Созданные ответы форума
-
Сообщения
-
Вот полный лог файл
ComboFix 09-10-07.05 — goadmin 08.10.2009 17:33.2.1 — FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.3.1251.7.1049.18.511.144 [GMT 4:00]
Running from: c:documents and settingsgoadminРабочий столComboFix.exeWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.((((((((((((((((((((((((( Files Created from 2009-09-08 to 2009-10-08 )))))))))))))))))))))))))))))))
.2009-10-08 13:25 . 2009-10-08 13:25
d
w- c:program filesuTorrent
2009-10-06 11:46 . 2009-10-06 11:46
d
w- c:program filesMicrosoft CAPICOM 2.1.0.2
2009-10-06 11:27 . 2008-10-16 10:06 268648 —-a-w- c:windowssystem32mucltui.dll
2009-10-04 17:12 . 2009-10-04 17:12
d
w- c:program filesCommon FilesVbox
2009-10-04 06:48 . 2009-10-04 06:48
d
w- c:program filesPowerISO
2009-10-02 18:10 . 2009-10-02 18:10 56 —ha-w- c:windowssystem32ezsidmv.dat
2009-10-02 18:10 . 2009-10-02 18:10
d
w- c:documents and settingsgoadminApplication DataskypePM
2009-10-02 18:06 . 2009-10-02 18:06
d
w- c:documents and settingsgoadminApplication DataSkype
2009-10-02 18:05 . 2009-10-02 18:05
d
w- c:program filesCommon FilesSkype
2009-10-02 18:05 . 2009-10-02 18:05
d
r- c:program filesSkype
2009-10-02 18:05 . 2009-10-02 18:05
d
w- c:documents and settingsAll UsersApplication DataSkype
2009-10-02 17:56 . 2009-10-02 17:56
d
w- c:documents and settingsgoadminLocal SettingsApplication DataAdobe
2009-10-02 16:57 . 2009-10-02 16:57
d
w- c:windowsA3W_DATA
2009-10-02 12:51 . 2009-10-02 12:51
d
w- c:documents and settingsgoadminApplication DataCMedia
2009-10-02 12:43 . 2009-10-02 12:43
d
w- c:documents and settingsgoadminLocal SettingsApplication DataCentered Systems
2009-10-02 12:43 . 2006-12-21 11:18 497496 —-a-w- c:windowssystem32XceedZip.dll
2009-10-01 19:11 . 2009-10-01 19:11
d
w- C:FOUND.005
2009-10-01 14:53 . 2009-10-01 14:53 228 —-a-w- c:windowsPowerReg.dat
2009-10-01 13:48 . 2001-01-12 12:31 1699840 —-a-r- c:windowsfargus.scr
2009-09-29 17:58 . 2009-09-29 17:58
d
w- C:SAVE
2009-09-29 17:53 . 2009-09-29 17:53
d
w- C:Games
2009-09-29 15:12 . 2009-09-29 15:12
d
w- C:FOUND.004
2009-09-29 13:34 . 2009-09-29 13:34
d
w- c:documents and settingsLocalServiceApplication DataSymantec
2009-09-27 17:28 . 2009-09-27 17:28
d
w- C:FOUND.003
2009-09-27 09:53 . 2007-11-02 15:34 1895104 —-a-r- c:windowsuna2setup.exe
2009-09-27 09:52 . 2007-11-02 15:34 1891008 —-a-r- c:windowsunasetup.exe
2009-09-27 09:50 . 2009-09-27 09:50 53248 —-a-w- c:windowssystem32unrar.dll
2009-09-27 09:50 . 2007-11-02 15:33 1602240 —-a-r- c:windowsuncsetup.exe
2009-09-25 14:57 . 2009-09-25 14:57
d
w- C:FOUND.002
2009-09-25 04:19 . 2009-09-25 04:19
d
w- C:FOUND.001
2009-09-24 15:28 . 2002-11-02 05:53 57344 —-a-w- c:windowssystem32WNASPINT.DLL
2009-09-24 14:59 . 2009-09-24 14:59
d
w- c:program filesBuka
2009-09-23 13:18 . 2009-09-23 13:30 114700 —-a-w- c:windowsWar3Unin.dat
2009-09-23 13:18 . 2009-09-23 13:23 2829 —-a-w- c:windowsWar3Unin.pif
2009-09-23 13:18 . 2009-09-23 13:23 139264 —-a-w- c:windowsWar3Unin.exe
2009-09-23 11:50 . 2009-09-23 11:50
d
w- C:FOUND.000
2009-09-23 03:59 . 2009-09-23 03:59
d
r- C:CONFIG
2009-09-23 03:57 . 2001-10-19 17:06 5632 —-a-w- c:windowssystem32ptpusb.dll
2009-09-23 03:57 . 2008-04-13 18:45 15104 —-a-w- c:windowssystem32driversusbscan.sys
2009-09-23 03:57 . 2008-04-13 18:45 15104 —-a-w- c:windowssystem32dllcacheusbscan.sys
2009-09-23 03:57 . 2008-04-14 16:10 159232 —-a-w- c:windowssystem32ptpusd.dll
2009-09-18 13:58 . 2009-09-18 13:58
d
w- c:documents and settingsgoadminApplication DataMicrosoft Games
2009-09-18 12:46 . 2004-06-04 14:33 314368 —-a-w- c:windowsIsUninstR.Exe
2009-09-18 12:28 . 2009-09-18 12:28
d
w- c:documents and settingsgoadminApplication DataDAEMON Tools Pro
2009-09-18 12:24 . 2009-09-18 12:24
d
w- c:documents and settingsAll UsersApplication DataDAEMON Tools Lite
2009-09-18 12:24 . 2009-09-18 12:24
d
w- c:program filesDAEMON Tools Toolbar
2009-09-18 12:24 . 2009-09-18 12:24
d
w- c:program filesDAEMON Tools Lite
2009-09-18 12:09 . 2009-09-18 12:09
d
w- c:documents and settingsgoadminApplication DataDAEMON Tools Lite
2009-09-18 11:16 . 2009-09-18 11:16
d
w- c:documents and settingsgoadminApplication DatauTorrent
2009-09-17 15:32 . 2009-09-17 15:32
d
w- c:documents and settingsgoadminApplication DataCyberLink
2009-09-17 15:32 . 2009-09-17 15:32
d
w- c:documents and settingsAll UsersApplication DataCyberLink
2009-09-17 15:10 . 2009-09-17 15:10
d
w- c:documents and settingsgoadminApplication DataMra
2009-09-17 15:09 . 2009-09-17 15:09
d
w- c:program filesMail.Ru
2009-09-17 13:52 . 2001-10-19 16:33 12160 —-a-w- c:windowssystem32driversmouhid.sys
2009-09-17 13:52 . 2001-10-19 16:33 12160 —-a-w- c:windowssystem32dllcachemouhid.sys
2009-09-17 13:52 . 2008-04-13 18:45 10368 —-a-w- c:windowssystem32drivershidusb.sys
2009-09-17 13:52 . 2008-04-13 18:45 10368 —-a-w- c:windowssystem32dllcachehidusb.sys
2009-09-17 03:36 . 2009-09-17 03:36
d
w- c:program filesVVSN
2009-09-17 03:30 . 2009-09-18 12:09 721904 —-a-w- c:windowssystem32driverssptd.sys
2009-09-16 18:37 . 2009-06-29 15:59 52224
w- c:windowssystem32dllcachemsfeedsbs.dll
2009-09-16 18:37 . 2009-06-29 15:59 459264
w- c:windowssystem32dllcachemsfeeds.dll
2009-09-16 18:37 . 2009-06-29 15:59 268288
w- c:windowssystem32dllcacheiertutil.dll
2009-09-16 18:37 . 2009-06-29 11:07 13824
w- c:windowssystem32dllcacheieudinit.exe
2009-09-16 18:37 . 2009-06-29 15:59 63488
w- c:windowssystem32dllcacheicardie.dll
2009-09-16 18:37 . 2009-06-29 15:59 380928
w- c:windowssystem32dllcacheieapfltr.dll
2009-09-16 18:37 . 2009-06-29 08:33 2452872
w- c:windowssystem32dllcacheieapfltr.dat
2009-09-16 18:37 . 2009-07-19 13:31 6067200
w- c:windowssystem32dllcacheieframe.dll
2009-09-16 18:14 . 2009-09-16 18:14
d
w- c:windowssystem32ru-ru
2009-09-16 18:14 . 2009-09-16 18:14
d
w- c:windowsl2schemas
2009-09-16 18:14 . 2009-09-16 18:14
d
w- c:windowssystem32ru
2009-09-16 18:14 . 2009-09-16 18:14
d
w- c:windowssystem32bits
2009-09-16 18:05 . 2009-09-16 18:06
d
w- c:windowsEHome
2009-09-16 12:11 . 2000-06-23 10:05 136704 —-a-w- c:windowssystem32iacenc.dll
2009-09-16 12:11 . 2000-06-22 09:09 56320
w- c:windowssystem32iyvu9_32.dll
2009-09-16 12:11 . 2009-09-16 12:11
d
w- c:program filesLigos
2009-09-14 18:44 . 2009-09-14 18:44
d
w- c:windowsServicePackFiles
2009-09-14 18:43 . 2009-09-14 18:43
d
w- c:program filesMSXML 4.0
2009-09-14 16:21 . 2009-09-14 16:21
d
w- c:documents and settingsgoadminLocal SettingsApplication DataOpera
2009-09-14 16:19 . 2009-09-14 16:19
d
w- c:program filesOpera
2009-09-14 16:12 . 2009-09-24 15:27 14224 —-a-w- c:documents and settingsgoadminLocal SettingsApplication DataGDIPFONTCACHEV1.DAT
2009-09-14 16:06 . 2008-06-14 17:35 272512
w- c:windowssystem32driversbthport.sys
2009-09-14 16:06 . 2008-06-14 17:35 272512
w- c:windowssystem32dllcachebthport.sys
2009-09-14 16:03 . 2009-06-21 21:48 153088
w- c:windowssystem32dllcachetriedit.dll
2009-09-14 16:03 . 2009-09-14 16:03
d
w- c:documents and settingsAll UsersApplication DatanView_Profiles
2009-09-14 16:02 . 2008-05-08 14:02 203136
w- c:windowssystem32dllcachermcast.sys
2009-09-14 16:02 . 2008-10-24 11:21 455296
w- c:windowssystem32dllcachemrxsmb.sys
2009-09-14 16:02 . 2008-12-11 10:57 333952
w- c:windowssystem32dllcachesrv.sys
2009-09-14 16:02 . 2008-05-01 14:37 331776
w- c:windowssystem32dllcachemsadce.dll
2009-09-14 16:02 . 2009-07-10 13:28 1315328
w- c:windowssystem32dllcachemsoe.dll
2009-09-14 16:02 . 2008-04-11 19:06 691712
w- c:windowssystem32dllcacheinetcomm.dll
2009-09-14 16:02 . 2009-06-10 05:21 2066432
w- c:windowssystem32dllcachemstscax.dll
2009-09-14 16:02 . 2008-10-03 10:04 247326
w- c:windowssystem32dllcachestrmdll.dll
2009-09-14 16:02 . 2008-10-15 16:37 337408
w- c:windowssystem32dllcachenetapi32.dll
2009-09-14 16:02 . 2008-09-04 17:17 1106944
w- c:windowssystem32dllcachemsxml3.dll
2009-09-14 16:01 . 2008-04-21 21:15 218624
w- c:windowssystem32dllcachewordpad.exe
2009-09-14 15:55 . 2009-09-14 15:55
d
w- c:program filesSymNetDrv
2009-09-14 15:51 . 2009-09-14 15:51
d—h—w- c:windows$hf_mig$
2009-09-14 15:45 . 2009-09-14 15:45 546 —-a-w- c:windowssystem32ABA6JC.DAT
2009-09-14 15:43 . 2006-05-22 18:15
d
w- c:windowssystem32configsystemprofileWINDOWS
2009-09-14 15:43 . 2006-05-22 18:15
d
w- c:documents and settingsDefault UserWINDOWS.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-23 03:59 . 2009-09-23 03:59 0 —-a-w- c:documents and settingsgoadminApplication Dataud.sys
2009-09-16 18:31 . 2004-09-22 13:51 49750 —-a-w- c:windowssystem32perfc019.dat
2009-09-16 18:31 . 2004-09-22 13:51 346690 —-a-w- c:windowssystem32perfh019.dat
2009-08-05 09:01 . 2004-09-22 13:51 204800 —-a-w- c:windowssystem32mswebdvd.dll
2009-07-29 04:36 . 2004-09-22 13:51 119808 —-a-w- c:windowssystem32t2embed.dll
2009-07-29 04:36 . 2004-09-22 13:50 81920 —-a-w- c:windowssystem32fontsub.dll
2009-07-27 02:43 . 2009-07-27 02:43 58908 —-a-w- c:windowssystem32driversscdemu.sys
2009-07-17 19:03 . 2004-09-22 13:50 58880 —-a-w- c:windowssystem32atl.dll
2009-07-12 08:21 . 2004-09-22 13:51 233472 —-a-w- c:windowssystem32wmpdxm.dll
.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiersCMedia]
@=»{6B830884-20E3-4AB6-B672-2629F0F72071}»
[HKEY_CLASSES_ROOTCLSID{6B830884-20E3-4AB6-B672-2629F0F72071}]
2009-10-02 12:51 750080 —-a-w- c:documents and settingsgoadminApplication DataCMediaCMedia.dll[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«MSMSGS»=»c:program filesMessengermsmsgs.exe» [2008-04-14 1695232]
«DAEMON Tools Lite»=»c:program filesDAEMON Tools Litedaemon.exe» [2009-04-23 691656][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«HControl»=»c:windowsATK0100HControl.exe» [2005-11-10 102400]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2005-11-21 7335936]
«ASUS Live Update»=»c:program filesASUSASUS Live UpdateALU.exe» [2005-11-02 180224]
«Power_Gear»=»c:program filesASUSPower4 GearBatteryLife.exe» [2005-10-05 86016]
«Wireless Console 2″=»c:program filesWireless Console 2wcourier.exe» [2005-10-17 987136]
«SynTPEnh»=»c:program filesSynapticsSynTPSynTPEnh.exe» [2005-10-20 761945]
«ABLKSR»=»c:windowsABLKSRABLKSR.exe» [2006-01-02 61440]
«RemoteControl»=»c:program filesASUSTeKASUSDVDPDVDServ.exe» [2004-11-02 32768]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2001-07-09 155648]
«ccApp»=»c:program filesCommon FilesSymantec SharedccApp.exe» [2008-01-17 58728]
«IntelZeroConfig»=»c:program filesIntelWirelessbinZCfgSvc.exe» [2005-12-28 667718]
«IntelWireless»=»c:program filesIntelWirelessBinifrmewrk.exe» [2005-12-28 602182]
«EOUApp»=»c:program filesIntelWirelessBinEOUWiz.exe» [2005-12-28 569413]
«Symantec NetDriver Monitor»=»c:progra~1SYMNET~1SNDMon.exe» [2009-09-14 100056]
«VVSN»=»c:program filesVVSNVVSN.exe» [2005-10-25 107520]
«MAgent»=»c:program filesMail.RuAgentMAgent.exe» [2009-09-17 7975608]
«PWRISOVM.EXE»=»c:program filesPowerISOPWRISOVM.EXE» [2009-07-27 180224]
«nwiz»=»nwiz.exe» — c:windowssystem32nwiz.exe [2005-11-21 1519616]
«RTHDCPL»=»RTHDCPL.EXE» — c:windowsRTHDCPL.exe [2005-09-06 14850560]
«SMSERIAL»=»sm56hlpr.exe» — c:windowssm56hlpr.exe [2005-05-26 544768][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-14 15360]c:documents and settingsgoadminѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
PowerReg Scheduler.exe [2009-10-1 189952]c:documents and settingsAll Usersѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
Adobe Reader Speed Launch.lnk — c:program filesAdobeAcrobat 7.0Readerreader_sl.exe [2004-12-14 29696]
ASUS ChkMail.lnk — c:program filesAsusAsus ChkMailChkMail.exe [2006-5-22 32768]
Adobe Gamma Loader.lnk — c:program filesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe [2009-10-4 113664][HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«AntiVirusOverride»=dword:00000001[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringSymantecAntiVirus]
«DisableMonitoring»=dword:00000001[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringSymantecFirewall]
«DisableMonitoring»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«c:\Program Files\Skype\Phone\Skype.exe»=
«c:\Documents and Settings\GOADMIN\Мои документы\торренты\utorrent.exe»=
«c:\Program Files\uTorrent\uTorrent.exe»=[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled components{67EFG7H6-8IJL-56YT-KLH4-76WE2D3RAM87}]
c:configS-1-5-21-1482476501-1644491937-682003330-1013ConfDriver.exe
.
Contents of the ‘Scheduled Tasks’ folder2009-10-03 c:windowsTasksNorton AntiVirus — Scan my computer — goadmin.job
— c:progra~1NORTON~1NORTON~1Navw32.exe [2004-08-30 08:54]
.
.
Supplementary Scan
.
uStart Page = hxxp://www.apeha.ru
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:program filesMail.RuAgentmagent.exe
.**************************************************************************
catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-08 17:37
Windows 5.1.2600 Service Pack 3 FAT NTAPIscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘explorer.exe'(3248)
c:windowssystem32WININET.dll
c:documents and settingsgoadminApplication DataCMediaCMedia.dll
.
Completion time: 2009-10-08 17:38
ComboFix-quarantined-files.txt 2009-10-08 13:38
ComboFix2.txt 2009-10-08 12:44Pre-Run: 2 629 042 176 байт свободно
Post-Run: 2 599 223 296 байт свободно209 — E O F — 2009-10-06 11:46
