Созданные ответы форума
-
Сообщения
-
Все получилось. Огромное спасибо!Теперь нет этой назойливой рекламы. Еще раз прошелся Combofix-ом на всякий случай. Вот мой Log файл.[*]
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.3070.2500 [GMT 4:00]
Running from: c:documents and settingsАдминистраторРабочий столComboFix.exe
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ActiveArmor Firewall *disabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}
.((((((((((((((((((((((((( Files Created from 2009-08-10 to 2009-09-10 )))))))))))))))))))))))))))))))
.2009-09-03 16:15 . 2009-09-03 16:15 0 —-a-w- c:windowsnsreg.dat
2009-09-03 16:15 . 2009-09-03 16:15
d
w- c:documents and settingsАдминистраторLocal SettingsApplication DataMozilla
2009-08-28 16:19 . 2009-08-28 16:19
d
w- c:documents and settingsАдминистраторLocal SettingsApplication DataWinamp Toolbar
2009-08-28 10:55 . 2009-08-28 10:55
d
w- c:documents and settingsАдминистраторLocal SettingsApplication Data7Wonders2
2009-08-22 14:12 . 2009-08-22 14:12
d
w- c:program filesQIP
2009-08-21 14:52 . 2009-08-21 14:52
dc-h—w- c:documents and settingsAll UsersApplication Data{84EF169C-95EA-44DC-9474-A07F9112D205}
2009-08-21 14:52 . 2009-08-21 14:52
dc-h—w- c:documents and settingsAll UsersApplication Data{A397AF63-B3A1-40DF-AA85-5C5368304B60}.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-03 15:42 . 2008-04-15 12:00 74670 —-a-w- c:windowssystem32perfc019.dat
2009-09-03 15:42 . 2008-04-15 12:00 442332 —-a-w- c:windowssystem32perfh019.dat
2009-08-26 10:43 . 2009-08-26 10:37 13824 —-a-w- c:documents and settingsАдминистраторApplication Datamsmedia.dll
2009-08-21 14:52 . 2009-06-03 10:23
d
w- c:program filesCommon FilesNative Instruments
2009-08-21 14:52 . 2009-01-19 15:50
d
w- c:program filesNative Instruments
2009-08-14 16:58 . 2009-06-03 09:51 4 —-a-w- C:miracle.sys
2009-08-14 12:16 . 2009-06-03 08:34
d
w- c:documents and settingsАдминистраторApplication DataWinamp
2009-07-30 09:50 . 2009-06-03 08:41
d
w- c:program filesAIMP2
2009-06-14 13:37 . 2009-05-22 18:56 32 —-a-w- c:windowsmsocreg32.dat
.
Sigcheck
[-] 2008-04-25 . E506465BFB0821DC33077E29FD184E31 . 691200 . . [5.82] . . c:windowssystem32comctl32.dll
[7] 2008-04-15 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:windowsWinSxSx86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70acomctl32.dll
[7] 2008-04-15 . FF63BB56C05EA817124D4E18162FCE46 . 1054208 . . [6.0] . . c:windowsWinSxSx86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83comctl32.dll[-] 2008-04-23 . EAEC6EA32BDABD7622371C10B8D68A17 . 361344 . . [5.1.2600.5512] . . c:windowssystem32driverstcpip.sys
[-] 2008-04-25 . 11E710C0612A63C6CE5B3D6534030285 . 3242496 . . [6.00.2900.5512] . . c:windowsie7mshtml.dll
[-] 2008-01-16 . B33628B9937221045A78230130A685C5 . 3593728 . . [7.00.6000.20753] . . c:windowssystem32mshtml.dll[-] 2008-04-23 . 7668E176F08B158D7EF2A17D8EB2B8D3 . 2286592 . . [5.1.2600.5512] . . c:windowssystem32ntoskrnl.exe
[-] 2008-04-25 . 371C41F777924F3EA3BFAD18C6A04502 . 584192 . . [5.1.2600.5512] . . c:windowssystem32user32.dll
[-] 2008-04-25 . 7477564EC8AA190D95A7F3FBB6471F4F . 123904 . . [5.4.3790.5512] . . c:windowssystem32wuauclt.exe
[-] 2008-04-25 . A0F98BB46BEEAF2A94593FF9AB856A80 . 1597952 . . [6.00.2900.5512] . . c:windowsexplorer.exe
[-] 2008-04-25 . 1C079017E180FB9AB4B56AA8F896F708 . 1571840 . . [5.1.2600.5512] . . c:windowssystem32sfcfiles.dll
[-] 2008-04-25 . 0CE07543B08FD1E209D99D504076102B . 17408 . . [5.1.2600.5512] . . c:windowssystem32ctfmon.exe
[-] 2008-04-25 . 60D59D502589F1C0459FDDB5FC22B161 . 2165248 . . [5.1.2600.5512] . . c:windowssystem32ntkrnlpa.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]
«{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}»= «c:program filesWinamp Toolbarwinamptb.dll» [2009-02-19 1262888][HKEY_CLASSES_ROOTclsid{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOTWINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOTTypeLib{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOTWINAMPTB.AOLTBSearch][HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-03-23 132096]
«IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=»c:program filesCommon FilesNeroLibNMIndexStoreSvr.exe» [2008-02-28 1828136]
«E-MU USB Audio Control Panel»=»c:program filesCreative ProfessionalE-MU USB AudioE-MU USB AudioEmuUsbAudioCP.exe» [2006-11-17 274432][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2007-12-05 8523776]
«WinampAgent»=»c:program filesWinampwinampa.exe» [2009-04-10 37888]
«UpdReg»=»c:windowsUpdReg.EXE» [2000-05-10 90112]
«SoundMAXPnP»=»c:program filesAnalog DevicesCoresmax4pnp.exe» [2005-05-20 925696]
«QuickTime Task»=»c:program filesQuickTimeqttask.exe» [2009-01-05 413696]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2007-12-05 81920]
«nTrayFw»=»c:program filesNVIDIA CorporationNetworkAccessManagerbinnTrayFw.exe» [2006-02-17 270336]
«NeroFilterCheck»=»c:program filesCommon FilesNeroLibNeroCheck.exe» [2008-02-28 570664]
«iTunesHelper»=»d:program filesiTunesiTunesHelper.exe» [2009-01-06 290088]
«GrooveMonitor»=»d:program filesMicrosoft OfficeOffice12GrooveMonitor.exe» [2007-08-24 33648]
«egui»=»c:program filesESETESET NOD32 Antivirusegui.exe» [2008-03-13 1443072]
«nwiz»=»nwiz.exe» — c:windowssystem32nwiz.exe [2006-02-13 1519616][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-25 17408]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-03-23 132096]c:documents and settingsAll Usersѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
Adobe Reader Speed Launch.lnk — c:program filesAdobeAcrobat 7.0Readerreader_sl.exe [2005-9-23 29696][HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]
«SynchronousMachineGroupPolicy»= 0 (0x0)
«SynchronousUserGroupPolicy»= 0 (0x0)[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoThumbnailCache»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)
«NoSMHelp»= 1 (0x1)[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoThumbnailCache»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)
«NoSMHelp»= 1 (0x1)[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesDisableNotify»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusOverride»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)
«DisableNotifications»= 1 (0x1)[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\Bonjour\mDNSResponder.exe»=R1 epfwtdir;epfwtdir;c:windowssystem32driversepfwtdir.sys [13.03.2008 17:52 33800]
R2 ekrn;Eset Service;c:program filesESETESET NOD32 Antivirusekrn.exe [13.03.2008 17:49 472320]
R2 emaudsv;E-MU Audio Service;c:windowssystem32emaudsv.exe [20.11.2006 13:29 10240]
R3 SAA713x;Behold TV WDM Capture (SAA713x);c:windowssystem32driverssaa713x.sys [18.01.2009 1:36 127104]
R3 ZY202_XP;ZyXEL 802.11g XG202 1211 Driver;c:windowssystem32driversWlanUZXP.sys [18.01.2009 2:30 437760]
S3 emusba10;E-MU USB-Audio 1.0 Driver;c:windowssystem32driversemusba10.sys [20.11.2006 13:29 142208]
.
Contents of the ‘Scheduled Tasks’ folder2009-08-31 c:windowsTasksAppleSoftwareUpdate.job
— c:program filesApple Software UpdateSoftwareUpdate.exe [2008-07-30 09:34]
.
.
Supplementary Scan
.
uStart Page = hxxp://xtreme.ws/
uDefault_Search_URL = hxxp://search.qip.ru
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = Root: HKCU; Subkey: SoftwareMicrosoftInternet ExplorerSearchUrl; ValueType: string; ValueName: ‘; ValueData: ‘; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
IE: &Winamp Search — c:documents and settingsAll UsersApplication DataWinamp ToolbarieToolbarresourcesen-USlocalsearch.html
IE: &Экспорт в Microsoft Excel — d:progra~1MICROS~1Office12EXCEL.EXE/3000
LSP: %SYSTEMROOT%system32nvappfilter.dll
FF — ProfilePath — c:documents and settingsАдминистраторApplication DataMozillaFirefoxProfiles2qokhfrr.default
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnppl3260.dll
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnprpjplug.dll
FF — plugin: d:program filesiTunesMozilla Pluginsnpitunes.dll
FF — plugin: d:program filesOperaprogrampluginsnpdsplay.dll
FF — plugin: d:program filesOperaprogrampluginsNPOFF12.DLL
FF — plugin: d:program filesOperaprogrampluginsnppl3260.dll
FF — plugin: d:program filesOperaprogrampluginsnpqtplugin.dll
FF — plugin: d:program filesOperaprogrampluginsnpqtplugin2.dll
FF — plugin: d:program filesOperaprogrampluginsnpqtplugin3.dll
FF — plugin: d:program filesOperaprogrampluginsnpqtplugin4.dll
FF — plugin: d:program filesOperaprogrampluginsnpqtplugin5.dll
FF — plugin: d:program filesOperaprogrampluginsnpqtplugin6.dll
FF — plugin: d:program filesOperaprogrampluginsnpqtplugin7.dll
FF — plugin: d:program filesOperaprogrampluginsnprpjplug.dll
FF — plugin: d:program filesOperaprogrampluginsNPSWF32.dll
FF — plugin: d:program filesOperaprogrampluginsnpwmsdrm.dll
.**************************************************************************
catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-10 14:13
Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(820)
c:windowssystem32cscui.dll— — — — — — — > ‘lsass.exe'(892)
c:windowssystem32nvappfilter.dll— — — — — — — > ‘explorer.exe'(4008)
c:windowssystem32SHDOCVW.dll
c:windowssystem32COMRes.dll
c:windowsSystem32cscui.dll
c:program filesWindows Media Playerwmpband.dll
c:windowssystem32msi.dll
c:windowssystem32NETSHELL.dll
c:windowssystem32credui.dll
c:windowssystem32MSVCP60.dll
c:windowssystem32WPDShServiceObj.dll
c:windowssystem32PortableDeviceTypes.dll
c:windowssystem32PortableDeviceApi.dll
.
Completion time: 2009-09-10 14:14
ComboFix-quarantined-files.txt 2009-09-10 10:14
ComboFix2.txt 2009-09-03 15:47Pre-Run: 60 737 785 856 байт свободно
Post-Run: 60 726 112 256 байт свободно172
[*]
