Созданные ответы форума
-
Сообщения
-
Вот GMER LOG
GMER 1.0.15.14944 — http://www.gmer.net
Rootkit scan 2009-03-21 07:41:22
Windows 5.1.2600 Service Pack 3—- System — GMER 1.0.15 —-
SSDT spji.sys ZwCreateKey [0xBA6AB0E0]
SSDT spji.sys ZwEnumerateKey [0xBA6C8CA2]
SSDT spji.sys ZwEnumerateValueKey [0xBA6C9030]
SSDT spji.sys ZwOpenKey [0xBA6AB0C0]
SSDT spji.sys ZwQueryKey [0xBA6C9108]
SSDT spji.sys ZwQueryValueKey [0xBA6C8F88]
SSDT spji.sys ZwSetValueKey [0xBA6C919A]INT 0x63 ? 8AA9CBF8
INT 0x63 ? 8AA9CBF8
INT 0x63 ? 8AA9CBF8
INT 0x63 ? 8AA9CBF8
INT 0x63 ? 8A8ECBF8
INT 0x63 ? 8A8ECBF8
INT 0x63 ? 8AA9CBF8
INT 0x83 ? 8AA9CBF8
INT 0x83 ? 8AA9CBF8
INT 0x83 ? 8A8ECBF8
INT 0x83 ? 8AA9CBF8
INT 0x84 ? 8A8ECBF8
INT 0xA4 ? 8A8ECBF8
INT 0xB4 ? 8A8ECBF8—- Kernel code sections — GMER 1.0.15 —-
? spji.sys Не удается найти указанный файл. !
.text USBPORT.SYS!DllUnload B9C7F8AC 5 Bytes JMP 8A8EC1D8
.text a4mh77bp.SYS B9BC6384 1 Byte [20]
.text a4mh77bp.SYS B9BC6384 37 Bytes [20, 00, 00, 68, 00, 00, 00, …]
.text a4mh77bp.SYS B9BC63AA 24 Bytes [00, 00, 20, 00, 00, E0, 00, …]
.text a4mh77bp.SYS B9BC63C4 3 Bytes [00, 00, 00]
.text a4mh77bp.SYS B9BC63C9 1 Byte [00]
.text …—- User code sections — GMER 1.0.15 —-
.text C:Program FilesWinampwinamp.exe[2628] USER32.dll!SetScrollInfo 7E369056 7 Bytes JMP 0203A68D C:Program FilesWinampPluginsgen_jumpex.dll
.text C:Program FilesWinampwinamp.exe[2628] USER32.dll!GetScrollInfo 7E37DFE2 7 Bytes JMP 0203A615 C:Program FilesWinampPluginsgen_jumpex.dll
.text C:Program FilesWinampwinamp.exe[2628] USER32.dll!ShowScrollBar 7E37F2F2 5 Bytes JMP 0203A711 C:Program FilesWinampPluginsgen_jumpex.dll
.text C:Program FilesWinampwinamp.exe[2628] USER32.dll!GetScrollPos 7E37F704 5 Bytes JMP 0203A63D C:Program FilesWinampPluginsgen_jumpex.dll
.text C:Program FilesWinampwinamp.exe[2628] USER32.dll!SetScrollPos 7E37F750 5 Bytes JMP 0203A6B8 C:Program FilesWinampPluginsgen_jumpex.dll
.text C:Program FilesWinampwinamp.exe[2628] USER32.dll!GetScrollRange 7E37F787 5 Bytes JMP 0203A662 C:Program FilesWinampPluginsgen_jumpex.dll
.text C:Program FilesWinampwinamp.exe[2628] USER32.dll!SetScrollRange 7E37F99B 5 Bytes JMP 0203A6E3 C:Program FilesWinampPluginsgen_jumpex.dll
.text C:Program FilesWinampwinamp.exe[2628] USER32.dll!EnableScrollBar 7E3B8005 7 Bytes JMP 0203A5ED C:Program FilesWinampPluginsgen_jumpex.dll—- Kernel IAT/EAT — GMER 1.0.15 —-
IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [BA6AC040] spji.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [BA6AC13C] spji.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [BA6AC0BE] spji.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [BA6AC7FC] spji.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [BA6AC6D2] spji.sys
IAT SystemRootSystem32Driversa4mh77bp.SYS[HAL.dll!KfAcquireSpinLock] 000000AD
IAT SystemRootSystem32Driversa4mh77bp.SYS[HAL.dll!READ_PORT_UCHAR] 000000D4
IAT SystemRootSystem32Driversa4mh77bp.SYS[HAL.dll!KeGetCurrentIrql] 000000A2
IAT SystemRootSystem32Driversa4mh77bp.SYS[HAL.dll!KfRaiseIrql] 000000AF
IAT SystemRootSystem32Driversa4mh77bp.SYS[HAL.dll!KfLowerIrql] 0000009C
IAT SystemRootSystem32Driversa4mh77bp.SYS[HAL.dll!HalGetInterruptVector] 000000A4
IAT SystemRootSystem32Driversa4mh77bp.SYS[HAL.dll!HalTranslateBusAddress] 00000072
IAT SystemRootSystem32Driversa4mh77bp.SYS[HAL.dll!KeStallExecutionProcessor] 000000C0
IAT SystemRootSystem32Driversa4mh77bp.SYS[HAL.dll!KfReleaseSpinLock] 000000B7
IAT SystemRootSystem32Driversa4mh77bp.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] 000000FD
IAT SystemRootSystem32Driversa4mh77bp.SYS[HAL.dll!READ_PORT_USHORT] 00000093
IAT SystemRootSystem32Driversa4mh77bp.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] 00000026
IAT SystemRootSystem32Driversa4mh77bp.SYS[HAL.dll!WRITE_PORT_UCHAR] 00000036
IAT SystemRootSystem32Driversa4mh77bp.SYS[WMILIB.SYS!WmiSystemControl] 000000F7
IAT SystemRootSystem32Driversa4mh77bp.SYS[WMILIB.SYS!WmiCompleteRequest] 000000CC—- Devices — GMER 1.0.15 —-
Device FileSystemNtfs Ntfs 8AA9B1F8
AttachedDevice FileSystemNtfs Ntfs amon.sys (Amon monitor/Eset )
Device Driversptd Device4143125236 spji.sys
Device Driverusbuhci DeviceUSBPDO-0 8A8EB1F8
Device Driverusbuhci DeviceUSBPDO-1 8A8EB1F8
Device Driverdmio DeviceDmControlDmIoDaemon 8AB0C1F8
Device Driverdmio DeviceDmControlDmConfig 8AB0C1F8
Device Driverdmio DeviceDmControlDmPnP 8AB0C1F8
Device Driverdmio DeviceDmControlDmInfo 8AB0C1F8
Device Driverusbuhci DeviceUSBPDO-2 8A8EB1F8
Device Driverusbehci DeviceUSBPDO-3 8A8C91F8
Device Driverusbuhci DeviceUSBPDO-4 8A8EB1F8
Device Driverusbuhci DeviceUSBPDO-5 8A8EB1F8
Device Driverusbuhci DeviceUSBPDO-6 8A8EB1F8
Device DriverFtdisk DeviceHarddiskVolume1 8AA9D1F8
Device Driverusbehci DeviceUSBPDO-7 8A8C91F8
Device DriverFtdisk DeviceHarddiskVolume2 8AA9D1F8
Device DriverCdrom DeviceCdRom0 8A777500
Device DriverNetBT DeviceNetBt_Wins_Export 8A673368
Device DriverPCI_PNP5236 Device000003f spji.sys
Device DriverNetBT DeviceNetbiosSmb 8A673368
Device Driverusbuhci DeviceUSBFDO-0 8A8EB1F8
Device Driverusbuhci DeviceUSBFDO-1 8A8EB1F8
Device FileSystemMRxSmb DeviceLanmanDatagramReceiver 8A6C3500
Device Driverusbuhci DeviceUSBFDO-2 8A8EB1F8
Device FileSystemMRxSmb DeviceLanmanRedirector 8A6C3500
Device Driverusbehci DeviceUSBFDO-3 8A8C91F8
Device DriverFtdisk DeviceFtControl 8AA9D1F8
Device Driverusbuhci DeviceUSBFDO-4 8A8EB1F8
Device Driverusbuhci DeviceUSBFDO-5 8A8EB1F8
Device Driverusbuhci DeviceUSBFDO-6 8A8EB1F8
Device Driverusbehci DeviceUSBFDO-7 8A8C91F8
Device Drivera4mh77bp DeviceScsia4mh77bp1 8A80E1F8
Device Drivera4mh77bp DeviceScsia4mh77bp1Port6Path0Target0Lun0 8A80E1F8
Device FileSystemCdfs Cdfs 8A74C500—- Registry — GMER 1.0.15 —-
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 ?4;0404=484@4>0424I484:0404 ?0404:0454B4>0424 1?2?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (L002TP) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPTP) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPPoE) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@374@4O4494 ?0404@0404;4;0454;4L4=4K494 ?4>4@4B4 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (IP) 1?
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@s1 771343423
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@s2 285507792
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@h0 1
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04@p0 C:Program FilesAlcohol SoftAlcohol 120
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04@h0 0
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04@ujdew 0x8A 0xBE 0xBD 0xAF …
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001@ujdew 0xF0 0xA7 0xF7 0x14 …
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40@ujdew 0xB6 0xB3 0xCC 0x50 …
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04@p0 C:Program FilesAlcohol SoftAlcohol 120
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04@h0 0
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04@ujdew 0x8A 0xBE 0xBD 0xAF …
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@ujdew 0xF0 0xA7 0xF7 0x14 …
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40@ujdew 0xB6 0xB3 0xCC 0x50 …
Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 ?4;0404=484@4>0424I484:0404 ?0404:0454B4>0424 1?2?
Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (L002TP) 1?
Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPTP) 1?
Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPPoE) 1?
Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@374@4O4494 ?0404@0404;4;0454;4L4=4K494 ?4>4@4B4 1?
Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (IP) 1?
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D04
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D04@p0 C:Program FilesAlcohol SoftAlcohol 120
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D04@h0 0
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D04@ujdew 0x8A 0xBE 0xBD 0xAF …
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@ujdew 0xF0 0xA7 0xF7 0x14 …
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40@ujdew 0xB6 0xB3 0xCC 0x50 …—- EOF — GMER 1.0.15 —-
Здравствуйте,VALERI!
Последние 2 дня через 5-10 минут работы повторяются зависания после которых исчезает дисковод!!В дальнеешее время работы вроде бы все работает нормально…но дисковода так и нет!!!
Вот новый comboFix LOG.TXT
ComboFix 09-03-15.01 — Тимур 2009-03-16 20:27:05.2 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1251.1.1049.18.3071.2568 [GMT 3:00]
Running from: c:documents and settingsТимурРабочий столComboFix.exe
Command switches used :: c:documents and settingsТимурРабочий столCFScript.txt
AV: Антивирусная система Eset NOD32 2.70 *On-access scanning enabled* (Updated)
* Created a new restore point
* Resident AV is activeWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
c:windowssystem32K4hostElSvc.exe
.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
..
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
Legacy_K4HOSTEL
Service_K4hostEL((((((((((((((((((((((((( Files Created from 2009-02-16 to 2009-03-16 )))))))))))))))))))))))))))))))
.2009-03-15 16:56 . 2009-03-16 20:24 dr-h
c:documents and settingsТимурRecent
2009-03-15 16:56 . 2009-03-16 20:24 dr-h
c:documents and settingsТимурRecent
2009-03-15 02:40 . 2009-03-15 13:27 d
C:rsit
2009-03-15 02:18 . 2009-03-15 02:18 d
c:program filesuTorrent
2009-03-15 02:18 . 2009-03-15 17:14 d
c:documents and settingsТимурApplication DatauTorrent
2009-03-13 22:28 . 2009-03-15 02:08 d
c:program filesTrojan Remover
2009-03-13 22:28 . 2009-03-13 22:28 d
c:documents and settingsAll UsersApplication DataSimply Super Software
2009-03-13 18:05 . 2009-03-13 18:09 d
c:program filestrend micro
2009-03-12 16:06 . 2009-03-12 16:06 d
c:documents and settingsТимурApplication DataSimply Super Software
2009-03-12 16:06 . 2006-05-25 14:52 162,304 —a
c:windowssystem32ztvunrar36.dll
2009-03-12 16:06 . 2003-02-02 19:06 153,088 —a
c:windowssystem32UNRAR3.dll
2009-03-12 16:06 . 2005-08-26 00:50 77,312 —a
c:windowssystem32ztvunace26.dll
2009-03-12 16:06 . 2002-03-06 00:00 75,264 —a
c:windowssystem32unacev2.dll
2009-03-12 16:06 . 2006-06-19 12:01 69,632 —a
c:windowssystem32ztvcabinet.dll
2009-03-12 15:37 . 2009-03-15 00:12 d-a
c:documents and settingsAll UsersApplication DataTEMP
2009-03-11 23:57 . 2009-03-11 23:56 512,096 —a
c:windowssystem32driversamon.sys
2009-03-11 23:57 . 2009-03-11 23:56 298,104 —a
c:windowssystem32imon.dll
2009-03-11 23:57 . 2009-03-11 23:56 15,424 —a
c:windowssystem32driversnod32drv.sys
2009-03-11 23:48 . 2009-03-15 19:31 d
c:program filesEset
2009-03-11 22:31 . 2006-01-25 16:40 815,104 —a
c:windowssystem32rmvtrjan.trb
2009-03-06 23:40 . 2009-03-15 17:57 d
c:documents and settingsТимурApplication DataThe Creative Assembly
2009-03-06 16:10 . 2009-03-06 16:19 d
c:documents and settingsТимурApplication DataQIP.Online
2009-03-04 19:30 . 2009-03-04 19:30 32 —a
c:windows0
2009-03-04 19:30 . 2009-03-04 19:30 0 —a
c:windowssystem320
2009-02-20 23:16 . 2009-02-20 23:16 d
c:program filesMSXML 6.0
2009-02-20 23:14 . 2009-02-20 23:14 d
c:program filesMSXML 4.0
2009-02-20 14:54 . 2009-02-22 15:11 d
c:windowssystem32CatRoot_bak
2009-02-20 14:53 . 2008-06-14 20:59 272,512
c:windowssystem32driversbthport.sys
2009-02-20 14:53 . 2008-06-14 20:59 272,512
c— c:windowssystem32dllcachebthport.sys
2009-02-20 14:49 . 2008-08-14 16:40 2,187,776
c— c:windowssystem32dllcachentoskrnl.exe
2009-02-20 14:49 . 2008-08-14 16:40 2,144,768
c— c:windowssystem32dllcachentkrnlmp.exe
2009-02-20 14:49 . 2008-08-14 16:40 2,064,768
c— c:windowssystem32dllcachentkrnlpa.exe
2009-02-20 14:49 . 2008-08-14 16:40 2,022,912
c— c:windowssystem32dllcachentkrpamp.exe
2009-02-20 14:45 . 2008-10-24 14:25 455,936
c— c:windowssystem32dllcachemrxsmb.sys
2009-02-20 14:42 . 2009-03-12 14:31 d—h
c:windows$hf_mig$
2009-02-20 14:39 . 2008-10-16 14:08 31,768 —a
c:windowssystem32wucltui.dll.mui
2009-02-20 14:39 . 2008-10-16 14:08 27,672 —a
c:windowssystem32wuapi.dll.mui
2009-02-20 14:39 . 2008-10-16 14:07 23,576 —a
c:windowssystem32wuaucpl.cpl.mui
2009-02-20 14:39 . 2008-10-16 14:07 18,968 —a
c:windowssystem32wuaueng.dll.mui.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-15 15:08
d
w c:documents and settingsТимурApplication DataICQ
2009-03-14 21:11
d
w c:program filessXe Injected
2009-02-15 13:09
d
w c:program filesK-Lite Codec Pack
2009-02-15 13:09
d
w c:program filesDivX
2009-02-12 19:23
d
w c:documents and settingsТимурApplication DataDivX
2009-02-11 15:59
d—h—w c:program filesInstallShield Installation Information
2009-02-11 15:59
d
w c:program filesLogitech
2009-02-11 15:59
d
w c:program filesCommon FilesLogitech
2009-02-10 18:54
d
w c:documents and settingsAll UsersApplication DataKONAMI
2009-02-08 17:15
d
w c:program filesA4Tech
2009-02-08 11:59
d
w c:documents and settingsAll UsersApplication DataElectronic Arts
2009-02-08 11:40
d
w c:program filesCommon FilesWise Installation Wizard
2009-02-08 11:40
d
w c:program filesAGEIA Technologies
2009-02-02 18:17
d
w c:program filesMicrosoft ActiveSync
2009-02-02 18:15
d
w c:program filesMicrosoft.NET
2009-02-01 11:46
d
w c:program filesCommon FilesNero
2009-02-01 11:46
d
w c:documents and settingsТимурApplication DataNero
2009-02-01 11:45
d
w c:program filesNero
2009-02-01 11:45
d
w c:documents and settingsAll UsersApplication DataNero
2009-01-31 17:11
d
w c:program filesmp3DirectCut
2009-01-30 20:10
d
w c:program filesAVIConverter
2009-01-30 18:48
d
w c:program filesNO1 Video Converter
2009-01-28 09:49
d
w c:documents and settingsТимурApplication DataWinamp
2009-01-27 19:28
d
w c:documents and settingsТимурApplication DataU3
2009-01-27 14:02
d
w c:program filesOpera
2009-01-27 13:03
d
w c:program filesVKLife
2009-01-27 12:49
d
w c:documents and settingsТимурApplication DataVKLife
2009-01-25 16:43
d
w c:program filesICQ6.5
2009-01-25 16:43
d
w c:program filesCommon FilesICQ
2009-01-20 15:56
d
w c:documents and settingsТимурApplication Datateamspeak2
2009-01-20 15:38
d
w c:documents and settingsТимурApplication DataMedia Player Classic
2009-01-20 14:18
d
w c:program filesAlcohol Soft
2009-01-20 14:17 716,272 —-a-w c:windowssystem32driverssptd.sys
2009-01-20 14:11
d
w c:documents and settingsТимурApplication DataMra
2009-01-20 13:58
d
w c:documents and settingsТимурApplication DataMail.Ru
2009-01-20 13:57
d
w c:program filesMail.Ru
2009-01-20 13:48
d
w c:documents and settingsAll UsersApplication DataESET
2009-01-20 13:45
d
w c:program filesWinamp
2009-01-20 13:43
d
w c:program filesCommon FilesAdobe
2009-01-20 13:38
d
w c:program filesCCleaner
2009-01-20 13:34
d
w c:program filesRealtek
2009-01-20 13:34
d
w c:program filesCommon FilesInstallShield
2009-01-20 13:23
d
w c:program filesmicrosoft frontpage
2009-01-20 13:23
d
w c:program filesJava
2009-01-20 13:23
d
w c:program filesCommon FilesJava
2009-01-20 13:19
d
w c:program filesWindows Media Connect 2
2009-01-20 13:19
d
w c:program filesWindows Media Components
2009-01-20 13:19
d
w c:program filesMSN Messenger
2009-01-20 13:19
d
w c:program filesMicrosoft
.((((((((((((((((((((((((((((( SnapShot@2009-03-15_19.32.09,57 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 17:02:28 163,328 —-a-w c:windowsErdNtsubsERDNT.EXE
— 2009-01-21 15:42:16 84,661 —-a-w c:windowssystem32MacromedFlashuninstall_plugin.exe
+ 2009-03-15 16:40:36 84,661 —-a-w c:windowssystem32MacromedFlashuninstall_plugin.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2004-08-17 15360]
«AlcoholAutomount»=»c:program filesAlcohol SoftAlcohol 120axcmd.exe» [2009-01-20 4608]
«H/PC Connection Agent»=»c:program filesMicrosoft ActiveSyncwcescomm.exe» [2006-06-26 1207080]
«BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=»c:program filesCommon FilesNeroLibNMBgMonitor.exe» [2007-10-23 202024]
«Steam»=»d:gamessteamsteam.exe» [2009-01-20 1410296][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«CoolSwitch»=»c:windowssystem32TaskSwitch.exe» [2005-12-22 45632]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2008-10-07 13574144]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2008-10-07 86016]
«Adobe Reader Speed Launcher»=»c:program filesAdobeReader 9.0ReaderReader_sl.exe» [2008-06-12 34672]
«WinampAgent»=»c:program filesWinampwinampa.exe» [2008-08-04 36352]
«MAgent»=»c:program filesMail.RuAgentmagent.exe» [2009-01-22 5603000]
«NeroFilterCheck»=»c:program filesCommon FilesNeroLibNeroCheck.exe» [2007-03-01 153136]
«NBKeyScan»=»c:program filesNeroNero8Nero BackItUpNBKeyScan.exe» [2007-09-20 1836328]
«WheelMouse»=»c:program filesA4TechMouseAmoumain.exe» [2006-12-26 196608]
«nod32kui»=»c:program filesEsetnod32kui.exe» [2009-03-11 949376]
«TrojanScanner»=»c:program filesTrojan RemoverTrjscan.exe» [2009-02-15 1214856]
«nwiz»=»nwiz.exe» [2008-10-07 c:windowssystem32nwiz.exe]
«RTHDCPL»=»RTHDCPL.EXE» [2008-11-07 c:windowsRTHDCPL.EXE][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2004-08-17 15360][HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«d:\Games\Counter-strike\hl.exe»=
«d:\Games\Steam\SteamApps\gfd1zel\counter-strike\hl.exe»=
«c:\Program Files\ICQ6.5\ICQLite\ICQ.exe»=
«d:\Games\Episode 2 + Portal + TF\Team Fortress 2\hl2.exe»=
«d:\Games\Steam\SteamApps\gfd1zel\team fortress 2\hl2.exe»=
«d:\Games\Steam\SteamApps\gfd1zel\counter-strike source\hl2.exe»=
«d:\Games\Steam\steam.exe»=
«c:\Program Files\Mail.Ru\Agent\magent.exe»=
«c:program filesMicrosoft ActiveSyncrapimgr.exe»= c:program filesMicrosoft ActiveSyncrapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
«c:program filesMicrosoft ActiveSyncwcescomm.exe»= c:program filesMicrosoft ActiveSyncwcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
«c:program filesMicrosoft ActiveSyncWCESMgr.exe»= c:program filesMicrosoft ActiveSyncWCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
«d:\Games\Counter-Strike\hltv.exe»=
«d:\Games\Mirror’s Edge\Binaries\MirrorsEdge.exe»=
«d:\Games\PES 2009\pes2009.exe»=
«c:\Documents and Settings\Тимур\Рабочий стол\pes2009.exe»=
«d:\Games\Burnout Paradise\BurnoutLauncher.exe»=
«d:\Games\Burnout Paradise\BurnoutConfigTool.exe»=
«d:\Games\Burnout Paradise\BurnoutParadise.exe»=
«d:\Games\Steam\SteamApps\common\left 4 dead\left4dead.exe»=
«c:\Program Files\uTorrent\utorrent.exe»=
«c:\Program Files\Opera\opera.exe»=[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«26675:TCP»= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync ServiceR1 nod32drv;nod32drv;c:windowssystem32driversnod32drv.sys [2009-03-11 15424]
R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;c:windowssystem32driversAmps2prt.sys [2006-05-09 13824]
R3 MouseCap;MouseCapture Driver;c:windowssystem32driversMouseCap.sys [2005-08-08 6640][HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{52fcdf1a-ec84-11dd-a33a-008048483d4f}]
ShellAutoRuncommand — G:LaunchU3.exe -a
.
.
Supplementary Scan
.
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~4OFFICE11EXCEL.EXE/3000
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:program filesMail.RuAgentmagent.exe
LSP: c:windowssystem32imon.dll
.**************************************************************************
catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-16 20:29:08
Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘lsass.exe'(664)
c:windowssystem32imon.dll
c:program filesEsetpr_imon.dll
.
Other Running Processes
.
c:windowssystem32rundll32.exe
c:progra~1MICROS~3rapimgr.exe
c:program filesNeroNero8Nero BackItUpNBService.exe
c:program filesEsetnod32krn.exe
c:windowssystem32nvsvc32.exe
c:program filesAlcohol SoftAlcohol 120StarWindStarWindServiceAE.exe
c:program filesCommon FilesNeroLibNMIndexingService.exe
c:program filesCommon FilesNeroLibNMIndexStoreSvr.exe
.
**************************************************************************
.
Completion time: 2009-03-16 20:30:19 — machine was rebooted
ComboFix-quarantined-files.txt 2009-03-16 17:30:17
ComboFix2.txt 2009-03-15 16:32:29Pre-Run: 40 807 174 144 байт свободно
Post-Run: 40,752,517,120 байт свободно217 — E O F — 2009-03-12 13:02:19
ComboFix LOG.TXT
ComboFix 09-03-14.01 — Тимур 2009-03-15 19:31:23.1 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1251.1.1049.18.3071.2586 [GMT 3:00]
Running from: c:documents and settingsТимурРабочий столComboFix.exe
AV: Антивирусная система Eset NOD32 2.70 *On-access scanning enabled* (Updated)
* Created a new restore point
* Resident AV is activeWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.((((((((((((((((((((((((( Files Created from 2009-02-15 to 2009-03-15 )))))))))))))))))))))))))))))))
.2009-03-15 17:45 . 2009-03-15 17:45 d
c:windowsLastGood
2009-03-15 16:56 . 2009-03-15 17:17 dr-h
c:documents and settingsТимурRecent
2009-03-15 16:56 . 2009-03-15 17:17 dr-h
c:documents and settingsТимурRecent
2009-03-15 02:40 . 2009-03-15 13:27 d
C:rsit
2009-03-15 02:18 . 2009-03-15 02:18 d
c:program filesuTorrent
2009-03-15 02:18 . 2009-03-15 17:14 d
c:documents and settingsТимурApplication DatauTorrent
2009-03-13 22:28 . 2009-03-15 02:08 d
c:program filesTrojan Remover
2009-03-13 22:28 . 2009-03-13 22:28 d
c:documents and settingsAll UsersApplication DataSimply Super Software
2009-03-13 18:05 . 2009-03-13 18:09 d
c:program filestrend micro
2009-03-12 16:06 . 2009-03-12 16:06 d
c:documents and settingsТимурApplication DataSimply Super Software
2009-03-12 16:06 . 2006-05-25 14:52 162,304 —a
c:windowssystem32ztvunrar36.dll
2009-03-12 16:06 . 2003-02-02 19:06 153,088 —a
c:windowssystem32UNRAR3.dll
2009-03-12 16:06 . 2005-08-26 00:50 77,312 —a
c:windowssystem32ztvunace26.dll
2009-03-12 16:06 . 2002-03-06 00:00 75,264 —a
c:windowssystem32unacev2.dll
2009-03-12 16:06 . 2006-06-19 12:01 69,632 —a
c:windowssystem32ztvcabinet.dll
2009-03-12 15:37 . 2009-03-15 00:12 d-a
c:documents and settingsAll UsersApplication DataTEMP
2009-03-11 23:57 . 2009-03-11 23:56 512,096 —a
c:windowssystem32driversamon.sys
2009-03-11 23:57 . 2009-03-11 23:56 298,104 —a
c:windowssystem32imon.dll
2009-03-11 23:57 . 2009-03-11 23:56 15,424 —a
c:windowssystem32driversnod32drv.sys
2009-03-11 23:48 . 2009-03-15 19:31 d
c:program filesEset
2009-03-11 22:31 . 2006-01-25 16:40 815,104 —a
c:windowssystem32rmvtrjan.trb
2009-03-06 23:40 . 2009-03-15 17:57 d
c:documents and settingsТимурApplication DataThe Creative Assembly
2009-03-06 16:10 . 2009-03-06 16:19 d
c:documents and settingsТимурApplication DataQIP.Online
2009-03-04 19:30 . 2009-03-04 19:30 32 —a
c:windows0
2009-03-04 19:30 . 2009-03-04 19:30 0 —a
c:windowssystem320
2009-02-20 23:16 . 2009-02-20 23:16 d
c:program filesMSXML 6.0
2009-02-20 23:14 . 2009-02-20 23:14 d
c:program filesMSXML 4.0
2009-02-20 14:54 . 2009-02-22 15:11 d
c:windowssystem32CatRoot_bak
2009-02-20 14:53 . 2008-06-14 20:59 272,512
c:windowssystem32driversbthport.sys
2009-02-20 14:53 . 2008-06-14 20:59 272,512
c— c:windowssystem32dllcachebthport.sys
2009-02-20 14:49 . 2008-08-14 16:40 2,187,776
c— c:windowssystem32dllcachentoskrnl.exe
2009-02-20 14:49 . 2008-08-14 16:40 2,144,768
c— c:windowssystem32dllcachentkrnlmp.exe
2009-02-20 14:49 . 2008-08-14 16:40 2,064,768
c— c:windowssystem32dllcachentkrnlpa.exe
2009-02-20 14:49 . 2008-08-14 16:40 2,022,912
c— c:windowssystem32dllcachentkrpamp.exe
2009-02-20 14:45 . 2008-10-24 14:25 455,936
c— c:windowssystem32dllcachemrxsmb.sys
2009-02-20 14:42 . 2009-03-12 14:31 d—h
c:windows$hf_mig$
2009-02-20 14:39 . 2008-10-16 14:08 31,768 —a
c:windowssystem32wucltui.dll.mui
2009-02-20 14:39 . 2008-10-16 14:08 27,672 —a
c:windowssystem32wuapi.dll.mui
2009-02-20 14:39 . 2008-10-16 14:07 23,576 —a
c:windowssystem32wuaucpl.cpl.mui
2009-02-20 14:39 . 2008-10-16 14:07 18,968 —a
c:windowssystem32wuaueng.dll.mui
2009-02-15 16:08 . 2009-02-15 16:09 d
c:program filesK-Lite Codec Pack
2009-02-15 16:08 . 2009-02-15 16:08 d
c:documents and settingsТимурApplication DataReal.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-15 15:08
d
w c:documents and settingsТимурApplication DataICQ
2009-03-14 21:11
d
w c:program filessXe Injected
2009-02-15 13:09
d
w c:program filesDivX
2009-02-12 19:23
d
w c:documents and settingsТимурApplication DataDivX
2009-02-11 15:59
d—h—w c:program filesInstallShield Installation Information
2009-02-11 15:59
d
w c:program filesLogitech
2009-02-11 15:59
d
w c:program filesCommon FilesLogitech
2009-02-10 18:56 107,888 —-a-w c:windowssystem32CmdLineExt.dll
2009-02-10 18:54
d
w c:documents and settingsAll UsersApplication DataKONAMI
2009-02-09 18:56 67,584 —-a-w c:windowssystem32ff_vfw.dll
2009-02-09 13:55 1,847,552 —-a-w c:windowssystem32win32k.sys
2009-02-08 17:15
d
w c:program filesA4Tech
2009-02-08 11:59
d
w c:documents and settingsAll UsersApplication DataElectronic Arts
2009-02-08 11:40
d
w c:program filesCommon FilesWise Installation Wizard
2009-02-08 11:40
d
w c:program filesAGEIA Technologies
2009-02-02 18:17
d
w c:program filesMicrosoft ActiveSync
2009-02-02 18:15
d
w c:program filesMicrosoft.NET
2009-02-01 11:46
d
w c:program filesCommon FilesNero
2009-02-01 11:46
d
w c:documents and settingsТимурApplication DataNero
2009-02-01 11:45
d
w c:program filesNero
2009-02-01 11:45
d
w c:documents and settingsAll UsersApplication DataNero
2009-01-31 17:11
d
w c:program filesmp3DirectCut
2009-01-30 20:10
d
w c:program filesAVIConverter
2009-01-30 18:48
d
w c:program filesNO1 Video Converter
2009-01-28 09:49
d
w c:documents and settingsТимурApplication DataWinamp
2009-01-27 19:28
d
w c:documents and settingsТимурApplication DataU3
2009-01-27 14:02
d
w c:program filesOpera
2009-01-27 13:03
d
w c:program filesVKLife
2009-01-27 12:49
d
w c:documents and settingsТимурApplication DataVKLife
2009-01-25 16:43
d
w c:program filesICQ6.5
2009-01-25 16:43
d
w c:program filesCommon FilesICQ
2009-01-20 15:56
d
w c:documents and settingsТимурApplication Datateamspeak2
2009-01-20 15:38
d
w c:documents and settingsТимурApplication DataMedia Player Classic
2009-01-20 14:18
d
w c:program filesAlcohol Soft
2009-01-20 14:17 716,272 —-a-w c:windowssystem32driverssptd.sys
2009-01-20 14:11
d
w c:documents and settingsТимурApplication DataMra
2009-01-20 13:58
d
w c:documents and settingsТимурApplication DataMail.Ru
2009-01-20 13:57
d
w c:program filesMail.Ru
2009-01-20 13:48
d
w c:documents and settingsAll UsersApplication DataESET
2009-01-20 13:45
d
w c:program filesWinamp
2009-01-20 13:43
d
w c:program filesCommon FilesAdobe
2009-01-20 13:38
d
w c:program filesCCleaner
2009-01-20 13:34
d
w c:program filesRealtek
2009-01-20 13:34
d
w c:program filesCommon FilesInstallShield
2009-01-20 13:23
d
w c:program filesmicrosoft frontpage
2009-01-20 13:23
d
w c:program filesJava
2009-01-20 13:23
d
w c:program filesCommon FilesJava
2009-01-20 13:19
d
w c:program filesWindows Media Connect 2
2009-01-20 13:19
d
w c:program filesWindows Media Components
2009-01-20 13:19
d
w c:program filesMSN Messenger
2009-01-20 13:19
d
w c:program filesMicrosoft
.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2004-08-17 15360]
«AlcoholAutomount»=»c:program filesAlcohol SoftAlcohol 120axcmd.exe» [2009-01-20 4608]
«H/PC Connection Agent»=»c:program filesMicrosoft ActiveSyncwcescomm.exe» [2006-06-26 1207080]
«BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=»c:program filesCommon FilesNeroLibNMBgMonitor.exe» [2007-10-23 202024]
«Steam»=»d:gamessteamsteam.exe» [2009-01-20 1410296][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«CoolSwitch»=»c:windowssystem32TaskSwitch.exe» [2005-12-22 45632]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2008-10-07 13574144]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2008-10-07 86016]
«Adobe Reader Speed Launcher»=»c:program filesAdobeReader 9.0ReaderReader_sl.exe» [2008-06-12 34672]
«WinampAgent»=»c:program filesWinampwinampa.exe» [2008-08-04 36352]
«MAgent»=»c:program filesMail.RuAgentmagent.exe» [2009-01-22 5603000]
«NeroFilterCheck»=»c:program filesCommon FilesNeroLibNeroCheck.exe» [2007-03-01 153136]
«NBKeyScan»=»c:program filesNeroNero8Nero BackItUpNBKeyScan.exe» [2007-09-20 1836328]
«WheelMouse»=»c:program filesA4TechMouseAmoumain.exe» [2006-12-26 196608]
«nod32kui»=»c:program filesEsetnod32kui.exe» [2009-03-11 949376]
«TrojanScanner»=»c:program filesTrojan RemoverTrjscan.exe» [2009-02-15 1214856]
«nwiz»=»nwiz.exe» [2008-10-07 c:windowssystem32nwiz.exe]
«RTHDCPL»=»RTHDCPL.EXE» [2008-11-07 c:windowsRTHDCPL.EXE][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2004-08-17 15360][HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«d:\Games\Counter-strike\hl.exe»=
«d:\Games\Steam\SteamApps\gfd1zel\counter-strike\hl.exe»=
«c:\Program Files\ICQ6.5\ICQLite\ICQ.exe»=
«d:\Games\Episode 2 + Portal + TF\Team Fortress 2\hl2.exe»=
«d:\Games\Steam\SteamApps\gfd1zel\team fortress 2\hl2.exe»=
«d:\Games\Steam\SteamApps\gfd1zel\counter-strike source\hl2.exe»=
«d:\Games\Steam\steam.exe»=
«c:\Program Files\Mail.Ru\Agent\magent.exe»=
«c:program filesMicrosoft ActiveSyncrapimgr.exe»= c:program filesMicrosoft ActiveSyncrapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
«c:program filesMicrosoft ActiveSyncwcescomm.exe»= c:program filesMicrosoft ActiveSyncwcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
«c:program filesMicrosoft ActiveSyncWCESMgr.exe»= c:program filesMicrosoft ActiveSyncWCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
«d:\Games\Counter-Strike\hltv.exe»=
«d:\Games\Mirror’s Edge\Binaries\MirrorsEdge.exe»=
«d:\Games\PES 2009\pes2009.exe»=
«c:\Documents and Settings\Тимур\Рабочий стол\pes2009.exe»=
«d:\Games\Burnout Paradise\BurnoutLauncher.exe»=
«d:\Games\Burnout Paradise\BurnoutConfigTool.exe»=
«d:\Games\Burnout Paradise\BurnoutParadise.exe»=
«d:\Games\Steam\SteamApps\common\left 4 dead\left4dead.exe»=
«c:\Program Files\uTorrent\utorrent.exe»=
«c:\Program Files\Opera\opera.exe»=[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«26675:TCP»= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync ServiceR1 nod32drv;nod32drv;c:windowssystem32driversnod32drv.sys [2009-03-11 15424]
R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;c:windowssystem32driversAmps2prt.sys [2006-05-09 13824]
R3 MouseCap;MouseCapture Driver;c:windowssystem32driversMouseCap.sys [2005-08-08 6640]
S2 K4hostEL;K4hostEL;c:windowssystem32K4hostElSvc.exe —> c:windowssystem32K4hostElSvc.exe [?][HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{52fcdf1a-ec84-11dd-a33a-008048483d4f}]
ShellAutoRuncommand — G:LaunchU3.exe -a
.
— — — — ORPHANS REMOVED — — — —HKCU-Run-Start WingMan Profiler — (no file)
HKLM-Run-AT-Watch — (no file).
Supplementary Scan
.
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~4OFFICE11EXCEL.EXE/3000
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:program filesMail.RuAgentmagent.exe
LSP: c:windowssystem32imon.dll
.**************************************************************************
catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-15 19:31:59
Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘lsass.exe'(652)
c:windowssystem32imon.dll
c:program filesEsetpr_imon.dll
.
Completion time: 2009-03-15 19:32:28
ComboFix-quarantined-files.txt 2009-03-15 16:32:27Pre-Run: 34 529 607 680 байт свободно
Post-Run: 34,527,215,616 байт свободно196 — E O F — 2009-03-12 13:02:19
