total security 4.52

[FuTSy]

Проделал все Ваши советы…
вот отчет из Malwarebytes’ Anti-Malware :
Malwarebytes’ Anti-Malware 1.40
Версия базы данных: 2651
Windows 5.1.2600 Service Pack 3

19.08.2009 12:14:36
mbam-log-2009-08-19 (12-14-36).txt

Тип проверки: Полная (C:|)
Проверено объектов: 106547
Прошло времени: 17 minute(s), 20 second(s)

Заражено процессов в памяти: 1
Заражено модулей в памяти: 0
Заражено ключей реестра: 1
Заражено значений реестра: 4
Заражено параметров реестра: 4
Заражено папок: 2
Заражено файлов: 12

Заражено процессов в памяти:
C:Documents and SettingsAdminРабочий столexplorer.exe (Heuristics.Reserved.Word.Exploit) -> Unloaded process successfully.

Заражено модулей в памяти:
(Вредоносные программы не обнаружены)

Заражено ключей реестра:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallsystemsecurity2009 (Rogue.TotalSecurity) -> Quarantined and deleted successfully.

Заражено значений реестра:
HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRunant_neth.exe (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogontaskman (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRunMicrosoft Driver Setup (Worm.Palevo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunMicrosoft Driver Setup (Worm.Palevo) -> Quarantined and deleted successfully.

Заражено параметров реестра:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterAntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterFirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterUpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonUserinit (Hijack.Userinit) -> Bad: (C:WINDOWSsystem32userinit.exe,C:Documents and SettingsAdminsieph.exe s) Good: (Userinit.exe) -> Quarantined and deleted successfully.

Заражено папок:
C:Documents and SettingsAdminГлавное менюПрограммыTotal Security (Rogue.TotalSecurity) -> Quarantined and deleted successfully.
C:Documents and SettingsAll UsersApplication Data13324684 (Rogue.Multiple) -> Quarantined and deleted successfully.

Заражено файлов:
C:Documents and SettingsAdminApplication DataNetHelperant_neth.exe (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
C:Documents and SettingsAdminLocal SettingsTemporary Internet FilesContent.IE59C785BXXins[1].exe (Rogue.SystemSecurity) -> Quarantined and deleted successfully.
C:Documents and SettingsAll UsersApplication Data1332468413324684.exe (Rogue.SystemSecurity) -> Quarantined and deleted successfully.
C:Program FilesTotal CommanderPluginsarcDefault.sfx (Malware.Packer) -> Quarantined and deleted successfully.
C:Program FilesTotal CommanderUtilitesSFX ToolUpack.exe (Malware.Packer) -> Quarantined and deleted successfully.
C:Documents and SettingsAdminГлавное менюПрограммыTotal SecurityTotal Security 2009.lnk (Rogue.TotalSecurity) -> Quarantined and deleted successfully.
C:Documents and SettingsAll UsersApplication Data1332468413324684 (Rogue.Multiple) -> Quarantined and deleted successfully.
C:Documents and SettingsAll UsersApplication Data13324684pc13324684ins (Rogue.Multiple) -> Quarantined and deleted successfully.
C:Documents and SettingsAdminРабочий столTotal Security 2009.lnk (Rogue.TotalSecurity) -> Quarantined and deleted successfully.
C:WINDOWSsystem32secupdat.dat (Backdoor.Bot) -> Quarantined and deleted successfully.
C:WINDOWSwaw32.exe (Worm.Palevo) -> Quarantined and deleted successfully.
C:Documents and SettingsAdminРабочий столexplorer.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

Так же сама по себе открывается страница http://pvideoguide.org/take.php?id=4&r=1659 и папка с моим пользователем в «Документс энд Сеттингс»…

После проделывания советуемых вами процедур «Антивир» (Security) не давал знать о себе пол часа… и потом чудесным образом снова возродился(
Я не знаю что у меня с компом,но он переодически перезагружается… блокирует все проги…
Самое странное что я уже 3й раз форматировал полностью систему и переустанавливал виндоус… Каждый раз ставил разные антивири сначало KAV 9,потом nod32 4( и Файрвол про 2009),потом Avast 4.8, и они хоть и находят что то,но толк не меняют…
Виндовс с с двд диска… работал последние года 2 нормально…
Помогите оч прошу…
Посоветуйте какую защиту лучше всего поставить на компьютер…

P.s.
Так же выкладываю лог Комбофикса…

ComboFix 09-08-18.01 — Admin 19.08.2009 12:49.1.2 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.510.274 [GMT 4:00]
Running from: c:documents and settingsAdminРабочий столComboFix.exe
Command switches used :: c:documents and settingsAdminРабочий столWindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
AV: avast! antivirus 4.8.1351 [VPS 090817-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:documents and settingsAll UsersApplication Data11652814
c:documents and settingsAll UsersApplication Data1165281411652814
c:documents and settingsAll UsersApplication Data1165281411652814.exe
c:documents and settingsAll UsersApplication Data11652814pc11652814ins
c:recyclerS-1-5-21-0086392524-1195618648-082513961-1636
c:recyclerS-1-5-21-4831832836-0769564554-102806149-8715
c:recyclerS-1-5-21-4831832836-0769564554-102806149-8715Desktop.ini
c:recyclerS-1-5-21-4831832836-0769564554-102806149-8715mwau.exe
c:recyclerS-1-5-21-6687301624-7212156791-078042158-0551
c:windowssystem32secupdat.dat

Infected copy of c:windowssystem32mspmsnsv.dll was found and disinfected
Restored copy from — c:windowssystem32dllcachemspmsnsv.dll

.
((((((((((((((((((((((((( Files Created from 2009-07-19 to 2009-08-19 )))))))))))))))))))))))))))))))
.

2009-08-19 08:41 . 2009-08-19 08:41 3167193 —-a-w- C:ComboFix.exe
2009-08-19 08:28 . 2009-08-19 08:28

---

d

---

w- C:games.temp
2009-08-19 08:27 . 2009-08-19 08:27 12800 —ha-w- c:documents and settingsAdminvyj.exe
2009-08-19 08:19 . 2009-08-19 08:19

---

d

---

w- c:windowssystem32LogFiles
2009-08-19 08:18 . 2009-08-19 08:18 12800 —ha-w- c:documents and settingsAdmintppt.exe
2009-08-19 08:18 . 2009-08-19 08:18 84992 —sh—r- c:windowswaw32.exe
2009-08-19 08:18 . 2009-08-19 08:18 12800 —ha-w- c:documents and settingsAdminlomwyvd.exe
2009-08-19 07:00 . 2009-08-19 07:00 84992 —-a-w- c:windowssystem3228.scr
2009-08-19 06:36 . 2009-08-19 06:36 84992 —-a-w- c:windowssystem3288.scr
2009-08-19 06:36 . 2009-08-19 06:36 12800 —ha-w- c:documents and settingsAdminsieph.exe
2009-08-19 00:09 . 2009-08-19 00:09 12800 —ha-w- c:documents and settingsAdminthptjw.exe
2009-08-19 00:09 . 2009-08-19 00:09 139776 —-a-w- c:windowssystem3253.scr
2009-08-19 00:01 . 2009-08-19 00:01 139776 —-a-w- c:windowssystem326.scr
2009-08-19 00:01 . 2009-08-19 00:01 12800 —ha-w- c:documents and settingsAdminkljp.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-19 08:28 . 2009-08-18 21:51

---

d

---

w- c:program filesCommon FilesBlizzard Entertainment
2009-08-19 08:21 . 2008-04-15 12:00 84858 —-a-w- c:windowssystem32perfc019.dat
2009-08-19 08:21 . 2008-04-15 12:00 485480 —-a-w- c:windowssystem32perfh019.dat
2009-08-19 08:19 . 2009-08-18 20:48

---

d

---

w- c:program filesWinamp
2009-08-19 08:19 . 2009-08-18 19:58

---

d

---

w- c:program filesWindows Media Connect 2
2009-08-19 08:14 . 2009-08-18 20:58

---

d

---

w- c:documents and settingsAdminApplication DataNetHelper
2009-08-18 23:53 . 2009-08-18 23:53 0 —-a-w- c:windowsativpsrm.bin
2009-08-18 23:39 . 2009-08-18 23:39

---

d

---

w- c:documents and settingsAdminApplication DataMalwarebytes
2009-08-18 23:38 . 2009-08-18 23:38

---

d

---

w- c:program filesMalwarebytes’ Anti-Malware
2009-08-18 23:38 . 2009-08-18 23:38

---

d

---

w- c:documents and settingsAll UsersApplication DataMalwarebytes
2009-08-18 23:17 . 2009-08-18 23:17 12800 —ha-w- c:documents and settingsAdminfgdg.exe
2009-08-18 23:15 . 2009-08-18 23:15 139776 —-a-w- c:windowssystem3220.scr
2009-08-18 22:01 . 2009-08-18 21:55

---

d

---

w- c:program filesQIP Infium
2009-08-18 21:56 . 2009-08-18 21:56

---

d

---

w- c:documents and settingsAll UsersApplication DataBlizzard
2009-08-18 21:37 . 2009-08-18 20:45

---

d

---

w- c:program filesEverest
2009-08-18 21:30 . 2009-08-18 20:35

---

d

---

w- c:program filesOpera
2009-08-18 21:28 . 2009-08-18 21:28

---

d

---

w- c:program filesAlwil Software
2009-08-18 20:51 . 2009-08-18 20:51

---

d

---

w- c:program filesKillSoft
2009-08-18 20:51 . 2009-08-18 20:51

---

d

---

w- c:program filesLClock
2009-08-18 20:50 . 2009-08-18 20:50

---

d

---

w- c:program filesDAEMON Tools Lite
2009-08-18 20:50 . 2009-08-18 20:50

---

d

---

w- c:documents and settingsAdminApplication DataDAEMON Tools
2009-08-18 20:50 . 2009-08-18 20:50

---

d

---

w- c:program filesAhead
2009-08-18 20:50 . 2009-08-18 20:50

---

d

---

w- c:program filesCommon FilesAhead
2009-08-18 20:49 . 2009-08-18 20:49 65536 —-a-r- c:documents and settingsAdminApplication DataMicrosoftInstaller{5AFF9A56-B7EB-486D-912C-FB89C857DFAB}ARPPRODUCTICON.exe
2009-08-18 20:49 . 2009-08-18 20:49

---

d

---

w- c:program filesRadmin Viewer 3
2009-08-18 20:49 . 2009-08-18 20:49

---

d

---

w- c:program filesRadminServerStop
2009-08-18 20:49 . 2009-08-18 20:49 65536 —-a-r- c:documents and settingsAdminApplication DataMicrosoftInstaller{ED87EE42-C14B-4119-8686-C3A630F2A463}Z_MENU_SRVCFG_6BF1780B36EA432B9451DD84FF5C9D52.exe
2009-08-18 20:49 . 2009-08-18 20:49 65536 —-a-r- c:documents and settingsAdminApplication DataMicrosoftInstaller{ED87EE42-C14B-4119-8686-C3A630F2A463}NewShortcut4_6BF1780B36EA432B9451DD84FF5C9D52.exe
2009-08-18 20:49 . 2009-08-18 20:49 65536 —-a-r- c:documents and settingsAdminApplication DataMicrosoftInstaller{ED87EE42-C14B-4119-8686-C3A630F2A463}NewShortcut3_6BF1780B36EA432B9451DD84FF5C9D52.exe
2009-08-18 20:49 . 2009-08-18 20:49 65536 —-a-r- c:documents and settingsAdminApplication DataMicrosoftInstaller{ED87EE42-C14B-4119-8686-C3A630F2A463}ARPPRODUCTICON.exe
2009-08-18 20:49 . 2009-08-18 20:49

---

d

---

w- c:program filesTotal Commander
2009-08-18 20:48 . 2009-08-18 20:48

---

d

---

w- c:program filesLouderIt
2009-08-18 20:48 . 2009-08-18 20:48

---

d

---

w- c:documents and settingsAdminApplication DataWinamp
2009-08-18 20:47 . 2009-08-18 20:47 116344 —-a-w- c:documents and settingsLocalServiceLocal SettingsApplication DataFontCache3.0.0.0.dat
2009-08-18 20:46 . 2009-08-18 20:46

---

d

---

w- c:program filesMSBuild
2009-08-18 20:46 . 2009-08-18 20:46

---

d

---

w- c:program filesReference Assemblies
2009-08-18 20:45 . 2009-08-18 20:45

---

d

---

w- c:program filesNeoSmart Technologies
2009-08-18 20:44 . 2009-08-18 20:44

---

d

---

w- c:program filesEasy Gif Animator
2009-08-18 20:43 . 2009-08-18 20:37

---

d

---

w- c:program filesCommon FilesAdobe
2009-08-18 20:38 . 2009-08-18 20:38

---

d

---

w- c:program filesCommon FilesMacrovision Shared
2009-08-18 20:36 . 2009-08-18 20:36

---

d

---

w- c:documents and settingsAll UsersApplication DataTechSmith
2009-08-18 20:36 . 2009-08-18 20:36

---

d

---

w- c:program filesTechSmith
2009-08-18 20:36 . 2009-08-18 20:36

---

d

---

w- c:program filesCommon FilesWise Installation Wizard
2009-08-18 20:35 . 2009-08-18 20:35

---

d

---

w- c:program filesCcleaner
2009-08-18 20:35 . 2009-08-18 20:35

---

d

---

w- c:program filesUninstall Tool
2009-08-18 20:35 . 2009-08-18 20:35

---

d

---

w- c:program filesK-Lite Codec Pack
2009-08-18 20:35 . 2009-08-18 20:30

---

d

---

w- c:documents and settingsAll UsersApplication DataMicrosoft Help
2009-08-18 20:32 . 2009-08-18 20:32

---

d

---

w- c:program filesMicrosoft Works
2009-08-18 20:31 . 2009-08-18 20:31

---

d

---

w- c:program filesMicrosoft.NET
2009-08-18 20:29 . 2009-08-18 20:29

---

d

---

w- c:program filesFoxit Reader
2009-08-18 20:08 . 2009-08-18 20:08

---

d

---

w- c:program filesmicrosoft frontpage
2009-08-18 20:07 . 2009-08-18 20:07

---

d

---

w- c:program filesVistaDriveIcon
2009-08-18 20:07 . 2009-08-18 20:07 717296 —-a-w- c:windowssystem32driverssptd.sys
2009-08-18 20:07 . 2009-08-18 20:06

---

d

---

w- c:program filesJava
2009-08-18 20:06 . 2009-08-18 20:06

---

d

---

w- c:program filesCommon FilesJava
2009-08-18 20:03 . 2009-08-18 20:03

---

d—a-w- c:program filesAmlMaple
2009-08-18 20:01 . 2009-08-18 20:01 86327 —-a-w- c:windowspchealthhelpctrOfflineCacheindex.dat
2009-08-18 19:58 . 2009-08-18 19:58 22564 —-a-w- c:windowssystem32emptyregdb.dat
2009-08-18 19:58 . 2009-08-18 19:57

---

d

---

w- c:program filesPaint.NET
2009-08-17 16:10 . 2009-08-18 21:28 1279456 —-a-w- c:windowssystem32aswBoot.exe
2009-08-17 16:06 . 2009-08-18 21:28 93392 —-a-w- c:windowssystem32driversaswmon.sys
2009-08-17 16:06 . 2009-08-18 21:28 94160 —-a-w- c:windowssystem32driversaswmon2.sys
2009-08-17 16:05 . 2009-08-18 21:28 114768 —-a-w- c:windowssystem32driversaswSP.sys
2009-08-17 16:05 . 2009-08-18 21:28 20560 —-a-w- c:windowssystem32driversaswFsBlk.sys
2009-08-17 16:04 . 2009-08-18 21:28 51376 —-a-w- c:windowssystem32driversaswTdi.sys
2009-08-17 16:04 . 2009-08-18 21:28 23152 —-a-w- c:windowssystem32driversaswRdr.sys
2009-08-17 16:03 . 2009-08-18 21:28 26944 —-a-w- c:windowssystem32driversaavmker4.sys
2009-08-17 16:02 . 2009-08-18 21:28 97480 —-a-w- c:windowssystem32AvastSS.scr
2009-08-03 09:36 . 2009-08-18 23:38 38160 —-a-w- c:windowssystem32driversmbamswissarmy.sys
2009-08-03 09:36 . 2009-08-18 23:38 19096 —-a-w- c:windowssystem32driversmbam.sys
.

---

Sigcheck

---

[-] 2008-05-20 15:54 579072 23B7D3F3F5EC8FEEA75EC381C71CBD5E c:windowssystem32user32.dll

[-] 2008-05-20 15:54 952320 7A737E1453D01FF94801272F13497362 c:windowssystem32wininet.dll

[-] 2008-05-20 15:52 361344 030DC4D48CC2B894FEE2F390D8E66AD5 c:windowssystem32driverstcpip.sys

[-] 2008-05-20 15:53 1721344 DC5D73A9809B66026231A9D49DE6987F c:windowsexplorer.exe

[-] 2008-05-20 15:53 30208 AE0DB25EE10900C73D923AD5880564CF c:windowssystem32ctfmon.exe

[-] 2008-05-20 15:55 80216 5F38B1B965527C6F5C30DEDAB0AB0550 c:windowssystem32wuauclt.exe

[-] 2008-05-20 15:53 855040 9918D182D970638835D3F6DF36D4C92A c:windowssystem32comres.dll

[-] 2008-05-20 16:29 1571840 46D60730EE2DF438750B38370425BC74 c:windowssystem32sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
«louderit.exe»=»c:program fileslouderitLouderIt.exe» [2008-02-19 41472]
«LClock»=»c:program filesLClockLClock.exe» [2007-12-14 86016]
«KillCopy»=»c:windowssystem32killcopy.exe» [2006-10-29 1185792]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«AmlMaple»=»c:program filesAmlMapleAmlMaple.exe» [2008-04-24 91648]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2006-01-12 155648]
«avast!»=»c:progra~1ALWILS~1Avast4ashDisp.exe» [2009-08-17 81000]
«Microsoft Driver Setup»=»c:windowswaw32.exe» [2009-08-19 84992]
«RTHDCPL»=»RTHDCPL.EXE» — c:windowsRTHDCPL.EXE [2008-04-10 16861184]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-05-20 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» — c:windowssystem32advpack.dll [2008-05-20 124928]
«IE7_012″=»advpack.dll» — c:windowssystem32advpack.dll [2008-05-20 124928]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusOverride»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=

R1 aswSP;avast! Self Protection;c:windowssystem32driversaswSP.sys [19.08.2009 1:28 114768]
R1 raddrvv3;raddrvv3;c:windowssystem32rserver30raddrvv3.sys [24.04.2008 8:49 45848]
R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [19.08.2009 1:28 20560]
R2 RServer3;Radmin Server V3;c:windowssystem32rserver30rserver3.exe [24.04.2008 8:44 1238344]
R2 TTFixerService;NST ToolTipFixer;c:program filesNeoSmart TechnologiesToolTipFixerToolTipFixer.exe [27.06.2007 9:20 10240]
R3 mirrorv3;mirrorv3;c:windowssystem32driversrminiv3.sys [01.11.2006 6:01 3328]
S3 afnhfldr;afnhfldr;??c:windowsSystem32Driversafnhfldr.sys —> c:windowsSystem32Driversafnhfldr.sys [?]
S3 cwfyvwom;cwfyvwom;??c:windowsSystem32Driverscwfyvwom.sys —> c:windowsSystem32Driverscwfyvwom.sys [?]
S3 dwtdjzjm;dwtdjzjm;??c:windowsSystem32Driversdwtdjzjm.sys —> c:windowsSystem32Driversdwtdjzjm.sys [?]
S3 nfvesqqx;nfvesqqx;??c:windowsSystem32Driversnfvesqqx.sys —> c:windowsSystem32Driversnfvesqqx.sys [?]
S3 omaoexnq;omaoexnq;??c:windowsSystem32Driversomaoexnq.sys —> c:windowsSystem32Driversomaoexnq.sys [?]
S3 ztyimqpu;ztyimqpu;??c:windowsSystem32Driversztyimqpu.sys —> c:windowsSystem32Driversztyimqpu.sys [?]

— Other Services/Drivers In Memory —

*NewlyCreated* — WUAUSERV
.
— — — — ORPHANS REMOVED — — — —

HKLM-Run-11652814 — c:documents and settingsAll UsersApplication Data1165281411652814.exe

.

---

Supplementary Scan

---

.
uStart Page = start.qip.ru
uDefault_Search_URL = hxxp://search.qip.ru
uSearchURL,(Default) = Root: HKCU; Subkey: SoftwareMicrosoftInternet ExplorerSearchUrl; ValueType: string; ValueName: ‘; ValueData: ‘; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-19 12:54
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘winlogon.exe'(884)
c:windowssystem32SETUPAPI.dll
c:windowssystem32Ati2evxx.dll
c:windowssystem32cscui.dll
c:windowssystem32COMRes.dll

— — — — — — — > ‘lsass.exe'(940)
c:windowssystem32setupapi.dll

— — — — — — — > ‘explorer.exe'(5264)
c:program filesAmlMapleAmlMaple.dll
c:windowssystem32COMRes.dll
c:windowsSystem32cscui.dll
c:program fileslouderitLHook.dll
c:windowssystem32msi.dll
c:windowssystem32SETUPAPI.dll
c:windowssystem32NETSHELL.dll
c:program filesLClockLC.dll
c:windowssystem32wpdshserviceobj.dll
c:windowssystem32portabledevicetypes.dll
c:windowssystem32portabledeviceapi.dll
.

---

Other Running Processes

---

.
c:windowssystem32ati2evxx.exe
c:windowssystem32ati2evxx.exe
c:program filesAlwil SoftwareAvast4aswUpdSv.exe
c:program filesAlwil SoftwareAvast4ashServ.exe
c:windowssystem32rserver30FamItrfc.Exe
c:docume~1AdminLOCALS~1TempRtkBtMnt.exe
c:program filesAlwil SoftwareAvast4ashMaiSv.exe
c:program filesAlwil SoftwareAvast4Setupavast.setup
c:program filesAlwil SoftwareAvast4ashWebSv.exe
c:windowssystem32wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-08-19 12:56 — machine was rebooted
ComboFix-quarantined-files.txt 2009-08-19 08:56

Pre-Run: 66 899 816 448 байт свободно
Post-Run: 67 087 855 616 байт свободно

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)WINDOWS
[operating systems]
c:cmdconsBOOTSECT.DAT=»Microsoft Windows Recovery Console» /cmdcons
multi(0)disk(0)rdisk(0)partition(1)WINDOWS=»Microsoft Windows XP Professional RU» /execute /fastdetect
multi(0)disk(0)rdisk(0)partition(2)WINDOWS=»Microsoft Windows XP Professional RU» /execute /fastdetect

240

[FuTSy]

up 👿

[Admin]

Здравствуйте, добро пожаловать на Spyware-ru форум.

Откройте блокнот (Кликните Пуск, Выполнить, в строке ввода введите notepad и нажмите Enter) и вставьте в него следующий текст:

Driver::

afnhfldr

cwfyvwom

dwtdjzjm

nfvesqqx

omaoexnq

ztyimqpu



Registry::

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]

"Microsoft Driver Setup"=



File::

C:games.temp

c:documents and settingsAdminvyj.exe

c:windowssystem32LogFiles

c:documents and settingsAdmintppt.exe

c:windowswaw32.exe

c:documents and settingsAdminlomwyvd.exe

c:windowssystem3228.scr

c:windowssystem3288.scr

c:documents and settingsAdminsieph.exe

c:documents and settingsAdminthptjw.exe

c:windowssystem3253.scr

c:windowssystem326.scr

c:documents and settingsAdminkljp.exe

c:windowswaw32.exe

Запишите получившийся файл на ваш рабочий стол под именем CFScript
Далее перетащите получившийся файл на иконку Combofix, как показано на картинке ниже.

Сombofix запуститься и выполнит процедуры описанные в созданном нами файле.
По результатам работы Combofix будет создан новый лог, его и вставьте в свой следующий ответ.

[Автор]

Сообщения