Созданные ответы форума
-
Сообщения
-
Здравствуйте.
пожалуйста,вот логComboFix 09-05-06.02 — User 08.05.2009 11:18.3 — NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1251.7.1049.18.3070.2123 [GMT 11:00]
Running from: c:usersUserDesktopпроги против всякой хрениComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)
FW: Kaspersky Internet Security *disabled*
.((((((((((((((((((((((((( Files Created from 2009-04-08 to 2009-05-08 )))))))))))))))))))))))))))))))
.2009-05-07 05:44 . 2009-05-07 14:43
d
w c:program filestrend micro
2009-05-07 05:44 . 2009-05-07 06:00
d
w C:rsit
2009-05-07 04:00 . 2009-05-07 04:00
d
w c:usersUserAppDataRoamingMalwarebytes
2009-05-07 04:00 . 2009-04-06 04:32 15504 —-a-w c:windowssystem32driversmbam.sys
2009-05-07 04:00 . 2009-04-06 04:32 38496 —-a-w c:windowssystem32driversmbamswissarmy.sys
2009-05-07 04:00 . 2009-05-07 04:00
d
w c:programdataMalwarebytes
2009-05-07 04:00 . 2009-05-07 04:00
d
w c:program filesMalwarebytes’ Anti-Malware
2009-05-07 03:59 . 2009-05-07 03:59
d
w C:_OTMoveIt
2009-05-02 01:26 . 2009-05-07 12:58
d
w c:programdataeMule
2009-05-02 01:26 . 2009-05-07 12:58
d
w c:usersUserAppDataLocaleMule
2009-05-01 11:38 . 2009-05-01 11:38
d
w C:Archivos de programa
2009-05-01 11:36 . 2009-05-07 12:58
d
w c:program fileseMule
2009-05-01 10:05 . 2009-05-06 23:57
d
w C:Downloads
2009-05-01 10:05 . 2009-05-02 10:44
d
w c:usersUserAppDataRoamingDownload Master
2009-05-01 10:05 . 2009-05-01 10:05
d
w c:program filesDownload Master
2009-04-30 10:19 . 2007-11-05 22:06 11568 —-a-w c:windowssystem32driversUimFIO.sys
2009-04-30 10:19 . 2007-11-05 22:06 32080 —-a-w c:windowssystem32driversUimBus.sys
2009-04-30 10:19 . 2007-11-05 22:06 131672 —-a-w c:windowssystem32driversUim_IM.sys
2009-04-30 10:18 . 2007-11-05 22:06 39472 —-a-w c:windowssystem32drivershotcore3.sys
2009-04-30 10:17 . 2009-04-30 10:18
d
w c:program filesParagon Software
2009-04-28 05:35 . 2009-04-28 05:35
d
w c:program filesДеловой Хабаровск 2008-2
2009-04-28 05:34 . 2009-04-30 00:54
d
w c:program filesДеловой Южно-Сахалинск 2008-2
2009-04-26 23:05 . 2009-04-26 23:06
d
w c:usersUserAppDataLocalAdobe
2009-04-26 23:04 . 2009-04-26 23:04
d
w c:program filesCommon FilesAdobe
2009-04-25 01:01 . 2008-01-21 06:43 247560 —-a-w c:windowssystem32prgiso.dll
2009-04-25 01:01 . 2008-01-21 06:43 4244744 —-a-w c:windowssystem32qtp-mt334.dll
2009-04-25 01:01 . 2008-01-21 06:43 13576 —-a-w c:windowssystem32wnaspi32.dll
2009-04-24 09:46 . 2009-04-24 09:46
d
w c:program filesICCup
2009-04-24 09:28 . 2009-04-24 09:28
d
w c:usersUserAppDataRoamingMicro-Sys
2009-04-24 09:28 . 2009-04-24 09:28
d
w c:program filesMicro-Sys Software
2009-04-22 00:05 . 2009-04-22 00:05
d
w c:usersUserAppDataRoamingNokia
2009-04-22 00:02 . 2009-04-22 00:02
d
w c:usersUserAppDataRoamingNokia Multimedia Player
2009-04-22 00:01 . 2009-04-30 10:18
d—h—w c:program filesInstallShield Installation Information
2009-04-22 00:01 . 2009-04-22 00:01
d
w c:usersUserAppDataRoamingPC Suite
2009-04-22 00:01 . 2009-04-22 00:01
d
w c:usersUserPhone Browser
2009-04-22 00:00 . 2009-04-22 00:00
d
w c:program filesCommon FilesPCSuite
2009-04-22 00:00 . 2009-04-22 00:00
d
w c:program filesCommon FilesNokia
2009-04-22 00:00 . 2009-04-22 00:00
d
w c:program filesNokia
2009-04-21 23:56 . 2009-04-30 10:17
d
w c:program filesCommon FilesInstallShield
2009-04-14 12:13 . 2009-04-14 12:13 751 —-a-w c:usersUserkeys.dat
2009-04-08 11:49 . 2009-04-08 11:49
d
w c:windowsShellNew
2009-04-08 11:48 . 2009-04-08 11:48
d
w c:usersUserAppDataRoamingMicrosoft Web Folders.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-08 00:17 . 2008-01-21 05:59 653074 —-a-w c:windowssystem32perfh019.dat
2009-05-08 00:17 . 2008-01-21 05:59 125594 —-a-w c:windowssystem32perfc019.dat
2009-05-07 14:49 . 2009-03-14 14:04 6042656 —sha-w c:windowssystem32driversfidbox.dat
2009-05-07 14:49 . 2009-03-14 14:04 50384 —sha-w c:windowssystem32driversfidbox.idx
2009-05-07 14:49 . 2009-03-14 14:04 450592 —sha-w c:windowssystem32driversfidbox2.dat
2009-05-07 14:49 . 2009-03-14 14:04 3668 —sha-w c:windowssystem32driversfidbox2.idx
2009-05-07 14:34 . 2009-03-14 05:08 58048 —-a-w c:usersUserAppDataLocalGDIPFONTCACHEV1.DAT
2009-05-07 03:28 . 2009-03-15 02:56 10 —-a-w c:windowspopcinfo.dat
2009-04-30 10:20 . 2006-11-02 10:25 51200 —-a-w c:windowsinfinfpub.dat
2009-04-30 10:20 . 2006-11-02 10:25 143360 —-a-w c:windowsinfinfstrng.dat
2009-04-30 10:20 . 2006-11-02 10:25 86016 —-a-w c:windowsinfinfstor.dat
2009-04-30 00:54 . 2009-04-28 05:34
d
w c:program filesДеловой Южно-Сахалинск 2008-2
2009-04-28 05:35 . 2009-04-28 05:35
d
w c:program filesДеловой Хабаровск 2008-2
2009-04-21 23:57 . 2009-04-21 23:57 0 —ha-w c:windowssystem32driversMsft_Kernel_ccdcmb_01005.Wdf
2009-04-04 07:25 . 2009-03-18 05:40
d
w c:program filesДеловой Владивосток 2008-2
2009-03-26 06:11 . 2009-03-26 06:11 2833 —-a-w c:windowsmozver.dat
2009-03-24 08:24 . 2009-03-24 08:24 410984 —-a-w c:windowssystem32deploytk.dll
2009-03-24 08:23 . 2009-03-24 08:23
d
w c:program filesJava
2009-03-23 10:30 . 2009-03-23 10:30
d
w c:program filesAIMP2
2009-03-19 11:39 . 2009-03-19 11:35
d
w c:program filesATI
2009-03-19 11:37 . 2009-03-19 11:35
d
w c:program filesATI Technologies
2009-03-18 14:19 . 2009-03-18 05:52
d
w c:program filesGoogle
2009-03-18 05:52 . 2009-03-18 05:52
d
w c:program filesIrfanView
2009-03-18 05:42 . 2009-03-18 05:42
d
w c:program filesK-Lite Codec Pack
2009-03-16 07:03 . 2009-03-16 07:03
d
w c:program filesOpera
2009-03-14 14:18 . 2008-01-29 07:29 33808 —-a-w c:windowssystem32driversklbg.sys
2009-03-14 14:18 . 2009-03-14 14:04 89601 —-a-w c:windowssystem32driversklick.dat
2009-03-14 14:18 . 2009-03-14 14:04 101287 —-a-w c:windowssystem32driversklin.dat
2009-03-14 14:04 . 2009-03-14 14:04
d
w c:program filesKaspersky Lab
2008-01-21 02:57 . 2006-11-02 12:48 174 —sha-w c:program filesdesktop.ini
2009-03-26 06:11 . 2009-03-26 06:11 60518 —-a-w c:program filesmozilla firefoxcomponentsjar50.dll
2009-03-26 06:11 . 2009-03-26 06:11 49248 —-a-w c:program filesmozilla firefoxcomponentsjsd3250.dll
2009-03-26 06:11 . 2009-03-26 06:11 165992 —-a-w c:program filesmozilla firefoxcomponentsxpinstal.dll
.((((((((((((((((((((((((((((( SnapShot@2009-05-07_03.49.28 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-21 01:58 . 2009-05-08 00:12 32170 c:windowsSystem32WDIShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:02 . 2009-05-08 00:12 72744 c:windowsSystem32WDIBootPerformanceDiagnostics_SystemData.bin
+ 2009-03-14 05:05 . 2009-05-07 12:58 16384 c:windowsSystem32configsystemprofileAppDataRoamingMicrosoftWindowsCookiesindex.dat
— 2009-03-14 05:05 . 2009-05-02 01:26 16384 c:windowsSystem32configsystemprofileAppDataRoamingMicrosoftWindowsCookiesindex.dat
+ 2009-03-14 05:05 . 2009-05-07 12:58 32768 c:windowsSystem32configsystemprofileAppDataLocalMicrosoftWindowsTemporary Internet FilesContent.IE5index.dat
— 2009-03-14 05:05 . 2009-05-02 01:26 32768 c:windowsSystem32configsystemprofileAppDataLocalMicrosoftWindowsTemporary Internet FilesContent.IE5index.dat
+ 2009-03-14 05:05 . 2009-05-07 12:58 16384 c:windowsSystem32configsystemprofileAppDataLocalMicrosoftWindowsHistoryHistory.IE5index.dat
— 2009-03-14 05:05 . 2009-05-02 01:26 16384 c:windowsSystem32configsystemprofileAppDataLocalMicrosoftWindowsHistoryHistory.IE5index.dat
+ 2009-03-14 05:22 . 2009-05-08 00:12 5708 c:windowsSystem32WDI{86432a0b-3c7d-4ddf-a89c-172faa90485d}S-1-5-21-1942802604-3239854711-3347668718-1000_UserData.bin
+ 2009-05-08 00:10 . 2009-05-08 00:10 2048 c:windowsServiceProfilesLocalServiceAppDataLocallastalive1.dat
— 2009-05-06 23:23 . 2009-05-06 23:23 2048 c:windowsServiceProfilesLocalServiceAppDataLocallastalive1.dat
— 2009-05-06 23:23 . 2009-05-06 23:23 2048 c:windowsServiceProfilesLocalServiceAppDataLocallastalive0.dat
+ 2009-05-08 00:10 . 2009-05-08 00:10 2048 c:windowsServiceProfilesLocalServiceAppDataLocallastalive0.dat
+ 2006-11-02 10:33 . 2009-05-08 00:17 586980 c:windowsSystem32perfh009.dat
— 2006-11-02 10:33 . 2009-05-06 23:31 586980 c:windowsSystem32perfh009.dat
— 2006-11-02 10:33 . 2009-05-06 23:31 101052 c:windowsSystem32perfc009.dat
+ 2006-11-02 10:33 . 2009-05-08 00:17 101052 c:windowsSystem32perfc009.dat
— 2006-11-02 12:44 . 2009-04-08 23:03 259328 c:windowsSystem32FNTCACHE.DAT
+ 2006-11-02 12:44 . 2009-05-08 00:11 259328 c:windowsSystem32FNTCACHE.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2008-05-12 1459464][HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar][HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2008-05-12 1459464][HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar][HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«Sidebar»=»c:program filesWindows Sidebarsidebar.exe» [2008-01-21 1233920]
«YandexDesktopSearch»=»c:program filesYandexDesktopyandesk.exe» [2007-12-10 7456256]
«Yupdate!»=»c:program filesCommon FilesYandexYupdateyupdate.exe» [2008-05-30 460040]
«swg»=»c:program filesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe» [2009-03-18 39408]
«PcSync»=»c:program filesNokiaNokia PC Suite 6PcSync2.exe» [2004-11-24 880640]
«Download Master»=»c:program filesDownload Masterdmaster.exe» [2006-01-13 932352]
«WMPNSCFG»=»c:program filesWindows Media PlayerWMPNSCFG.exe» [2008-01-21 202240][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«Lingvo Launcher»=»c:program filesABBYY Lingvo 12Lvagent.exe» [2007-06-29 193824]
«AVP»=»c:program filesKaspersky LabKaspersky Internet Security 2009avp.exe» [2009-03-14 206088]
«Google Desktop Search»=»c:program filesGoogleGoogle Desktop SearchGoogleDesktop.exe» [2009-03-18 1838592]
«StartCCC»=»c:program filesATI TechnologiesATI.ACECore-StaticCLIStart.exe» [2008-08-29 61440]
«SunJavaUpdateSched»=»c:program filesJavajre6binjusched.exe» [2009-03-24 148888]
«PCSuiteTrayApplication»=»c:program filesNokiaNokia PC Suite 6Launch Application 2.exe» [2004-11-25 143360]
«Adobe Reader Speed Launcher»=»c:program filesAdobeReader 9.0ReaderReader_sl.exe» [2009-02-27 35696]
«RtHDVCpl»=»RtHDVCpl.exe» — c:windowsRtHDVCpl.exe [2008-02-26 4939776]c:programdataMicrosoftWindowsStart MenuProgramsStartup
Microsoft Office.lnk — c:program filesMicrosoft OfficeOfficeOSA9.EXE [1999-2-17 65588][HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]
«EnableLUA»= 0 (0x0)
«EnableUIADesktopToggle»= 0 (0x0)[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwindows]
«AppInit_DLLs»=c:progra~1KASPER~1KASPER~1mzvkbd.dll c:progra~1KASPER~1KASPER~1mzvkbd3.dll c:progra~1KASPER~1KASPER~1adialhk.dll c:progra~1KASPER~1KASPER~1kloehk.dll c:progra~1GoogleGOOGLE~2GoogleDesktopNetwork3.dll[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringKasperskyAntiVirus]
«DisableMonitoring»=dword:00000001[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerSvcS-1-5-21-1942802604-3239854711-3347668718-1000]
«EnableNotificationsRef»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicyDomainProfile]
«EnableFirewall»= 0 (0x0)[HKLM~servicessharedaccessparametersfirewallpolicyPublicProfile]
«EnableFirewall»= 0 (0x0)[HKLM~servicessharedaccessparametersfirewallpolicyStandardProfile]
«EnableFirewall»= 0 (0x0)R0 hotcore3;hotcore3;c:windowsSystem32drivershotcore3.sys [30.04.2009 21:18 39472]
R0 klbg;Kaspersky Lab Boot Guard Driver;c:windowsSystem32driversklbg.sys [29.01.2008 18:29 33808]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:windowsSystem32driversklim6.sys [09.07.2008 18:28 20496]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:windowsSystem32driversklfltdev.sys [13.03.2008 19:02 26640][HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionsvchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{3f659ab2-3130-11de-a274-001d7d7aadfb}]
shellAutoRuncommand — c:windowssystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL I:PStart.exe
.
.
Supplementary Scan
.
uStart Page = hxxp://google.mini20.com
mStart Page = hxxp://www.yandex.ru/?clid=21987
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
IE: Добавить в Анти-Баннер — c:program filesKaspersky LabKaspersky Internet Security 2009ie_banner_deny.htm
IE: Закачать ВСЕ при помощи Download Master — c:program filesDownload Masterdmieall.htm
IE: Закачать при помощи Download Master — c:program filesDownload Masterdmie.htm
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe
TCP: {783ECC52-D5CA-4496-B93F-2A3FABF2BC67} = 193.25.9.254 193.25.8.4
Filter: x-sdch — {B1759355-3EEC-4C1E-B0F1-B719FE26E377} — c:program filesGoogleGoogle ToolbarComponentfastsearch_A8904FB862BD9564.dll
FF — ProfilePath — c:usersUserAppDataRoamingMozillaFirefoxProfiles9vf96daw.default
FF — prefs.js: browser.search.selectedEngine — Google
FF — component: c:program filesMozilla Firefoxcomponentsxpinstal.dll
FF — component: c:program filesMozilla Firefoxextensionstalkback@mozilla.orgcomponentsqfaservices.dll—- FIREFOX POLICIES —-
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.cookie.p3plevel», 1); // 0=low, 1=medium, 2=high, 3=custom
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.enablePad», false); // Allow client to do proxy autodiscovery
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«browser.search.param.Google.1.default», «chrome://branding/content/searchconfig.properties»);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«browser.search.param.Google.1.custom», «chrome://branding/content/searchconfig.properties»);
.**************************************************************************
catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-08 11:20
Windows 6.0.6001 Service Pack 1 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
LOCKED REGISTRY KEYS
[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0000AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
«BlindDial»=dword:00000000
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘Explorer.exe'(1268)
c:program filesABBYY Lingvo 12LvHook.dll
.
Completion time: 2009-05-08 11:21
ComboFix-quarantined-files.txt 2009-05-08 00:21
ComboFix2.txt 2009-05-07 05:32Pre-Run: 24 765 034 496 байт свободно
Post-Run: 24 564 641 792 байт свободно218
лог RSIT
Logfile of random’s system information tool 1.06 (written by random/random)
Run by User at 2009-05-08 01:41:49
Microsoft® Windows Vista™ Home Basic Service Pack 1
System drive C: has 24 GB (23%) free of 102 GB
Total RAM: 3070 MB (70% free)Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:41:51, on 08.05.2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: NormalRunning processes:
C:Windowssystem32Dwm.exe
C:WindowsExplorer.EXE
C:Windowssystem32taskeng.exe
C:Windowsnotepad.exe
C:WindowsRtHDVCpl.exe
C:Program FilesABBYY Lingvo 12LvAgent.exe
C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe
C:Program FilesATI TechnologiesATI.ACECore-StaticMOM.exe
C:Program FilesJavajre6binjusched.exe
C:Program FilesNokiaNokia PC Suite 6Launch Application 2.exe
C:Program FilesWindows Sidebarsidebar.exe
C:Program FilesYandexDesktopyandesk.exe
C:Program FilesCommon FilesYandexYupdateyupdate.exe
C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
C:Program FilesNokiaNokia PC Suite 6PcSync2.exe
C:Program FilesDownload Masterdmaster.exe
C:Program FilesCommon FilesPCSuiteServicesServiceLayer.exe
C:Program FilesWindows Media Playerwmpnscfg.exe
C:Program FilesATI TechnologiesATI.ACECore-StaticCCC.exe
C:Program FilesCommon FilesNokiaMPAPIMPAPI3s.exe
C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe
C:PROGRA~1COMMON~1PCSuiteDATALA~1DATALA~1.EXE
C:Windowssystem32CMMON32.EXE
C:Program FilesMozilla Firefoxfirefox.exe
C:Program FilesOperaopera.exe
C:UsersUserDesktopпроги против всякой хрениRSIT.exe
C:Program Filestrend microUser.exeR0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://google.mini20.com
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.yandex.ru/?clid=21987
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =
O1 — Hosts: ::1 localhost
O2 — BHO: AcroIEHelperStub — {18DF081C-E8AD-4283-A596-FA578C2EBDC3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelperShim.dll
O2 — BHO: IEVkbdBHO — {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} — C:Program FilesKaspersky LabKaspersky Internet Security 2009ievkbd.dll
O2 — BHO: IE 4.x-6.x BHO for Download Master — {9961627E-4059-41B4-8E0E-A7D6B3854ADF} — C:PROGRA~1DOWNLO~1dmiehlp.dll
O2 — BHO: Google Toolbar Helper — {AA58ED58-01DD-4d91-8333-CF10577473F7} — C:Program FilesGoogleGoogle ToolbarGoogleToolbar.dll
O2 — BHO: Google Toolbar Notifier BHO — {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} — C:Program FilesGoogleGoogleToolbarNotifier5.1.1309.3572swg.dll
O2 — BHO: Google Dictionary Compression sdch — {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} — C:Program FilesGoogleGoogle ToolbarComponentfastsearch_A8904FB862BD9564.dll
O2 — BHO: Java(tm) Plug-In 2 SSV Helper — {DBC80044-A445-435b-BC74-9C25C1C588A9} — C:Program FilesJavajre6binjp2ssv.dll
O3 — Toolbar: Яндекс.Бар — {91397D20-1446-11D4-8AF4-0040CA1127B6} — C:Program FilesYandexYandexBarIEyndbar.dll
O3 — Toolbar: Google Toolbar — {2318C2B1-4965-11d4-9B18-009027A5CD4F} — C:Program FilesGoogleGoogle ToolbarGoogleToolbar.dll
O4 — HKLM..Run: [RtHDVCpl] RtHDVCpl.exe
O4 — HKLM..Run: [Lingvo Launcher] «c:Program FilesABBYY Lingvo 12Lvagent.exe» /STARTUP
O4 — HKLM..Run: [AVP] «C:Program FilesKaspersky LabKaspersky Internet Security 2009avp.exe»
O4 — HKLM..Run: [Google Desktop Search] «C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe» /startup
O4 — HKLM..Run: [StartCCC] «C:Program FilesATI TechnologiesATI.ACECore-StaticCLIStart.exe» MSRun
O4 — HKLM..Run: [SunJavaUpdateSched] «C:Program FilesJavajre6binjusched.exe»
O4 — HKLM..Run: [PCSuiteTrayApplication] C:Program FilesNokiaNokia PC Suite 6Launch Application 2.exe -onlytray
O4 — HKLM..Run: [DataLayer] C:PROGRA~1COMMON~1PCSuiteDATALA~1DATALA~1.EXE
O4 — HKLM..Run: [Adobe Reader Speed Launcher] «C:Program FilesAdobeReader 9.0ReaderReader_sl.exe»
O4 — HKCU..Run: [Sidebar] C:Program FilesWindows Sidebarsidebar.exe /autoRun
O4 — HKCU..Run: [YandexDesktopSearch] «C:Program FilesYandexDesktopyandesk.exe»
O4 — HKCU..Run: [Yupdate!] «C:Program FilesCommon FilesYandexYupdateyupdate.exe»
O4 — HKCU..Run: [swg] C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
O4 — HKCU..Run: [PcSync] C:Program FilesNokiaNokia PC Suite 6PcSync2.exe /NoDialog
O4 — HKCU..Run: [Download Master] C:Program FilesDownload Masterdmaster.exe -autorun
O4 — HKCU..Run: [WMPNSCFG] C:Program FilesWindows Media PlayerWMPNSCFG.exe
O4 — Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOfficeOSA9.EXE
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://c:PROGRA~1MICROS~2Office12EXCEL.EXE/3000
O8 — Extra context menu item: Добавить в Анти-Баннер — C:Program FilesKaspersky LabKaspersky Internet Security 2009ie_banner_deny.htm
O8 — Extra context menu item: Закачать ВСЕ при помощи Download Master — C:Program FilesDownload Masterdmieall.htm
O8 — Extra context menu item: Закачать при помощи Download Master — C:Program FilesDownload Masterdmie.htm
O9 — Extra button: Статистика защиты веб-трафика — {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} — C:Program FilesKaspersky LabKaspersky Internet Security 2009SCIEPlgn.dll
O9 — Extra button: Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
O9 — Extra ‘Tools’ menuitem: &Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
O13 — Gopher Prefix:
O16 — DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) — http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 — HKLMSystemCCSServicesTcpip..{783ECC52-D5CA-4496-B93F-2A3FABF2BC67}: NameServer = 193.25.9.254 193.25.8.4
O18 — Filter: x-sdch — {B1759355-3EEC-4C1E-B0F1-B719FE26E377} — C:Program FilesGoogleGoogle ToolbarComponentfastsearch_A8904FB862BD9564.dll
O20 — AppInit_DLLs: C:PROGRA~1KASPER~1KASPER~1mzvkbd.dll C:PROGRA~1KASPER~1KASPER~1mzvkbd3.dll C:PROGRA~1KASPER~1KASPER~1adialhk.dll C:PROGRA~1KASPER~1KASPER~1kloehk.dll C:PROGRA~1GoogleGOOGLE~2GoogleDesktopNetwork3.dll
O23 — Service: Ati External Event Utility — ATI Technologies Inc. — C:Windowssystem32Ati2evxx.exe
O23 — Service: Kaspersky Internet Security (AVP) — Kaspersky Lab — C:Program FilesKaspersky LabKaspersky Internet Security 2009avp.exe
O23 — Service: @dfsrres.dll,-101 (DFSR) — Корпорация Майкрософт — C:Windowssystem32DFSR.exe
O23 — Service: GoogleDesktopManager — Google — C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe
O23 — Service: Google Software Updater (gusvc) — Google — C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
O23 — Service: @%systemroot%system32SearchIndexer.exe,-103 (WSearch) — Корпорация Майкрософт — C:Windowssystem32SearchIndexer.exe—
End of file — 7287 bytes======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelperShim.dll [2009-02-27 75128][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class — C:Program FilesKaspersky LabKaspersky Internet Security 2009ievkbd.dll [2008-11-11 62728][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9961627E-4059-41B4-8E0E-A7D6B3854ADF}]
IE 4.x-6.x BHO for Download Master — C:PROGRA~1DOWNLO~1dmiehlp.dll [2005-05-24 67584][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper — C:Program FilesGoogleGoogle ToolbarGoogleToolbar.dll [2009-04-19 259696][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO — C:Program FilesGoogleGoogleToolbarNotifier5.1.1309.3572swg.dll [2009-04-18 668656][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
Google Dictionary Compression sdch — C:Program FilesGoogleGoogle ToolbarComponentfastsearch_A8904FB862BD9564.dll [2009-04-19 470512][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper — C:Program FilesJavajre6binjp2ssv.dll [2009-03-24 35840][HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{91397D20-1446-11D4-8AF4-0040CA1127B6} — Яндекс.Бар — C:Program FilesYandexYandexBarIEyndbar.dll [2008-05-13 1459464]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} — Google Toolbar — C:Program FilesGoogleGoogle ToolbarGoogleToolbar.dll [2009-04-19 259696][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«RtHDVCpl»=C:WindowsRtHDVCpl.exe [2008-02-27 4939776]
«Lingvo Launcher»=c:Program FilesABBYY Lingvo 12Lvagent.exe [2007-06-30 193824]
«AVP»=C:Program FilesKaspersky LabKaspersky Internet Security 2009avp.exe [2009-03-15 206088]
«Google Desktop Search»=C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe [2009-03-18 1838592]
«StartCCC»=C:Program FilesATI TechnologiesATI.ACECore-StaticCLIStart.exe [2008-08-29 61440]
«SunJavaUpdateSched»=C:Program FilesJavajre6binjusched.exe [2009-03-24 148888]
«PCSuiteTrayApplication»=C:Program FilesNokiaNokia PC Suite 6Launch Application 2.exe [2004-11-25 143360]
«DataLayer»=C:PROGRA~1COMMON~1PCSuiteDATALA~1DATALA~1.EXE [2004-12-09 1068032]
«Adobe Reader Speed Launcher»=C:Program FilesAdobeReader 9.0ReaderReader_sl.exe [2009-02-27 35696][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«Sidebar»=C:Program FilesWindows Sidebarsidebar.exe [2008-01-21 1233920]
«YandexDesktopSearch»=C:Program FilesYandexDesktopyandesk.exe [2007-12-11 7456256]
«Yupdate!»=C:Program FilesCommon FilesYandexYupdateyupdate.exe [2008-05-30 460040]
«swg»=C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe [2009-03-19 39408]
«PcSync»=C:Program FilesNokiaNokia PC Suite 6PcSync2.exe [2004-11-24 880640]
«Download Master»=C:Program FilesDownload Masterdmaster.exe [2006-01-13 932352]
«WMPNSCFG»=C:Program FilesWindows Media PlayerWMPNSCFG.exe [2008-01-21 202240]C:ProgramDataMicrosoftWindowsStart MenuProgramsStartup
Microsoft Office.lnk — C:Program FilesMicrosoft OfficeOfficeOSA9.EXE[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWindows]
«AppInit_DLLS»=»C:PROGRA~1KASPER~1KASPER~1mzvkbd.dll C:PROGRA~1KASPER~1KASPER~1mzvkbd3.dll C:PROGRA~1KASPER~1KASPER~1adialhk.dll C:PROGRA~1KASPER~1KASPER~1kloehk.dll C:PROGRA~1GoogleGOOGLE~2GoogleDesktopNetwork3.dll»[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyklogon]
C:Windowssystem32klogon.dll [2008-11-11 218376][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«EnableLUA»=0
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1
«EnableUIADesktopToggle»=0[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDrives»=0[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDrives»=[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{3f659ab2-3130-11de-a274-001d7d7aadfb}]
shellAutoRuncommand — C:Windowssystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL I:PStart.exe======List of files/folders created in the last 1 months======
2009-05-07 16:44:36 —-D—- C:rsit
2009-05-07 16:44:36 —-D—- C:Program Filestrend micro
2009-05-07 16:36:07 —-A—- C:log.txt
2009-05-07 16:32:15 —-D—- C:Windowstemp
2009-05-07 16:32:14 —-A—- C:ComboFix.txt
2009-05-07 16:28:01 —-D—- C:ComboFix
2009-05-07 15:00:23 —-D—- C:UsersUserAppDataRoamingMalwarebytes
2009-05-07 15:00:19 —-D—- C:ProgramDataMalwarebytes
2009-05-07 15:00:19 —-D—- C:Program FilesMalwarebytes’ Anti-Malware
2009-05-07 14:59:10 —-D—- C:_OTMoveIt
2009-05-07 14:45:08 —-A—- C:Windowszip.exe
2009-05-07 14:45:08 —-A—- C:WindowsvFind.exe
2009-05-07 14:45:08 —-A—- C:WindowsSWXCACLS.exe
2009-05-07 14:45:08 —-A—- C:WindowsSWSC.exe
2009-05-07 14:45:08 —-A—- C:WindowsSWREG.exe
2009-05-07 14:45:08 —-A—- C:Windowssed.exe
2009-05-07 14:45:08 —-A—- C:WindowsNIRCMD.exe
2009-05-07 14:45:08 —-A—- C:Windowsgrep.exe
2009-05-07 14:44:45 —-D—- C:WindowsERDNT
2009-05-07 14:44:21 —-D—- C:Qoobox
2009-05-07 14:41:10 —-A—- C:logit.txt
2009-05-02 12:26:27 —-D—- C:ProgramDataeMule
2009-05-01 22:38:03 —-D—- C:Archivos de programa
2009-05-01 22:36:16 —-D—- C:Program FileseMule
2009-05-01 21:05:45 —-D—- C:Downloads
2009-05-01 21:05:24 —-D—- C:UsersUserAppDataRoamingDownload Master
2009-05-01 21:05:20 —-D—- C:Program FilesDownload Master
2009-04-30 21:17:49 —-D—- C:Program FilesParagon Software
2009-04-28 16:35:09 —-D—- C:Program FilesДеловой Хабаровск 2008-2
2009-04-28 16:34:24 —-D—- C:Program FilesДеловой Южно-Сахалинск 2008-2
2009-04-27 10:04:31 —-D—- C:ProgramDataAdobe
2009-04-27 10:04:28 —-D—- C:Program FilesCommon FilesAdobe
2009-04-27 10:04:28 —-D—- C:Program FilesAdobe
2009-04-25 12:01:39 —-A—- C:Windowssystem32wnaspi32.dll
2009-04-25 12:01:39 —-A—- C:Windowssystem32qtp-mt334.dll
2009-04-25 12:01:39 —-A—- C:Windowssystem32prgiso.dll
2009-04-24 20:46:34 —-D—- C:Program FilesICCup
2009-04-24 20:28:30 —-D—- C:UsersUserAppDataRoamingMicro-Sys
2009-04-24 20:28:18 —-D—- C:Program FilesMicro-Sys Software
2009-04-22 11:05:03 —-D—- C:UsersUserAppDataRoamingNokia
2009-04-22 11:02:11 —-D—- C:UsersUserAppDataRoamingNokia Multimedia Player
2009-04-22 11:01:18 —-HD—- C:Program FilesInstallShield Installation Information
2009-04-22 11:01:14 —-D—- C:UsersUserAppDataRoamingPC Suite
2009-04-22 11:00:46 —-D—- C:Program FilesNokia
2009-04-22 11:00:46 —-D—- C:Program FilesCommon FilesPCSuite
2009-04-22 11:00:46 —-D—- C:Program FilesCommon FilesNokia
2009-04-22 10:56:32 —-D—- C:Program FilesCommon FilesInstallShield======List of files/folders modified in the last 1 months======
2009-05-08 01:41:32 —-D—- C:WindowsSystem32
2009-05-08 01:41:32 —-D—- C:Windowsinf
2009-05-08 01:41:32 —-A—- C:Windowssystem32PerfStringBackup.INI
2009-05-08 01:34:31 —-D—- C:ProgramDataKaspersky Lab
2009-05-07 16:44:36 —-RD—- C:Program Files
2009-05-07 16:32:16 —-D—- C:Windowssystem32ru-RU
2009-05-07 16:32:15 —-D—- C:Windows
2009-05-07 16:31:17 —-A—- C:Windowssystem.ini
2009-05-07 16:29:57 —-D—- C:Windowssystem32drivers
2009-05-07 16:29:57 —-D—- C:WindowsAppPatch
2009-05-07 16:29:56 —-D—- C:Program FilesCommon Files
2009-05-07 16:27:54 —-D—- C:WindowsPrefetch
2009-05-07 15:00:19 —-HD—- C:ProgramData
2009-05-06 11:29:49 —-SHD—- C:System Volume Information
2009-05-06 11:23:58 —-D—- C:Windowssystem32catroot2
2009-04-30 21:20:11 —-D—- C:Windowssystem32catroot
2009-04-30 20:03:36 —-D—- C:Program FilesMozilla Firefox
2009-04-27 10:05:59 —-D—- C:UsersUserAppDataRoamingAdobe
2009-04-27 10:05:42 —-SHD—- C:WindowsInstaller
2009-04-27 10:05:37 —-D—- C:Windowswinsxs
2009-04-11 11:51:28 —-D—- C:UsersUserAppDataRoamingAIMP======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 kl1;kl1; C:Windowssystem32DRIVERSkl1.sys [2008-07-21 121872]
R1 KLIF;Kaspersky Lab Driver; C:Windowssystem32DRIVERSklif.sys [2009-03-15 239120]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter; C:Windowssystem32DRIVERSklim6.sys [2008-07-09 20496]
R1 Uim_IM;UIM Drive Backup Image Plugin; C:WindowsSystem32DriversUim_IM.sys [2007-11-06 131672]
R1 UimBus;Universal Image Mounter Controller; C:Windowssystem32DRIVERSUimBus.sys [2007-11-06 32080]
R3 atikmdag;atikmdag; C:Windowssystem32DRIVERSatikmdag.sys [2009-01-14 4235776]
R3 HdAudAddService;Драйвер функции UAA для службы High Definition Audio (Microsoft), версия 1.1; C:Windowssystem32driversHdAudio.sys [2006-11-02 235520]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:Windowssystem32driversRTKVHDA.sys [2008-02-27 2070304]
R3 KLFLTDEV;Kaspersky Lab KLFltDev; C:Windowssystem32DRIVERSklfltdev.sys [2008-03-13 26640]
R3 RTL8169;Realtek 8169 NT Driver; C:Windowssystem32DRIVERSRtlh86.sys [2008-04-07 118784]
R3 WUDFRd;WUDFRd; C:Windowssystem32DRIVERSWUDFRd.sys [2008-01-21 83328]
S3 drmkaud;Звуковой дешифратор DRM ядра системы; C:Windowssystem32driversdrmkaud.sys [2008-01-21 5632]
S3 MSKSSRV;Представитель служб потоков Microsoft; C:Windowssystem32driversMSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Посредник синхронизации потоков Microsoft; C:Windowssystem32driversMSPCLOCK.sys [2008-01-21 5888]
S3 MSPQM;Представитель диспетчера качества потоков Microsoft; C:Windowssystem32driversMSPQM.sys [2008-01-21 5504]
S3 MSTEE;Преобразователь потоков Tee/Sink-to-Sink Microsoft; C:Windowssystem32driversMSTEE.sys [2008-01-21 6016]
S3 nmwcd;Nokia USB Phone Parent; C:Windowssystem32driversccdcmb.sys [2008-05-02 17536]
S3 nmwcdc;Nokia USB Generic; C:Windowssystem32driversccdcmbo.sys [2008-05-02 20864]
S3 upperdev;upperdev; C:Windowssystem32DRIVERSusbser_lowerflt.sys [2008-05-02 8064]
S3 usbser;Nokia USB Serial Port; C:Windowssystem32DRIVERSusbser.sys [2008-01-21 28160]
S3 UsbserFilt;UsbserFilt; C:Windowssystem32DRIVERSusbser_lowerfltj.sys [2008-05-02 8064]
S3 yukonwlh;Драйвер минипорта NDIS6.0 для Ethernet-контроллера Marvell Yukon; C:Windowssystem32DRIVERSyk60x86.sys [2006-11-02 194048]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:Windowssystem32driverserrdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:Windowssystem32driversmegasr.sys [2008-01-21 386616]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:Windowssystem32driverswmiacpi.sys [2008-01-21 11264]======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 Ati External Event Utility;Ati External Event Utility; C:Windowssystem32Ati2evxx.exe [2009-01-14 729088]
R2 AVP;Kaspersky Internet Security; C:Program FilesKaspersky LabKaspersky Internet Security 2009avp.exe [2009-03-15 206088]
S3 GoogleDesktopManager;GoogleDesktopManager; C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe [2009-03-18 1838592]
S3 gusvc;Google Software Updater; C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe [2009-04-19 182768]
EOF
