Там вирус?

[frantong]

Добрый день!Проверьте пожалуйста, вроде вирус!!

ComboFix 10-12-17.02 — Галина 18.12.2010 15:04:41.1.1 — x86
Microsoft Windows XP Professional 5.1.2600.2.1251.7.1049.18.1014.461 [GMT 7:00]
Running from: c:documents and settingsГалинаРабочий столComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:documents and settingsГалинаjahcii.exe
C:KALBA
c:kalbaMAAFENAdesKtOp.InI
C:Thumbs.db
c:windowssystem32Thumbs.db

.
((((((((((((((((((((((((( Files Created from 2010-11-18 to 2010-12-18 )))))))))))))))))))))))))))))))
.

2010-12-10 16:03 . 2010-12-10 16:03

---

d

---

w- c:windowssystem3220-20 Technologies
2010-12-10 15:37 . 2010-12-10 15:37

---

d

---

w- c:documents and settingsГалинаApplication DataCarambis
2010-12-10 15:37 . 2010-12-10 15:37

---

d

---

w- c:documents and settingsГалинаLocal SettingsApplication DataYandex
2010-12-10 15:37 . 2010-12-10 15:37

---

d

---

w- c:documents and settingsAll UsersApplication DataYandex
2010-12-10 15:37 . 2010-12-10 15:37

---

d

---

w- c:program filesYandex
2010-12-02 08:35 . 2010-12-02 08:40

---

d

---

w- c:documents and settingsГалинаLocal SettingsApplication DataArchiCAD_1247475532
2010-11-29 12:30 . 2010-12-10 16:35 1409 —-a-w- c:windowsQTFont.for

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-03 10:52 . 2010-10-03 10:52 8192 —-a-r- c:documents and settingsГалинаApplication DataMicrosoftInstaller{B22CE542-B0A1-42AD-955D-7455B7C9ED74}IconTmpl1.108DF49C_3AB4_4A7D_B6FD_8B6286B317FA.exe
2010-10-03 10:52 . 2010-10-03 10:52 54784 —-a-r- c:documents and settingsГалинаApplication DataMicrosoftInstaller{B22CE542-B0A1-42AD-955D-7455B7C9ED74}IconTmpl6.A961A077_4BD0_4C98_86BC_EE4A98CE550D.exe
2010-10-03 10:52 . 2010-10-03 10:52 14848 —-a-r- c:documents and settingsГалинаApplication DataMicrosoftInstaller{B22CE542-B0A1-42AD-955D-7455B7C9ED74}IconTmpl4.A961A077_4BD0_4C98_86BC_EE4A98CE550D.exe
2010-04-01 14:46 . 2010-04-01 14:46 5918720 —-a-w- c:program filesmbam-setup.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]
«{268dece7-4ace-473e-a426-a9810c7f4ba1}»= «c:program filesspeedbit-TEtbspee.dll» [2008-02-25 1470488]

[HKEY_CLASSES_ROOTclsid{268dece7-4ace-473e-a426-a9810c7f4ba1}]

[HKEY_LOCAL_MACHINE~Browser Helper Objects{268dece7-4ace-473e-a426-a9810c7f4ba1}]
2008-02-25 08:41 1470488 —-a-w- c:program filesspeedbit-TEtbspee.dll

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{268dece7-4ace-473e-a426-a9810c7f4ba1}»= «c:program filesspeedbit-TEtbspee.dll» [2008-02-25 1470488]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2010-10-07 10971976]

[HKEY_CLASSES_ROOTclsid{268dece7-4ace-473e-a426-a9810c7f4ba1}]

[HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar]

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{268DECE7-4ACE-473E-A426-A9810C7F4BA1}»= «c:program filesspeedbit-TEtbspee.dll» [2008-02-25 1470488]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2010-10-07 10971976]

[HKEY_CLASSES_ROOTclsid{268dece7-4ace-473e-a426-a9810c7f4ba1}]

[HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar]

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«Skype»=»c:program filesSkypePhoneSkype.exe» [2010-04-20 26192680]
«swg»=»c:program filesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe» [2009-12-03 39408]
«Praetorian»=»c:documents and settingsГалинаLocal SettingsApplication DataYandexUpdaterpraetorian.exe» [2010-10-21 798024]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«Broadcom Wireless Manager UI»=»c:windowssystem32WLTRAY» [X]
«IgfxTray»=»c:windowssystem32igfxtray.exe» [2005-01-23 155648]
«LaunchAp»=»c:program filesLaunch ManagerLaunchAp.exe» [2005-03-30 32768]
«PowerKey»=»c:program filesLaunch ManagerPowerKey.exe» [2002-08-30 94208]
«LManager»=»c:program filesLaunch ManagerHotkeyApp.exe» [2005-06-06 69632]
«CtrlVol»=»c:program filesLaunch ManagerCtrlVol.exe» [2003-09-16 20480]
«LMgrOSD»=»c:program filesLaunch ManagerOSDCtrl.exe» [2005-06-06 241664]
«Wbutton»=»c:program filesLaunch ManagerWbutton.exe» [2005-06-21 81920]
«SoundMan»=»SOUNDMAN.EXE» [2005-04-15 77824]
«SynTPLpr»=»c:program filesSynapticsSynTPSynTPLpr.exe» [2005-02-04 102490]
«SynTPEnh»=»c:program filesSynapticsSynTPSynTPEnh.exe» [2005-02-04 708698]
«ACU»=»c:program filesAtherosACU.exe» [2005-01-31 253952]
«ISUSPM Startup»=»c:program filesCommon FilesInstallShieldUpdateServiceISUSPM.exe» [2005-08-11 249856]
«MaxMenuMgr»=»c:program filesSeagateSeagateManagerFreeAgent StatusStxMenuMgr.exe» [2009-05-01 185640]
«QuickTime Task»=»c:program filesQuickTimeqttask.exe» [2007-10-19 286720]
«SunJavaUpdateSched»=»c:program filesCommon FilesJavaJava Updatejusched.exe» [2010-05-14 248552]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2006-03-02 15360]

c:documents and settingsѓ «Ё­ ѓ« ў­®Ґ ¬Ґ­оЏа®Ја ¬¬лЂўв®§ Јаг§Є 
CodeMeter Control Center.lnk — c:program filesCodeMeterRuntimebinCodeMeterCC.exe [2009-8-19 6348800]

c:documents and settingsAll Usersѓ« ў­®Ґ ¬Ґ­оЏа®Ја ¬¬лЂўв®§ Јаг§Є 
InterVideo WinCinema Manager.lnk — c:program filesInterVideoCommonBinWinCinemaMgr.exe [2007-7-2 114688]
Nikon Monitor.lnk — c:program filesCommon FilesNikonMonitorNkMonitor.exe [2007-10-18 479232]
Ѓлбвал© § ЇгбЄ AutoCAD.lnk — c:program filesCommon FilesAutodesk Sharedacstart16.exe [2005-3-5 10872]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregHotKeysCmds]
2005-01-23 02:31 126976 —-a-r- c:windowssystem32hkcmd.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregISUSPM Startup]
2005-08-11 09:30 249856 —-a-w- c:program filesCommon FilesInstallShieldUpdateServiceISUSPM.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregISUSScheduler]
2005-08-11 09:30 81920 —-a-w- c:program filesCommon FilesInstallShieldUpdateServiceissch.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«AntiVirusOverride»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE»=
«c:\Program Files\ApexDC++\ApexDC.exe»=
«c:\Program Files\Skype\Plugin Manager\skypePM.exe»=
«c:\Program Files\Autodesk\Backburner\monitor.exe»=
«c:\Program Files\Autodesk\Backburner\manager.exe»=
«c:\Program Files\Autodesk\Backburner\server.exe»=
«c:\Program Files\CodeMeter\Runtime\bin\CodeMeter.exe»=
«c:\Program Files\Graphisoft\ArchiCAD 13\ArchiCAD.exe»=
«c:\Program Files\Skype\Phone\Skype.exe»=

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«2613:TCP»= 2613:TCP:addegxlj

R2 CodeMeter.exe;CodeMeter Runtime Server;c:program filesCodeMeterRuntimebinCodeMeter.exe [19.08.2009 3:10 1705280]
R2 FreeAgentGoNext Service;Seagate Service;c:program filesSeagateSeagateManagerSyncFreeAgentService.exe [01.05.2009 14:35 181544]
R3 POWERKEY;POWERKEY;c:program filesLaunch ManagerPOWERKEY.SYS [02.07.2007 15:36 2343]
S1 mailKmd;mailKmd; [x]
S2 gupdate;Служба Google Update (gupdate);c:program filesGoogleUpdateGoogleUpdate.exe [11.02.2010 12:05 135664]
S2 haspflt;haspflt;c:windowssystem32drivershaspflt.sys [02.07.2007 18:25 29024]
S3 AVEO;USB2.0 PC Camera;c:windowssystem32driversAVEOdcnt.sys [05.10.2010 11:34 224256]
S3 massfilter;ZTE Mass Storage Filter Driver;c:windowssystem32driversmassfilter.sys —> c:windowssystem32driversmassfilter.sys [?]

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSvchost — NetSvcs
hgsjbtc
.
Contents of the ‘Scheduled Tasks’ folder

2010-12-14 c:windowsTasksAppleSoftwareUpdate.job
— c:program filesApple Software UpdateSoftwareUpdate.exe [2007-08-29 06:57]

2010-12-18 c:windowsTasksGoogleUpdateTaskMachineCore.job
— c:program filesGoogleUpdateGoogleUpdate.exe [2010-02-11 05:05]

2010-12-18 c:windowsTasksGoogleUpdateTaskMachineUA.job
— c:program filesGoogleUpdateGoogleUpdate.exe [2010-02-11 05:05]
.
.

---

Supplementary Scan

---

.
uDefault_Search_URL = hxxp://search.qip.ru
uStart Page = hxxp://www.yandex.ru/?clid=160052
uInternet Settings,ProxyServer = 192.168.9.5:8080
uSearchAssistant = hxxp://search.qip.ru
uSearchURL,(Default) = hxxp://search.qip.ru/search?query=%s&from=IE
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
IE: Google ВикиКомментарии… — c:program filesGoogleGoogle ToolbarComponentGoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
DPF: Microsoft XML Parser for Java — file:///C:/WINDOWS/Java/classes/xmldso.cab
.
— — — — ORPHANS REMOVED — — — —

HKCU-Run-LUXOR — c:kalbaMAAFENALAXOURY.exe
MSConfigStartUp-DownloadAccelerator — c:program filesDAPDAP.EXE
MSConfigStartUp-ICQ — c:program filesICQ6.5ICQ.exe
MSConfigStartUp-QIP — c:program filesQIP.Onlineqiponline.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-18 15:08
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘winlogon.exe'(456)
c:windowsSystem32BCMLogon.dll
.
Completion time: 2010-12-18 15:10:23
ComboFix-quarantined-files.txt 2010-12-18 08:10

Pre-Run: 2 767 462 400 байт свободно
Post-Run: 2 884 775 936 байт свободно

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)WINDOWS
[operating systems]
c:cmdconsBOOTSECT.DAT=»Microsoft Windows Recovery Console» /cmdcons
UnsupportedDebug=»do not select this» /debug
multi(0)disk(0)rdisk(0)partition(1)WINDOWS=»Microsoft Windows XP Professional RU» /noexecute=optin /fastdetect

— — End Of File — — E87CCCFE118C6542817D3241E397FD08

[Автор]

Сообщения