Созданные ответы форума
-
Сообщения
-
Благодарю вас от всей души 🙂 новостная лента изчезла!!!!!! вот лог который получился :
ComboFix 09-02-08.02 — Admin 2009-02-10 20:57:50.1 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1251.1.1049.18.2047.1643 [GMT 5:00]
Running from: c:documents and settingsAdminРабочий столComboFix.exe
Command switches used :: c:documents and settingsAdminРабочий столCFScript.txt
FW: NVIDIA Firewall *disabled*
* Created a new restore pointWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
c:documents and settingsAll UsersApplication Dataaqplib.dll
c:documents and settingsAll UsersApplication Datamlqlib.dll
c:documents and settingsAll UsersApplication Datayvulib.dll
c:windowssystem32driversaexrbobf.sys
.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.c:documents and settingsAdminLocal SettingsTemporary Internet Files0EB9F12C_6E6B_4c03_AEBA_8C04CFA98AA4.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files0EB9F12C_6E6B_4c03_AEBA_8C04CFA98AA4.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet Files15913497_F86C_4218_8817_F50940D1E1B2.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files15913497_F86C_4218_8817_F50940D1E1B2.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet Files29887DDE_00B9_4011_9CF7_59511F1ECC1B.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files29887DDE_00B9_4011_9CF7_59511F1ECC1B.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet Files2A665EDD_5758_480c_8366_66DFC5F23877.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files35B7DFFA_884F_4fbc_8E60_DA601BDC7BF7.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files362FD6E8_8CDA_4c2a_A8AA-BDA22B321711.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files362FD6E8_8CDA_4c2a_A8AA-BDA22B321711.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet Files3DF04940_9866_4241_A998_0CDDFAFD147A.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files3DF04940_9866_4241_A998_0CDDFAFD147A.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet Files426500D7_0FF3_426c_828D_065DBAEA0581.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files478BD4AE_2691_438d_BDCA_3485DC022700.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files5C6C645F_BAA8_4149_BFEB_2031230FF0FD.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files5C6C645F_BAA8_4149_BFEB_2031230FF0FD.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet Files61EA7D69_19D4_421a_A899_0DF4D58CD119.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files61EA7D69_19D4_421a_A899_0DF4D58CD119.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet Files777FDAFB_83CF_4960_AA71_4E5D7BCD8E57.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files8DA878D5_E80B_4721_B75A_17EFFAF1A700.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files98F6DF79_7171_452d_9C26_C0193E12DBDF.gif
c:documents and settingsAdminLocal SettingsTemporary Internet FilesA2B240D6_0386_419e_91C5_3F7D90437CD0.gif
c:documents and settingsAdminLocal SettingsTemporary Internet FilesA2B240D6_0386_419e_91C5_3F7D90437CD0.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet FilesC75CEF8D_5AF4_4563_8594_C45A45E14E63.gif
c:documents and settingsAdminLocal SettingsTemporary Internet FilesE21285C1_40E6_435c_A69F_3387E7BD89CB.gif
c:documents and settingsAdminLocal SettingsTemporary Internet FilesE21285C1_40E6_435c_A69F_3387E7BD89CB.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet FilesE9A4D648_ED73_4ea7_88B2_18332DBA4F3E.gif
c:documents and settingsAdminLocal SettingsTemporary Internet FilesE9A4D648_ED73_4ea7_88B2_18332DBA4F3E.jpg
c:documents and settingsAll UsersApplication Dataaqplib.dll
c:documents and settingsAll UsersApplication Datamlqlib.dll
c:documents and settingsAll UsersApplication Datayvulib.dll.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
Legacy_OREANS32
Service_oreans32((((((((((((((((((((((((( Files Created from 2009-01-10 to 2009-02-10 )))))))))))))))))))))))))))))))
.2009-02-09 15:45 . 2009-02-09 15:45
d
c:documents and settingsAdminApplication DataDivX
2009-02-09 09:44 . 2009-02-09 09:44d
C:rsit
2009-02-09 09:44 . 2009-02-09 15:02d
c:program filestrend micro
2009-02-08 22:09 . 2009-02-09 15:02d
C:SDFix
2009-02-08 21:54 . 2009-02-08 21:54d
C:_OTMoveIt
2009-02-08 20:44 . 2009-02-08 20:44d
c:windowsERUNT
2009-02-08 20:44 . 2009-02-08 20:44d
C:ERDNT
2009-02-08 20:44 . 2009-02-08 21:36d
C:!FixIEDef
2009-02-08 20:34 . 2009-02-08 20:34d
c:program filesMalwarebytes’ Anti-Malware
2009-02-08 20:34 . 2009-02-08 20:34d
c:documents and settingsAll UsersApplication DataMalwarebytes
2009-02-08 20:34 . 2009-02-08 20:34d
c:documents and settingsAdminApplication DataMalwarebytes
2009-02-08 20:34 . 2009-01-14 16:11 38,496 —a
c:windowssystem32driversmbamswissarmy.sys
2009-02-08 20:34 . 2009-01-14 16:11 15,504 —a
c:windowssystem32driversmbam.sys
2009-02-08 18:55 . 2009-02-08 18:55d—h
c:windows$hf_mig$
2009-02-08 15:56 . 2006-01-22 00:08d
c:tempIE7-WindowsXP-x86-enu-RUS
2009-02-08 15:56 . 2009-02-08 15:56d
C:TEMP
2009-02-08 09:42 . 2009-02-08 09:42d
c:program filesCommon FilesAdobe AIR
2009-02-08 09:42 . 2009-02-08 09:42d
c:program filesAdobe Media Player
2009-02-08 09:41 . 2009-02-08 09:41 0 —a
c:windowsnsreg.dat
2009-02-08 08:36 . 2009-02-08 08:36d
c:program filesDivX
2009-02-08 08:29 . 2009-02-08 22:19d
c:program filesGoogle
2009-01-25 01:49 . 2009-01-25 01:49d
c:documents and settingsAdminApplication DataImperium Romanum
2009-01-23 02:34 . 2009-01-23 02:34d
c:program filesBeholdTV
2009-01-23 02:33 . 2009-01-23 02:33d
c:documents and settingsAdminApplication DataBeholdTV
2009-01-15 22:48 . 2009-01-15 22:48d
c:program filesWMV9_VCM
2009-01-15 22:48 . 2009-01-15 22:48d
c:program filesMSXML 4.0
2009-01-15 22:48 . 2008-07-12 10:18 3,851,784 —a
c:windowssystem32D3DX9_39.dll
2009-01-15 22:48 . 2008-07-12 10:18 1,493,528 —a
c:windowssystem32D3DCompiler_39.dll
2009-01-15 22:48 . 2008-07-31 12:40 509,448 —a
c:windowssystem32XAudio2_2.dll
2009-01-15 22:48 . 2008-07-12 10:18 467,984 —a
c:windowssystem32d3dx10_39.dll
2009-01-15 22:48 . 2008-07-31 12:41 238,088 —a
c:windowssystem32xactengine3_2.dll
2009-01-15 22:48 . 2008-07-31 12:41 68,616 —a
c:windowssystem32XAPOFX1_1.dll
2009-01-14 13:09 . 2009-01-14 13:09d
c:program filesCommon FilesDirectX
2009-01-13 20:05 . 2009-01-13 20:05d
c:documents and settingsAdminApplication DataSierra Entertainment
2009-01-13 20:02 . 2009-01-13 20:02d—-c— c:windowssystem32DRVSTORE
2009-01-13 20:02 . 2009-01-13 20:02d
c:windowssystem32AGEIA
2009-01-13 20:02 . 2009-01-13 20:02d
c:program filesCommon FilesWise Installation Wizard
2009-01-13 20:02 . 2009-01-13 20:02d
c:program filesAGEIA Technologies.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-10 15:58
d
w c:documents and settingsAdminApplication DatauTorrent
2009-02-09 11:38 22,328 —-a-w c:windowssystem32driversPnkBstrK.sys
2009-02-08 14:40
d—h—w c:program filesInstallShield Installation Information
2009-01-05 20:58
d
w c:program filesFargus
2009-01-05 16:07
d
w c:documents and settingsAdminApplication DataInstallShield
2008-12-28 10:45 33,824 —-a-w c:windowssystem32driversoreans32.sys
2008-12-18 10:43
d
w c:program filesEverest
2008-12-12 14:40
d
w c:program filesAMD
2008-12-12 14:38
d
w c:program filesRealtek AC97
2008-12-12 14:38
d
w c:program filesAvRack
2008-12-12 14:37
d
w c:program filesNVIDIA Corporation
2008-12-12 12:50
d
w c:program filesATI Technologies
2008-12-12 12:48
d
w c:program filesCommon FilesInstallShield
2008-12-09 08:45 331,264 —-a-w c:documents and settingsAll UsersApplication Dataspvlib.dll
2008-11-22 13:49 72,748 —-a-w c:windowsunins000.exe
.
Sigcheck
2008-03-15 13:55 578560 196b409a7c1c39a5a0f7566c2741fad1 c:windowssystem32user32.dll2008-03-15 14:00 360832 edf9cac3e377b61b2581e28ce810a7e0 c:windowssystem32driverstcpip.sys
2008-03-15 13:53 1720832 c79d071054766fcc78077abd022b287f c:windowsexplorer.exe
2008-03-15 13:53 30208 2a48af162b14e978da2373a2f693f4fd c:windowssystem32ctfmon.exe
2008-03-15 13:55 80216 84c7654e3de78f92a82bf7ba932752aa c:windowssystem32wuauclt.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2008-03-15 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
«DAEMON Tools Lite»=»c:program filesDAEMON Tools Litedaemon.exe» [2008-02-14 486856]
«swg»=»c:program filesGoogleGoogleToolbarNotifier1.2.1128.5462GoogleToolbarNotifier.exe» [2009-02-08 171448][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2006-01-12 155648]
«GrooveMonitor»=»c:program filesMicrosoft OfficeOffice12GrooveMonitor.exe» [2006-10-27 31016]
«ATIPTA»=»c:program filesATI TechnologiesATI Control Panelatiptaxx.exe» [2004-08-25 339968]
«nTrayFw»=»c:program filesNVIDIA CorporationNetworkAccessManagerbinnTrayFw.exe» [2005-02-24 266240]
«MagicRotation»=»c:program filesMagicRotationMagicPvt.exe» [BU]
«SoundMan»=»SOUNDMAN.EXE» [2005-06-20 c:windowssoundman.exe][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-03-15 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» [2008-03-15 c:windowssystem32advpack.dll]
«IE7_012″=»advpack.dll» [2008-03-15 c:windowssystem32advpack.dll]c:documents and settingsAdminѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
authcliw.exe (3).lnk — d:їа®јёЇа®ЈЁauthcliw.exe [2008-11-19 577024]
utorrent.exe.lnk — c:program filesuTorrentutorrent.exe [2008-01-27 270128][HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesDisableNotify»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusDisableNotify»=dword:00000001
«AntiVirusOverride»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«c:\Program Files\uTorrent\utorrent.exe»=
«d:\проги\проги\authcliw.exe»=
«d:\проги\GreyLink4.84_igro.ed\greylink.exe»=
«d:\games\Age of Chivalry\hl2.exe»=R0 nvcchflt;NVIDIA Disk Cache Filter Driver;c:windowssystem32driversnvcchflt.sys [2008-11-22 16640]
R1 magicpvt;magicpvt;c:windowssystem32driversmagicpvt.sys [2008-12-24 9728]
R2 ICQ Service;ICQ Service;c:program filesICQ6ToolbarICQ Service.exe [2008-12-09 222456]
R2 TTFixerService;NST ToolTipFixer;c:program filesNeoSmart TechnologiesToolTipFixerToolTipFixer.exe [2007-06-27 10240]— Other Services/Drivers In Memory —
*NewlyCreated* — WUAUSERV
[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{e2e30cd2-bbad-11dd-9084-000461a02382}]
ShellAutoRuncommand — WD_Windows_ToolsSetup.exe
.
.
Supplementary Scan
.
uStart Page = hxxp://igronet.ru/
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
LSP: %SYSTEMROOT%system32nvappfilter.dll
Trusted Zone: drochinehochu.ru
Trusted Zone: vesti.ruwww
TCP: {A4811310-E4F0-4144-83A7-0DF416049921} = 195.64.220.2,195.64.192.35
FF — ProfilePath — c:documents and settingsAdminApplication DataMozillaFirefoxProfilescu6l3s6c.default
FF — prefs.js: browser.startup.homepage — about:blank
.**************************************************************************
catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-10 21:00:46
Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(712)
c:windowssystem32SETUPAPI.dll
c:windowssystem32Ati2evxx.dll
c:windowssystem32cscui.dll— — — — — — — > ‘lsass.exe'(776)
c:windowssystem32SETUPAPI.dll
c:windowssystem32nvappfilter.dll
.
Other Running Processes
.
c:windowssystem32ati2evxx.exe
c:windowssystem32ati2evxx.exe
c:program filesNVIDIA CorporationNetworkAccessManagerApache GroupApache2binApache.exe
c:program filesNVIDIA CorporationNetworkAccessManagerbinnSvcIp.exe
c:program filesNVIDIA CorporationNetworkAccessManagerbinnSvcLog.exe
c:windowssystem32PnkBstrA.exe
c:program filesNVIDIA CorporationNetworkAccessManagerApache GroupApache2binApache.exe
d:c:Program FilesuTorrentutorrent.exe
c:program filesNVIDIA CorporationNetworkAccessManagerbinnSvcAppFlt.exe
.
**************************************************************************
.
Completion time: 2009-02-10 21:03:13 — machine was rebooted
ComboFix-quarantined-files.txt 2009-02-10 16:03:07
ComboFix2.txt 2009-02-08 17:54:08
ComboFix3.txt 2009-02-08 17:47:45
ComboFix4.txt 2009-02-08 17:36:26Pre-Run: 53 019 594 752 байт свободно
Post-Run: 53,028,556,800 байт свободно225
