[capuchon]

Лог Каспера

---

ОТЧЕТ О ПРОВЕРКЕ KASPERSKY ONLINE SCANNER 7.0
30 Апрель 2009 г.
Операционная система: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Версия Kaspersky Online Scanner: 7.0.26.13
Последнее обновление баз: Wednesday, April 29, 2009 22:19:59
Количество записей в базах: 2100628

---

Параметры проверки:
проверять, используя следующие базы: расширенные
Проверять архивы: да
Проверять почтовые базы: да

Область проверки — Мой компьютер:
A:
C:
D:
F:
G:

Статистика проверки:
Проверено объектов: 131511
Обнаружено угроз: 4
Обнаружено зараженных объектов: 4
Обнаружено подозрительных объектов: 0
Время проверки: 04:09:18

Имя файла / Имя угрозы / Количество угроз
F:INSTALLNERONero_9_HD_HQ_Activation_Patcher.rar Зараженный: Packed.Win32.Black.a 1
F:INTERИнтер6.rar Зараженный: not-a-virus:PSWTool.Win32.PassView.150b2 1
F:INTERИнтер6.rar Зараженный: not-a-virus:PSWTool.Win32.PassView.150Rel 1
F:Sites_viazanieforum.knitting-info.ru.rar Зараженный: Trojan-Downloader.JS.Iframe.zi 1

Выбранная область проверена.

---

Лог ComboFix

ComboFix 09-04-25.04 — User 29.04.2009 22:55.3 — NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1251.7.1049.18.2047.1468 [GMT 3:00]
Running from: c:documents and settingsUserРабочий столComboFix.exe
Command switches used :: c:documents and settingsUserРабочий столCFScript.txt
AV: Антивирусная система Eset NOD32 2.50 *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-05-28 to 2009-4-29 )))))))))))))))))))))))))))))))
.

2009-04-27 19:36 . 2009-04-27 19:36

---

d-sha-r C:autorun.inf
2009-04-22 19:50 . 2009-04-22 19:50

---

d

---

w c:documents and settingsAll UsersApplication DataSUPERAntiSpyware.com
2009-04-22 19:49 . 2009-04-22 19:49

---

d

---

w c:documents and settingsUserApplication DataSUPERAntiSpyware.com
2009-04-22 17:07 . 2009-04-22 17:09

---

d

---

w C:rsit
2009-04-18 18:50 . 2009-04-18 18:50 2364 —-a-w c:windowscorecom.tlb
2009-04-09 16:42 . 2009-04-09 16:42

---

d

---

w c:windowssystem32ru
2009-04-09 16:42 . 2009-04-09 16:42

---

d

---

w c:windowssystem32bits
2009-04-09 16:42 . 2009-04-09 16:42

---

d

---

w c:windowsl2schemas
2009-04-09 16:40 . 2009-04-09 16:40

---

d

---

w c:windowsServicePackFiles
2009-04-09 16:37 . 2009-04-09 16:37

---

d

---

w c:windowsEHome
2009-04-09 15:44 . 2004-07-17 19:55 129045

---

w c:windowssystem32driverscxthsfs2.cty
2009-04-09 15:44 . 2006-03-02 12:00 9585 -c—-w c:windowssystem32dllcachecontrols.css
2009-04-09 15:44 . 2006-03-02 12:00 184262 -c—-w c:windowssystem32dllcachecompact.wmz
2009-04-09 15:44 . 2006-03-02 12:00 773 -c—-w c:windowssystem32dllcachecnth.gif
2009-04-09 15:44 . 2006-03-02 12:00 773 -c—-w c:windowssystem32dllcachecnt.gif
2009-04-09 15:44 . 2006-03-02 12:00 772 -c—-w c:windowssystem32dllcachecntd.gif
2009-04-09 15:44 . 2006-03-02 12:00 760 -c—-w c:windowssystem32dllcachecloapph.gif
2009-04-09 15:44 . 2006-03-02 12:00 717 -c—-w c:windowssystem32dllcachecloapp.gif
2009-04-09 15:44 . 2006-03-02 12:00 999 -c—-w c:windowssystem32dllcachebktrh.gif
2009-04-09 15:27 . 2008-06-14 17:35 272512 -c—-w c:windowssystem32dllcachebthport.sys
2009-04-09 15:27 . 2008-06-14 17:35 272512

---

w c:windowssystem32driversbthport.sys
2009-04-09 15:26 . 2008-08-14 13:26 2067840 -c—-w c:windowssystem32dllcachentkrnlpa.exe
2009-04-09 15:26 . 2008-08-14 13:26 2147328 -c—-w c:windowssystem32dllcachentkrnlmp.exe
2009-04-09 15:26 . 2008-08-14 13:26 2190976 -c—-w c:windowssystem32dllcachentoskrnl.exe
2009-04-09 15:26 . 2008-08-14 13:26 2025984 -c—-w c:windowssystem32dllcachentkrpamp.exe
2009-04-09 15:23 . 2008-05-08 14:02 203136 -c—-w c:windowssystem32dllcachermcast.sys
2009-04-09 15:23 . 2008-10-24 11:21 455296 -c—-w c:windowssystem32dllcachemrxsmb.sys
2009-04-09 15:21 . 2008-12-11 10:57 333952 -c—-w c:windowssystem32dllcachesrv.sys
2009-04-09 15:21 . 2008-04-11 19:06 691712 -c—-w c:windowssystem32dllcacheinetcomm.dll
2009-04-09 15:19 . 2008-10-15 16:37 337408 -c—-w c:windowssystem32dllcachenetapi32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-29 19:50 . 2009-02-18 17:10

---

d

---

w c:documents and settingsUserApplication DatauTorrent
2009-04-29 19:45 . 2007-07-25 03:17

---

d

---

w c:program filesUpsPilot
2009-04-22 19:49 . 2009-04-22 19:49

---

d

---

w c:program filesSUPERAntiSpyware
2009-04-22 19:49 . 2009-04-22 19:49

---

d

---

w c:program filesCommon FilesWise Installation Wizard
2009-04-22 17:08 . 2009-04-22 17:08 11976 —-a-w C:info.txt
2009-04-22 17:07 . 2009-04-22 17:07

---

d

---

w c:program filestrend micro
2009-04-09 17:00 . 2007-07-12 16:45 64368 —-a-w c:documents and settingsUserLocal SettingsApplication DataGDIPFONTCACHEV1.DAT
2009-04-09 16:56 . 2006-03-02 12:00 65616 —-a-w c:windowssystem32perfc019.dat
2009-04-09 16:56 . 2006-03-02 12:00 424230 —-a-w c:windowssystem32perfh019.dat
2009-04-09 16:39 . 2006-03-02 12:00 251152 —sha-r C:ntldr
2009-04-05 13:15 . 2009-04-05 13:15

---

d

---

w c:program filesAVIcodec
2009-03-26 17:02 . 2009-03-26 17:02

---

d

---

w c:program filesK-Lite Codec Pack
2009-03-23 15:52 . 2007-10-06 10:57

---

d

---

w c:program filesICE Book Reader Professional Russian
2009-02-24 23:26 . 2009-03-26 17:02 2255360 —-a-w c:windowssystem32x264vfw.dll
2009-02-09 18:56 . 2009-03-26 17:02 67584 —-a-w c:windowssystem32ff_vfw.dll
2009-02-09 14:07 . 2006-03-02 12:00 1846912 —-a-w c:windowssystem32win32k.sys
2007-07-16 19:27 . 2007-07-16 19:27 127 —-a-w c:documents and settingsUserLocal SettingsApplication Datafusioncache.dat
2006-07-30 20:20 . 2007-07-21 22:54 959 —sha-r c:windowssystem32autorun.bin
2001-10-29 19:00 . 2007-07-21 22:54 61440 —sha-r c:windowssystem32Autorun.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2008-04-14 15360]
«uTorrent»=»c:program filesuTorrentuTorrent.exe» [2009-02-18 270128]
«SUPERAntiSpyware»=»c:program filesSUPERAntiSpywareSUPERAntiSpyware.exe» [2009-03-23 1830128]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«SoundMAXPnP»=»c:program filesAnalog DevicesCoresmax4pnp.exe» [2006-12-18 868352]
«JMB36X IDE Setup»=»c:windowsJMJMInsIDE.exe» [2006-10-30 36864]
«JMB36X Configure»=»c:windowssystem32JMRaidSetup.exe» [2006-10-30 1953792]
«ATICCC»=»c:program filesATI TechnologiesATI.ACEcli.exe» [2006-01-02 45056]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2001-07-09 155648]
«nod32kui»=»c:program filesEsetnod32kui.exe» [2007-07-21 917504]
«Winpower»=»c:program filesUpsPilotWinpower.exe» [2007-07-25 114688]
«ANIWZCS2Service»=»c:program filesANIANIWZCS2 ServiceWZCSLDR2.exe» [2007-01-19 49152]
«D-Link D-Link Wireless G DWA-110″=»c:program filesD-LinkD-Link Wireless G DWA-110AirGCFG.exe» [2007-05-04 1662976]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-14 15360]

c:documents and settingsAll Usersѓ« ў­®Ґ ¬Ґ­оЏа®Ја ¬¬лЂўв®§ Јаг§Є 
Adobe Reader Speed Launch.lnk — c:program filesAdobeAcrobat 7.0Readerreader_sl.exe [2004-12-14 29696]

[hkey_local_machinesoftwaremicrosoftwindowscurrentversionexplorerShellExecuteHooks]
«{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}»= «c:program filesSUPERAntiSpywareSASSEH.DLL» [2008-05-13 77824]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotify!SASWinLogon]
2008-12-22 09:05 356352 —-a-w c:program filesSUPERAntiSpywareSASWINLO.dll

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«AntiVirusDisableNotify»=dword:00000001
«UpdatesDisableNotify»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«c:\WINDOWS\system32\sessmgr.exe»=
«c:\Program Files\uTorrent\uTorrent.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=

S1 SASDIFSV;SASDIFSV;c:program filesSUPERAntiSpywareSASDIFSV.SYS [2009-03-23 9968]
S1 SASKUTIL;SASKUTIL;c:program filesSUPERAntiSpywareSASKUTIL.sys [2009-03-23 72944]
S3 SASENUM;SASENUM;c:program filesSUPERAntiSpywareSASENUM.SYS [2009-03-23 7408]

.
.

---

Supplementary Scan

---

.
uStart Page = about:blank
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
IE: Add to Google Photos Screensa&ver — c:windowssystem32GPhotos.scr/200
LSP: imon.dll
TCP: {B91680C3-DEC3-4EF7-9724-CB6A6ACCCD25} = 192.168.1.1
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-29 22:56
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘winlogon.exe'(796)
c:program filesSUPERAntiSpywareSASWINLO.dll
c:windowssystem32Ati2evxx.dll

— — — — — — — > ‘lsass.exe'(852)
c:windowssystem32imon.dll
c:program filesEsetpr_imon.dll
.
Completion time: 2009-04-29 22:57
ComboFix-quarantined-files.txt 2009-04-29 19:57
ComboFix2.txt 2009-04-27 20:12
ComboFix3.txt 2009-04-25 05:41

Pre-Run: 15 192 084 480 байт свободно
Post-Run: 15 180 853 248 байт свободно

138 — E O F — 2009-04-09 17:01

[capuchon]

ComboFix.txt:

ComboFix 09-04-25.04 — User 27.04.2009 23:11.2 — NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1251.7.1049.18.2047.1594 [GMT 3:00]
Running from: c:documents and settingsUserРабочий столComboFix.exe
AV: Антивирусная система Eset NOD32 2.50 *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((((( Files Created from 2009-05-27 to 2009-4-27 )))))))))))))))))))))))))))))))
.

2009-04-27 19:36 . 2009-04-27 19:36

---

d-sha-r C:autorun.inf
2009-04-22 19:50 . 2009-04-22 19:50

---

d

---

w c:documents and settingsAll UsersApplication DataSUPERAntiSpyware.com
2009-04-22 19:49 . 2009-04-22 19:49

---

d

---

w c:documents and settingsUserApplication DataSUPERAntiSpyware.com
2009-04-22 17:07 . 2009-04-22 17:09

---

d

---

w C:rsit
2009-04-18 18:50 . 2009-04-18 18:50 2364 —-a-w c:windowscorecom.tlb
2009-04-09 16:42 . 2009-04-09 16:42

---

d

---

w c:windowssystem32ru
2009-04-09 16:42 . 2009-04-09 16:42

---

d

---

w c:windowssystem32bits
2009-04-09 16:42 . 2009-04-09 16:42

---

d

---

w c:windowsl2schemas
2009-04-09 16:40 . 2009-04-09 16:40

---

d

---

w c:windowsServicePackFiles
2009-04-09 16:37 . 2009-04-09 16:37

---

d

---

w c:windowsEHome
2009-04-09 15:44 . 2004-07-17 19:55 129045

---

w c:windowssystem32driverscxthsfs2.cty
2009-04-09 15:44 . 2006-03-02 12:00 9585 -c—-w c:windowssystem32dllcachecontrols.css
2009-04-09 15:44 . 2006-03-02 12:00 184262 -c—-w c:windowssystem32dllcachecompact.wmz
2009-04-09 15:44 . 2006-03-02 12:00 773 -c—-w c:windowssystem32dllcachecnth.gif
2009-04-09 15:44 . 2006-03-02 12:00 773 -c—-w c:windowssystem32dllcachecnt.gif
2009-04-09 15:44 . 2006-03-02 12:00 772 -c—-w c:windowssystem32dllcachecntd.gif
2009-04-09 15:44 . 2006-03-02 12:00 760 -c—-w c:windowssystem32dllcachecloapph.gif
2009-04-09 15:44 . 2006-03-02 12:00 717 -c—-w c:windowssystem32dllcachecloapp.gif
2009-04-09 15:44 . 2006-03-02 12:00 999 -c—-w c:windowssystem32dllcachebktrh.gif
2009-04-09 15:27 . 2008-06-14 17:35 272512 -c—-w c:windowssystem32dllcachebthport.sys
2009-04-09 15:27 . 2008-06-14 17:35 272512

---

w c:windowssystem32driversbthport.sys
2009-04-09 15:26 . 2008-08-14 13:26 2067840 -c—-w c:windowssystem32dllcachentkrnlpa.exe
2009-04-09 15:26 . 2008-08-14 13:26 2147328 -c—-w c:windowssystem32dllcachentkrnlmp.exe
2009-04-09 15:26 . 2008-08-14 13:26 2190976 -c—-w c:windowssystem32dllcachentoskrnl.exe
2009-04-09 15:26 . 2008-08-14 13:26 2025984 -c—-w c:windowssystem32dllcachentkrpamp.exe
2009-04-09 15:23 . 2008-05-08 14:02 203136 -c—-w c:windowssystem32dllcachermcast.sys
2009-04-09 15:23 . 2008-10-24 11:21 455296 -c—-w c:windowssystem32dllcachemrxsmb.sys
2009-04-09 15:21 . 2008-12-11 10:57 333952 -c—-w c:windowssystem32dllcachesrv.sys
2009-04-09 15:21 . 2008-04-11 19:06 691712 -c—-w c:windowssystem32dllcacheinetcomm.dll
2009-04-09 15:19 . 2008-10-15 16:37 337408 -c—-w c:windowssystem32dllcachenetapi32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-27 20:06 . 2009-02-18 17:10

---

d

---

w c:documents and settingsUserApplication DatauTorrent
2009-04-27 04:24 . 2007-07-25 03:17

---

d

---

w c:program filesUpsPilot
2009-04-22 19:49 . 2009-04-22 19:49

---

d

---

w c:program filesSUPERAntiSpyware
2009-04-22 19:49 . 2009-04-22 19:49

---

d

---

w c:program filesCommon FilesWise Installation Wizard
2009-04-22 17:08 . 2009-04-22 17:08 11976 —-a-w C:info.txt
2009-04-22 17:07 . 2009-04-22 17:07

---

d

---

w c:program filestrend micro
2009-04-09 17:00 . 2007-07-12 16:45 64368 —-a-w c:documents and settingsUserLocal SettingsApplication DataGDIPFONTCACHEV1.DAT
2009-04-09 16:56 . 2006-03-02 12:00 65616 —-a-w c:windowssystem32perfc019.dat
2009-04-09 16:56 . 2006-03-02 12:00 424230 —-a-w c:windowssystem32perfh019.dat
2009-04-09 16:39 . 2006-03-02 12:00 251152 —sha-r C:ntldr
2009-04-05 13:15 . 2009-04-05 13:15

---

d

---

w c:program filesAVIcodec
2009-03-26 17:02 . 2009-03-26 17:02

---

d

---

w c:program filesK-Lite Codec Pack
2009-03-23 15:52 . 2007-10-06 10:57

---

d

---

w c:program filesICE Book Reader Professional Russian
2009-02-24 23:26 . 2009-03-26 17:02 2255360 —-a-w c:windowssystem32x264vfw.dll
2009-02-09 18:56 . 2009-03-26 17:02 67584 —-a-w c:windowssystem32ff_vfw.dll
2009-02-09 14:07 . 2006-03-02 12:00 1846912 —-a-w c:windowssystem32win32k.sys
2007-07-16 19:27 . 2007-07-16 19:27 127 —-a-w c:documents and settingsUserLocal SettingsApplication Datafusioncache.dat
2006-07-30 20:20 . 2007-07-21 22:54 959 —sha-r c:windowssystem32autorun.bin
2001-10-29 19:00 . 2007-07-21 22:54 61440 —sha-r c:windowssystem32Autorun.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2008-04-14 15360]
«uTorrent»=»c:program filesuTorrentuTorrent.exe» [2009-02-18 270128]
«SUPERAntiSpyware»=»c:program filesSUPERAntiSpywareSUPERAntiSpyware.exe» [2009-03-23 1830128]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«SoundMAXPnP»=»c:program filesAnalog DevicesCoresmax4pnp.exe» [2006-12-18 868352]
«JMB36X IDE Setup»=»c:windowsJMJMInsIDE.exe» [2006-10-30 36864]
«JMB36X Configure»=»c:windowssystem32JMRaidSetup.exe» [2006-10-30 1953792]
«ATICCC»=»c:program filesATI TechnologiesATI.ACEcli.exe» [2006-01-02 45056]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2001-07-09 155648]
«nod32kui»=»c:program filesEsetnod32kui.exe» [2007-07-21 917504]
«Winpower»=»c:program filesUpsPilotWinpower.exe» [2007-07-25 114688]
«ANIWZCS2Service»=»c:program filesANIANIWZCS2 ServiceWZCSLDR2.exe» [2007-01-19 49152]
«D-Link D-Link Wireless G DWA-110″=»c:program filesD-LinkD-Link Wireless G DWA-110AirGCFG.exe» [2007-05-04 1662976]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-14 15360]

c:documents and settingsAll Usersѓ« ў­®Ґ ¬Ґ­оЏа®Ја ¬¬лЂўв®§ Јаг§Є 
Adobe Reader Speed Launch.lnk — c:program filesAdobeAcrobat 7.0Readerreader_sl.exe [2004-12-14 29696]

[hkey_local_machinesoftwaremicrosoftwindowscurrentversionexplorerShellExecuteHooks]
«{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}»= «c:program filesSUPERAntiSpywareSASSEH.DLL» [2008-05-13 77824]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotify!SASWinLogon]
2008-12-22 09:05 356352 —-a-w c:program filesSUPERAntiSpywareSASWINLO.dll

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«AntiVirusDisableNotify»=dword:00000001
«UpdatesDisableNotify»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«c:\WINDOWS\system32\sessmgr.exe»=
«c:\Program Files\uTorrent\uTorrent.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=

S1 SASDIFSV;SASDIFSV;c:program filesSUPERAntiSpywareSASDIFSV.SYS [2009-03-23 9968]
S1 SASKUTIL;SASKUTIL;c:program filesSUPERAntiSpywareSASKUTIL.sys [2009-03-23 72944]
S3 SASENUM;SASENUM;c:program filesSUPERAntiSpywareSASENUM.SYS [2009-03-23 7408]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{f2d34be6-5569-11dd-ba94-001b11c1cc3c}]
ShellAutocommand — activexdebugger32.exe f
ShellAutoRuncommand — c:windowssystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f
ShellexploreCommand — activexdebugger32.exe f
ShellopenCommand — activexdebugger32.exe f
.
.

---

Supplementary Scan

---

.
uStart Page = about:blank
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
IE: Add to Google Photos Screensa&ver — c:windowssystem32GPhotos.scr/200
LSP: imon.dll
TCP: {B91680C3-DEC3-4EF7-9724-CB6A6ACCCD25} = 192.168.1.1
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-27 23:12
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘winlogon.exe'(796)
c:program filesSUPERAntiSpywareSASWINLO.dll
c:windowssystem32Ati2evxx.dll

— — — — — — — > ‘lsass.exe'(852)
c:windowssystem32imon.dll
c:program filesEsetpr_imon.dll

— — — — — — — > ‘explorer.exe'(1800)
c:program filesAdobeAcrobat 7.0ActiveXPDFShell.dll
.
Completion time: 2009-04-27 23:12
ComboFix-quarantined-files.txt 2009-04-27 20:12
ComboFix2.txt 2009-04-25 05:41

Pre-Run: 15 252 041 728 байт свободно
Post-Run: 15 243 272 192 байт свободно

142 — E O F — 2009-04-09 17:01

Относительно Wi-Fi прояснилось. ComboFix убивает его. После перезагрузки все восстанавливается.

[capuchon]

Позже выяснилось, что пришел конец драйверу Wi-Fi.
На рабочем столе появилась системная папка «Internet Explorer». С чего бы это?

[capuchon]

Добрый день.
Сделала, как посоветовали.
Результат
ComboFix 09-04-25.04 — User 25.04.2009 8:39.1 — NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1251.7.1049.18.2047.1323 [GMT 3:00]
Running from: c:documents and settingsUserРабочий столComboFix.exe
Command switches used :: c:documents and settingsUserРабочий столWindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
AV: Антивирусная система Eset NOD32 2.50 *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:Autorun.exe
c:windowsa3kebook.ini
c:windowsakebook.ini
c:windowsANS2000.INI
c:windowssystem32autorun.ini
c:windowssystem32pthreadGC2.dll

.
((((((((((((((((((((((((( Files Created from 2009-05-25 to 2009-4-25 )))))))))))))))))))))))))))))))
.

2009-04-09 16:42 . 2009-04-09 16:42

---

d

---

w c:windowssystem32ru
2009-04-09 16:42 . 2009-04-09 16:42

---

d

---

w c:windowssystem32bits
2009-04-09 16:42 . 2009-04-09 16:42

---

d

---

w c:windowsl2schemas
2009-04-09 16:40 . 2009-04-09 16:40

---

d

---

w c:windowsServicePackFiles
2009-04-09 16:37 . 2009-04-09 16:37

---

d

---

w c:windowsEHome
2009-04-09 15:44 . 2004-07-17 19:55 129045

---

w c:windowssystem32driverscxthsfs2.cty
2009-04-09 15:44 . 2006-03-02 12:00 9585 -c—-w c:windowssystem32dllcachecontrols.css
2009-04-09 15:44 . 2006-03-02 12:00 184262 -c—-w c:windowssystem32dllcachecompact.wmz
2009-04-09 15:44 . 2006-03-02 12:00 773 -c—-w c:windowssystem32dllcachecnth.gif
2009-04-09 15:44 . 2006-03-02 12:00 773 -c—-w c:windowssystem32dllcachecnt.gif
2009-04-09 15:44 . 2006-03-02 12:00 772 -c—-w c:windowssystem32dllcachecntd.gif
2009-04-09 15:44 . 2006-03-02 12:00 760 -c—-w c:windowssystem32dllcachecloapph.gif
2009-04-09 15:44 . 2006-03-02 12:00 717 -c—-w c:windowssystem32dllcachecloapp.gif
2009-04-09 15:44 . 2006-03-02 12:00 999 -c—-w c:windowssystem32dllcachebktrh.gif
2009-04-09 15:27 . 2008-06-14 17:35 272512 -c—-w c:windowssystem32dllcachebthport.sys
2009-04-09 15:27 . 2008-06-14 17:35 272512

---

w c:windowssystem32driversbthport.sys
2009-04-09 15:26 . 2008-08-14 13:26 2067840 -c—-w c:windowssystem32dllcachentkrnlpa.exe
2009-04-09 15:26 . 2008-08-14 13:26 2147328 -c—-w c:windowssystem32dllcachentkrnlmp.exe
2009-04-09 15:26 . 2008-08-14 13:26 2190976 -c—-w c:windowssystem32dllcachentoskrnl.exe
2009-04-09 15:26 . 2008-08-14 13:26 2025984 -c—-w c:windowssystem32dllcachentkrpamp.exe
2009-04-09 15:23 . 2008-05-08 14:02 203136 -c—-w c:windowssystem32dllcachermcast.sys
2009-04-09 15:23 . 2008-10-24 11:21 455296 -c—-w c:windowssystem32dllcachemrxsmb.sys
2009-04-09 15:21 . 2008-12-11 10:57 333952 -c—-w c:windowssystem32dllcachesrv.sys
2009-04-09 15:21 . 2008-04-11 19:06 691712 -c—-w c:windowssystem32dllcacheinetcomm.dll
2009-04-09 15:19 . 2008-10-15 16:37 337408 -c—-w c:windowssystem32dllcachenetapi32.dll
2009-03-26 17:02 . 2008-10-03 12:30 414 —-a-w c:windowssystem32lame_acm.xml
2009-03-26 17:02 . 2008-09-24 18:41 839680 —-a-w c:windowssystem32lameACM.acm
2009-03-26 17:02 . 2009-02-24 23:26 2255360 —-a-w c:windowssystem32x264vfw.dll
2009-03-26 17:02 . 2008-12-07 18:08 795648 —-a-w c:windowssystem32xvidcore.dll
2009-03-26 17:02 . 2008-12-07 18:08 130048 —-a-w c:windowssystem32xvidvfw.dll
2009-03-26 17:02 . 2004-01-25 16:18 217088 —-a-w c:windowssystem32yv12vfw.dll
2009-03-26 17:02 . 2008-12-11 00:33 86016 —-a-w c:windowssystem32dpl100.dll
2009-03-26 17:02 . 2008-11-06 16:37 3596288 —-a-w c:windowssystem32qt-dx331.dll
2009-03-26 17:02 . 2008-11-06 16:33 684032 —-a-w c:windowssystem32divx.dll
2009-03-26 17:02 . 2007-07-10 16:10 547 —-a-w c:windowssystem32ff_vfw.dll.manifest
2009-03-26 17:02 . 2009-02-09 18:56 67584 —-a-w c:windowssystem32ff_vfw.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-25 05:18 . 2009-02-18 17:10

---

d

---

w c:documents and settingsUserApplication DatauTorrent
2009-04-25 02:33 . 2007-07-25 03:17

---

d

---

w c:program filesUpsPilot
2009-04-22 19:50 . 2009-04-22 19:50

---

d

---

w c:documents and settingsAll UsersApplication DataSUPERAntiSpyware.com
2009-04-22 19:49 . 2009-04-22 19:49

---

d

---

w c:program filesSUPERAntiSpyware
2009-04-22 19:49 . 2009-04-22 19:49

---

d

---

w c:documents and settingsUserApplication DataSUPERAntiSpyware.com
2009-04-22 19:49 . 2009-04-22 19:49

---

d

---

w c:program filesCommon FilesWise Installation Wizard
2009-04-22 17:08 . 2009-04-22 17:08 11976 —-a-w C:info.txt
2009-04-22 17:07 . 2009-04-22 17:07

---

d

---

w c:program filestrend micro
2009-04-09 17:00 . 2007-07-12 16:45 64368 —-a-w c:documents and settingsUserLocal SettingsApplication DataGDIPFONTCACHEV1.DAT
2009-04-09 16:56 . 2006-03-02 12:00 65616 —-a-w c:windowssystem32perfc019.dat
2009-04-09 16:56 . 2006-03-02 12:00 424230 —-a-w c:windowssystem32perfh019.dat
2009-04-09 16:39 . 2006-03-02 12:00 251152 —sha-r C:ntldr
2009-04-05 13:15 . 2009-04-05 13:15

---

d

---

w c:program filesAVIcodec
2009-03-26 17:02 . 2009-03-26 17:02

---

d

---

w c:program filesK-Lite Codec Pack
2009-03-23 15:52 . 2007-10-06 10:57

---

d

---

w c:program filesICE Book Reader Professional Russian
2009-02-09 14:07 . 2006-03-02 12:00 1846912 —-a-w c:windowssystem32win32k.sys
2007-07-16 19:27 . 2007-07-16 19:27 127 —-a-w c:documents and settingsUserLocal SettingsApplication Datafusioncache.dat
2006-07-30 20:20 . 2007-07-21 22:54 959 —sha-r c:windowssystem32autorun.bin
2001-10-29 19:00 . 2007-07-21 22:54 61440 —sha-r c:windowssystem32Autorun.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2008-04-14 15360]
«uTorrent»=»c:program filesuTorrentuTorrent.exe» [2009-02-18 270128]
«SUPERAntiSpyware»=»c:program filesSUPERAntiSpywareSUPERAntiSpyware.exe» [2009-03-23 1830128]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«SoundMAXPnP»=»c:program filesAnalog DevicesCoresmax4pnp.exe» [2006-12-18 868352]
«JMB36X IDE Setup»=»c:windowsJMJMInsIDE.exe» [2006-10-30 36864]
«JMB36X Configure»=»c:windowssystem32JMRaidSetup.exe» [2006-10-30 1953792]
«ATICCC»=»c:program filesATI TechnologiesATI.ACEcli.exe» [2006-01-02 45056]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2001-07-09 155648]
«nod32kui»=»c:program filesEsetnod32kui.exe» [2007-07-21 917504]
«Winpower»=»c:program filesUpsPilotWinpower.exe» [2007-07-25 114688]
«ANIWZCS2Service»=»c:program filesANIANIWZCS2 ServiceWZCSLDR2.exe» [2007-01-19 49152]
«D-Link D-Link Wireless G DWA-110″=»c:program filesD-LinkD-Link Wireless G DWA-110AirGCFG.exe» [2007-05-04 1662976]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-14 15360]

c:documents and settingsAll Usersѓ« ў­®Ґ ¬Ґ­оЏа®Ја ¬¬лЂўв®§ Јаг§Є 
Adobe Reader Speed Launch.lnk — c:program filesAdobeAcrobat 7.0Readerreader_sl.exe [2004-12-14 29696]

[hkey_local_machinesoftwaremicrosoftwindowscurrentversionexplorerShellExecuteHooks]
«{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}»= «c:program filesSUPERAntiSpywareSASSEH.DLL» [2008-05-13 77824]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotify!SASWinLogon]
2008-12-22 09:05 356352 —-a-w c:program filesSUPERAntiSpywareSASWINLO.dll

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«AntiVirusDisableNotify»=dword:00000001
«UpdatesDisableNotify»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«c:\WINDOWS\system32\sessmgr.exe»=
«c:\Program Files\uTorrent\uTorrent.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=

S1 SASDIFSV;SASDIFSV;c:program filesSUPERAntiSpywareSASDIFSV.SYS [2009-03-23 9968]
S1 SASKUTIL;SASKUTIL;c:program filesSUPERAntiSpywareSASKUTIL.sys [2009-03-23 72944]
S3 SASENUM;SASENUM;c:program filesSUPERAntiSpywareSASENUM.SYS [2009-03-23 7408]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{f2d34be6-5569-11dd-ba94-001b11c1cc3c}]
ShellAutocommand — activexdebugger32.exe f
ShellAutoRuncommand — c:windowssystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f
ShellexploreCommand — activexdebugger32.exe f
ShellopenCommand — activexdebugger32.exe f
.
— — — — ORPHANS REMOVED — — — —

HKCU-Run-Picasa Media Detector — c:program filesPicasa2PicasaMediaDetector.exe
HKLM-Run-WinampAgent — c:program filesWinampwinampa.exe

.

---

Supplementary Scan

---

.
uStart Page = about:blank
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
IE: Add to Google Photos Screensa&ver — c:windowssystem32GPhotos.scr/200
LSP: imon.dll
TCP: {B91680C3-DEC3-4EF7-9724-CB6A6ACCCD25} = 192.168.1.1
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-25 08:40
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘winlogon.exe'(796)
c:program filesSUPERAntiSpywareSASWINLO.dll
c:windowssystem32Ati2evxx.dll

— — — — — — — > ‘lsass.exe'(852)
c:windowssystem32imon.dll
c:program filesEsetpr_imon.dll
.
Completion time: 2009-04-25 8:41
ComboFix-quarantined-files.txt 2009-04-25 05:41

Pre-Run: 14 750 183 424 байт свободно
Post-Run: 15 266 521 088 байт свободно

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)WINDOWS
[operating systems]
c:cmdconsBOOTSECT.DAT=»Microsoft Windows Recovery Console» /cmdcons
multi(0)disk(0)rdisk(0)partition(1)WINDOWS=»Microsoft Windows XP Home Edition RU» /noexecute=optin /fastdetect

165 — E O F — 2009-04-09 17:01

[Автор]

Сообщения