[bearsong]

ComboFix 10-12-15.04 — Dima 16.12.2010 1:53.1.2 — x86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.3070.2633 [GMT 3:00]
Running from: d:softComboFix.exe
AV: Антивирус Касперского *Disabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr0.dat
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr1.dat
c:program filesMail.RuAgentMradllnewmrasearch.dll
c:windowslogfile32.txt
c:windowssystem32umdmgr.log

---

BITS: Possible infected sites

---

hxxp://soft.export.yandex.ru
hxxp://download.yandex.ru
.
((((((((((((((((((((((((( Files Created from 2010-11-15 to 2010-12-15 )))))))))))))))))))))))))))))))
.

2010-12-10 22:09 . 2010-12-10 22:09

---

d

---

w- C:rsit
2010-12-05 19:36 . 2010-12-05 19:36

---

d

---

w- c:program filesJetSet
2010-11-30 19:05 . 2010-11-30 19:05

---

d

---

w- c:documents and settingsDimaApplication DataW
2010-11-26 04:14 . 2010-11-29 16:09

---

d

---

w- c:program filesGarena
2010-11-23 21:14 . 2010-11-23 21:14

---

d

---

w- c:program filesICCup
2010-11-21 19:39 . 2010-11-21 19:39

---

d

---

w- c:program filesOpera AC
2010-11-18 17:31 . 2001-10-19 18:06 5632 —-a-w- c:windowssystem32ptpusb.dll
2010-11-18 17:31 . 2008-04-14 18:40 159232 —-a-w- c:windowssystem32ptpusd.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-15 20:15 . 2010-10-15 20:15 34064 —-a-w- c:windowssystem32lhacm.acm
2010-09-18 08:23 . 2003-08-18 04:00 974848 —-a-w- c:windowssystem32mfc42u.dll
2010-09-18 06:53 . 2003-08-18 04:00 974848 —-a-w- c:windowssystem32mfc42.dll
2010-09-18 06:53 . 2003-08-18 04:00 954368 —-a-w- c:windowssystem32mfc40.dll
2010-09-18 06:53 . 2003-08-18 04:00 953856 —-a-w- c:windowssystem32mfc40u.dll
.

---

Sigcheck

---

[7] 2008-04-13 18:09 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:windowsServicePackFilesi386aec.sys
[-] 2006-02-15 00:22 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:windowssystem32driversaec.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE~Browser Helper Objects{9BFBA68E-E21B-458E-AE12-FE85E903D2C1}]
2010-08-31 14:15 257384 —-a-w- c:program filesAlterGeoAlterGeo Magic Scanner2.8.8.615AlterGeo.BrowserPlugin.dll

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«DAEMON Tools Lite»=»c:program filesDAEMON Tools Litedaemon.exe» [2009-04-23 691656]
«uTorrent»=»c:program filesuTorrentuTorrent.exe» [2010-08-12 274224]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2009-04-30 86016]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2009-04-30 13750272]
«AVP»=»c:program filesKaspersky LabKaspersky Anti-Virus 2010avp.exe» [2010-08-18 340520]
«RTHDCPL»=»RTHDCPL.EXE» [2010-04-30 19523616]
«Adobe Reader Speed Launcher»=»c:program filesAdobeReader 9.0ReaderReader_sl.exe» [2010-09-23 35760]
«MAgent»=»c:program filesMail.RuAgentMAgent.exe» [2010-12-12 12319424]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-14 15360]

[HKLM~startupfolderC:^Documents and Settings^Dima^Главное меню^Программы^Автозагрузка^PowerReg Scheduler V3.exe]
path=c:documents and settingsDimaГлавное менюПрограммыАвтозагрузкаPowerReg Scheduler V3.exe
backup=c:windowspssPowerReg Scheduler V3.exeStartup

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregKernelFaultCheck]
c:windowssystem32dumprep 0 -k [X]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe ARM]
2010-09-20 19:07 932288 —-a-r- c:program filesCommon FilesAdobeARM1.0AdobeARM.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAuslogics BoostSpeed]
2009-12-11 13:44 480368 —-a-w- c:program filesAuslogicsAuslogics BoostSpeedBoostSpeed.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregBonus.SSR.FR10]
2010-01-20 18:37 941320 —-a-w- c:program filesABBYY FineReader 10Bonus.ScreenshotReader.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregGuard.Mail.ru.gui]
2010-12-12 17:11 1038016 —-a-w- c:program filesMail.RuGuardGuardMailRu.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregMAgent]
2010-12-12 17:11 12319424 —-a-w- c:program filesMail.RuAgentmagent.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregMSMSGS]
2008-04-14 17:41 1695232

---

w- c:program filesMessengermsmsgs.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregnwiz]
2009-04-30 20:31 1657376 —-a-w- c:windowssystem32nwiz.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSkype]
2010-09-02 11:15 13351304 —-a-r- c:program filesSkypePhoneSkype.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringKasperskyAntiVirus]
«DisableMonitoring»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«c:\Program Files\uTorrent\uTorrent.exe»=
«c:\Program Files\Ventrilo\Ventrilo.exe»=
«c:\Program Files\Skype\Plugin Manager\skypePM.exe»=
«c:\Opera_AC\opera.exe»=
«c:\Program Files\Skype\Phone\Skype.exe»=
«c:\Program Files\Mail.Ru\Sputnik\SputnikFlashPlayer.exe»=
«c:\Program Files\Mail.Ru\Sputnik\SputnikHelper.exe»=

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«9450:TCP»= 9450:TCP:blcfueir

R0 klbg;Kaspersky Lab Boot Guard Driver;c:windowssystem32driversklbg.sys [14.10.2009 19:18 36880]
R0 sptd;sptd;c:windowssystem32driverssptd.sys [28.04.2010 22:29 721904]
R1 uzi4mty4;AVZ-RK Kernel Driver;c:windowssystem32driversuzi4mty4.sys [03.05.2010 16:28 11264]
R2 Guard.Mail.ru;Guard.Mail.ru;c:program filesMail.RuGuardGuardMailRu.exe [07.11.2010 20:21 1038016]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:windowssystem32driversklim5.sys [14.09.2009 12:42 32272]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:windowssystem32driversklmouflt.sys [02.10.2009 17:39 19472]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:windowsMicrosoft.NETFrameworkv4.0.30319mscorsvw.exe [18.03.2010 12:16 130384]
S2 SSPORT;SSPORT;??c:windowssystem32DriversSSPORT.sys —> c:windowssystem32DriversSSPORT.sys [?]
S3 Ambfilt;Ambfilt;c:windowssystem32driversAmbfilt.sys [25.06.2010 23:04 1691480]
S3 DAUpdaterSvc;Dragon Age: Origins — Content Updater;d:gamesDragon Age.Origins And Awakeningbin_shipDAUpdaterSvc.Service.exe —> d:gamesDragon Age.Origins And Awakeningbin_shipDAUpdaterSvc.Service.exe [?]
S3 GGSAFERDriver;GGSAFER Driver;??c:program filesGarenasafedrv.sys —> c:program filesGarenasafedrv.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:windowsMicrosoft.NETFrameworkv4.0.30319WPFWPFFontCache_v0400.exe [18.03.2010 12:16 753504]

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSvchost — NetSvcs
rybhqhnz
zqnhuyfuy
nowema
.
Contents of the ‘Scheduled Tasks’ folder

2010-12-15 c:windowsTasksWGASetup.job
— c:windowssystem32KB905474wgasetup.exe [2010-05-04 18:18]
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.mail.ru/cnt/7227
uDefault_Search_URL = hxxp://search.qip.ru
uSearchAssistant = hxxp://search.qip.ru/ie
uSearchURL,(Default) = Root: HKCU; Subkey: SoftwareMicrosoftInternet ExplorerSearchUrl; ValueType: string; ValueName: ‘; ValueData: ‘; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:program filesMail.RuAgentmagent.exe
IE: {{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — {3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — c:program filesWebMoney Advisorwmadvisor.dll
.
— — — — ORPHANS REMOVED — — — —

BHO-{52CFF9E4-5FCD-460E-B476-7953788CA004} — c:documents and settingsDimaApplication DataMambamambabar2iemambabar2_ie.dll
BHO-{B4806C1A-FE8A-4008-9DA3-8CEDB6E82C10} — c:program filesWebMoney Advisorwmadvisor.dll
Toolbar-{91397D20-1446-11D4-8AF4-0040CA1127B6} — c:program filesYandexYandexBarIEyndbar.dll
Toolbar-{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — c:program filesWebMoney Advisorwmadvisor.dll
Toolbar-{52CFF9E4-5FCD-460E-B476-7953788CA004} — c:documents and settingsDimaApplication DataMambamambabar2iemambabar2_ie.dll
WebBrowser-{91397D20-1446-11D4-8AF4-0040CA1127B6} — c:program filesYandexYandexBarIEyndbar.dll
WebBrowser-{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — c:program filesWebMoney Advisorwmadvisor.dll
MSConfigStartUp-12CFG214-K641-12SF-N85P — c:recyclerS-1-5-21-0243936033-3052116371-381863308-1811vsbntlo.exe
MSConfigStartUp-660 — c:windowssystem32umdmgr.exe
MSConfigStartUp-773 — c:windowssystem32umdmgr.exe
MSConfigStartUp-816 — c:windowssystem32umdmgr.exe
MSConfigStartUp-vsbntlo — c:windowssystem32umdmgr.exe
MSConfigStartUp-wmagent — c:program filesWebMoney Agentwmagent.exe
AddRemove-Assassin’s Creed_is1 — c:documents and settingsDimaApplication DataAssassin’s CreedUninstallunins000.exe
AddRemove-Teamspeak 2 RC2_is1 — c:program filesTeamspeak2_RC2unins000.exe
AddRemove-TeamSpeak 3 Client — c:program filesTeamSpeak 3 Clientuninstall.exe
AddRemove-WebMoney Agent — c:program filesWebMoney Agentuninst_wmagent.exe
AddRemove-{6D9A7CEE-054A-437D-99EF-DD7C77E001FD} — c:program filesWebMoneyUninstall.exe
AddRemove-{8CFA9151-6404-409A-AF22-4632D04582FD} — c:documents and settingsDimaApplication DataAssassin’s CreedUninstallunins000.exe
AddRemove-Бар Знакомств — c:documents and settingsDimaApplication DataMambamambabar2ieuninst.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-16 01:59
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘explorer.exe'(2088)
c:program filesCommon FilesAdobeAcrobatActiveXPDFShell.RUS
.

---

Other Running Processes

---

.
c:windowssystem32nvsvc32.exe
c:windowssystem32RUNDLL32.EXE
c:windowsRTHDCPL.EXE
c:windowssystem32wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-12-16 02:01:54 — machine was rebooted
ComboFix-quarantined-files.txt 2010-12-15 23:01

Pre-Run: 1 485 647 872 байт свободно
Post-Run: 1 438 519 296 байт свободно

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)WINDOWS
[operating systems]
c:cmdconsBOOTSECT.DAT=»Microsoft Windows Recovery Console» /cmdcons
UnsupportedDebug=»do not select this» /debug
multi(0)disk(0)rdisk(0)partition(1)WINDOWS=»Microsoft Windows XP Professional RU» /noexecute=optin /fastdetect

— — End Of File — — BA49CAD763C6C7F9EAF779D8E06F306D

[Автор]

Сообщения