-08-03 57600]
R3 usbstor;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2004-08-03 26496]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2004-08-03 20480]
S3 aut2o4sw;aut2o4sw; C:WINDOWSsystem32driversaut2o4sw.sys []
S3 pdiddcci;DDC/CI monitor; C:WINDOWSSystem32DRIVERSpdiddcci.sys [2006-09-08 11776]
S3 usb_rndisx;USB RNDIS Adapter; C:WINDOWSsystem32DRIVERSusb8023x.sys [2005-10-21 12800]
S3 WudfPf;Windows Driver Foundation — User-mode Driver Framework Platform Driver; C:WINDOWSsystem32DRIVERSWudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 Apple Mobile Device;Apple Mobile Device; C:Program FilesCommon FilesAppleMobile Device SupportbinAppleMobileDeviceService.exe [2008-11-07 132424]
R2 Asset Management Daemon;Asset Management Daemon; C:Program FilesPortrait DisplaysforteManagerdtsslsrv.exe [2006-09-08 114688]
R2 AVP;Kaspersky Anti-Virus 6.0; C:Program FilesKaspersky LabKaspersky Anti-Virus 6.0 for Windows Workstationsavp.exe [2009-01-21 211568]
R2 Bonjour Service;Bonjour Service; C:Program FilesBonjourmDNSResponder.exe [2008-08-29 238888]
R2 DTSRVC;Portrait Displays Display Tune Service; C:Program FilesPortrait DisplaysforteManagerDTSRVC.exe [2006-09-08 61440]
R2 ICQ Service;ICQ Service; C:Program FilesICQ6ToolbarICQ Service.exe [2008-06-10 222456]
R2 MDM;Machine Debug Manager; C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE [2003-06-19 322120]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:Program FilesCommon FilesNeroNero BackItUp 4NBService.exe [2008-12-05 935208]
R2 NVSvc;NVIDIA Display Driver Service; C:WINDOWSsystem32nvsvc32.exe [2007-04-20 163908]
R2 StarWindServiceAE;StarWind AE Service; C:Program FilesAlcohol SoftAlcohol 120StarWindStarWindServiceAE.exe [2007-05-28 275968]
R3 iPod Service;Сервис iPod; C:Program FilesiPodbiniPodService.exe [2008-11-20 536872]
S2 pr2aje6b;Top Spin 2 Drivers Auto Removal (pr2aje6b); C:WINDOWSsystem32pr2aje6b.exe [2007-02-16 407160]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; c:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2007-10-24 70144]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:WINDOWSMicrosoft.NetFrameworkv3.0WPFPresentationFontCache.exe [2007-10-09 36864]
S3 idsvc;Windows CardSpace; c:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication Foundationinfocard.exe [2007-10-11 864256]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2003-07-28 89136]
S3 WMPNetworkSvc;Служба общих сетевых ресурсов проигрывателя Windows Media; C:Program FilesWindows Media PlayerWMPNetwk.exe [2006-11-02 914944]
S3 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2004-08-17 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication FoundationSMSvcHost.exe [2007-10-11 122880]
EOF
вот какой лог после проверки комбофикса
ComboFix 09-02-25.02 — аня 2009-02-26 21:59:08.9 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1251.1.1049.18.1022.628 [GMT 3:00]
Running from: c:documents and settingsаняРабочий столComboFix.exe
Command switches used :: c:documents and settingsаняРабочий столCFScript.txt
AV: Антивирус Касперского *On-access scanning disabled* (Updated)
FW: Антивирус Касперского *disabled*
* Created a new restore pointWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
c:documents and settingsAll UsersApplication Dataaqplib.dll
.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.c:documents and settingsаняLocal SettingsTemporary Internet Files0EB9F12C_6E6B_4c03_AEBA_8C04CFA98AA4.gif
c:documents and settingsаняLocal SettingsTemporary Internet Files15913497_F86C_4218_8817_F50940D1E1B2.jpg
c:documents and settingsаняLocal SettingsTemporary Internet Files29887DDE_00B9_4011_9CF7_59511F1ECC1B.gif
c:documents and settingsаняLocal SettingsTemporary Internet Files35B7DFFA_884F_4fbc_8E60_DA601BDC7BF7.gif
c:documents and settingsаняLocal SettingsTemporary Internet Files3DF04940_9866_4241_A998_0CDDFAFD147A.jpg
c:documents and settingsаняLocal SettingsTemporary Internet Files426500D7_0FF3_426c_828D_065DBAEA0581.jpg
c:documents and settingsаняLocal SettingsTemporary Internet Files5C6C645F_BAA8_4149_BFEB_2031230FF0FD.gif
c:documents and settingsаняLocal SettingsTemporary Internet Files777FDAFB_83CF_4960_AA71_4E5D7BCD8E57.jpg
c:documents and settingsаняLocal SettingsTemporary Internet Files8DA878D5_E80B_4721_B75A_17EFFAF1A700.jpg
c:documents and settingsаняLocal SettingsTemporary Internet FilesC75CEF8D_5AF4_4563_8594_C45A45E14E63.gif
c:documents and settingsаняLocal SettingsTemporary Internet FilesE21285C1_40E6_435c_A69F_3387E7BD89CB.jpg
.
—- Previous Run
.
c:documents and settingsаняLocal SettingsTemporary Internet Files0EB9F12C_6E6B_4c03_AEBA_8C04CFA98AA4.gif
c:documents and settingsаняLocal SettingsTemporary Internet Files15913497_F86C_4218_8817_F50940D1E1B2.jpg
c:documents and settingsаняLocal SettingsTemporary Internet Files29887DDE_00B9_4011_9CF7_59511F1ECC1B.gif
c:documents and settingsаняLocal SettingsTemporary Internet Files35B7DFFA_884F_4fbc_8E60_DA601BDC7BF7.gif
c:documents and settingsаняLocal SettingsTemporary Internet Files3DF04940_9866_4241_A998_0CDDFAFD147A.jpg
c:documents and settingsаняLocal SettingsTemporary Internet Files426500D7_0FF3_426c_828D_065DBAEA0581.jpg
c:documents and settingsаняLocal SettingsTemporary Internet Files5C6C645F_BAA8_4149_BFEB_2031230FF0FD.gif
c:documents and settingsаняLocal SettingsTemporary Internet Files777FDAFB_83CF_4960_AA71_4E5D7BCD8E57.jpg
c:documents and settingsаняLocal SettingsTemporary Internet Files8DA878D5_E80B_4721_B75A_17EFFAF1A700.jpg
c:documents and settingsаняLocal SettingsTemporary Internet FilesC75CEF8D_5AF4_4563_8594_C45A45E14E63.gif
c:documents and settingsаняLocal SettingsTemporary Internet FilesE21285C1_40E6_435c_A69F_3387E7BD89CB.jpg.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
Legacy_WINSECGUARD((((((((((((((((((((((((( Files Created from 2009-01-26 to 2009-02-26 )))))))))))))))))))))))))))))))
.2009-02-26 21:42 . 2009-02-26 21:42
d
C:_OTMoveIt
2009-02-26 21:10 . 2009-02-26 21:11d
C:rsit
2009-02-26 21:10 . 2009-02-26 21:17d
c:program filestrend micro
2009-02-25 19:42 . 2009-02-25 19:42d—s—- c:documents and settingsаняUserData
2009-02-25 19:42 . 2009-02-25 19:42d—s—- c:documents and settingsаняUserData
2009-02-25 18:12 . 2009-02-25 18:12 506,880 —a
c:documents and settingsAll UsersApplication Dataibylib.dll
2009-02-25 18:11 . 2009-02-25 18:11 506,368 —a
c:documents and settingsAll UsersApplication Datayzdlib.dll
2009-02-22 20:46 . 2009-02-22 20:46 34 —a
c:windowsfshset.ini
2009-02-21 21:55 . 2009-02-24 21:36d
C:Downloads
2009-02-21 21:54 . 2009-02-21 22:16d
c:documents and settingsаняApplication DataDownload Master
2009-02-21 21:53 . 2009-02-24 21:40d
c:program filesDownload Master
2009-02-15 19:57 . 2009-02-15 19:58d
c:program filesMPC HomeCinema
2009-02-15 19:40 . 2009-02-15 23:06d
c:documents and settingsаняApplication DataXBMC
2009-02-15 19:39 . 2009-02-15 19:40d
c:program filesXBMC
2009-02-15 19:37 . 2009-02-15 19:37d
c:program filesCookRecepts
2009-02-14 23:17 . 2009-02-14 23:17d
c:program filesKaraoke GALAXY
2009-02-13 13:41 . 2009-02-13 13:41d
c:program filesuTorrent
2009-02-13 13:41 . 2009-02-13 13:52d
c:documents and settingsаняApplication DatauTorrent
2009-02-09 19:09 . 2009-02-09 19:09d
c:program filesРНИВЦ
2009-02-09 19:09 . 2009-02-09 19:09d
c:program filesДекларация 2008
2009-02-08 14:02 . 2009-02-08 14:02d
c:documents and settingsAll UsersApplication DataEscapeTheMuseum
2009-02-08 11:56 . 2009-02-08 11:56d
c:program filesYandex
2009-02-08 11:56 . 2009-02-08 11:56d
c:program filesCommon FilesYandex
2009-02-08 11:56 . 2009-02-08 11:56d
c:documents and settingsаняApplication DataYandex
2009-02-08 11:04 . 2009-02-08 11:04d
c:program filesCommon FilesAdobe AIR
2009-02-08 11:04 . 2009-02-08 11:04d
c:program filesAdobe Media Player
2009-02-07 23:10 . 2009-02-07 23:10d
c:documents and settingsAll UsersApplication DataPlayrix Entertainment
2009-02-07 23:00 . 2009-02-07 23:00d
c:documents and settingsAll UsersApplication DataDivoGames
2009-02-07 22:59 . 2009-02-07 22:59d
c:program filesMyRealGames.com
2009-02-07 22:59 . 2009-02-07 22:59d
c:documents and settingsаняApplication DataEncyclopedia of Patience
2009-02-07 22:56 . 2009-02-07 22:56d
c:program filesMyPlayCity.ru
2009-02-07 22:51 . 2009-02-07 22:51d
c:documents and settingsаняApplication DataPlayrix Entertainment
2009-02-07 22:50 . 2009-02-08 14:10d
C:Игры от NevoSoft
2009-02-07 18:46 . 2008-10-16 14:06 268,648 —a
c:windowssystem32mucltui.dll
2009-02-07 18:46 . 2008-10-16 14:06 208,744 —a
c:windowssystem32muweb.dll
2009-02-07 18:46 . 2008-10-16 14:06 27,496 —a
c:windowssystem32mucltui.dll.mui
2009-02-07 17:19 . 2009-02-07 17:32d
c:program filesFieryAds
2009-02-07 17:19 . 2009-02-07 17:19 30,208 —a
c:windowssystem32borlndmm.dll
2009-02-07 16:13 . 2009-02-07 16:13d
c:program filesWindows Media Connect 2
2009-02-07 16:12 . 2009-02-07 16:12d
c:windowssystem32LogFiles
2009-02-07 16:12 . 2009-02-07 16:12d
c:windowssystem32driversUMDF
2009-02-07 13:06 . 2009-02-07 13:06d
c:program filesMicrosoft Silverlight
2009-02-07 12:49 . 2009-02-07 12:50d
c:program filesSlimBrowser
2009-02-07 12:49 . 2009-02-08 20:05d
c:documents and settingsаняApplication DataSlimBrowser
2009-02-04 23:31 . 2009-02-04 23:31d
c:program filesДекларация 2007
2009-02-04 11:40 . 2009-02-09 10:11 69 —a
c:windowsNeroDigital.ini
2009-02-02 23:29 . 2009-02-02 23:29d
c:program filesMSXML 4.0
2009-02-01 23:24 . 2009-02-01 23:24d
c:documents and settingsаняApplication DataNero
2009-02-01 21:10 . 2009-02-01 21:10d
c:program filesPool ‘m Up
2009-02-01 21:10 . 2009-02-01 21:11 488 —a
c:windowsPoolemup.ini
2009-02-01 20:25 . 2009-02-01 20:25 4,767 —a
c:windowsIrremote.ini
2009-02-01 20:23 . 2009-02-01 20:23d
c:program filesWindows Sidebar
2009-02-01 20:12 . 2009-02-01 20:24d
c:program filesNero
2009-02-01 20:12 . 2009-02-01 20:37d
c:program filesCommon FilesNero
2009-02-01 20:12 . 2009-02-01 20:18d
c:documents and settingsAll UsersApplication DataNero
2009-02-01 15:33 . 2009-02-21 21:36d
c:program filesИгры
2009-02-01 15:10 . 2009-02-01 15:10d
c:program filesAlcohol Soft
2009-02-01 15:08 . 2009-02-01 15:08 716,272 —a
c:windowssystem32driverssptd.sys
2009-02-01 00:35 . 2009-02-01 00:36d
c:windowssystem32XPSViewer
2009-02-01 00:35 . 2009-02-01 00:35d
c:program filesReference Assemblies
2009-02-01 00:35 . 2009-02-01 00:35d
c:program filesMSBuild
2009-02-01 00:34 . 2006-06-29 13:07 14,048
c:windowssystem32spmsg2.dll
2009-02-01 00:32 . 2009-02-01 00:32d
c:program filesMSXML 6.0
2009-02-01 00:16 . 2009-02-01 00:16d
c:program filesInstallPlay65
2009-01-31 23:14 . 2009-01-31 23:14d
c:documents and settingsAll UsersApplication DataPlayFirst
2009-01-31 23:13 . 2009-02-22 20:52d
c:documents and settingsAll UsersApplication DataAlawarWrapper
2009-01-31 23:02 . 2009-02-22 20:50d
c:program filesAlawar.ru
2009-01-28 14:43 . 2009-02-24 23:17dr
C:Алекса.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-26 19:00 532,000 —sha-w c:windowssystem32driversfidbox2.dat
2009-02-26 19:00 12,974,112 —sha-w c:windowssystem32driversfidbox.dat
2009-02-26 18:44
d
w c:documents and settingsAll UsersApplication DataKaspersky Lab
2009-02-26 18:43 51,320 —sha-w c:windowssystem32driversfidbox2.idx
2009-02-26 18:43 174,560 —sha-w c:windowssystem32driversfidbox.idx
2009-02-25 16:14 89,601 —-a-w c:windowssystem32driversklick.dat
2009-02-25 16:14 101,287 —-a-w c:windowssystem32driversklin.dat
2009-02-21 18:55
d
w c:program filesOpera
2009-02-21 18:34
d
w c:program filesMicrosoft ActiveSync
2009-02-21 12:30
d
w c:documents and settingsAll UsersApplication DataWinZip
2009-02-15 07:09
d
w c:documents and settingsаняApplication DataMra
2009-02-12 18:38
d
w c:documents and settingsаняApplication DataWinamp
2009-01-31 20:14
d
w c:documents and settingsаняApplication DataPlayFirst
2009-01-25 10:36
d
w c:program files1C
2009-01-22 18:30
d
w c:documents and settingsаняApplication DataICQ
2009-01-22 17:17 5,088,952 —-a-w C:magentsetup.exe
2009-01-22 17:17
d
w c:program filesMail.Ru
2009-01-21 17:45 112,144 —-a-w c:windowssystem32driverskl1.sys
2009-01-19 19:28
d
w c:program filesICQ6.5
2009-01-18 19:12
d
w c:documents and settingsаняApplication DataMedia Player Classic
2009-01-18 12:51
d
w c:program filesiTunes
2009-01-18 12:51
d
w c:documents and settingsAll UsersApplication Data{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-01-18 12:50
d
w c:program filesiPod
2009-01-18 12:49
d
w c:program filesApple Software Update
2009-01-18 12:47
d
w c:program filesCommon FilesApple
2009-01-18 12:41
d
w c:program filesK-Lite Codec Pack
2009-01-17 09:30 315,392 —-a-w c:windowsHideWin.exe
2009-01-17 09:30
d—h—w c:program filesInstallShield Installation Information
2009-01-17 09:30
d
w c:program filesRealtek
2009-01-06 10:53
d
w c:program filesWindows Mobile Device Handbook
2009-01-06 10:43
d
w c:program filesBuka
2009-01-06 10:22
d
w c:program filesRealtek AC97
2009-01-06 10:20
d
w c:program filesVIA
2009-01-06 10:20
d
w c:program filesCommon FilesInstallShield
2009-01-06 10:00
d
w c:program filesKaspersky Lab
2009-01-06 09:36
d
w c:program filesPULSE MP3 Master
2009-01-06 09:35
d
w c:program filesKMPlayer 2.9.3 !!!!!!!!!!!
2009-01-06 09:18
d
w c:program filesФотоДЕКОР
2009-01-06 09:15
d
w c:program files7-Zip
2009-01-06 09:00
d
w c:program filesMicrosoft.NET
2009-01-06 09:00
d
w c:program filesMicrosoft Works
2009-01-04 19:08
d
w c:documents and settingsAll UsersApplication DataAspyr
2009-01-04 17:24
d
w c:program filesSigmaTel
2009-01-04 16:11
d
w c:documents and settingsаняApplication DataDisplayTune
2009-01-04 16:10
d
w c:program filesPortrait Displays
2009-01-04 15:43
d
w c:program filesAkella Games
2009-01-04 15:37
d
w c:program filesVenta
2009-01-04 13:24
d
w c:program filesAshampoo
2009-01-04 13:02
d
w c:documents and settingsаняApplication DataGlarySoft
2009-01-04 12:58
d
w c:program filesAskSearch
2009-01-04 12:58
d
w c:program filesAskBarDis
2009-01-04 09:38
d
w c:program filesQuickTime
2009-01-04 09:38
d
w c:program filesBonjour
2009-01-04 09:38
d
w c:documents and settingsаняApplication DataApple Computer
2009-01-04 09:37
d
w c:documents and settingsAll UsersApplication DataApple Computer
2009-01-04 09:37
d
w c:documents and settingsAll UsersApplication DataApple
2009-01-04 09:35
d
w c:documents and settingsаняApplication DataAshampoo
2009-01-04 09:34
d
w c:documents and settingsAll UsersApplication Dataashampoo
2009-01-04 09:33
d
w c:documents and settingsаняApplication DataQIP
2009-01-04 09:32
d
w c:program filesICQ6Toolbar
2009-01-04 09:32
d
w c:documents and settingsAll UsersApplication DataICQ
2009-01-04 09:27
d—a-w c:program filesAcronis
2009-01-04 09:27
d
w c:program filesCommon FilesAcronis
2009-01-04 09:24 971,232 —-a-w c:windowssystem32driverstdrpm147.sys
2009-01-04 09:24 540,000 —-a-w c:windowssystem32driverstimntr.sys
2009-01-04 09:24 44,704 —-a-w c:windowssystem32driverstifsfilt.sys
2009-01-04 09:20 134,272 —-a-w c:windowssystem32driverssnman380.sys
2009-01-04 09:11
d
w c:documents and settingsаняApplication DataAcronis
2009-01-04 09:11
d
w c:documents and settingsAll UsersApplication DataAcronis
2009-01-04 09:04
d
w c:documents and settingsаняApplication DataSongbird2
2009-01-04 09:03
d
w c:documents and settingsAll UsersApplication DataSongbirdVLC
2009-01-04 08:51
d
w c:program filesWinamp
2009-01-04 08:39
d
w c:program filesCommon FilesAdobe
2009-01-04 08:15
d
w c:program filesmicrosoft frontpage
.
Sigcheck
2008-04-14 19:11 509440 b3b5d5855127e240c88451030aaee76e c:windowsSoftwareDistributionDownloada50daa009f8a7e7bb00fe145d2709bd7winlogon.exe
2004-09-17 15:16 503808 a975a70fcefe2a224412214320c89ded c:windowssystem32winlogon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_LOCAL_MACHINE~Browser Helper Objects{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-07-17 17:20 279944 —a
c:program filesAskBarDisbarbinaskBar.dll[HKEY_LOCAL_MACHINE~Browser Helper Objects{3802F364-62DD-4112-BF89-D8E6454FD755}]
2009-02-25 18:11 506368 —a
c:documents and settingsAll UsersApplication Datayzdlib.dll[HKEY_LOCAL_MACHINE~Browser Helper Objects{BA3D8793-CB77-4C54-9F21-7D1E5F51B902}]
2009-02-25 18:12 506880 —a
c:documents and settingsAll UsersApplication Dataibylib.dll[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{3041d03e-fd4b-44e0-b742-2d9b88305f98}»= «c:program filesAskBarDisbarbinaskBar.dll» [2008-07-17 279944]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2008-12-03 1561864][HKEY_CLASSES_ROOTclsid{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOTTypeLib{4b1c1e16-6b34-430e-b074-5928eca4c150}][HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar][HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2008-12-03 1561864]
«{3041D03E-FD4B-44E0-B742-2D9B88305F98}»= «c:program filesAskBarDisbarbinaskBar.dll» [2008-07-17 279944][HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar][HKEY_CLASSES_ROOTclsid{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOTTypeLib{4b1c1e16-6b34-430e-b074-5928eca4c150}][HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2004-08-17 15360]
«H/PC Connection Agent»=»c:program filesMicrosoft ActiveSyncwcescomm.exe» [2006-11-13 1289000]
«MSMSGS»=»c:program filesMessengermsmsgs.exe» [2004-08-17 1667584]
«AlcoholAutomount»=»c:program filesAlcohol SoftAlcohol 120axcmd.exe» [2008-02-22 217544]
«Yupdate!»=»c:program filesCommon FilesYandexYupdateyupdate.exe» [2008-10-20 479496]
«SetDefaultMIDI»=»MIDIDef.exe» [2002-12-03 c:windowsMIDIDEF.EXE][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«Adobe Reader Speed Launcher»=»c:program filesAdobeReader 9.0ReaderReader_sl.exe» [2008-06-12 34672]
«QuickTime Task»=»c:program filesQuickTimeqttask.exe» [2008-09-06 413696]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2007-04-20 8429568]
«DT Task»=»c:program filesPortrait DisplaysforteManagerDTHtml.exe» [2006-09-08 282624]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2007-04-20 81920]
«iTunesHelper»=»c:program filesiTunesiTunesHelper.exe» [2008-11-20 290088]
«MAgent»=»c:program filesMail.RuAgentMAgent.exe» [2009-01-22 5600952]
«Synchronization Manager»=»c:windowssystem32mobsync.exe» [2004-08-17 143360]
«NevoDRM»=»c:игры от nevosoftNevoDRMNevoDRM.exe» [2008-12-11 41984]
«WinampAgent»=»c:program filesWinampwinampa.exe» [2008-07-10 36352]
«nwiz»=»nwiz.exe» [2007-04-20 c:windowssystem32nwiz.exe]
«RTHDCPL»=»RTHDCPL.EXE» [2007-06-13 c:windowsRTHDCPL.exe][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2004-08-17 15360][HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringKasperskyAntiVirus]
«DisableMonitoring»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\ICQ6.5\ICQ.exe»=
«c:\Program Files\Bonjour\mDNSResponder.exe»=
«c:program filesMicrosoft ActiveSyncrapimgr.exe»= c:program filesMicrosoft ActiveSyncrapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
«c:program filesMicrosoft ActiveSyncwcescomm.exe»= c:program filesMicrosoft ActiveSyncwcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
«c:program filesMicrosoft ActiveSyncWCESMgr.exe»= c:program filesMicrosoft ActiveSyncWCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
«c:\Program Files\iTunes\iTunes.exe»=
«c:\Program Files\uTorrent\utorrent.exe»=[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«26675:TCP»= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync ServiceR0 pe3aje6b;Top Spin 2 Environment Driver (pe3aje6b);c:windowssystem32driverspe3aje6b.sys [2007-02-16 65408]
R0 ps6aje6b;Top Spin 2 Synchronization Driver (ps6aje6b);c:windowssystem32driversps6aje6b.sys [2007-02-16 51592]
R0 snapman380;Acronis Snapshots Manager (Build 380);c:windowssystem32driverssnman380.sys [2009-01-04 134272]
R2 ICQ Service;ICQ Service;c:program filesICQ6ToolbarICQ Service.exe [2009-01-04 222456]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:windowssystem32driversklim5.sys [2007-04-04 24344]
S2 pr2aje6b;Top Spin 2 Drivers Auto Removal (pr2aje6b);c:windowssystem32pr2aje6b.exe svc —> c:windowssystem32pr2aje6b.exe svc [?]
.
.
Supplementary Scan
.
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10168&gct=&gc=1&q=%s
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
IE: Закачать ВСЕ при помощи Download Master — c:program filesDownload Masterdmieall.htm
IE: Закачать при помощи Download Master — c:program filesDownload Masterdmie.htm
IE: Поиск@Mail.Ru — c:program filesMail.RuSputnikMailRuSputnik.dll/282
IE: Словари@Mail.Ru — c:program filesMail.RuSputnikMailRuSputnik.dll/283
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:program filesMail.RuAgentmagent.exe
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe
TCP: {2A32FE11-A620-4B63-8E8C-83BE1434B600} = 85.158.48.34 85.158.50.50
TCP: {63A57C90-0036-4EA2-9548-06AA808CD5FB} = 85.158.48.34,85.158.50.50
FF — ProfilePath — c:documents and settingsаняApplication DataMozillaFirefoxProfiles9vf96daw.default
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnppl3260.dll
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnprpjplug.dll
FF — plugin: c:program filesOperaprogrampluginsnpdm.dll
FF — plugin: c:program filesOperaprogrampluginsnppl3260.dll
FF — plugin: c:program filesOperaprogrampluginsnprpjplug.dll
.**************************************************************************
catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-26 22:00:43
Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(1180)
c:windowssystem32klogon.dll
.
Completion time: 2009-02-26 22:01:42
ComboFix-quarantined-files.txt 2009-02-26 19:01:40
ComboFix2.txt 2009-02-25 20:03:19
ComboFix3.txt 2009-02-25 19:39:54Pre-Run: 111,498,481,664 байт свободно
Post-Run: 111,479,615,488 байт свободно308 — E O F — 2009-02-25 12:22:29
Здравствуйте, добро пожаловать на Spyware-ru форум.
Откройте блокнот (Кликните Пуск, Выполнить, в строке ввода введите notepad и нажмите Enter) и вставьте в него следующий текст:
Registry::
[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{3802F364-62DD-4112-BF89-D8E6454FD755}]
[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{BA3D8793-CB77-4C54-9F21-7D1E5F51B902}]
File::
C:Documents and SettingsAll UsersApplication Dataibylib.dll
C:Documents and SettingsAll UsersApplication Datayzdlib.dllЗапишите получившийся файл на ваш рабочий стол под именем CFScript
Далее перетащите получившийся файл на иконку Combofix, как показано на картинке ниже.
Сombofix запуститься и выполнит процедуры описанные в созданном нами файле.
По результатам работы Combofix будет создан новый лог, его и вставьте в свой следующий ответ.
И конечно-же проверьте InternetExplorer в работе.- Темы:532
- Сообщений:1553
- ☆☆☆☆☆
спасибо ОГРОМНОЕ!!!!!!!! ВСЕ ПРОПАЛО!!!!!! ЕЩЕ РАЗ ОГРОМНОЕ СПАСИБО!!!!!!!!!!!!!!!!!!!!!!!!!!!
вот мой лог
ComboFix 09-02-27.02 — аня 2009-02-28 20:56:38.11 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1251.1.1049.18.1022.589 [GMT 3:00]
Running from: c:documents and settingsаняРабочий столComboFix.exe
Command switches used :: c:documents and settingsаняРабочий столCFScript.txt
AV: Антивирус Касперского *On-access scanning disabled* (Outdated)
FW: Антивирус Касперского *disabled*
* Created a new restore pointWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
c:documents and settingsAll UsersApplication Dataibylib.dll
c:documents and settingsAll UsersApplication Datayzdlib.dll
.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.c:documents and settingsAll UsersApplication Dataibylib.dll
c:documents and settingsAll UsersApplication Datayzdlib.dll
c:documents and settingsаняLocal SettingsTemporary Internet Files0EB9F12C_6E6B_4c03_AEBA_8C04CFA98AA4.gif
c:documents and settingsаняLocal SettingsTemporary Internet Files15913497_F86C_4218_8817_F50940D1E1B2.jpg
c:documents and settingsаняLocal SettingsTemporary Internet Files29887DDE_00B9_4011_9CF7_59511F1ECC1B.gif
c:documents and settingsаняLocal SettingsTemporary Internet Files35B7DFFA_884F_4fbc_8E60_DA601BDC7BF7.gif
c:documents and settingsаняLocal SettingsTemporary Internet Files3DF04940_9866_4241_A998_0CDDFAFD147A.jpg
c:documents and settingsаняLocal SettingsTemporary Internet Files426500D7_0FF3_426c_828D_065DBAEA0581.jpg
c:documents and settingsаняLocal SettingsTemporary Internet Files5C6C645F_BAA8_4149_BFEB_2031230FF0FD.gif
c:documents and settingsаняLocal SettingsTemporary Internet Files777FDAFB_83CF_4960_AA71_4E5D7BCD8E57.jpg
c:documents and settingsаняLocal SettingsTemporary Internet Files8DA878D5_E80B_4721_B75A_17EFFAF1A700.jpg
c:documents and settingsаняLocal SettingsTemporary Internet FilesC75CEF8D_5AF4_4563_8594_C45A45E14E63.gif
c:documents and settingsаняLocal SettingsTemporary Internet FilesE21285C1_40E6_435c_A69F_3387E7BD89CB.jpg.
((((((((((((((((((((((((( Files Created from 2009-01-28 to 2009-02-28 )))))))))))))))))))))))))))))))
.2009-02-26 22:03 . 2009-02-26 22:03
d
c:documents and settingsаняApplication DataHelp
2009-02-26 21:42 . 2009-02-26 21:42d
C:_OTMoveIt
2009-02-26 21:10 . 2009-02-26 21:11d
C:rsit
2009-02-26 21:10 . 2009-02-26 21:17d
c:program filestrend micro
2009-02-25 19:42 . 2009-02-25 19:42d—s—- c:documents and settingsаняUserData
2009-02-25 19:42 . 2009-02-25 19:42d—s—- c:documents and settingsаняUserData
2009-02-22 20:46 . 2009-02-22 20:46 34 —a
c:windowsfshset.ini
2009-02-21 21:55 . 2009-02-24 21:36d
C:Downloads
2009-02-21 21:54 . 2009-02-21 22:16d
c:documents and settingsаняApplication DataDownload Master
2009-02-21 21:53 . 2009-02-24 21:40d
c:program filesDownload Master
2009-02-15 19:57 . 2009-02-15 19:58d
c:program filesMPC HomeCinema
2009-02-15 19:40 . 2009-02-15 23:06d
c:documents and settingsаняApplication DataXBMC
2009-02-15 19:39 . 2009-02-15 19:40d
c:program filesXBMC
2009-02-15 19:37 . 2009-02-15 19:37d
c:program filesCookRecepts
2009-02-14 23:17 . 2009-02-14 23:17d
c:program filesKaraoke GALAXY
2009-02-13 13:41 . 2009-02-13 13:41d
c:program filesuTorrent
2009-02-13 13:41 . 2009-02-13 13:52d
c:documents and settingsаняApplication DatauTorrent
2009-02-09 19:09 . 2009-02-09 19:09d
c:program filesРНИВЦ
2009-02-09 19:09 . 2009-02-09 19:09d
c:program filesДекларация 2008
2009-02-08 14:02 . 2009-02-08 14:02d
c:documents and settingsAll UsersApplication DataEscapeTheMuseum
2009-02-08 11:56 . 2009-02-08 11:56d
c:program filesYandex
2009-02-08 11:56 . 2009-02-08 11:56d
c:program filesCommon FilesYandex
2009-02-08 11:56 . 2009-02-08 11:56d
c:documents and settingsаняApplication DataYandex
2009-02-08 11:04 . 2009-02-08 11:04d
c:program filesCommon FilesAdobe AIR
2009-02-08 11:04 . 2009-02-08 11:04d
c:program filesAdobe Media Player
2009-02-07 23:10 . 2009-02-07 23:10d
c:documents and settingsAll UsersApplication DataPlayrix Entertainment
2009-02-07 23:00 . 2009-02-07 23:00d
c:documents and settingsAll UsersApplication DataDivoGames
2009-02-07 22:59 . 2009-02-07 22:59d
c:program filesMyRealGames.com
2009-02-07 22:59 . 2009-02-07 22:59d
c:documents and settingsаняApplication DataEncyclopedia of Patience
2009-02-07 22:56 . 2009-02-07 22:56d
c:program filesMyPlayCity.ru
2009-02-07 22:51 . 2009-02-07 22:51d
c:documents and settingsаняApplication DataPlayrix Entertainment
2009-02-07 22:50 . 2009-02-08 14:10d
C:Игры от NevoSoft
2009-02-07 18:46 . 2008-10-16 14:06 268,648 —a
c:windowssystem32mucltui.dll
2009-02-07 18:46 . 2008-10-16 14:06 208,744 —a
c:windowssystem32muweb.dll
2009-02-07 18:46 . 2008-10-16 14:06 27,496 —a
c:windowssystem32mucltui.dll.mui
2009-02-07 17:19 . 2009-02-07 17:32d
c:program filesFieryAds
2009-02-07 17:19 . 2009-02-07 17:19 30,208 —a
c:windowssystem32borlndmm.dll
2009-02-07 16:13 . 2009-02-07 16:13d
c:program filesWindows Media Connect 2
2009-02-07 16:12 . 2009-02-07 16:12d
c:windowssystem32LogFiles
2009-02-07 16:12 . 2009-02-07 16:12d
c:windowssystem32driversUMDF
2009-02-07 13:06 . 2009-02-07 13:06d
c:program filesMicrosoft Silverlight
2009-02-07 12:49 . 2009-02-07 12:50d
c:program filesSlimBrowser
2009-02-07 12:49 . 2009-02-08 20:05d
c:documents and settingsаняApplication DataSlimBrowser
2009-02-04 23:31 . 2009-02-04 23:31d
c:program filesДекларация 2007
2009-02-04 11:40 . 2009-02-09 10:11 69 —a
c:windowsNeroDigital.ini
2009-02-02 23:29 . 2009-02-02 23:29d
c:program filesMSXML 4.0
2009-02-01 23:24 . 2009-02-01 23:24d
c:documents and settingsаняApplication DataNero
2009-02-01 21:10 . 2009-02-01 21:10d
c:program filesPool ‘m Up
2009-02-01 21:10 . 2009-02-01 21:11 488 —a
c:windowsPoolemup.ini
2009-02-01 20:25 . 2009-02-01 20:25 4,767 —a
c:windowsIrremote.ini
2009-02-01 20:23 . 2009-02-01 20:23d
c:program filesWindows Sidebar
2009-02-01 20:12 . 2009-02-01 20:24d
c:program filesNero
2009-02-01 20:12 . 2009-02-01 20:37d
c:program filesCommon FilesNero
2009-02-01 20:12 . 2009-02-01 20:18d
c:documents and settingsAll UsersApplication DataNero
2009-02-01 15:33 . 2009-02-21 21:36d
c:program filesИгры
2009-02-01 15:10 . 2009-02-01 15:10d
c:program filesAlcohol Soft
2009-02-01 15:08 . 2009-02-01 15:08 716,272 —a
c:windowssystem32driverssptd.sys
2009-02-01 00:35 . 2009-02-01 00:36d
c:windowssystem32XPSViewer
2009-02-01 00:35 . 2009-02-01 00:35d
c:program filesReference Assemblies
2009-02-01 00:35 . 2009-02-01 00:35d
c:program filesMSBuild
2009-02-01 00:34 . 2006-06-29 13:07 14,048
c:windowssystem32spmsg2.dll
2009-02-01 00:32 . 2009-02-01 00:32d
c:program filesMSXML 6.0
2009-02-01 00:16 . 2009-02-01 00:16d
c:program filesInstallPlay65
2009-01-31 23:14 . 2009-01-31 23:14d
c:documents and settingsAll UsersApplication DataPlayFirst
2009-01-31 23:13 . 2009-02-22 20:52d
c:documents and settingsAll UsersApplication DataAlawarWrapper
2009-01-31 23:02 . 2009-02-22 20:50d
c:program filesAlawar.ru
2009-01-28 14:43 . 2009-02-24 23:17dr
C:Алекса.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-28 17:58 542,496 —sha-w c:windowssystem32driversfidbox2.dat
2009-02-28 17:58 13,199,904 —sha-w c:windowssystem32driversfidbox.dat
2009-02-28 15:25
d
w c:documents and settingsAll UsersApplication DataKaspersky Lab
2009-02-26 21:10 52,424 —sha-w c:windowssystem32driversfidbox2.idx
2009-02-26 21:10 177,440 —sha-w c:windowssystem32driversfidbox.idx
2009-02-25 16:14 89,601 —-a-w c:windowssystem32driversklick.dat
2009-02-25 16:14 101,287 —-a-w c:windowssystem32driversklin.dat
2009-02-21 18:55
d
w c:program filesOpera
2009-02-21 18:34
d
w c:program filesMicrosoft ActiveSync
2009-02-21 12:30
d
w c:documents and settingsAll UsersApplication DataWinZip
2009-02-15 07:09
d
w c:documents and settingsаняApplication DataMra
2009-02-12 18:38
d
w c:documents and settingsаняApplication DataWinamp
2009-01-31 20:14
d
w c:documents and settingsаняApplication DataPlayFirst
2009-01-25 10:36
d
w c:program files1C
2009-01-22 18:30
d
w c:documents and settingsаняApplication DataICQ
2009-01-22 17:17 5,088,952 —-a-w C:magentsetup.exe
2009-01-22 17:17
d
w c:program filesMail.Ru
2009-01-21 17:45 112,144 —-a-w c:windowssystem32driverskl1.sys
2009-01-19 19:28
d
w c:program filesICQ6.5
2009-01-18 19:12
d
w c:documents and settingsаняApplication DataMedia Player Classic
2009-01-18 12:51
d
w c:program filesiTunes
2009-01-18 12:51
d
w c:documents and settingsAll UsersApplication Data{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-01-18 12:50
d
w c:program filesiPod
2009-01-18 12:49
d
w c:program filesApple Software Update
2009-01-18 12:47
d
w c:program filesCommon FilesApple
2009-01-18 12:41
d
w c:program filesK-Lite Codec Pack
2009-01-17 09:30 315,392 —-a-w c:windowsHideWin.exe
2009-01-17 09:30
d—h—w c:program filesInstallShield Installation Information
2009-01-17 09:30
d
w c:program filesRealtek
2009-01-06 10:53
d
w c:program filesWindows Mobile Device Handbook
2009-01-06 10:43
d
w c:program filesBuka
2009-01-06 10:22
d
w c:program filesRealtek AC97
2009-01-06 10:20
d
w c:program filesVIA
2009-01-06 10:20
d
w c:program filesCommon FilesInstallShield
2009-01-06 10:00
d
w c:program filesKaspersky Lab
2009-01-06 09:36
d
w c:program filesPULSE MP3 Master
2009-01-06 09:35
d
w c:program filesKMPlayer 2.9.3 !!!!!!!!!!!
2009-01-06 09:18
d
w c:program filesФотоДЕКОР
2009-01-06 09:15
d
w c:program files7-Zip
2009-01-06 09:00
d
w c:program filesMicrosoft.NET
2009-01-06 09:00
d
w c:program filesMicrosoft Works
2009-01-04 19:08
d
w c:documents and settingsAll UsersApplication DataAspyr
2009-01-04 17:24
d
w c:program filesSigmaTel
2009-01-04 16:11
d
w c:documents and settingsаняApplication DataDisplayTune
2009-01-04 16:10
d
w c:program filesPortrait Displays
2009-01-04 15:43
d
w c:program filesAkella Games
2009-01-04 15:37
d
w c:program filesVenta
2009-01-04 13:24
d
w c:program filesAshampoo
2009-01-04 13:02
d
w c:documents and settingsаняApplication DataGlarySoft
2009-01-04 12:58
d
w c:program filesAskSearch
2009-01-04 12:58
d
w c:program filesAskBarDis
2009-01-04 09:38
d
w c:program filesQuickTime
2009-01-04 09:38
d
w c:program filesBonjour
2009-01-04 09:38
d
w c:documents and settingsаняApplication DataApple Computer
2009-01-04 09:37
d
w c:documents and settingsAll UsersApplication DataApple Computer
2009-01-04 09:37
d
w c:documents and settingsAll UsersApplication DataApple
2009-01-04 09:35
d
w c:documents and settingsаняApplication DataAshampoo
2009-01-04 09:34
d
w c:documents and settingsAll UsersApplication Dataashampoo
2009-01-04 09:33
d
w c:documents and settingsаняApplication DataQIP
2009-01-04 09:32
d
w c:program filesICQ6Toolbar
2009-01-04 09:32
d
w c:documents and settingsAll UsersApplication DataICQ
2009-01-04 09:27
d—a-w c:program filesAcronis
2009-01-04 09:27
d
w c:program filesCommon FilesAcronis
2009-01-04 09:24 971,232 —-a-w c:windowssystem32driverstdrpm147.sys
2009-01-04 09:24 540,000 —-a-w c:windowssystem32driverstimntr.sys
2009-01-04 09:24 44,704 —-a-w c:windowssystem32driverstifsfilt.sys
2009-01-04 09:20 134,272 —-a-w c:windowssystem32driverssnman380.sys
2009-01-04 09:11
d
w c:documents and settingsаняApplication DataAcronis
2009-01-04 09:11
d
w c:documents and settingsAll UsersApplication DataAcronis
2009-01-04 09:04
d
w c:documents and settingsаняApplication DataSongbird2
2009-01-04 09:03
d
w c:documents and settingsAll UsersApplication DataSongbirdVLC
2009-01-04 08:51
d
w c:program filesWinamp
2009-01-04 08:39
d
w c:program filesCommon FilesAdobe
2009-01-04 08:15
d
w c:program filesmicrosoft frontpage
.
Sigcheck
2008-04-14 19:11 509440 b3b5d5855127e240c88451030aaee76e c:windowsSoftwareDistributionDownloada50daa009f8a7e7bb00fe145d2709bd7winlogon.exe
2004-09-17 15:16 503808 a975a70fcefe2a224412214320c89ded c:windowssystem32winlogon.exe
.
((((((((((((((((((((((((((((( SnapShot@2009-02-25_22.39.20,12 )))))))))))))))))))))))))))))))))))))))))
.
— 2009-02-09 19:19:55 253,472 —-a-w c:windowssystem32FNTCACHE.DAT
+ 2009-02-28 15:25:10 253,472 —-a-w c:windowssystem32FNTCACHE.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_LOCAL_MACHINE~Browser Helper Objects{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-07-17 17:20 279944 —a
c:program filesAskBarDisbarbinaskBar.dll[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{3041d03e-fd4b-44e0-b742-2d9b88305f98}»= «c:program filesAskBarDisbarbinaskBar.dll» [2008-07-17 279944]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2008-12-03 1561864][HKEY_CLASSES_ROOTclsid{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOTTypeLib{4b1c1e16-6b34-430e-b074-5928eca4c150}][HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar][HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2008-12-03 1561864]
«{3041D03E-FD4B-44E0-B742-2D9B88305F98}»= «c:program filesAskBarDisbarbinaskBar.dll» [2008-07-17 279944][HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar][HKEY_CLASSES_ROOTclsid{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOTTypeLib{4b1c1e16-6b34-430e-b074-5928eca4c150}][HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2004-08-17 15360]
«H/PC Connection Agent»=»c:program filesMicrosoft ActiveSyncwcescomm.exe» [2006-11-13 1289000]
«MSMSGS»=»c:program filesMessengermsmsgs.exe» [2004-08-17 1667584]
«AlcoholAutomount»=»c:program filesAlcohol SoftAlcohol 120axcmd.exe» [2008-02-22 217544]
«Yupdate!»=»c:program filesCommon FilesYandexYupdateyupdate.exe» [2008-10-20 479496]
«SetDefaultMIDI»=»MIDIDef.exe» [2002-12-03 c:windowsMIDIDEF.EXE][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«Adobe Reader Speed Launcher»=»c:program filesAdobeReader 9.0ReaderReader_sl.exe» [2008-06-12 34672]
«QuickTime Task»=»c:program filesQuickTimeqttask.exe» [2008-09-06 413696]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2007-04-20 8429568]
«DT Task»=»c:program filesPortrait DisplaysforteManagerDTHtml.exe» [2006-09-08 282624]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2007-04-20 81920]
«iTunesHelper»=»c:program filesiTunesiTunesHelper.exe» [2008-11-20 290088]
«MAgent»=»c:program filesMail.RuAgentMAgent.exe» [2009-01-22 5600952]
«Synchronization Manager»=»c:windowssystem32mobsync.exe» [2004-08-17 143360]
«NevoDRM»=»c:игры от nevosoftNevoDRMNevoDRM.exe» [2008-12-11 41984]
«WinampAgent»=»c:program filesWinampwinampa.exe» [2008-07-10 36352]
«nwiz»=»nwiz.exe» [2007-04-20 c:windowssystem32nwiz.exe]
«RTHDCPL»=»RTHDCPL.EXE» [2007-06-13 c:windowsRTHDCPL.exe][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2004-08-17 15360][HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringKasperskyAntiVirus]
«DisableMonitoring»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\ICQ6.5\ICQ.exe»=
«c:\Program Files\Bonjour\mDNSResponder.exe»=
«c:program filesMicrosoft ActiveSyncrapimgr.exe»= c:program filesMicrosoft ActiveSyncrapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
«c:program filesMicrosoft ActiveSyncwcescomm.exe»= c:program filesMicrosoft ActiveSyncwcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
«c:program filesMicrosoft ActiveSyncWCESMgr.exe»= c:program filesMicrosoft ActiveSyncWCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
«c:\Program Files\iTunes\iTunes.exe»=
«c:\Program Files\uTorrent\utorrent.exe»=[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«26675:TCP»= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync ServiceR0 pe3aje6b;Top Spin 2 Environment Driver (pe3aje6b);c:windowssystem32driverspe3aje6b.sys [2007-02-16 65408]
R0 ps6aje6b;Top Spin 2 Synchronization Driver (ps6aje6b);c:windowssystem32driversps6aje6b.sys [2007-02-16 51592]
R0 snapman380;Acronis Snapshots Manager (Build 380);c:windowssystem32driverssnman380.sys [2009-01-04 134272]
R2 ICQ Service;ICQ Service;c:program filesICQ6ToolbarICQ Service.exe [2009-01-04 222456]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:windowssystem32driversklim5.sys [2007-04-04 24344]
S2 pr2aje6b;Top Spin 2 Drivers Auto Removal (pr2aje6b);c:windowssystem32pr2aje6b.exe svc —> c:windowssystem32pr2aje6b.exe svc [?]
.
.
Supplementary Scan
.
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10168&gct=&gc=1&q=%s
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
IE: Закачать ВСЕ при помощи Download Master — c:program filesDownload Masterdmieall.htm
IE: Закачать при помощи Download Master — c:program filesDownload Masterdmie.htm
IE: Поиск@Mail.Ru — c:program filesMail.RuSputnikMailRuSputnik.dll/282
IE: Словари@Mail.Ru — c:program filesMail.RuSputnikMailRuSputnik.dll/283
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:program filesMail.RuAgentmagent.exe
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe
TCP: {2A32FE11-A620-4B63-8E8C-83BE1434B600} = 85.158.48.34 85.158.50.50
TCP: {63A57C90-0036-4EA2-9548-06AA808CD5FB} = 85.158.48.34,85.158.50.50
FF — ProfilePath — c:documents and settingsаняApplication DataMozillaFirefoxProfiles9vf96daw.default
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnppl3260.dll
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnprpjplug.dll
FF — plugin: c:program filesOperaprogrampluginsnpdm.dll
FF — plugin: c:program filesOperaprogrampluginsnppl3260.dll
FF — plugin: c:program filesOperaprogrampluginsnprpjplug.dll
.**************************************************************************
catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-28 20:58:15
Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(796)
c:windowssystem32klogon.dll
.
Completion time: 2009-02-28 20:59:12
ComboFix-quarantined-files.txt 2009-02-28 17:59:10Pre-Run: 111 455 875 072 байт свободно
Post-Run: 111,438,467,072 байт свободно292 — E O F — 2009-02-25 12:22:29
Всё чисто.
Несколько завершающих действий.1. Обновите ваши программы.
Зайдите на сайт update.microsoft.com и обновите Windows.2. Удалите все программы, которые вы использовали в процессе лечения, в случае необходимости, вы всегда сможете скавать их заново. Удаление их необходимо по-причине того, что они содержат компоненты, которые вирусы и трояны могут использовать в плохих целях.
Удалите Combofix с вашего компьютера, действуйте согласно инструкции: Как правильно удалить combofix с компьютера.
3. Подойдите к защите вашего компьютера более серьёзно.
Установите программу Spybot Search and Destroy, это довольно неплохая дополнительная защита от шпионских и других вредоносных программ.
Большинство троянов и вирусов разработаны для поражения Internet Explorer`а, поэтому рекомендую использовать Оперу или Firefox.
4. Создайте новую точку восстановления и удалите все старые.
Удалите старые точки восстановления, так как в них возможно нахождения инфицированных файлов, троянов и других вредоносных программ. Для этого кликните по иконке Мой компьютер, выберите пункт Свойства. В открывшемся окне выберите вкладку Восстановление системы. Поставьте галочку напротив пункта Отключить восстановление системы на всех дисках. Кликните по кнопке Применить. Подтвердите свои действия кликнув по кнопке OK в открывшемся диалоге. Закройте окно Свойства системы, кликнув по кнопке OK.
После загрузки компьютера выполните действия описанные выше, только в этот раз снимите галочку.
Создайте новую точку восстановления. Это поможет вам в случае необходимости загрузить текущую конфигурацию Windows и быстро излечиться от спайваре/вируса. Для этого кликните по кнопке Пуск, далее выберите пункт Стандартные, в нём Служебные и запустите программу Восстановление системы. В открывшемся окне выберите задачу Создать точку восстановления и нажмите кнопку Далее и следуйте указаниям.
5. И несколько дополнительных советов.
Запустите ваш антивирус и проверьте состояние автоматической защиты. Включите, если она выключена.
Не забывайте обновлять Windows, ваши программы и особенно ваш антивирус.
Не посещайте незнакомые сайты, очень внимательно относитесь к файлам скаченным с Интернета.
Всего доброго!
- Для ответа в этой теме необходимо авторизоваться.
