Всплывающая реклама

[druzh76]

Заранее спасибо!
Logfile of random’s system information tool 1.06 (written by random/random)
Run by Admin at 2010-03-27 13:30:41
Microsoft Windows XP Professional Service Pack 3
System drive C: has 32 GB (64%) free of 51 GB
Total RAM: 767 MB (39% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:30:57, on 27.03.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32nvsvc32.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSExplorer.EXE
C:Program FilesAlwil SoftwareAvast5AvastSvc.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesMail.RuAgentMAgent.exe
C:PROGRA~1ALWILS~1Avast5avastUI.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:WINDOWSsystem32ctfmon.exe
C:Program FilesDAEMON Tools LiteDTLite.exe
C:Program FilesRocketDockRocketDock.exe
C:Program FilesWindows Sidebarsidebar.exe
C:Program FilesWindows Sidebarsidebar.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:Program FilesMalwarebytes’ Anti-Malwarembam.exe
C:Documents and SettingsAdminМои документыЗагрузкиRSIT.exe
C:Program Filestrend microAdmin.exe

R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://mail.ru/
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — c:program filesmail.rusputnikMailRuSputnik.dll
O3 — Toolbar: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — c:program filesmail.rusputnikMailRuSputnik.dll
O4 — HKLM..Run: [MAgent] C:Program FilesMail.RuAgentMAgent.exe -LM
O4 — HKLM..Run: [avast5] C:PROGRA~1ALWILS~1Avast5avastUI.exe /nogui
O4 — HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 — HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 — HKLM..Run: [LogonStudio] «C:Program FilesWinCustomizeLogonStudiologonstudio.exe» /RANDOM
O4 — HKLM..RunOnce: [Malwarebytes’ Anti-Malware] C:Program FilesMalwarebytes’ Anti-Malwarembamgui.exe /install /silent
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [uTorrent] «C:Program FilesuTorrentuTorrent.exe»
O4 — HKCU..Run: [DAEMON Tools Lite] «C:Program FilesDAEMON Tools LiteDTLite.exe» -autorun
O4 — HKCU..Run: [RocketDock] «C:Program FilesRocketDockRocketDock.exe»
O4 — HKCU..Run: [Sidebar] C:Program FilesWindows Sidebarsidebar.exe /low /autoRun
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-20..RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — Startup: _uninst_setup_9.0.0.722_26.03.2010_16-48.exe.lnk = C:Documents and SettingsAdminLocal SettingsTemp_uninst_setup_9.0.0.722_26.03.2010_16-48.exe.bat
O8 — Extra context menu item: &Winamp Search — C:Documents and SettingsAll UsersApplication DataWinamp ToolbarieToolbarresourcesen-USlocalsearch.html
O8 — Extra context menu item: Google ВикиКомментарии… — res://C:Program FilesGoogleGoogle ToolbarComponentGoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O8 — Extra context menu item: Поиск@Mail.Ru — res://c:program filesmail.rusputnikMailRuSputnik.dll/282
O8 — Extra context menu item: Словари@Mail.Ru — res://c:program filesmail.rusputnikMailRuSputnik.dll/283
O9 — Extra button: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra ‘Tools’ menuitem: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra button: (no name) — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — (no file)
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O16 — DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) — http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1266773072875
O16 — DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} — http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 — HKLMSystemCCSServicesTcpip..{F9C55D63-5FEC-4B05-8304-F490149A403F}: NameServer = 195.34.31.50 62.112.106.130
O23 — Service: avast! Antivirus — ALWIL Software — C:Program FilesAlwil SoftwareAvast5AvastSvc.exe
O23 — Service: avast! Mail Scanner — ALWIL Software — C:Program FilesAlwil SoftwareAvast5AvastSvc.exe
O23 — Service: avast! Web Scanner — ALWIL Software — C:Program FilesAlwil SoftwareAvast5AvastSvc.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: NetMeeting Remote Desktop Sharing (mnmsrvc) — Корпорация Майкрософт — C:WINDOWSsystem32mnmsrvc.exe
O23 — Service: NVIDIA Display Driver Service (nvsvc) — NVIDIA Corporation — C:WINDOWSsystem32nvsvc32.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe

—
End of file — 7151 bytes

======Scheduled tasks folder======

C:WINDOWStasksUser_Feed_Synchronization-{285FACC5-4AB8-479B-A401-84A9B8098E9F}.job

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{09900DE8-1DCA-443F-9243-26FF581438AF} — Спутник@Mail.Ru — c:program filesmail.rusputnikMailRuSputnik.dll [2002-02-28 1029296]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«MAgent»=C:Program FilesMail.RuAgentMAgent.exe [2002-02-28 8746680]
«avast5″=C:PROGRA~1ALWILS~1Avast5avastUI.exe [2010-03-09 2769336]
«NvMediaCenter»=C:WINDOWSsystem32NvMcTray.dll [2010-01-11 110696]
«NvCplDaemon»=C:WINDOWSsystem32NvCpl.dll [2010-01-11 13666408]
«LogonStudio»=C:Program FilesWinCustomizeLogonStudiologonstudio.exe [2002-09-03 987187]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnce]
«Malwarebytes’ Anti-Malware»=C:Program FilesMalwarebytes’ Anti-Malwarembamgui.exe [2010-01-07 429392]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=C:WINDOWSsystem32ctfmon.exe [2008-04-14 15360]
«uTorrent»=C:Program FilesuTorrentuTorrent.exe [2010-03-10 319792]
«DAEMON Tools Lite»=C:Program FilesDAEMON Tools LiteDTLite.exe [2009-10-30 369200]
«RocketDock»=C:Program FilesRocketDockRocketDock.exe [2007-03-19 630784]
«Sidebar»=C:Program FilesWindows Sidebarsidebar.exe [2009-07-05 1280512]

C:Documents and SettingsAdminГлавное менюПрограммыАвтозагрузка
_uninst_setup_9.0.0.722_26.03.2010_16-48.exe.lnk — C:Documents and SettingsAdminLocal SettingsTemp_uninst_setup_9.0.0.722_26.03.2010_16-48.exe.bat

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyWgaLogon]
C:WINDOWSsystem32WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalPEVSystemStart]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalprocexp90.Sys]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkPEVSystemStart]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkprocexp90.Sys]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=253
«NoDriveAutoRun-«=0
«NoDriveTypeAutoRun-«=0
«NoDriveAutoRun»=67108863

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«HonorAutoRunSetting»=
«NoDriveAutoRun-«=
«NoDriveTypeAutoRun-«=
«NoDriveAutoRun»=
«NoDriveTypeAutoRun»=

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«C:Program FilesuTorrentuTorrent.exe»=»C:Program FilesuTorrentuTorrent.exe:*:Enabled:µTorrent»
«C:Documents and SettingsAdminРабочий столutorrent.exe»=»C:Documents and SettingsAdminРабочий столutorrent.exe:*:Enabled:µTorrent»
«C:Documents and SettingsAdminРабочий столHandyCache098b1exeHandyCache.exe»=»C:Documents and SettingsAdminРабочий столHandyCache098b1exeHandyCache.exe:*:Enabled:HTTP Proxy server with cache»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{b07cd78a-2956-11d6-9a18-0015f22c84e3}]
shellAutoRuncommand — F:Autorun.exe

======List of files/folders created in the last 1 months======

2010-03-27 13:30:45 —-D—- C:Program Filestrend micro
2010-03-27 13:30:41 —-D—- C:rsit
2010-03-27 13:20:30 —-A—- C:logit.txt
2010-03-27 13:09:20 —-D—- C:Program FilesMalwarebytes’ Anti-Malware
2010-03-27 13:04:52 —-D—- C:Avenger
2010-03-27 13:04:51 —-A—- C:avenger.txt
2010-03-27 12:59:37 —-D—- C:Qoobox
2010-03-27 12:26:48 —-D—- C:Documents and SettingsAll UsersApplication DataAd Muncher
2010-03-26 20:10:29 —-D—- C:Documents and SettingsAdminApplication DataChemTable Software
2010-03-26 19:38:50 —-A—- C:WINDOWSlsoon.ini
2010-03-26 19:28:48 —-RSHD—- C:desktop.ini
2010-03-26 19:28:48 —-RSHD—- C:comment.htt
2010-03-26 19:28:48 —-RSHD—- C:autorun.inf
2010-03-26 19:27:26 —-D—- C:Documents and SettingsAdminApplication DataRegrun
2010-03-26 19:20:06 —-D—- C:Backreg
2010-03-26 19:17:30 —-RASHOT—- C:WINDOWSwinstart.bat
2010-03-26 18:42:32 —-D—- C:Program FilesGridinSoft Trojan Killer
2010-03-23 14:53:08 —-A—- C:WINDOWSLogonStudio.ini
2010-03-23 14:52:44 —-A—- C:WINDOWSsystem32JPGUtils.dll
2010-03-23 14:52:43 —-D—- C:Program FilesWinCustomize
2010-03-23 14:52:43 —-D—- C:Program FilesCommon FilesStardock
2010-03-23 13:06:03 —-D—- C:Documents and SettingsAdminApplication DataNero
2010-03-23 13:05:44 —-A—- C:WINDOWSsystem32TwnLib4.dll
2010-03-23 13:05:44 —-A—- C:WINDOWSsystem32imagXRA7.dll
2010-03-23 13:05:44 —-A—- C:WINDOWSsystem32imagXR7.dll
2010-03-23 13:05:44 —-A—- C:WINDOWSsystem32imagXpr7.dll
2010-03-23 13:05:44 —-A—- C:WINDOWSsystem32BCGPOleAcc.dll
2010-03-23 13:05:44 —-A—- C:WINDOWSsystem32BCGCBPRO860u80.dll
2010-03-23 13:05:43 —-A—- C:WINDOWSsystem32imagX7.dll
2010-03-23 13:05:42 —-D—- C:Program FilesCommon FilesNero
2010-03-23 13:05:41 —-D—- C:Program FilesNero
2010-03-22 16:18:36 —-D—- C:Program FilesWindows Sidebar
2010-03-22 14:32:57 —-D—- C:Documents and SettingsAdminApplication DataHelp
2010-03-22 14:14:48 —-D—- C:Downloads
2010-03-22 14:13:54 —-D—- C:Documents and SettingsAdminApplication DataDownload Master
2010-03-22 10:40:52 —-D—- C:WINDOWSERUNT
2010-03-22 10:40:52 —-D—- C:WINDOWSERDNT
2010-03-22 10:21:37 —-D—- C:Documents and SettingsAdminApplication DataWinPatrol
2010-03-22 10:21:24 —-D—- C:Program FilesBillP Studios
2010-03-21 18:38:42 —-D—- C:Program FilesESET
2010-03-21 18:08:06 —-D—- C:Documents and SettingsAll UsersApplication DataSUPERAntiSpyware.com
2010-03-21 18:07:52 —-D—- C:Documents and SettingsAdminApplication DataSUPERAntiSpyware.com
2010-03-21 17:15:20 —-D—- C:Documents and SettingsAdminApplication DataMalwarebytes
2010-03-21 17:15:15 —-D—- C:Documents and SettingsAll UsersApplication DataMalwarebytes
2010-03-21 11:21:06 —-A—- C:WINDOWSsystem32QqaJmwL.exe
2010-03-20 19:31:58 —-A—- C:WINDOWSsystem32I9tpJxk.exe
2010-03-20 19:31:54 —-A—- C:WINDOWSsystem32z99y06R.exe
2010-03-20 17:19:20 —-D—- C:Documents and SettingsAdminApplication DataYandex
2010-03-20 16:44:21 —-D—- C:Config.Msi
2010-03-19 20:41:46 —-D—- C:Documents and SettingsAdminApplication DataOpera
2010-03-10 12:28:28 —-HDC—- C:WINDOWS$NtUninstallKB975561$
2010-03-04 18:13:30 —-D—- C:Program FilesRocketDock
2010-03-03 15:49:41 —-D—- C:WINDOWSsystem32AGEIA
2010-03-03 15:49:41 —-D—- C:Program FilesAGEIA Technologies
2010-03-03 14:33:18 —-D—- C:Program FilesWinamp Toolbar
2010-03-03 14:33:18 —-D—- C:Documents and SettingsAll UsersApplication DataWinamp Toolbar
2010-03-03 14:32:28 —-N—- C:WINDOWSsystem32pxsfs.dll
2010-03-03 14:32:28 —-N—- C:WINDOWSsystem32pxinsa64.exe
2010-03-03 14:32:28 —-N—- C:WINDOWSsystem32pxhpinst.exe
2010-03-03 14:32:28 —-N—- C:WINDOWSsystem32pxdrv.dll
2010-03-03 14:32:28 —-N—- C:WINDOWSsystem32pxcpya64.exe
2010-03-03 14:32:28 —-N—- C:WINDOWSsystem32pxafs.dll
2010-03-03 14:32:27 —-N—- C:WINDOWSsystem32vxblock.dll
2010-03-03 14:32:27 —-N—- C:WINDOWSsystem32pxwave.dll
2010-03-03 14:32:27 —-N—- C:WINDOWSsystem32pxmas.dll
2010-03-03 14:32:27 —-N—- C:WINDOWSsystem32px.dll
2010-03-03 14:32:26 —-D—- C:Program FilesWinamp
2010-03-03 14:32:26 —-D—- C:Documents and SettingsAdminApplication DataWinamp

======List of files/folders modified in the last 1 months======

2010-03-27 13:30:47 —-D—- C:WINDOWSPrefetch
2010-03-27 13:30:45 —-RD—- C:Program Files
2010-03-27 13:30:01 —-D—- C:WINDOWSsystem32
2010-03-27 13:11:26 —-D—- C:WINDOWSTemp
2010-03-27 13:10:58 —-D—- C:WINDOWSsystem32CatRoot2
2010-03-27 13:10:15 —-D—- C:Documents and SettingsAdminApplication DatauTorrent
2010-03-27 13:09:22 —-D—- C:WINDOWSsystem32drivers
2010-03-27 13:04:06 —-A—- C:WINDOWSSchedLgU.Txt
2010-03-26 21:42:04 —-RSD—- C:WINDOWSFonts
2010-03-26 20:28:38 —-A—- C:WINDOWSsystem32logonuiX.exe
2010-03-26 20:19:32 —-SHD—- C:WINDOWSInstaller
2010-03-26 20:19:32 —-D—- C:WINDOWSsystem32config
2010-03-26 20:19:32 —-D—- C:WINDOWSsecurity
2010-03-26 20:19:32 —-D—- C:WINDOWS
2010-03-26 20:19:32 —-D—- C:Program FilesWinRAR
2010-03-26 20:19:32 —-D—- C:Program FilesMozilla Firefox
2010-03-26 19:03:13 —-SHD—- C:System Volume Information
2010-03-26 19:02:22 —-HD—- C:WINDOWSinf
2010-03-26 18:12:58 —-HD—- C:Program FilesInstallShield Installation Information
2010-03-23 14:52:43 —-D—- C:Program FilesCommon Files
2010-03-23 13:04:30 —-D—- C:WINDOWSWinSxS
2010-03-23 12:55:35 —-D—- C:Program FilesCommon FilesAhead
2010-03-23 12:05:03 —-SD—- C:Documents and SettingsAll UsersApplication DataMicrosoft
2010-03-23 12:04:47 —-D—- C:WINDOWSsystem32wbem
2010-03-23 12:04:47 —-D—- C:WINDOWSsystem32ru-ru
2010-03-23 12:03:02 —-D—- C:Documents and SettingsAll UsersApplication DataNero
2010-03-22 15:44:46 —-D—- C:Program FilesWindows NT
2010-03-22 10:56:53 —-A—- C:WINDOWSntbtlog.txt
2010-03-21 17:53:48 —-D—- C:WINDOWSDebug
2010-03-20 16:45:25 —-D—- C:WINDOWSRegistration
2010-03-19 20:20:14 —-D—- C:Documents and SettingsAdminApplication DataMozilla
2010-03-17 21:48:38 —-SD—- C:Documents and SettingsAdminApplication DataMicrosoft
2010-03-15 10:57:42 —-D—- C:WINDOWSsystem32Restore
2010-03-12 15:19:14 —-D—- C:Program FilesuTorrent
2010-03-10 16:30:41 —-A—- C:WINDOWSScarab Setup Log.txt
2010-03-10 16:30:40 —-D—- C:Program FilesScarab
2010-03-10 12:28:30 —-RSHDC—- C:WINDOWSsystem32dllcache
2010-03-10 12:28:30 —-D—- C:Program FilesMovie Maker
2010-03-10 12:28:10 —-HD—- C:WINDOWS$hf_mig$
2010-03-09 14:24:05 —-A—- C:WINDOWSsystem32aswBoot.exe
2010-03-03 15:46:05 —-D—- C:WINDOWSsystem32DirectX
2010-03-03 15:45:24 —-RSD—- C:WINDOWSassembly
2010-03-03 15:45:15 —-D—- C:WINDOWSMicrosoft.NET
2010-03-03 15:17:35 —-A—- C:WINDOWSNeroDigital.ini
2010-03-03 14:10:03 —-D—- C:Program FilesCommon FilesInstallShield
2010-03-03 13:29:01 —-D—- C:Documents and SettingsAll UsersApplication DataAlawarWrapper
2010-03-02 08:30:12 —-A—- C:WINDOWSsystem32MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:WINDOWSsystem32driversAavmker4.sys [2010-03-09 28880]
R1 AmdPPM;Драйвер AMD HwPState процессора; C:WINDOWSsystem32DRIVERSAmdPPM.sys [2007-04-16 33792]
R1 aswSP;aswSP; C:WINDOWSsystem32driversaswSP.sys [2010-03-09 162640]
R1 aswTdi;avast! Network Shield Support; C:WINDOWSsystem32driversaswTdi.sys [2010-03-09 46672]
R1 DumaNT;NVIDIA Stereo Helper Service; C:WINDOWSsystem32DRIVERSdumant.sys [2002-11-18 399700]
R2 aswFsBlk;aswFsBlk; C:WINDOWSsystem32driversaswFsBlk.sys [2010-03-09 19024]
R2 aswMon2;avast! Standard Shield Support; C:WINDOWSsystem32driversaswMon2.sys [2010-03-09 100432]
R3 aeaudio;aeaudio; C:WINDOWSsystem32driversaeaudio.sys [2004-04-08 116176]
R3 aswRdr;aswRdr; C:WINDOWSsystem32driversaswRdr.sys [2010-03-09 23376]
R3 MBAMSwissArmy;MBAMSwissArmy; ??C:WINDOWSsystem32driversmbamswissarmy.sys []
R3 MTsensor;ATK0110 ACPI UTILITY; C:WINDOWSsystem32DRIVERSASACPI.sys [2004-08-14 5810]
R3 nv;nv; C:WINDOWSsystem32DRIVERSnv4_mini.sys [2010-01-12 10276768]
R3 senfilt;senfilt; C:WINDOWSsystem32driverssenfilt.sys [2004-04-27 381056]
R3 smwdm;smwdm; C:WINDOWSsystem32driverssmwdm.sys [2004-06-08 266880]
R3 USB_RNDIS_51;ZTE USB Remote NDIS Device Driver; C:WINDOWSsystem32DRIVERSusb8023.sys [2008-04-13 12800]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2008-04-13 59520]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2008-04-13 20608]
S1 kbdhid;Драйвер клавиатуры HID; C:WINDOWSsystem32DRIVERSkbdhid.sys [2008-04-14 14720]
S2 ATE_PROCMON;ATE_PROCMON; ??C:Program FilesAnti Trojan EliteATEPMon.sys []
S3 asz2iasi;asz2iasi; C:WINDOWSsystem32driversasz2iasi.sys []
S3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service; C:WINDOWSsystem32DRIVERSfetnd5bv.sys [2008-09-22 43520]
S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet адаптер, драйвер для NT; C:WINDOWSsystem32DRIVERSfetnd5.sys [2001-08-17 27165]
S3 GMSIPCI;GMSIPCI; ??E:INSTALLGMSIPCI.SYS []
S3 hidusb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2008-04-13 10368]
S3 mouhid;Драйвер мыши HID; C:WINDOWSsystem32DRIVERSmouhid.sys [2007-01-11 12160]
S3 usbaudio;Аудио драйвер USB (WDM); C:WINDOWSsystem32driversusbaudio.sys [2008-04-13 60032]
S3 usbccgp;Драйвер универсального родительского устройства USB (Microsoft); C:WINDOWSsystem32DRIVERSusbccgp.sys [2008-04-13 32128]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2008-04-13 26368]
S3 WudfPf;Windows Driver Foundation — User-mode Driver Framework Platform Driver; C:WINDOWSsystem32DRIVERSWudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:Program FilesAlwil SoftwareAvast5AvastSvc.exe [2010-03-09 40384]
R2 nvsvc;NVIDIA Display Driver Service; C:WINDOWSsystem32nvsvc32.exe [2010-01-11 154216]
R3 avast! Mail Scanner;avast! Mail Scanner; C:Program FilesAlwil SoftwareAvast5AvastSvc.exe [2010-03-09 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:Program FilesAlwil SoftwareAvast5AvastSvc.exe [2010-03-09 40384]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:WINDOWSMicrosoft.NETFrameworkv3.0WPFPresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication Foundationinfocard.exe [2008-07-29 881664]
S3 WMPNetworkSvc;Служба общих сетевых ресурсов проигрывателя Windows Media; C:Program FilesWindows Media PlayerWMPNetwk.exe [2006-11-02 914944]
S3 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication FoundationSMSvcHost.exe [2008-07-29 132096]

---

EOF

---

[Admin]

Здравствуйте, добро пожаловать на Spyware-ru форум.

Вижу вы запускали Combofix, запустите ещё раз и получившийся лог вставьте в ваше следующее сообщение.

[druzh76]

Здравствуйте!Я сделал что вы просили. Вот только не уверен что правильно.Вот результат-

ComboFix 10-03-29.04 — Admin 31.03.2010 22:20:47.1.1 — x86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.767.464 [GMT 4:00]
Running from: c:documents and settingsAdminМои документыЗагрузкиComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:program filesMail.RuAgentMradllnewmrasearch.dll
d:наташаviKRoyki-stor.exe

.
((((((((((((((((((((((((( Files Created from 2010-02-28 to 2010-03-31 )))))))))))))))))))))))))))))))
.

2010-03-29 10:38 . 2010-03-29 10:38

---

d

---

w- c:documents and settingsAdminLocal SettingsApplication DataUnSofter
2010-03-28 13:33 . 2010-03-28 13:33

---

d

---

w- c:documents and settingsAdminLocal SettingsApplication DataCriterion Games
2010-03-28 06:33 . 2010-03-28 06:33 52224 —-a-w- c:documents and settingsAdminApplication DataSUPERAntiSpyware.comSUPERAntiSpywareSDDLLSSD10005.dll
2010-03-28 06:33 . 2010-03-28 06:33 117760 —-a-w- c:documents and settingsAdminApplication DataSUPERAntiSpyware.comSUPERAntiSpywareSDDLLSUIREPAIR.DLL
2010-03-28 06:31 . 2010-03-28 06:31

---

d

---

w- c:program filesSUPERAntiSpyware
2010-03-28 06:30 . 2010-03-28 06:30

---

d

---

w- c:program filesCommon FilesWise Installation Wizard
2010-03-27 11:33 . 2010-03-27 11:35

---

d

---

w- c:program filesWindows Sidebar
2010-03-27 10:30 . 2010-03-27 10:30

---

d

---

w- c:program filestrend micro
2010-03-27 10:09 . 2010-01-07 13:07 38224 —-a-w- c:windowssystem32driversmbamswissarmy.sys
2010-03-27 10:09 . 2010-03-27 10:09

---

d

---

w- c:program filesMalwarebytes’ Anti-Malware
2010-03-27 10:09 . 2010-01-07 13:07 19160 —-a-w- c:windowssystem32driversmbam.sys
2010-03-27 09:26 . 2010-03-27 09:28

---

d

---

w- c:documents and settingsAll UsersApplication DataAd Muncher
2010-03-26 17:13 . 2010-03-26 17:13

---

d

---

w- c:documents and settingsAdminLocal SettingsApplication DataChemTable Software
2010-03-26 17:10 . 2010-03-26 17:10

---

d

---

w- c:documents and settingsAdminApplication DataChemTable Software
2010-03-26 17:09 . 2010-03-26 17:25

---

d

---

w- c:documents and settingsAdminLocal SettingsApplication DataAnVir
2010-03-26 16:28 . 2010-03-26 16:28

---

d

---

r- C:comment.htt
2010-03-26 16:27 . 2010-03-26 16:27

---

d

---

w- c:documents and settingsAdminApplication DataRegrun
2010-03-26 16:17 . 2010-03-26 16:28 2 —shatr- c:windowswinstart.bat
2010-03-26 15:42 . 2010-03-26 16:00

---

d

---

w- c:program filesGridinSoft Trojan Killer
2010-03-23 11:52 . 2000-05-17 06:52 187392 —-a-w- c:windowssystem32JPGUtils.dll
2010-03-23 11:52 . 2010-03-23 11:52

---

d

---

w- c:program filesWinCustomize
2010-03-23 11:52 . 2010-03-23 11:52

---

d

---

w- c:program filesCommon FilesStardock
2010-03-23 10:06 . 2010-03-23 10:06

---

d

---

w- c:documents and settingsAdminApplication DataNero
2010-03-23 10:05 . 2008-06-24 10:45 33576 —-a-w- c:windowssystem32BCGPOleAcc.dll
2010-03-23 10:05 . 2008-06-24 10:45 3036456 —-a-w- c:windowssystem32BCGCBPRO860u80.dll
2010-03-23 10:05 . 2006-03-17 12:49 368640 —-a-w- c:windowssystem32TwnLib4.dll
2010-03-23 10:05 . 2006-03-17 09:45 802816 —-a-w- c:windowssystem32imagXRA7.dll
2010-03-23 10:05 . 2006-03-17 09:45 497296 —-a-w- c:windowssystem32imagXpr7.dll
2010-03-23 10:05 . 2006-03-17 09:45 258048 —-a-w- c:windowssystem32imagXR7.dll
2010-03-23 10:05 . 2006-03-17 09:45 1757184 —-a-w- c:windowssystem32imagX7.dll
2010-03-23 10:05 . 2010-03-23 10:05

---

d

---

w- c:program filesCommon FilesNero
2010-03-23 10:05 . 2010-03-23 10:05

---

d

---

w- c:program filesNero
2010-03-22 13:24 . 2010-03-22 13:24

---

d

---

w- c:documents and settingsAdminAppData
2010-03-22 11:32 . 2010-03-22 11:32

---

d

---

w- c:documents and settingsAdminLocal SettingsApplication DataHelp
2010-03-22 11:13 . 2010-03-22 11:53

---

d

---

w- c:documents and settingsAdminApplication DataDownload Master
2010-03-22 11:13 . 2007-12-18 10:56 1412608 —-a-w- c:documents and settingsAdminApplication DataDownload Mastertempskin.dll
2010-03-22 07:40 . 2010-03-22 07:40

---

d

---

w- c:windowsERUNT
2010-03-22 07:21 . 2010-03-22 07:21

---

d

---

w- c:documents and settingsAdminApplication DataWinPatrol
2010-03-22 07:21 . 2002-02-02 21:04 0 —-a-w- c:documents and settingsAdminApplication DataWinPatrolConfig.sys
2010-03-22 07:21 . 2002-02-02 21:04 0 —-a-w- c:documents and settingsAdminApplication DataWinPatrolAutoexec.bat
2010-03-22 07:21 . 2010-03-22 07:21

---

d

---

w- c:program filesBillP Studios
2010-03-21 15:08 . 2010-03-21 15:08

---

d

---

w- c:documents and settingsAll UsersApplication DataSUPERAntiSpyware.com
2010-03-21 15:07 . 2010-03-28 06:31

---

d

---

w- c:documents and settingsAdminApplication DataSUPERAntiSpyware.com
2010-03-21 14:15 . 2010-03-21 14:15

---

d

---

w- c:documents and settingsAdminApplication DataMalwarebytes
2010-03-21 14:15 . 2010-03-21 14:15

---

d

---

w- c:documents and settingsAll UsersApplication DataMalwarebytes
2010-03-20 14:19 . 2010-03-20 14:19

---

d

---

w- c:documents and settingsAdminApplication DataYandex
2010-03-20 13:45 . 2010-03-20 13:45

---

d

---

w- c:windowssystem32wbemRepository
2010-03-19 17:41 . 2010-03-19 17:41

---

d

---

w- c:documents and settingsAdminLocal SettingsApplication DataOpera
2010-03-10 09:17 . 2009-10-23 15:28 3558912 -c—-w- c:windowssystem32dllcachemoviemk.exe
2010-03-04 15:13 . 2010-03-04 15:19

---

d

---

w- c:program filesRocketDock
2010-03-03 12:49 . 2010-03-03 12:49

---

d

---

w- c:program filesAGEIA Technologies
2010-03-03 12:49 . 2010-03-03 12:49

---

d

---

w- c:windowssystem32AGEIA
2010-03-03 12:22 . 2010-03-03 12:22

---

d

---

w- c:documents and settingsAdminLocal SettingsApplication DataWinamp Toolbar
2010-03-03 11:33 . 2010-03-03 11:33

---

d

---

w- c:program filesWinamp Toolbar
2010-03-03 11:33 . 2010-03-03 11:33

---

d

---

w- c:documents and settingsAll UsersApplication DataWinamp Toolbar

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-31 18:18 . 2002-02-28 19:38

---

d

---

w- c:documents and settingsAdminApplication DatauTorrent
2010-03-28 11:54 . 2004-08-18 12:00 8494592 —-a-w- c:windowssystem32logonuiX.exe
2010-03-28 05:58 . 2004-08-18 12:00 474518 —-a-w- c:windowssystem32perfh019.dat
2010-03-28 05:58 . 2004-08-18 12:00 79546 —-a-w- c:windowssystem32perfc019.dat
2010-03-27 11:37 . 2002-02-02 21:19 15960 —-a-w- c:documents and settingsAdminLocal SettingsApplication DataGDIPFONTCACHEV1.DAT
2010-03-27 11:32 . 2010-01-30 20:18

---

d

---

w- c:program filesAlky for Applications
2010-03-26 15:12 . 2002-02-02 21:37

---

d—h—w- c:program filesInstallShield Installation Information
2010-03-23 09:55 . 2010-01-30 18:20

---

d

---

w- c:program filesCommon FilesAhead
2010-03-23 09:03 . 2010-01-30 18:20

---

d

---

w- c:documents and settingsAll UsersApplication DataNero
2010-03-12 12:19 . 2002-02-28 19:39

---

d

---

w- c:program filesuTorrent
2010-03-10 13:30 . 2010-02-21 09:39

---

d

---

w- c:program filesScarab
2010-03-09 11:24 . 2002-02-24 19:13 153184 —-a-w- c:windowssystem32aswBoot.exe
2010-03-09 11:12 . 2002-02-24 19:13 46672 —-a-w- c:windowssystem32driversaswTdi.sys
2010-03-09 11:12 . 2002-02-24 19:13 162640 —-a-w- c:windowssystem32driversaswSP.sys
2010-03-09 11:09 . 2002-02-24 19:13 23376 —-a-w- c:windowssystem32driversaswRdr.sys
2010-03-09 11:08 . 2002-02-24 19:13 100432 —-a-w- c:windowssystem32driversaswmon2.sys
2010-03-09 11:08 . 2002-02-24 19:13 94800 —-a-w- c:windowssystem32driversaswmon.sys
2010-03-09 11:08 . 2002-02-24 19:13 19024 —-a-w- c:windowssystem32driversaswFsBlk.sys
2010-03-09 11:08 . 2002-02-24 19:13 28880 —-a-w- c:windowssystem32driversaavmker4.sys
2010-03-04 14:40 . 2010-03-03 11:32

---

d

---

w- c:documents and settingsAdminApplication DataWinamp
2010-03-03 11:33 . 2010-03-03 11:32

---

d

---

w- c:program filesWinamp
2010-03-03 11:10 . 2002-02-02 21:36

---

d

---

w- c:program filesCommon FilesInstallShield
2010-03-03 10:29 . 2010-02-13 10:30

---

d

---

w- c:documents and settingsAll UsersApplication DataAlawarWrapper
2010-02-25 06:19 . 2007-01-11 12:55 916480 —-a-w- c:windowssystem32wininet.dll
2010-02-24 16:01 . 2010-02-23 16:00

---

d

---

w- c:program filesMicrosoft CAPICOM 2.1.0.2
2010-02-24 10:04 . 2010-02-24 07:15

---

d

---

w- c:program filesMicrosoft Windows 7 Upgrade Advisor
2010-02-22 10:22 . 2010-02-22 10:22

---

d

---

w- c:documents and settingsAdminApplication DataWindows Search
2010-02-21 16:18 . 2002-02-24 18:19

---

d

---

w- c:program filesNVIDIA Corporation
2010-02-21 15:40 . 2010-02-21 15:40

---

d

---

w- c:program filesMSBuild
2010-02-21 15:40 . 2010-02-21 15:40

---

d

---

w- c:program filesReference Assemblies
2010-02-21 14:58 . 2010-02-21 14:58

---

d

---

w- c:program filesWindows Media Connect 2
2010-02-21 14:36 . 2010-02-21 14:36

---

d

---

w- c:documents and settingsAll UsersApplication DataOffice Genuine Advantage
2010-02-21 07:25 . 2010-02-21 07:25

---

d

---

w- c:program filesCommon Fileswm
2010-02-13 10:33 . 2010-02-13 10:30

---

d

---

w- c:program filesuGames
2010-02-11 18:53 . 2002-02-24 19:13 38848 —-a-w- c:windowssystem32avastSS.scr
2010-02-11 10:48 . 2010-02-10 10:52

---

d

---

w- c:documents and settingsAdminApplication DataURSE Games
2010-02-06 18:31 . 2002-02-24 19:13

---

d

---

w- c:program filesAlwil Software
2010-02-06 18:29 . 2010-02-06 18:29

---

d

---

w- c:documents and settingsAll UsersApplication DataAlwil Software
2010-02-02 07:28 . 2002-02-28 19:22

---

d

---

w- c:documents and settingsAdminApplication DataMra
2010-02-01 06:51 . 2010-02-01 06:51

---

d

---

w- c:program filesMSXML 6.0
2010-01-23 13:22 . 2002-02-02 21:03 86327 —-a-w- c:windowspchealthhelpctrOfflineCacheindex.dat
2010-01-22 18:11 . 2010-01-22 18:11 62800 —-a-w- c:documents and settingsAdminApplication DataMozillaFirefoxProfilesd60js9l0.defaultextensions{0b38152b-1b20-484d-a11f-5e04a9b0661f}componentsWinampTBPlayer.dll
2010-01-22 15:45 . 2002-02-24 18:42 691696 —-a-w- c:windowssystem32driverssptd.sys
2010-01-12 20:34 . 2010-01-12 20:34 281088 —-a-w- c:windowsarcClock.scr
2010-01-11 19:17 . 2010-01-11 19:17 278120 —-a-w- c:windowssystem32nvmccs.dll
2010-01-11 19:17 . 2010-01-11 19:17 154216 —-a-w- c:windowssystem32nvsvc32.exe
2010-01-11 19:17 . 2010-01-11 19:17 145000 —-a-w- c:windowssystem32nvcolor.exe
2010-01-11 19:17 . 2010-01-11 19:17 13666408 —-a-w- c:windowssystem32nvcpl.dll
2010-01-11 19:17 . 2010-01-11 19:17 110696 —-a-w- c:windowssystem32nvmctray.dll
2010-01-11 19:17 . 2010-01-11 19:17 81920 —-a-w- c:windowssystem32nvwddi.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«uTorrent»=»c:program filesuTorrentuTorrent.exe» [2010-03-10 319792]
«DAEMON Tools Lite»=»c:program filesDAEMON Tools LiteDTLite.exe» [2009-10-30 369200]
«RocketDock»=»c:program filesRocketDockRocketDock.exe» [2007-03-18 630784]
«Sidebar»=»c:program filesWindows Sidebarsidebar.exe» [2001-04-17 1231360]
«SUPERAntiSpyware»=»c:program filesSUPERAntiSpywareSUPERAntiSpyware.exe» [2010-02-18 2012912]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«MAgent»=»c:program filesMail.RuAgentMAgent.exe» [2002-02-28 8746680]
«avast5″=»c:progra~1ALWILS~1Avast5avastUI.exe» [2010-03-09 2769336]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2010-01-11 110696]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2010-01-11 13666408]
«LogonStudio»=»c:program filesWinCustomizeLogonStudiologonstudio.exe» [2002-09-03 987187]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-14 15360]

[hkey_local_machinesoftwaremicrosoftwindowscurrentversionexplorerShellExecuteHooks]
«{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}»= «c:program filesSUPERAntiSpywareSASSEH.DLL» [2008-05-13 77824]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogon]
«UIHost»=»c:windowssystem32logonuiX.exe»

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotify!SASWinLogon]
2009-09-03 10:21 548352 —-a-w- c:program filesSUPERAntiSpywareSASWINLO.dll

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«c:\Program Files\uTorrent\uTorrent.exe»=

R1 aswSP;aswSP;c:windowssystem32driversaswSP.sys [24.02.2002 23:13 162640]
R1 SASDIFSV;SASDIFSV;c:program filesSUPERAntiSpywaresasdifsv.sys [17.02.2010 10:25 12872]
R1 SASKUTIL;SASKUTIL;c:program filesSUPERAntiSpywareSASKUTIL.SYS [17.02.2010 10:15 66632]
R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [24.02.2002 23:13 19024]
R3 SASENUM;SASENUM;c:program filesSUPERAntiSpywareSASENUM.SYS [17.02.2010 10:15 12872]
R3 USB_RNDIS_51;ZTE USB Remote NDIS Device Driver;c:windowssystem32driversusb8023.sys [18.08.2004 16:00 12800]
S0 Partizan;Partizan;c:windowssystem32driversPartizan.sys —> c:windowssystem32driversPartizan.sys [?]
S2 ATE_PROCMON;ATE_PROCMON;??c:program filesAnti Trojan EliteATEPMon.sys —> c:program filesAnti Trojan EliteATEPMon.sys [?]
S4 sptd;sptd;c:windowssystem32driverssptd.sys [24.02.2002 22:42 691696]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled components{D58F39FF-953E-4F45-898F-59F243B9A523}]
2001-04-17 20:38 1231360 —-a-w- c:program filesWindows Sidebarsidebar.exe
.
Contents of the ‘Scheduled Tasks’ folder

2010-03-31 c:windowsTasksUser_Feed_Synchronization-{285FACC5-4AB8-479B-A401-84A9B8098E9F}.job
— c:windowssystem32msfeedssync.exe [2007-08-13 01:31]
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://mail.ru/
IE: &Winamp Search — c:documents and settingsAll UsersApplication DataWinamp ToolbarieToolbarresourcesen-USlocalsearch.html
IE: Google ВикиКомментарии… — c:program filesGoogleGoogle ToolbarComponentGoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: Закачать ВСЕ при помощи Download Master
IE: Закачать при помощи Download Master
IE: Передать на удаленную закачку DM
IE: Поиск@Mail.Ru — c:program filesmail.rusputnikMailRuSputnik.dll/282
IE: Словари@Mail.Ru — c:program filesmail.rusputnikMailRuSputnik.dll/283
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:program filesMail.RuAgentmagent.exe
TCP: {F9C55D63-5FEC-4B05-8304-F490149A403F} = 195.34.31.50 62.112.106.130
FF — ProfilePath — c:documents and settingsAdminApplication DataMozillaFirefoxProfilesd60js9l0.default
FF — prefs.js: browser.startup.homepage — hxxp://mail.ru/
FF — HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} — c:windowsMicrosoft.NETFrameworkv3.5Windows Presentation FoundationDotNetAssistantExtension

—- FIREFOX POLICIES —-
c:program filesMozilla Firefoxgreprefsall.js — pref(«ui.use_native_colors», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«ui.use_native_popup_windows», false);
c:program filesMozilla Firefoxgreprefsall.js — pref(«browser.enable_click_image_resizing», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«accessibility.browsewithcaret_shortcut.enabled», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«javascript.options.mem.high_water_mark», 32);
c:program filesMozilla Firefoxgreprefsall.js — pref(«javascript.options.mem.gc_frequency», 1600);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.auth.force-generic-ntlm», false);
c:program filesMozilla Firefoxgreprefsall.js — pref(«svg.smil.enabled», false);
c:program filesMozilla Firefoxgreprefsall.js — pref(«ui.trackpoint_hack.enabled», -1);
c:program filesMozilla Firefoxgreprefsall.js — pref(«browser.formfill.debug», false);
c:program filesMozilla Firefoxgreprefsall.js — pref(«browser.formfill.agedWeight», 2);
c:program filesMozilla Firefoxgreprefsall.js — pref(«browser.formfill.bucketSize», 1);
c:program filesMozilla Firefoxgreprefsall.js — pref(«browser.formfill.maxTimeGroupings», 25);
c:program filesMozilla Firefoxgreprefsall.js — pref(«browser.formfill.timeGroupingSize», 604800);
c:program filesMozilla Firefoxgreprefsall.js — pref(«browser.formfill.boundaryWeight», 25);
c:program filesMozilla Firefoxgreprefsall.js — pref(«browser.formfill.prefixWeight», 5);
c:program filesMozilla Firefoxgreprefsall.js — pref(«html5.enable», false);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js — pref(«security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref», true);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js — pref(«security.ssl.renego_unrestricted_hosts», «»);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js — pref(«security.ssl.treat_unsafe_negotiation_as_broken», false);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js — pref(«security.ssl.require_safe_negotiation», false);
c:program filesMozilla Firefoxdefaultspreffirefox-branding.js — pref(«app.update.download.backgroundInterval», 600);
c:program filesMozilla Firefoxdefaultspreffirefox-branding.js — pref(«app.update.url.manual», «http://www.firefox.com»);
c:program filesMozilla Firefoxdefaultspreffirefox-branding.js — pref(«browser.search.param.yahoo-fr-ja», «mozff»);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name», «chrome://browser/locale/browser.properties»);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description», «chrome://browser/locale/browser.properties»);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«xpinstall.whitelist.add», «addons.mozilla.org»);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«xpinstall.whitelist.add.36», «getpersonas.com»);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«lightweightThemes.update.enabled», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«browser.allTabs.previews», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«plugins.hide_infobar_for_outdated_plugin», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«plugins.update.notifyUser», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«toolbar.customization.usesheet», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«browser.taskbar.previews.enable», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«browser.taskbar.previews.max», 20);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«browser.taskbar.previews.cachetime», 20);
.
— — — — ORPHANS REMOVED — — — —

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} — (no file)
HKLM-Run-WinPatrol Russian v.2 — c:program filesBillP StudiosWinPatrolwinpatrol.exe
ActiveSetup-{BADA65A0-86B7-462B-B720-CE66655C73F5} — c:program filesWindows SidebarVAIO.vshellext.dll

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-31 22:24
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘winlogon.exe'(636)
c:program filesSUPERAntiSpywareSASWINLO.dll
c:windowssystem32WININET.dll
.
Completion time: 2010-03-31 22:25:42
ComboFix-quarantined-files.txt 2010-03-31 18:25

Pre-Run: 33 033 039 872 байт свободно
Post-Run: 33 361 240 064 байт свободно

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)WINDOWS
[operating systems]
c:cmdconsBOOTSECT.DAT=»Microsoft Windows Recovery Console» /cmdcons
multi(0)disk(0)rdisk(0)partition(1)WINDOWS=»Microsoft Windows XP Professional RU» /noexecute=optin /fastdetect

Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
— — End Of File — — 58DB4B17843D5D231329293BD00E408A

[Автор]

Сообщения