- This topic has 3 ответа, 2 участника, and was last updated 16 years, 1 month назад by
.
-
Сообщения
-
- Темы:532
- Сообщений:1553
- ☆☆☆☆☆
Logfile of random’s system information tool 1.06 (written by random/random)
Run by Ronny at 2009-08-15 19:39:35
Microsoft Windows XP Professional Service Pack 3
System drive C: has 725 MB (9%) free of 8 GB
Total RAM: 1151 MB (41% free)Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:39:37, on 15.08.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: NormalRunning processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:Program FilesESETESET NOD32 Antivirusekrn.exe
C:Program FilesICQ6ToolbarICQ Service.exe
D:Новая папка (6)Nero 8Nero BackItUpNBService.exe
C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
C:WINDOWSSOUNDMAN.EXE
C:Program FilesESETESET NOD32 Antivirusegui.exe
D:Program FilesSimpleCenterbinwinsclauncher.exe
D:5CE5C~1pragma.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesCommon FilesNeroLibNMBgMonitor.exe
D:Новая папка (2)DAEMON Toolsdaemon.exe
C:Program FilesMessengermsmsgs.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesCommon FilesNeroLibNMIndexingService.exe
C:Program FilesCommon FilesNeroLibNMIndexStoreSvr.exe
C:program filesInternet Exploreriexplore.exe
C:program filesInternet Exploreriexplore.exe
C:Program FilesICQ6.5ICQ.exe
C:program filesInternet Exploreriexplore.exe
C:program filesInternet Exploreriexplore.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:Program FilesOperaopera.exe
C:Documents and SettingsRonnyМои документыЗагрузкиRSIT(2).exe
C:Program Filestrend microRonny.exeR0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = mail.ru
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: (no name) — {83821C2B-32A8-4DD7-B6D4-44309A78E668} — D:Новая папка (9)Mradllnewmrasearch.dll (file missing)
R3 — URLSearchHook: (no name) — — (no file)
R3 — URLSearchHook: ICQToolBar — {855F3B16-6D32-4fe6-8A56-BBB695989046} — C:Program FilesICQ6ToolbarICQToolBar.dll (file missing)
O2 — BHO: AcroIEHelperStub — {18DF081C-E8AD-4283-A596-FA578C2EBDC3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelperShim.dll
O2 — BHO: AnyxPlayer Class — {1DFA2A6E-3CB3-4141-A96F-D42244A6B50E} — C:WINDOWSsystem32winbigbon.dll
O2 — BHO: Google Toolbar Helper — {AA58ED58-01DD-4D91-8333-CF10577473F7} — C:Program FilesGooglegoogletoolbar1.dll
O2 — BHO: XBTBPos00 — {FCBCCB87-9224-4B8D-B117-F56D924BEB18} — C:Program FilesPivim Multibarpivim.dll (file missing)
O3 — Toolbar: ICQToolBar — {855F3B16-6D32-4fe6-8A56-BBB695989046} — C:Program FilesICQ6ToolbarICQToolBar.dll (file missing)
O3 — Toolbar: Pivim Multibar — {1BB22D38-A411-4B13-A746-C2A4F4EC7344} — C:Program FilesPivim Multibarpivim.dll (file missing)
O4 — HKLM..Run: [ATIPTA] C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
O4 — HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 — HKLM..Run: [egui] «C:Program FilesESETESET NOD32 Antivirusegui.exe» /hide /waitservice
O4 — HKLM..Run: [Adobe Reader Speed Launcher] «C:Program FilesAdobeReader 9.0ReaderReader_sl.exe»
O4 — HKLM..Run: [NeroFilterCheck] C:Program FilesCommon FilesNeroLibNeroCheck.exe
O4 — HKLM..Run: [NBKeyScan] «D:Новая папка (6)Nero 8Nero BackItUpNBKeyScan.exe»
O4 — HKLM..Run: [sclauncher] D:Program FilesSimpleCenterbinwinsclauncher.exe
O4 — HKLM..Run: [Pragma] D:5CE5C~1pragma.exe
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra button: ICQ6 — {E59EB121-F339-4851-A3BA-FE49C35617C2} — C:Program FilesICQ6.5ICQ.exe
O9 — Extra ‘Tools’ menuitem: ICQ6 — {E59EB121-F339-4851-A3BA-FE49C35617C2} — C:Program FilesICQ6.5ICQ.exe
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O17 — HKLMSystemCCSServicesTcpip..{77C3A8D2-C93A-468F-ABF3-B63BC4E67238}: NameServer = 91.103.73.7,91.103.76.2
O23 — Service: Ati HotKey Poller — Unknown owner — C:WINDOWSsystem32Ati2evxx.exe
O23 — Service: ATI Smart — Unknown owner — C:WINDOWSsystem32ati2sgag.exe
O23 — Service: ESET HTTP Server (EhttpSrv) — ESET — C:Program FilesESETESET NOD32 AntivirusEHttpSrv.exe
O23 — Service: ESET Service (ekrn) — ESET — C:Program FilesESETESET NOD32 Antivirusekrn.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: ICQ Service — Unknown owner — C:Program FilesICQ6ToolbarICQ Service.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: NetMeeting Remote Desktop Sharing (mnmsrvc) — Корпорация Майкрософт — C:WINDOWSsystem32mnmsrvc.exe
O23 — Service: Nero BackItUp Scheduler 3 — Nero AG — D:Новая папка (6)Nero 8Nero BackItUpNBService.exe
O23 — Service: NMIndexingService — Nero AG — C:Program FilesCommon FilesNeroLibNMIndexingService.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: ServiceLayer — Nokia. — D:Program FilesNokiaPC Connectivity SolutionServiceLayer.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe
O24 — Desktop Component 0: (no name) — http://www.kiss-chat.ru/up/0_94752900_1244470634.jpg?avatar.64×64.av.qip.enjoy.ru.28479.gif—
End of file — 7191 bytes======Scheduled tasks folder======
C:WINDOWStasksUser_Feed_Synchronization-{9BD7C4F2-5613-4135-A70B-E1B6375BFDD2}.job
======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelperShim.dll [2009-02-27 75128][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{1DFA2A6E-3CB3-4141-A96F-D42244A6B50E}]
AnyxPlayer Class — C:WINDOWSsystem32winbigbon.dll [2007-09-17 438272][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{AA58ED58-01DD-4D91-8333-CF10577473F7}]
&Google — C:Program FilesGooglegoogletoolbar1.dll [2009-07-11 65536][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{FCBCCB87-9224-4B8D-B117-F56D924BEB18}]
XBTBPos00 Class — C:Program FilesPivim Multibarpivim.dll [][HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{855F3B16-6D32-4fe6-8A56-BBB695989046} — ICQToolBar — C:Program FilesICQ6ToolbarICQToolBar.dll []
{1BB22D38-A411-4B13-A746-C2A4F4EC7344} — Pivim Multibar — C:Program FilesPivim Multibarpivim.dll [][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«ATIPTA»=C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe [2003-09-12 335872]
«SoundMan»=C:WINDOWSSOUNDMAN.EXE [2003-10-08 57344]
«egui»=C:Program FilesESETESET NOD32 Antivirusegui.exe [2009-02-06 2021400]
«Adobe Reader Speed Launcher»=C:Program FilesAdobeReader 9.0ReaderReader_sl.exe [2009-02-27 35696]
«NeroFilterCheck»=C:Program FilesCommon FilesNeroLibNeroCheck.exe [2007-03-01 153136]
«NBKeyScan»=D:Новая папка (6)Nero 8Nero BackItUpNBKeyScan.exe [2007-09-20 1836328]
«sclauncher»=D:Program FilesSimpleCenterbinwinsclauncher.exe [2007-10-11 94208]
«Pragma»=D:5CE5C~1pragma.exe [2005-05-27 204288][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyAtiExtEvent]
C:WINDOWSsystem32Ati2evxx.dll [2003-09-12 86016][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32WPDShServiceObj.dll [2006-10-18 133632][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=145[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«HonorAutoRunSetting»=[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesFlylinkDC++FlylinkDC.exe»=»C:Program FilesFlylinkDC++FlylinkDC.exe:*:Enabled:FlylinkDC++»
«C:Program FilesICQ6.5ICQ.exe»=»C:Program FilesICQ6.5ICQ.exe:*:Enabled:ICQ6»
«D:Program FilesOrb NetworksOrbbinOrb.exe»=»D:Program FilesOrb NetworksOrbbinOrb.exe:*:Enabled:Orb»
«D:Program FilesOrb NetworksOrbbinOrbTray.exe»=»D:Program FilesOrb NetworksOrbbinOrbTray.exe:*:Enabled:OrbTray»
«D:Program FilesOrb NetworksOrbbinOrbStreamerClient.exe»=»D:Program FilesOrb NetworksOrbbinOrbStreamerClient.exe:*:Enabled:Orb Stream Client»
«D:Program FilesOrb NetworksOrbbinxmltv.exe»=»D:Program FilesOrb NetworksOrbbinxmltv.exe:*:Enabled:OrbTVGuide»
«D:Program FilesOrb NetworksOrbbinOrbChannelScan.exe»=»D:Program FilesOrb NetworksOrbbinOrbChannelScan.exe:*:Enabled:OrbChannelScan»
«D:Program FilesSimpleCenterHome Media Server.exe»=»D:Program FilesSimpleCenterHome Media Server.exe:*:Enabled:Home Media Server»
«C:Program FilesCommon FilesNokiaService LayerAnsl_host_process.exe»=»C:Program FilesCommon FilesNokiaService LayerAnsl_host_process.exe:*:Enabled:Nokia Service Layer Host Process «
«D:Program FilesNokiaSoftware Updaternsu_ui_client.exe»=»D:Program FilesNokiaSoftware Updaternsu_ui_client.exe:*:Enabled:Nokia Software Updater»
«C:Program FilesNokiaNokia Software Updaternsu_ui_client.exe»=»C:Program FilesNokiaNokia Software Updaternsu_ui_client.exe:*:Enabled:Nokia Software Updater»
«C:Program FilesOperaopera.exe»=»C:Program FilesOperaopera.exe:*:Enabled:Opera Internet Browser»
«D:FlylinkDC++FlylinkDC.exe»=»D:FlylinkDC++FlylinkDC.exe:*:Enabled:FlylinkDC++»
«C:FlylinkDC++FlylinkDC.exe»=»C:FlylinkDC++FlylinkDC.exe:*:Enabled:FlylinkDC++»
«C:Program FilesElectronic ArtsEADMCore.exe»=»C:Program FilesElectronic ArtsEADMCore.exe:*:Enabled:EA Download Manager»[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»======List of files/folders created in the last 1 months======
2009-08-15 19:32:28 —-DC—- C:Program Filestrend micro
2009-08-15 19:32:27 —-DC—- C:rsit
2009-08-15 17:07:55 —-HDC—- C:WINDOWS$NtUninstallKB960859$
2009-08-15 17:07:42 —-HDC—- C:WINDOWS$NtUninstallKB971657$
2009-08-15 17:07:32 —-HDC—- C:WINDOWS$NtUninstallKB971557$
2009-08-15 17:07:20 —-HDC—- C:WINDOWS$NtUninstallKB956744$
2009-08-15 17:07:05 —-HDC—- C:WINDOWS$NtUninstallKB973869$
2009-08-15 17:06:40 —-HDC—- C:WINDOWS$NtUninstallKB973507$
2009-08-15 17:06:21 —-HDC—- C:WINDOWS$NtUninstallKB973354$
2009-08-15 17:05:05 —-HDC—- C:WINDOWS$NtUninstallKB973540_WM9$
2009-08-15 17:03:13 —-HDC—- C:WINDOWS$NtUninstallKB973815$
2009-07-23 14:16:27 —-DC—- C:Documents and SettingsRonnyApplication DataMra
2009-07-22 21:27:08 —-DC—- C:ProgramData
2009-07-22 21:27:08 —-DC—- C:Documents and SettingsAll UsersApplication DataElectronic Arts
2009-07-22 20:30:44 —-RAC—- C:WINDOWSsystem32vp6vfw.dll
2009-07-18 15:43:17 —-DC—- C:Documents and SettingsRonnyApplication DataYandex
2009-07-18 15:42:14 —-DC—- C:Program FilesMozilla Firefox
2009-07-18 15:23:12 —-DC—- C:Documents and SettingsRonnyApplication DataTrident Software
2009-07-18 14:42:27 —-AC—- C:Documents and SettingsAll UsersApplication Datatv_enua.exe
2009-07-18 14:42:27 —-AC—- C:Documents and SettingsAll UsersApplication DataReadMe.txt
2009-07-18 14:37:04 —-DC—- C:WINDOWSlhsp======List of files/folders modified in the last 1 months======
2009-08-15 19:39:16 —-DC—- C:WINDOWSTemp
2009-08-15 19:32:54 —-DC—- C:WINDOWSPrefetch
2009-08-15 19:32:28 —-RDC—- C:Program Files
2009-08-15 18:51:09 —-DC—- C:Program FilesGoogle
2009-08-15 18:22:12 —-DC—- C:WINDOWSsystem32CatRoot2
2009-08-15 17:48:00 —-DC—- C:WINDOWS
2009-08-15 17:47:53 —-AC—- C:WINDOWSwin.ini
2009-08-15 17:47:23 —-DC—- C:WINDOWSsystem32
2009-08-15 17:45:07 —-A—- C:WINDOWSSchedLgU.Txt
2009-08-15 17:08:01 —-HDC—- C:WINDOWSinf
2009-08-15 17:07:58 —-RSHDC—- C:WINDOWSsystem32dllcache
2009-08-15 17:07:47 —-AC—- C:WINDOWSimsins.BAK
2009-08-15 17:07:19 —-HDC—- C:WINDOWS$hf_mig$
2009-08-15 17:06:26 —-DC—- C:Program FilesOutlook Express
2009-08-15 17:05:44 —-DC—- C:Program FilesInternet Explorer
2009-08-05 13:01:17 —-AC—- C:WINDOWSsystem32mswebdvd.dll
2009-07-30 04:49:14 —-AC—- C:WINDOWSsystem32MRT.exe
2009-07-24 16:11:41 —-AC—- C:WINDOWSNeroDigital.ini
2009-07-23 14:16:12 —-HDC—- C:Program FilesInstallShield Installation Information
2009-07-23 14:16:06 —-DC—- C:Program FilesCyberLink
2009-07-23 14:16:06 —-DC—- C:Program FilesCommon Files
2009-07-23 14:16:04 —-SHDC—- C:WINDOWSInstaller
2009-07-22 22:28:11 —-DC—- C:Program FilesICQ6Toolbar
2009-07-19 18:46:50 —-AC—- C:WINDOWSsystem32ieframe.dll
2009-07-19 17:16:51 —-AC—- C:WINDOWSsystem32mshtml.dll
2009-07-18 15:43:13 —-DC—- C:Documents and SettingsRonnyApplication DataMozilla
2009-07-18 15:22:56 —-RSDC—- C:WINDOWSFonts
2009-07-17 23:03:39 —-AC—- C:WINDOWSsystem32atl.dll======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 ehdrv;ehdrv; C:WINDOWSsystem32DRIVERSehdrv.sys [2009-02-06 106208]
R1 epfwtdir;epfwtdir; C:WINDOWSsystem32DRIVERSepfwtdir.sys [2009-02-06 93336]
R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2008-04-15 40704]
R2 atksgt;atksgt; C:WINDOWSsystem32DRIVERSatksgt.sys [2009-05-28 278728]
R2 eamon;eamon; C:WINDOWSsystem32DRIVERSeamon.sys [2009-02-06 113448]
R2 lirsgt;lirsgt; C:WINDOWSsystem32DRIVERSlirsgt.sys [2009-05-28 25416]
R3 ALCXSENS;Service for WDM 3D Audio Driver; C:WINDOWSsystem32driversALCXSENS.SYS [2003-10-04 391552]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:WINDOWSsystem32driversALCXWDM.SYS [2003-10-09 475788]
R3 ati2mtag;ati2mtag; C:WINDOWSsystem32DRIVERSati2mtag.sys [2003-09-12 611328]
R3 EL90XBC;3Com EtherLink XL 90XB/C, драйвер адаптера; C:WINDOWSsystem32DRIVERSel90xbc5.sys [2001-08-18 66591]
R3 hidusb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2008-04-15 10368]
R3 mouhid;Драйвер мыши HID; C:WINDOWSsystem32DRIVERSmouhid.sys [2008-04-15 12160]
R3 ms_mpu401;Драйвер UART Microsoft MPU-401 MIDI; C:WINDOWSsystem32driversmsmpu401.sys [2001-08-18 2944]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2008-04-15 30208]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2008-04-15 59520]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2008-04-15 20608]
S3 akwxcwuu;akwxcwuu; C:WINDOWSsystem32driversakwxcwuu.sys []
S3 KTalk;KTalk; ??C:DOCUME~1RonnyLOCALS~1Tempktalk.sys []
S3 MHIKEY10;MHIKEY10; C:WINDOWSSystem32DriversMHIKEY10.sys [2008-05-27 51072]
S3 nmwcd;Nokia USB Phone Parent; C:WINDOWSsystem32driversnmwcd.sys [2007-02-22 137216]
S3 nmwcdc;Nokia USB Generic; C:WINDOWSsystem32driversnmwcdc.sys [2007-02-22 8320]
S3 nmwcdcj;Nokia USB Port; C:WINDOWSsystem32driversnmwcdcj.sys [2007-02-22 12288]
S3 nmwcdcm;Nokia USB Modem; C:WINDOWSsystem32driversnmwcdcm.sys [2007-02-22 12288]
S3 usbccgp;Драйвер универсального родительского устройства USB (Microsoft); C:WINDOWSsystem32DRIVERSusbccgp.sys [2008-04-14 32128]
S3 usbscan;Драйвер USB-сканера; C:WINDOWSsystem32DRIVERSusbscan.sys [2008-04-14 15104]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2008-04-14 26368]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2006-09-15 82688]======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 Ati HotKey Poller;Ati HotKey Poller; C:WINDOWSsystem32Ati2evxx.exe [2003-09-12 376832]
R2 ekrn;ESET Service; C:Program FilesESETESET NOD32 Antivirusekrn.exe [2009-02-06 727720]
R2 ICQ Service;ICQ Service; C:Program FilesICQ6ToolbarICQ Service.exe [2008-06-10 222456]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; D:Новая папка (6)Nero 8Nero BackItUpNBService.exe [2007-09-20 853288]
R2 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2008-04-15 14336]
R3 NMIndexingService;NMIndexingService; C:Program FilesCommon FilesNeroLibNMIndexingService.exe [2007-09-20 382248]
S2 ATI Smart;ATI Smart; C:WINDOWSsystem32ati2sgag.exe [2003-09-12 114688]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2008-07-30 69632]
S3 EhttpSrv;ESET HTTP Server; C:Program FilesESETESET NOD32 AntivirusEHttpSrv.exe [2009-02-06 20680]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:WINDOWSMicrosoft.NETFrameworkv3.0WPFPresentationFontCache.exe [2008-07-29 46104]
S3 ServiceLayer;ServiceLayer; D:Program FilesNokiaPC Connectivity SolutionServiceLayer.exe [2007-06-15 300544]
EOF
вылазиют рекламы порно на рабочем столе,их закрываешь,а они опять появляютсяЗдравствуйте, добро пожаловать на Spyware-ru форум.
Скачайте программу Combofix. Закройте все открытые окна и запустите эту программу.
После выполнения будет создан лог файл, пожалуйста вставьте его в ваш ответ.Примечание: перед использованием Combofix обязательно установите Recovery console. Как это сделать будет описано на странице, ссылку на которую я привёл выше.
- Темы:532
- Сообщений:1553
- ☆☆☆☆☆
ComboFix 09-08-18.03 — Ronny 19.08.2009 17:26.1.1 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.1151.769 [GMT 4:00]
Running from: c:documents and settingsRonnyРабочий столComboFix.exe
Command switches used :: c:documents and settingsRonnyРабочий столWindowsXP-KB310994-SP2-Pro-BootDisk-RUS.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Created a new restore point
.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr0.dat
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr1.dat
c:documents and settingsRonnyLocal SettingsTemporary Internet Filesbmp2F43.tmp
c:progra~1COMMON~1{7445F~1
c:progra~1COMMON~1{7445F~1chrome.manifest
c:progra~1COMMON~1{7445F~1chromecontentextensions.xul
c:progra~1COMMON~1{7445F~1chromecontentlogo.png
c:progra~1COMMON~1{7445F~1chromecontentmain.js
c:progra~1COMMON~1{7445F~1chromecontentmain.xul
c:progra~1COMMON~1{7445F~1chromecontentq.png
c:progra~1COMMON~1{7445F~1chromecontentq_gray.png
c:progra~1COMMON~1{7445F~1chromecontentx.png
c:progra~1COMMON~1{7445F~1chromecontentx_gray.png
c:progra~1COMMON~1{7445F~1defaultspreferencesmain.js
c:progra~1COMMON~1{7445F~1defaultspreferencesmain.js.old
c:progra~1COMMON~1{7445F~1extension.reg
c:progra~1COMMON~1{7445F~1install.rdf
c:program filesGooglegoogletoolbar1.dll
c:program filesGooglesetupcom.dat
c:program filesGooglesetupext.dat
c:windowssystem323rs23525.dll
BITS: Possible infected sites
hxxp://soft.export.yandex.ru
hxxp://download.yandex.ru
Infected copy of c:windowssystem32mspmsnsv.dll was found and disinfected
Restored copy from — c:windowssystem32dllcachemspmsnsv.dll.
((((((((((((((((((((((((( Files Created from 2009-07-19 to 2009-08-19 )))))))))))))))))))))))))))))))
.2009-08-16 14:56 . 2009-08-16 14:56
dc—-w- c:documents and settingsRonnyLocal SettingsApplication DataWinamp Toolbar
2009-08-16 14:05 . 2009-08-16 14:05
dc—-w- c:program filesWinamp Toolbar
2009-08-16 14:05 . 2009-08-16 14:05
dc—-w- c:documents and settingsAll UsersApplication DataWinamp Toolbar
2009-08-16 14:04 . 2009-08-16 14:04
dc—-w- c:program filesWinamp Remote
2009-08-16 13:58 . 2009-08-16 13:58
dc-h—w- c:windowssystem32GroupPolicy
2009-08-16 13:33 . 2009-08-16 13:34
dc—-w- c:documents and settingsRonnyApplication DataXP Visual Tools
2009-08-16 13:25 . 2009-08-16 13:25
dc—-w- c:documents and settingsRonnyLocal SettingsApplication DataPixoria
2009-08-16 12:42 . 2009-08-16 13:32
dc—-w- C:Downloads
2009-08-16 12:41 . 2009-08-16 12:52
dc—-w- c:documents and settingsRonnyApplication DataDownload Master
2009-08-16 12:41 . 2007-12-18 10:56 1412608 -c—a-w- c:documents and settingsRonnyApplication DataDownload Mastertempskin.dll
2009-08-16 12:41 . 2009-08-16 12:41
dc—-w- c:documents and settingsRonnyLocal SettingsApplication DataYandex
2009-08-16 11:25 . 2009-08-16 11:43
dc-h—w- c:program filesRS
2009-08-16 10:30 . 2009-08-16 10:30
dc—-w- c:program filesESET
2009-08-15 17:37 . 2009-08-15 17:37
dc—-w- c:windowssystem32XPSViewer
2009-08-15 17:37 . 2009-08-15 17:37
dc—-w- c:program filesMSBuild
2009-08-15 17:36 . 2008-07-06 12:06 117760 -c—-w- c:windowssystem32prntvpt.dll
2009-08-15 17:36 . 2008-07-06 12:06 89088 -c—-w- c:windowssystem32dllcachefilterpipelineprintproc.dll
2009-08-15 17:36 . 2008-07-06 12:06 575488 -c—-w- c:windowssystem32xpsshhdr.dll
2009-08-15 17:36 . 2008-07-06 12:06 575488 -c—-w- c:windowssystem32dllcachexpsshhdr.dll
2009-08-15 17:36 . 2008-07-06 10:50 597504 -c—-w- c:windowssystem32dllcacheprintfilterpipelinesvc.exe
2009-08-15 17:36 . 2008-07-06 12:06 1676288 -c—-w- c:windowssystem32xpssvcs.dll
2009-08-15 17:36 . 2008-07-06 12:06 1676288 -c—-w- c:windowssystem32dllcachexpssvcs.dll
2009-08-15 17:33 . 2009-08-15 17:33
dcsh—w- c:documents and settingsNetworkServiceIETldCache
2009-08-15 17:27 . 2009-08-15 17:27
dc—-w- c:windowssystem32wbemRepository
2009-08-15 15:32 . 2009-08-15 17:25
dc—-w- c:program filestrend micro
2009-08-14 15:13 . 2009-07-03 17:00 55296 -c—-w- c:windowssystem32dllcachemsfeedsbs.dll
2009-08-14 15:13 . 2009-07-03 17:00 594432 -c—-w- c:windowssystem32dllcachemsfeeds.dll
2009-07-23 10:16 . 2009-07-23 10:16
dc—-w- c:documents and settingsRonnyApplication DataMra
2009-07-22 17:27 . 2009-07-22 18:29
dc—-w- c:documents and settingsAll UsersApplication DataElectronic Arts
2009-07-22 16:30 . 2008-09-05 00:22 447752 -c—a-r- c:windowssystem32vp6vfw.dll.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-19 13:30 . 2009-07-11 14:46
dc—-w- c:program filesGoogle
2009-08-19 09:08 . 2009-05-14 11:41 264 -c-ha-w- c:documents and settingsRonnyApplication Datastore.dat
2009-08-19 09:08 . 2009-05-14 11:41 264 -c-ha-w- c:documents and settingsAll UsersApplication Datastore.dat
2009-08-18 14:01 . 2009-08-16 13:57
dc—-w- c:documents and settingsRonnyApplication DataWinamp
2009-08-16 12:42 . 2009-05-10 11:15
dc—-w- c:program filesOpera
2009-08-16 12:41 . 2009-07-18 11:43
dc—-w- c:documents and settingsRonnyApplication DataYandex
2009-08-16 11:22 . 2009-05-10 10:29
dc-h—w- c:program filesInstallShield Installation Information
2009-08-16 11:20 . 2009-05-10 10:21 14048 -c—a-w- c:documents and settingsRonnyLocal SettingsApplication DataGDIPFONTCACHEV1.DAT
2009-08-15 17:42 . 2008-04-15 12:00 79546 —-a-w- c:windowssystem32perfc019.dat
2009-08-15 17:42 . 2008-04-15 12:00 474518 —-a-w- c:windowssystem32perfh019.dat
2009-08-05 09:01 . 2008-04-15 12:00 204800 -c—a-w- c:windowssystem32mswebdvd.dll
2009-07-23 10:16 . 2009-05-17 09:57
dc—-w- c:program filesCyberLink
2009-07-22 18:28 . 2009-05-10 11:30
dc—-w- c:program filesICQ6Toolbar
2009-07-18 11:43 . 2009-07-18 11:43 0 -c—a-w- c:windowsnsreg.dat
2009-07-18 11:23 . 2009-07-18 11:23
dc—-w- c:documents and settingsRonnyApplication DataTrident Software
2009-07-17 19:03 . 2008-04-15 12:00 58880 -c—a-w- c:windowssystem32atl.dll
2009-07-15 17:35 . 2009-07-15 17:35 62760 -c—a-w- c:documents and settingsRonnyApplication DataMozillaFirefoxProfilesdimucpfp.defaultextensions{0b38152b-1b20-484d-a11f-5e04a9b0661f}componentsWinampTBPlayer.dll
2009-07-12 08:21 . 2008-04-15 12:00 233472 -c—a-w- c:windowssystem32wmpdxm.dll
2009-07-03 17:00 . 2008-04-15 12:00 915456 -c—a-w- c:windowssystem32wininet.dll
2009-07-02 16:08 . 2009-05-27 10:46
dc—-w- c:program filesWindows Media Connect 2
2009-06-28 10:30 . 2009-06-17 11:45
dc—-w- c:documents and settingsRonnyApplication DataNSeries
2009-06-27 20:16 . 2009-05-10 11:26
dc—-w- c:documents and settingsRonnyApplication DataICQ
2009-06-17 16:47 . 2009-06-17 16:47 3351812 -c—a-w- c:documents and settingsAll UsersApplication DataInstallations{9F59C3AE-81B0-4EF6-9762-D674BB079705}InstallerCommonCustomActionsmsxml6Exec.exe
2009-06-17 16:46 . 2009-06-17 16:46 36864 -c—a-w- c:documents and settingsAll UsersApplication DataInstallations{9F59C3AE-81B0-4EF6-9762-D674BB079705}InstallerCommonCustomActionsSleep.exe
2009-06-17 16:46 . 2009-06-17 16:46 3181612 -c—a-w- c:documents and settingsAll UsersApplication DataInstallations{9F59C3AE-81B0-4EF6-9762-D674BB079705}InstallerCommonCustomActionsvcredistExec.exe
2009-06-17 16:46 . 2009-06-17 16:47 24503944 -c—a-w- c:documents and settingsAll UsersApplication DataInstallations{9F59C3AE-81B0-4EF6-9762-D674BB079705}NokiaSoftwareUpdaterSetup_1.6.13RU.exe
2009-06-16 14:40 . 2008-04-15 12:00 81920 -c—a-w- c:windowssystem32fontsub.dll
2009-06-16 14:40 . 2008-04-15 12:00 119808 -c—a-w- c:windowssystem32t2embed.dll
2009-06-15 10:45 . 2008-04-15 12:00 79872 -c—a-w- c:windowssystem32telnet.exe
2009-06-15 10:45 . 2008-04-15 12:00 80896 -c—a-w- c:windowssystem32tlntsess.exe
2009-06-13 19:24 . 2009-06-13 19:24 5132 -c—a-w- c:windowssystem32bsvi.dll
2009-06-13 19:23 . 2009-06-13 19:23 875520 -c—a-w- c:windowssystem32VFP6RENU.DLL
2009-06-13 19:23 . 2009-06-13 19:23 3370768 -c—a-w- c:windowssystem32VFP6R.DLL
2009-06-13 19:23 . 2009-06-13 19:23 24990 -c—a-w- c:windowssystem32VFP6RUN.EXE
2009-06-13 17:22 . 2009-06-13 17:22 766 -c—a-w- c:windowsmd.dll
2009-06-10 14:14 . 2008-04-15 12:00 85504 -c—a-w- c:windowssystem32avifil32.dll
2009-06-10 06:16 . 2008-04-15 12:00 132096 -c—a-w- c:windowssystem32wkssvc.dll
2009-06-10 05:21 . 2009-05-10 10:03 2066432 -c—a-w- c:windowssystem32mstscax.dll
2009-06-03 19:11 . 2008-04-15 12:00 1292800 -c—a-w- c:windowssystem32quartz.dll
2009-05-28 09:21 . 2009-05-28 09:21 685816 —-a-w- c:windowssystem32driverssptd.sys
2009-05-28 09:18 . 2009-05-28 09:18 278728 -c—a-w- c:windowssystem32driversatksgt.sys
2009-05-28 09:18 . 2009-05-28 09:18 25416 -c—a-w- c:windowssystem32driverslirsgt.sys
2009-05-21 16:15 . 2009-05-10 10:08 86327 -c—a-w- c:windowspchealthhelpctrOfflineCacheindex.dat
2005-02-04 13:03 . 2009-07-18 14:39 36864 -c—a-w- c:program filesmozilla firefoxcomponentspragma.dll
.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]
«{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}»= «c:program filesWinamp Toolbarwinamptb.dll» [2009-05-06 1262888][HKEY_CLASSES_ROOTclsid{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOTWINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOTTypeLib{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOTWINAMPTB.AOLTBSearch][HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiersAdRouter]
@=»{E2085722-3AC0-4411-A14B-906AFE1A75C4}»
[HKEY_CLASSES_ROOTCLSID{E2085722-3AC0-4411-A14B-906AFE1A75C4}]
2009-07-11 14:51 98304 -c—a-w- c:program filesAdobeadrouter.dll[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=»c:program filesCommon FilesNeroLibNMBgMonitor.exe» [2007-09-20 202024]
«MSMSGS»=»c:program filesMessengermsmsgs.exe» [2008-04-14 1695232]
«Download Master»=»d:download masterdmaster.exe» [2009-08-05 3777536]
«Orb»=»c:program filesWinamp RemotebinOrbTray.exe» [2008-04-01 507904][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«egui»=»D:New Folder» [X]
«ATIPTA»=»c:program filesATI TechnologiesATI Control Panelatiptaxx.exe» [2003-09-12 335872]
«Adobe Reader Speed Launcher»=»c:program filesAdobeReader 9.0ReaderReader_sl.exe» [2009-02-27 35696]
«NeroFilterCheck»=»c:program filesCommon FilesNeroLibNeroCheck.exe» [2007-03-01 153136]
«NBKeyScan»=»d:новая папка (6)Nero 8Nero BackItUpNBKeyScan.exe» [2007-09-20 1836328]
«sclauncher»=»d:program filesSimpleCenterbinwinsclauncher.exe» [2007-10-11 94208]
«Pragma»=»d:5ce5c~1pragma.exe» [2005-05-27 204288]
«WinampAgent»=»d:winampwinampa.exe» [2009-07-01 37888]
«SoundMan»=»SOUNDMAN.EXE» — c:windowsSOUNDMAN.EXE [2003-10-08 57344][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-15 15360]c:documents and settingsRonnyѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
Konfabulator.lnk — d:new folderKonfabulator.exe [2005-8-4 1282048][HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«AntiVirusOverride»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\ICQ6.5\ICQ.exe»=
«d:\Program Files\SimpleCenter\Home Media Server.exe»=
«c:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe»=
«c:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe»=
«c:\Program Files\Opera\opera.exe»=
«c:\Program Files\Winamp Remote\bin\Orb.exe»=
«c:\Program Files\Winamp Remote\bin\OrbTray.exe»=
«c:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe»=R1 ehdrv;ehdrv;c:windowssystem32driversehdrv.sys [19.03.2009 11:44 107256]
R1 epfwtdir;epfwtdir;c:windowssystem32driversepfwtdir.sys [19.03.2009 11:45 93848]
R2 ekrn;ESET Service;d:new folder,антивирусekrn.exe [19.03.2009 11:44 731840]
R2 ICQ Service;ICQ Service;c:program filesICQ6ToolbarICQ Service.exe [10.05.2009 15:30 222456]
S3 KTalk;KTalk;??c:docume~1RonnyLOCALS~1Tempktalk.sys —> c:docume~1RonnyLOCALS~1Tempktalk.sys [?]
S3 MHIKEY10;MHIKEY10;c:windowssystem32driversMHIKEY10.sys [27.05.2008 2:52 51072][HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled components>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
«c:windowssystem32rundll32.exe» «c:windowssystem32iedkcs32.dll»,BrandIEActiveSetup SIGNUP
.
Contents of the ‘Scheduled Tasks’ folder2009-08-19 c:windowsTasksUser_Feed_Synchronization-{9BD7C4F2-5613-4135-A70B-E1B6375BFDD2}.job
— c:windowssystem32msfeedssync.exe [2009-03-08 00:31]
.
— — — — ORPHANS REMOVED — — — —Toolbar-{91397D20-1446-11D4-8AF4-0040CA1127B6} — c:program filesYandexYandexBarIEyndbar.dll
WebBrowser-{91397D20-1446-11D4-8AF4-0040CA1127B6} — c:program filesYandexYandexBarIEyndbar.dll
HKCU-Run-AmazingClock — d:amazing clockAClock.exe
HKCU-Run-EA Core — c:program filesElectronic ArtsEADMCore.exe
HKCU-Run-SpeedConnectStartUp — (no file).
Supplementary Scan
.
uStart Page = mail.ru
uInternet Connection Wizard,ShellNext = iexplore
IE: &Winamp Search — c:documents and settingsAll UsersApplication DataWinamp ToolbarieToolbarresourcesen-USlocalsearch.html
IE: Закачать ВСЕ при помощи Download Master — d:download masterdmieall.htm
IE: Закачать при помощи Download Master — d:download masterdmie.htm
IE: Передать на удаленную закачку DM — d:download masterremdown.htm
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — d:download masterdmaster.exe
TCP: {77C3A8D2-C93A-468F-ABF3-B63BC4E67238} = 91.103.73.7,91.103.76.2
FF — ProfilePath — c:documents and settingsRonnyApplication DataMozillaFirefoxProfilesdimucpfp.default
FF — prefs.js: browser.search.defaulturl — hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
FF — prefs.js: browser.search.selectedEngine — Winamp Search
FF — prefs.js: keyword.URL — hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=
FF — prefs.js: network.proxy.type — 4
FF — component: c:documents and settingsRonnyApplication DataMozillaFirefoxProfilesdimucpfp.defaultextensions{0b38152b-1b20-484d-a11f-5e04a9b0661f}componentsWinampTBPlayer.dll
FF — plugin: c:program filesMozilla Firefoxpluginsnpdm.dll
FF — plugin: c:program filesOperaprogrampluginsnpdm.dll—- FIREFOX POLICIES —-
c:program filesMozilla Firefoxgreprefsall.js — pref(«media.enforce_same_site_origin», false);
c:program filesMozilla Firefoxgreprefsall.js — pref(«media.cache_size», 51200);
c:program filesMozilla Firefoxgreprefsall.js — pref(«media.ogg.enabled», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«media.wave.enabled», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«media.autoplay.enabled», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«browser.urlbar.autocomplete.enabled», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«capability.policy.mailnews.*.wholeText», «noAccess»);
c:program filesMozilla Firefoxgreprefsall.js — pref(«dom.storage.default_quota», 5120);
c:program filesMozilla Firefoxgreprefsall.js — pref(«content.sink.event_probe_rate», 3);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.http.prompt-temp-redirect», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«layout.css.dpi», -1);
c:program filesMozilla Firefoxgreprefsall.js — pref(«layout.css.devPixelsPerPx», -1);
c:program filesMozilla Firefoxgreprefsall.js — pref(«gestures.enable_single_finger_input», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«dom.max_chrome_script_run_time», 0);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.tcp.sendbuffer», 131072);
c:program filesMozilla Firefoxgreprefsall.js — pref(«geo.enabled», true);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js — pref(«security.remember_cert_checkbox_default_setting», true);
c:program filesMozilla Firefoxdefaultspreffirefox-branding.js — pref(«browser.search.param.yahoo-fr», «moz35»);
c:program filesMozilla Firefoxdefaultspreffirefox-branding.js — pref(«browser.search.param.yahoo-fr-cjkt», «moz35»);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«extensions.blocklist.level», 2);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«browser.urlbar.restrict.typed», «~»);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«browser.urlbar.default.behavior», 0);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.clearOnShutdown.history», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.clearOnShutdown.formdata», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.clearOnShutdown.passwords», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.clearOnShutdown.downloads», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.clearOnShutdown.cookies», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.clearOnShutdown.cache», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.clearOnShutdown.sessions», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.clearOnShutdown.offlineApps», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.clearOnShutdown.siteSettings», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.cpd.history», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.cpd.formdata», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.cpd.passwords», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.cpd.downloads», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.cpd.cookies», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.cpd.cache», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.cpd.sessions», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.cpd.offlineApps», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.cpd.siteSettings», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«privacy.sanitize.migrateFx3Prefs», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«browser.ssl_override_behavior», 2);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«security.alternate_certificate_error_page», «certerror»);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«browser.privatebrowsing.autostart», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«browser.privatebrowsing.dont_prompt_on_enter», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«geo.wifi.uri», «https://www.google.com/loc/json»);
.**************************************************************************
catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-19 17:32
Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(612)
c:windowssystem32Ati2evxx.dll— — — — — — — > ‘explorer.exe'(1112)
c:windowssystem32WININET.dll
c:program filesAdobeadrouter.dll
c:windowssystem32mshtml.dll
c:windowssystem32msls31.dll
c:windowssystem32webcheck.dll
c:windowssystem32WPDShServiceObj.dll
c:windowssystem32PortableDeviceTypes.dll
c:windowssystem32PortableDeviceApi.dll
.
Other Running Processes
.
c:windowssystem32ati2evxx.exe
c:windowssystem32ati2evxx.exe
d:new folder,c:WINDOWSsystem32CF17955.exe
d:c:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
d:new folder,d:Winampwinampa.exe
c:program filesCommon FilesNeroLibNMIndexingService.exe
c:program filesCommon FilesNeroLibNMIndexStoreSvr.exe
.
**************************************************************************
.
Completion time: 2009-08-19 17:36 — machine was rebooted
ComboFix-quarantined-files.txt 2009-08-19 13:36Pre-Run: 507 990 016 байт свободно
Post-Run: 1 001 603 072 байт свободноWindowsXP-KB310994-SP2-Pro-BootDisk-RUS.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)WINDOWS
[operating systems]
c:cmdconsBOOTSECT.DAT=»Microsoft Windows Recovery Console» /cmdcons
multi(0)disk(0)rdisk(0)partition(1)WINDOWS=»Microsoft Windows XP Professional RU» /noexecute=optin /fastdetect296 — E O F — 2009-08-16 09:01
Откройте блокнот (Кликните Пуск, Выполнить, в строке ввода введите notepad и нажмите Enter) и вставьте в него следующий текст:
Driver::
KTalk
Registry::
[-HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiersAdRouter]
[-HKEY_CLASSES_ROOTCLSID{E2085722-3AC0-4411-A14B-906AFE1A75C4}]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
"egui"=-
File::
c:program filesAdobeadrouter.dllЗапишите получившийся файл на ваш рабочий стол под именем CFScript
Далее перетащите получившийся файл на иконку Combofix, как показано на картинке ниже.
Сombofix запуститься и выполнит процедуры описанные в созданном нами файле.
По результатам работы Combofix будет создан новый лог, его и вставьте в свой следующий ответ.
- Для ответа в этой теме необходимо авторизоваться.
