[Grey13]

Долго мучился, и вот что вышло.. 🙂

ComboFix 10-08-30.02 — Серёжа 31.08.2010 20:08:27.1.2 — x86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.1023.547 [GMT 4:00]
Running from: c:documents and settingsСерёжаРабочий столComboFix.exe
Command switches used :: c:documents and settingsСерёжаРабочий столWindowsXP-KB310994-SP2-Pro-BootDisk-RUS.exe
AV: avast! antivirus 4.8.1368 [VPS 100831-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:documents and settingsAll UsersГлавное менюПрограммыPC Defender
c:documents and settingsAll UsersГлавное менюПрограммыPC DefenderPC Defender.lnk
c:documents and settingsAll UsersГлавное менюПрограммыPC DefenderUninstall.lnk
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr0.dat
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr1.dat
c:program filesCommon Fileskeylog.txt
c:program filesCommon FilesWM
c:program filesDef Group
c:program filesDef GroupPC Defenderpcdef.exe
c:program filesDef GroupPC Defenderproccheck.exe
c:program filesDef GroupPC Defenderprockill32.exe
c:program filesMail.RuAgentMradllnewmrasearch.dll
c:windowsAppPatchCustom{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb
c:windowssystem32Config.cfg

---

BITS: Possible infected sites

---

hxxp://soft.export.yandex.ru
.
((((((((((((((((((((((((( Files Created from 2010-07-28 to 2010-08-31 )))))))))))))))))))))))))))))))
.

2010-08-31 15:15 . 2008-11-05 22:03

---

d

---

w- C:SDFix
2010-08-31 14:28 . 2010-04-29 11:39 38224 —-a-w- c:windowssystem32driversmbamswissarmy.sys
2010-08-31 14:28 . 2010-08-31 14:29

---

d

---

w- c:program filesMalwarebytes’ Anti-Malware
2010-08-31 14:28 . 2010-04-29 11:39 20952 —-a-w- c:windowssystem32driversmbam.sys
2010-08-31 14:05 . 2010-08-31 14:05

---

d

---

w- c:documents and settingsAll UsersApplication DataMalwarebytes
2010-08-30 19:01 . 2010-08-30 19:01 133120 —-a-w- c:windowssystem32zoiuel.exe
2010-08-24 09:18 . 2010-08-24 09:18 135168 —-a-w- c:windowssystem32lfeuwn.exe
2010-08-23 03:51 . 2010-08-23 03:51 125952 —-a-w- c:windowssystem32zlwiiu.exe
2010-08-20 18:29 . 2010-08-20 18:29

---

d

---

w- c:documents and settingsСемьяLocal SettingsApplication DataAdobe
2010-08-20 18:29 . 2010-08-20 18:29

---

d

---

w- c:documents and settingsСемьяApplication DataAdobeUM
2010-08-18 20:08 . 2010-08-18 20:09

---

d

---

w- c:program filesQuickTime
2010-08-18 20:00 . 2010-08-18 20:00 72488 —-a-w- c:documents and settingsAll UsersApplication DataApple ComputerInstaller CacheSafari 5.33.17.8SetupAdmin.exe
2010-08-18 19:56 . 2010-08-18 19:56

---

d

---

w- c:program filesiPod
2010-08-18 19:45 . 2010-08-18 19:45 73000 —-a-w- c:documents and settingsAll UsersApplication DataApple ComputerInstaller CacheiTunes 9.2.1.5SetupAdmin.exe
2010-08-18 19:12 . 2010-08-31 15:51

---

d

---

w- c:program filesWallTriX

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-30 17:33 . 2009-11-28 10:47

---

d

---

w- c:program filesTolkovo
2010-08-30 17:29 . 2009-11-20 11:58 77840 —-a-w- c:documents and settingsСемьяLocal SettingsApplication DataGDIPFONTCACHEV1.DAT
2010-08-29 17:29 . 2009-11-29 19:57

---

d

---

w- c:documents and settingsAll UsersApplication DataMicrosoft Help
2010-08-29 17:20 . 2009-12-03 19:48

---

d

---

w- c:program filesDownload Master
2010-08-27 17:49 . 2009-11-20 04:54

---

d

---

w- c:program filesShareman
2010-08-18 20:03 . 2009-11-19 20:18

---

d

---

w- c:program filesSafari
2010-08-18 19:58 . 2010-02-20 12:53

---

d

---

w- c:program filesiTunes
2010-08-18 19:56 . 2009-12-16 18:14

---

d

---

w- c:program filesCommon FilesApple
2010-07-28 07:51 . 2009-11-19 20:31 46788 —ha-w- c:windowssystem32mlfcache.dat
2010-07-27 18:55 . 2010-07-27 18:52

---

d

---

w- c:program filesAll-CS 1.6 Final
2010-07-27 07:17 . 2010-07-25 12:54

---

d

---

w- c:program filesCommon FilesBlizzard Entertainment
2010-07-26 09:15 . 2010-07-26 09:15

---

d

---

w- c:documents and settingsAll UsersApplication DataYandex
2010-07-26 09:15 . 2010-07-26 09:15

---

d

---

w- c:program filesYandex
2010-07-26 09:15 . 2010-07-26 09:15

---

d

---

w- c:program filesuTorrent
2010-07-25 20:03 . 2010-07-25 20:03

---

d

---

w- c:documents and settingsAll UsersApplication DataBlizzard
2010-07-25 10:15 . 2010-07-24 08:02

---

d

---

w- c:program filesR.G. Mechanics
2010-07-23 21:56 . 2009-11-19 19:42

---

d

---

w- c:program filesCommon FilesAdobe
2010-07-21 22:59 . 2009-11-19 19:42

---

d

---

w- c:program filesMicrosoft Silverlight
2010-07-21 16:37 . 2010-07-21 16:37

---

d

---

w- c:program filesNobilis
2010-07-21 12:37 . 2010-07-21 12:37

---

d

---

w- c:documents and settingsAll UsersApplication DataEgoset
2010-07-21 11:33 . 2009-11-21 09:47

---

d—h—w- c:program filesInstallShield Installation Information
2010-07-19 09:18 . 2010-07-19 09:18

---

d

---

w- c:program filesCommon FilesSkype
2010-07-11 19:35 . 2010-07-11 19:35

---

d

---

w- c:program filesCommon FilesMacrovision Shared
2010-07-04 16:12 . 2010-07-04 16:12

---

d

---

w- c:program filesBonjour
2010-07-04 15:54 . 2010-07-04 15:54 71992 —-a-w- c:documents and settingsAll UsersApplication DataApple ComputerInstaller CacheSafari 5.33.16.0SetupAdmin.exe
2010-06-25 19:51 . 2010-06-25 19:51 57344 —-a-w- c:documents and settingsAll UsersApplication DataDivXRunAsUserRUNASUSERPROCESS.dll
2010-06-25 19:47 . 2010-06-25 19:47 56765 —-a-w- c:documents and settingsAll UsersApplication DataDivXDivXPlusShortcutsUninstaller.exe
2010-06-25 19:47 . 2010-06-25 19:47 56997 —-a-w- c:documents and settingsAll UsersApplication DataDivXWebPlayerUninstaller.exe
2010-06-25 19:47 . 2010-06-25 19:47 57715 —-a-w- c:documents and settingsAll UsersApplication DataDivXPlayerUninstaller.exe
2010-06-25 19:47 . 2010-06-25 19:47 53600 —-a-w- c:documents and settingsAll UsersApplication DataDivXUpdateUninstaller.exe
2010-06-25 19:47 . 2010-06-25 19:47 84062 —-a-w- c:documents and settingsAll UsersApplication DataDivXTransferWizardUninstaller.exe
2010-06-25 19:43 . 2010-06-25 19:43 144696 —-a-w- c:documents and settingsAll UsersApplication DataDivXRunAsUserRUNASUSERPROCESS.exe
2010-06-25 19:43 . 2010-06-25 19:47 1062184 —-a-w- c:documents and settingsAll UsersApplication DataDivXSetupResource.dll
2010-06-25 19:43 . 2010-06-25 19:47 895256 —-a-w- c:documents and settingsAll UsersApplication DataDivXSetupDivXSetup.exe
.

---

Sigcheck

---

[-] 2009-08-20 . AC23CF5D73E19F836172C490DB87593A . 634368 . . [5.1.2600.5512] . . c:windowssystem32user32.dll
[7] 2008-04-14 . A9CDF92EA1CFFB67448EF26F5DF21A6F . 579072 . . [5.1.2600.5512] . . c:windowsResPatchBackupuser32.dll

[-] 2009-08-20 . 1A68FD712419EB360BD3F15BB1A2BCA6 . 1571840 . . [5.1.2600.5512] . . c:windowssystem32sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{1208AB5D-4748-49fe-A74A-484AE2FA5D34}»= «c:program filesYandexYandexBarIEbarsbarietorrentyndbar.dll» [2010-05-21 8892232]

[HKEY_CLASSES_ROOTclsid{1208ab5d-4748-49fe-a74a-484ae2fa5d34}]
[HKEY_CLASSES_ROOTYandexTorrent.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{50EBFBE3-CEAE-4567-884E-C58C12E91F4C}]
[HKEY_CLASSES_ROOTYandexTorrent.Toolbar]

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{1208AB5D-4748-49fe-A74A-484AE2FA5D34}»= «c:program filesYandexYandexBarIEbarsbarietorrentyndbar.dll» [2010-05-21 8892232]

[HKEY_CLASSES_ROOTclsid{1208ab5d-4748-49fe-a74a-484ae2fa5d34}]
[HKEY_CLASSES_ROOTYandexTorrent.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{50EBFBE3-CEAE-4567-884E-C58C12E91F4C}]
[HKEY_CLASSES_ROOTYandexTorrent.Toolbar]

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«Google Update»=»c:documents and settingsСерёжаLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe» [2009-11-19 135664]
«Download Master»=»c:program filesDownload Masterdmaster.exe» [2010-08-27 3865408]
«Skype»=»c:program filesSkype\PhoneSkype.exe» [2010-05-13 26192168]
«swg»=»c:program filesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe» [2009-12-28 39408]
«DAEMON Tools Lite»=»c:program filesDAEMON Tools LiteDTLite.exe» [2009-10-30 369200]
«PMCRemote»=»c:program filesPinnacleShared FilesProgramsRemoteRemoterm.exe» [2007-04-24 253000]
«uTorrent»=»c:program filesuTorrentuTorrent.exe» [2010-07-26 327984]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«RTHDCPL»=»RTHDCPL.EXE» [2008-04-10 16861184]
«TaskSwitchXP»=»c:program filesTaskSwitchXPTaskSwitchXP.exe» [2007-03-09 62976]
«MAgent»=»c:program filesMail.RuAgentMAgent.exe» [2010-01-06 8746680]
«GrooveMonitor»=»c:program filesMicrosoft OfficeOffice12GrooveMonitor.exe» [2007-08-24 33648]
«WireLessMouse «=»c:program filesMultimedia Combo SetMouseDrv.exe» [2004-06-27 503808]
«WireLessKeyboard «=»c:program filesMultimedia Combo SetPS2USBKbdDrv.exe» [2005-08-02 233472]
«avast!»=»c:program filesAlwil SoftwareAvast4ashDisp.exe» [2009-11-24 81000]
«WallTriX Index Manager»=»c:program filesWallTriXWallTriXPanel.exe» [2010-08-25 306120]
«iTunesHelper»=»c:program filesiTunesiTunesHelper.exe» [2010-07-21 141608]
«QuickTime Task»=»c:program filesQuickTimeQTTask.exe» [2010-08-10 421888]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-15 15360]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_00″=»shell32» [X]
«IE7_01″=»advpack.dll» [2009-08-29 124928]
«IE7_013″=»rebuild.exe» [2007-11-01 114280]

[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«ForceClassicControlPanel»= 1 (0x1)

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogon]
«Userinit»=»c:windowssystem32userinit.exe,c:windowssystem326675036c.exe,c:windowssystem32zlwiiu.exe,»

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«AntiVirusOverride»=dword:00000001
«FirewallOverride»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)
«DisableUnicastResponsesToMulticastBroadcast»= 0 (0x0)

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE»=
«c:\Program Files\Microsoft Office\Office12\GROOVE.EXE»=
«c:\Program Files\Microsoft Office\Office12\ONENOTE.EXE»=
«c:\Program Files\Skype\Plugin Manager\skypePM.exe»=
«c:\Program Files\Shareman\Shareman.old.exe»=
«c:\WINDOWS\system32\PnkBstrA.exe»=
«c:\WINDOWS\system32\PnkBstrB.exe»=
«c:\Program Files\Bonjour\mDNSResponder.exe»=
«c:\Program Files\uTorrent\uTorrent.exe»=
«c:\Program Files\iTunes\iTunes.exe»=
«c:\Program Files\Shareman\Shareman.exe»=
«c:\Program Files\Skype\Phone\Skype.exe»=

R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:windowssystem32driverssfsync03.sys [06.12.2005 19:11 35328]
R1 aswSP;avast! Self Protection;c:windowssystem32driversaswSP.sys [01.02.2010 13:34 114768]
R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [01.02.2010 13:34 20560]
R3 3xHybrid;Pinnacle PCTV 100i-110i-300i-310i-MCE;c:windowssystem32drivers3xHybrid.sys [11.06.2010 22:52 1121536]
S2 gupdate;Служба Google Update (gupdate);c:program filesGoogleUpdateGoogleUpdate.exe [28.12.2009 10:45 135664]
S4 sptd;sptd;c:windowssystem32driverssptd.sys [19.11.2009 23:42 691696]
.
Contents of the ‘Scheduled Tasks’ folder

2010-08-25 c:windowsTasksAppleSoftwareUpdate.job
— c:program filesApple Software UpdateSoftwareUpdate.exe [2008-07-30 09:34]

2010-08-31 c:windowsTasksGoogle Software Updater.job
— c:program filesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe [2009-12-28 11:57]

2010-08-31 c:windowsTasksGoogleUpdateTaskMachineCore.job
— c:program filesGoogleUpdateGoogleUpdate.exe [2009-12-28 06:45]

2010-08-31 c:windowsTasksGoogleUpdateTaskMachineUA.job
— c:program filesGoogleUpdateGoogleUpdate.exe [2009-12-28 06:45]
.
.

---

Supplementary Scan

---

.
uStart Page = mail.ru
mStart Page = hxxp://mail.ru
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
IE: Закачать ВСЕ при помощи Download Master — c:program filesDownload Masterdmieall.htm
IE: Закачать при помощи Download Master — c:program filesDownload Masterdmie.htm
IE: Передать на удаленную закачку DM — c:program filesDownload Masterremdown.htm
IE: Поиск@Mail.Ru — c:program filesmail.rusputnikMailRuSputnik.dll/282
IE: Словари@Mail.Ru — c:program filesmail.rusputnikMailRuSputnik.dll/283
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:program filesMail.RuAgentmagent.exe
.
— — — — ORPHANS REMOVED — — — —

HKCU-Run-VistaIcon — c:program filesVistaDriveIconVistaDrv.exe
HKCU-Run-RGSC — c:program filesRockstar GamesRockstar Games Social ClubRGSCLauncher.exe
HKLM-Run-2gis update client UI — c:program files2gisUpdateClientWin32UpdateClientUI.exe
HKLM-Run-DivXUpdate — c:program filesDivXDivX UpdateDivXUpdate.exe
HKLM-Run-PC Defender — c:program filesDef GroupPC Defenderpcdef.exe
AddRemove-DAEMON Tools Toolbar — c:program filesDAEMON Tools Toolbaruninst.exe
AddRemove-Lula Inside — c:gamesTRIADALula InsideUninst.isu
AddRemove-ZoomPlayerLang — c:program filesZoom PlayerLanguageuninstall.exe
AddRemove-{F38ADCA4-AF7C-4C73-9021-6F1EA15D15EA} — c:program filesInstallShield Installation Information{F38ADCA4-AF7C-4C73-9021-6F1EA15D15EA}Setup.exeUNINSTALL

**************************************************************************
scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files:

**************************************************************************
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘winlogon.exe'(732)
c:windowssystem32Ati2evxx.dll
.
Completion time: 2010-08-31 20:15:40
ComboFix-quarantined-files.txt 2010-08-31 16:15

Pre-Run: 8 679 981 056 байт свободно
Post-Run: 13 648 670 720 байт свободно

WindowsXP-KB310994-SP2-Pro-BootDisk-RUS.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)WINDOWS
[operating systems]
c:cmdconsBOOTSECT.DAT=»Microsoft Windows Recovery Console» /cmdcons
UnsupportedDebug=»do not select this» /debug
multi(0)disk(0)rdisk(0)partition(1)WINDOWS=»Microsoft Windows XP Professional RU» /noexecute=optin /fastdetect

— — End Of File — — 1050FE704BB54316A375B2A32322C879

[Автор]

Сообщения