[julia09]

После перезагрузки компьютера nod опять находит и изолирует win32 червь. Вот лог файл после работы combofix:
ComboFix 09-10-04.01 — Admin 05.10.2009 21:49.1.2 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.2047.1375 [GMT 3:00]
Running from: c:documents and settingsAdminРабочий столComboFix.exe
Command switches used :: c:documents and settingsAdminРабочий столWindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:documents and settingsAdminРабочий столНовая папка (2)фотокисаDesktop_.ini
c:documents and settingsAdminApplication DataMicrosoftClip Organizermstore10.mgc
c:documents and settingsAdminApplication DataMicrosoftClip OrganizerOffic10.MGC
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr0.dat
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr1.dat
c:program files\setup.exe
c:recyclerS-1-5-21-1482476501-1644491937-682003330-1013

---

BITS: Possible infected sites

---

hxxp://soft.export.yandex.ru
hxxp://wsus.triolan.com.ua
.
((((((((((((((((((((((((( Files Created from 2009-09-05 to 2009-10-05 )))))))))))))))))))))))))))))))
.

2009-09-30 18:04 . 2009-09-30 18:04

---

d

---

w- c:documents and settingsAll UsersApplication Datacerasus.media
2009-09-30 18:04 . 2009-09-30 18:04

---

d

---

w- c:documents and settingsAdminApplication Datacerasus.media
2009-09-30 17:51 . 2009-09-30 18:03

---

d

---

w- c:program filesAlawar
2009-09-30 09:11 . 2009-09-30 09:23

---

d

---

w- c:program filestrend micro
2009-09-30 09:11 . 2009-09-30 09:11

---

d

---

w- C:rsit
2009-09-30 08:32 . 2009-09-30 08:33 664 —-a-w- c:windowssystem32d3d9caps.dat
2009-09-22 21:05 . 2009-09-22 21:05

---

d

---

w- c:documents and settingsAll UsersApplication DataInterAction studios
2009-09-19 14:12 . 2009-09-19 14:12

---

d

---

w- c:documents and settingsAdminLocal SettingsApplication DataFlatOut Ultimate Carnage
2009-09-17 22:32 . 2009-06-15 10:45 79872 -c—-w- c:windowssystem32dllcachetelnet.exe
2009-09-17 13:19 . 2009-09-17 13:19

---

d

---

w- c:documents and settingsAdminApplication Datarambler.ru
2009-09-17 13:18 . 2009-09-17 13:19

---

d

---

w- c:program filesRambler Assistant
2009-09-17 13:18 . 2009-09-17 13:21

---

d

---

w- c:documents and settingsAdminApplication DataICQ
2009-09-17 13:13 . 2009-09-17 13:13

---

d

---

w- c:documents and settingsAdminLocal SettingsApplication Datamultishop
2009-09-17 13:13 . 2009-09-17 13:13

---

d

---

w- c:program filesPivim Multibar
2009-09-08 18:50 . 2009-09-08 18:50

---

d

---

w- c:documents and settingsAdminLocal SettingsApplication DataTargem

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-05 18:36 . 2009-06-13 08:00

---

d

---

w- c:documents and settingsAdminApplication DataSkype
2009-10-05 18:36 . 2009-06-13 08:04

---

d

---

w- c:documents and settingsAdminApplication DataskypePM
2009-10-05 08:17 . 2009-05-18 22:27

---

d

---

w- c:documents and settingsAll UsersApplication DataGoogle Updater
2009-10-03 18:27 . 2008-10-11 14:20 138464 —-a-w- c:windowssystem32driversPnkBstrK.sys
2009-10-03 18:26 . 2008-10-11 14:20 111928 —-a-w- c:windowssystem32PnkBstrB.exe
2009-09-30 17:43 . 2009-07-14 22:09

---

d

---

w- c:documents and settingsAdminApplication DataMeridian93
2009-09-30 08:38 . 2008-04-15 12:00 84284 —-a-w- c:windowssystem32perfc019.dat
2009-09-30 08:38 . 2008-04-15 12:00 484670 —-a-w- c:windowssystem32perfh019.dat
2009-09-22 19:36 . 2009-07-01 12:51

---

d

---

w- c:documents and settingsAdminApplication DatauTorrent
2009-09-17 22:47 . 2008-10-09 15:55

---

d

---

w- c:program filesFlash Player Pro
2009-09-17 13:19 . 2008-10-09 15:52

---

d—h—w- c:program filesInstallShield Installation Information
2009-09-08 18:50 . 2008-10-28 17:24

---

d

---

w- c:program filesCommon FilesWise Installation Wizard
2009-09-08 18:50 . 2008-10-28 17:24

---

d

---

w- c:program filesAGEIA Technologies
2009-08-28 05:25 . 2009-08-28 05:25 11264 —-a-w- c:windowssystem32driversuzi3mtk2.sys
2009-08-18 16:11 . 2009-08-18 16:11

---

d

---

w- c:documents and settingsAll UsersApplication DataPlayrix Entertainment
2009-08-18 11:03 . 2009-07-14 20:57

---

d

---

w- c:program filesAlawar.ru
2009-08-18 11:01 . 2009-06-07 18:54

---

d

---

w- c:documents and settingsAll UsersApplication DataAlawarWrapper
2009-08-17 22:14 . 2009-08-12 19:47

---

d

---

w- c:program filesBattlefield 2 — Габмит
2009-08-17 14:33 . 2009-08-17 14:16

---

d

---

w- c:documents and settingsAll UsersApplication DataFarmFrenzy3
2009-08-13 18:50 . 2009-08-13 18:50

---

d

---

w- c:documents and settingsAll UsersApplication DataPlayFirst
2009-08-13 18:50 . 2009-08-13 18:50

---

d

---

w- c:documents and settingsAdminApplication DataPlayFirst
2009-08-12 10:42 . 2008-10-09 16:01

---

d

---

w- c:program filesEasy Gif Animator
2009-08-12 10:04 . 2009-07-23 16:29

---

d

---

w- c:documents and settingsAll UsersApplication DataKaspersky Lab
2009-08-12 10:04 . 2009-07-23 13:19

---

d

---

w- c:program filesKaspersky Lab
2009-08-05 09:01 . 2008-04-15 12:00 204800 —-a-w- c:windowssystem32mswebdvd.dll
2009-07-17 19:03 . 2008-04-15 12:00 58880 —-a-w- c:windowssystem32atl.dll
2009-07-13 19:43 . 2008-08-19 16:18 286208 —-a-w- c:windowssystem32wmpdxm.dll
2009-05-12 12:37 . 2009-05-12 12:37 7783728 —-a-w- c:program filesFirefox Setup 3.0.10.exe
2009-04-30 06:10 . 2009-04-30 06:10 2381 —-a-w- c:program filesSetup.ini
2009-04-30 05:20 . 2009-04-30 05:20 477696 —-a-w- c:program filesYa_bar85.mst
2009-04-27 12:02 . 2009-04-27 12:02 37 —-a-w- c:program filescd.inf
2009-03-27 09:05 . 2009-03-27 09:05 2823168 —-a-w- c:program filesPROMT Professional 8.5 ERRE.msi
2009-03-12 13:58 . 2009-03-12 13:58 127491314 —-a-w- c:program filesData1.cab
2009-03-12 13:57 . 2009-03-12 13:57 113152 —-a-w- c:program files1033.mst
2009-03-12 13:56 . 2009-03-12 13:56 195584 —-a-w- c:program files1049.mst
2008-10-08 11:10 . 2008-10-08 11:10 6619136 —-a-w- c:program filesData0.cab
2006-12-18 15:05 . 2006-12-18 15:05 23510720 —-a-w- c:program filesdotnetfx20.exe
2006-05-17 07:14 . 2006-05-17 07:14 340912 —-a-w- c:program filesdotnetfx.exe
2006-05-16 08:02 . 2006-05-16 08:02 6512 —-a-w- c:program filesx0419.ini
2006-05-16 08:02 . 2006-05-16 08:02 6129 —-a-w- c:program filesx0409.ini
2006-05-16 07:58 . 2006-05-16 07:58 2584848 —-a-w- c:program filesWindowsInstaller-KB893803-x86.exe
2009-05-01 21:02 . 2009-05-01 21:02 1044480 —-a-w- c:program filesmozilla firefoxpluginslibdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 —-a-w- c:program filesmozilla firefoxpluginsssldivx.dll
.

---

Sigcheck

---

[-] 2008-08-19 . 6A104BA98D99D53AB0C91825CE659FC6 . 361600 . . [5.1.2600.5625] . . c:windowssystem32driverstcpip.sys

[-] 2008-08-19 . 23B7D3F3F5EC8FEEA75EC381C71CBD5E . 579072 . . [5.1.2600.5512] . . c:windowssystem32user32.dll

[-] 2008-08-19 . 62EA07EDF5E3F3FF34EFF9BF7619BC64 . 1721344 . . [6.00.2900.5512] . . c:windowsexplorer.exe

[-] 2008-08-21 . 66452823532746FA58EFEDBA320F46A2 . 1571840 . . [5.1.2600.5512] . . c:windowssystem32sfcfiles.dll

[-] 2008-08-19 . B8B35F99DADAA5459FBA639F20045FE2 . 30208 . . [5.1.2600.5512] . . c:windowssystem32ctfmon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE~Browser Helper Objects{39AA6D29-4236-4F25-A36A-3410EF5283D9}]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2009-07-24 5586208]

[HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar]

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2009-07-24 5586208]

[HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar]

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2008-05-30 722112]
«LClock»=»c:program filesLClockLClock.exe» [2007-12-14 86016]
«Skype»=»c:program filesSkypePhoneSkype.exe» [2009-05-26 24264488]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2008-09-17 13574144]
«WinampAgent»=»c:program filesWinampwinampa.exe» [2008-08-03 36352]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2008-09-17 86016]
«Lingvo Launcher»=»c:program filesABBYY Lingvo 12Lvagent.exe» [2006-12-13 258048]
«Adobe Reader Speed Launcher»=»c:program filesAdobeReader 9.0ReaderReader_sl.exe» [2009-02-27 35696]
«egui»=»c:program filesESETESET NOD32 Antivirusegui.exe» [2009-03-19 2029640]
«NevoDRM»=»c:игры от nevosoftNevoDRMNevoDRM.exe» [2008-12-11 41984]
«RTHDCPL»=»RTHDCPL.EXE» — c:windowsRTHDCPL.EXE [2008-04-10 16861184]
«nwiz»=»nwiz.exe» — c:windowssystem32nwiz.exe [2008-09-17 1657376]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-08-19 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» — c:windowssystem32advpack.dll [2009-06-29 124928]
«IE7_012″=»advpack.dll» — c:windowssystem32advpack.dll [2009-06-29 124928]

c:documents and settingsAdminѓ« ў­®Ґ ¬Ґ­оЏа®Ја ¬¬лЂўв®§ Јаг§Є 
FlylinkDC++.lnk — c:flylinkdc++FlylinkDC.exe [2009-5-12 3074048]

c:documents and settingsAdminѓ« ў­®Ґ ¬Ґ­оЏа®Ја ¬¬лЂўв®§ Јаг§Є 
FlylinkDC++.lnk — c:flylinkdc++FlylinkDC.exe [2009-5-12 3074048]

c:documents and settingsAdminѓ« ў­®Ґ ¬Ґ­оЏа®Ја ¬¬лЂўв®§ Јаг§Є 
FlylinkDC++.lnk — c:flylinkdc++FlylinkDC.exe [2009-5-12 3074048]

c:documents and settingsAdminѓ« ў­®Ґ ¬Ґ­оЏа®Ја ¬¬лЂўв®§ Јаг§Є 
FlylinkDC++.lnk — c:flylinkdc++FlylinkDC.exe [2009-5-12 3074048]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesDisableNotify»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusOverride»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«d:\ИГРЫ\Call of Duty — World at War\CoDWaW.exe»=
«d:\ИГРЫ\Call of Duty — World at War\CoDWaWmp.exe»=
«c:\WINDOWS\system32\PnkBstrA.exe»=
«c:\WINDOWS\system32\PnkBstrB.exe»=
«c:\Program Files\uTorrent [tfile.ru]\utorrent.exe»=
«c:\Program Files\Skype\Phone\Skype.exe»=

R0 mv61xx;mv61xx;c:windowssystem32driversmv61xx.sys [21.08.2008 20:33 143360]
R1 ehdrv;ehdrv;c:windowssystem32driversehdrv.sys [19.03.2009 10:44 107256]
R1 epfwtdir;epfwtdir;c:windowssystem32driversepfwtdir.sys [19.03.2009 10:45 93848]
R1 uzi3mtk2;AVZ-RK Kernel Driver;c:windowssystem32driversuzi3mtk2.sys [28.08.2009 8:25 11264]
R2 ekrn;ESET Service;c:program filesESETESET NOD32 Antivirusekrn.exe [19.03.2009 10:44 731840]
S1 ALIMSIF;ALi Memory Stick controller;c:windowssystem32driversALIMSIF.SYS [09.10.2008 19:17 21997]
S2 gupdate1ca0924550d93ca;Служба Google Update (gupdate1ca0924550d93ca);c:program filesGoogleUpdateGoogleUpdate.exe [20.07.2009 13:24 133104]
S3 zteusbser;ZTE USB Device for Legacy Serial Communication;c:windowssystem32driverszteusbser.sys [09.10.2008 21:26 98432]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled componentsWindows Sidebar]
c:windowssystem32hidec /W c:program filesWindows SidebarVAIOToolsREGTLIB.EXE «c:program filesWindows Sidebarsidebar.exe»

[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled components{34A19196-274E-4D75-9D30-D7A45A0A4178}]
«c:program filesWindows Sidebar.regsvr32.exe» /s wlsrvc.dll

[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled components{6B9228DA-9C15-419e-856C-19E768A13BDC}]
«c:program filesWindows Sidebar.regsvr32.exe» /s sbdrop.dll

[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled components{BADA65A0-86B7-462B-B720-CE66655C73F5}]
regsvr32 /s c:program filesWindows SidebarVAIO.vshellext.dll
.
Contents of the ‘Scheduled Tasks’ folder

2009-10-05 c:windowsTasksGoogle Software Updater.job
— c:program filesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe [2009-05-18 22:27]

2009-10-05 c:windowsTasksGoogleUpdateTaskMachineCore.job
— c:program filesGoogleUpdateGoogleUpdate.exe [2009-07-20 10:24]

2009-10-05 c:windowsTasksGoogleUpdateTaskMachineUA.job
— c:program filesGoogleUpdateGoogleUpdate.exe [2009-07-20 10:24]
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://start.icq.com?p=7
uInternet Settings,ProxyOverride = *.local
IE: &Перевести — c:program filesArsenal CompanySOCRAT InternetHTMLWSocrat.js
IE: &Перевести с помощью ABBYY Lingvo… — c:program filesABBYY Lingvo 12Lingvo.exe/3000
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~1OFFICE11EXCEL.EXE/3000
IE: Hinzufugen zu Anti-Banner — c:program filesKaspersky LabKaspersky Security Suite CBE 09ie_banner_deny.htm
IE: Найти с помощью Рамблера — c:program filesRambler AssistantramblertoolbarU5090.dll/search.htm
IE: Перевести с помощью словарей Рамблера — c:program filesRambler AssistantramblertoolbarU5090.dll/dic.htm
IE: {{17FA5CD6-5737-45c2-B194-74C8A4A7F7E7} — {7E1F0737-53A5-4EDC-8734-DD94B50AAF83} — c:program filesArsenal CompanySOCRAT InternetSocratInternet.dll
IE: {{39AA6D29-4236-4F25-A36A-3410EF5283D9} — {39AA6D29-4236-4F25-A36A-3410EF5283D9} — c:progra~1PIVIMM~1MULTIS~1.DLL
IE: {{DFDC8970-FD66-4385-B8C0-835A4AA1DA00} — {A3400175-12F9-4220-83BF-A7210CA4003E} — c:program filesArsenal CompanySOCRAT InternetSocratInternet.dll
FF — ProfilePath — c:documents and settingsAdminApplication DataMozillaFirefoxProfiles2uhu3kyr.default
FF — prefs.js: browser.search.selectedEngine — Google
FF — prefs.js: browser.startup.homepage — hxxp://start.icq.com?p=7
FF — component: c:program filesMozilla Firefoxextensions{B13721C7-F507-4982-B2E5-502A71474FED}componentsNPComponent.dll
FF — plugin: c:program filesGoogleGoogle Updater2.4.1487.6512npCIDetect13.dll
FF — plugin: c:program filesGoogleUpdate1.2.183.7npGoogleOneClick8.dll
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnppl3260.dll
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnprpjplug.dll
.
— — — — ORPHANS REMOVED — — — —

HKCU-Run-RGSC — d:игрыSozial ClabRockstar Games Social ClubRGSCLauncher.exe
HKCU-Run-Download Master — c:program filesDownload Masterdmaster.exe
HKCU-Run-ICQ — c:program filesICQ6.5ICQ.exe
AddRemove-Call of Duty 4 — Modern Warfare_is1 — d:игрыCall of Duty 4 — Modern Warfareunins000.exe
AddRemove-Eggsucker_is1 — d:eggsuckerunins000.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-05 22:01
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘winlogon.exe'(756)
c:windowssystem32SETUPAPI.dll
c:windowssystem32COMRes.dll
c:windowssystem32cscui.dll

— — — — — — — > ‘lsass.exe'(812)
c:windowssystem32setupapi.dll

— — — — — — — > ‘explorer.exe'(2176)
c:windowssystem32SHDOCVW.dll
c:windowssystem32WININET.dll
c:windowssystem32COMRes.dll
c:windowsSystem32cscui.dll
c:program filesPunto Switcherpshook.dll.1213362844
c:program filesABBYY Lingvo 12LvHook.dll
c:windowssystem32msi.dll
c:windowssystem32SETUPAPI.dll
c:windowssystem32NETSHELL.dll
c:program filesLClockLC.dll
c:windowssystem32WPDShServiceObj.dll
c:windowssystem32PortableDeviceTypes.dll
c:windowssystem32PortableDeviceApi.dll
.

---

Other Running Processes

---

.
c:program filesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
c:matlab701binwin32MATLAB.exe
c:windowssystem32nvsvc32.exe
c:windowssystem32PnkBstrA.exe
c:windowssystem32rundll32.exe
c:windowssystem32rundll32.exe
c:program filesSkypePlugin ManagerskypePM.exe
.
**************************************************************************
.
Completion time: 2009-10-05 22:05 — machine was rebooted
ComboFix-quarantined-files.txt 2009-10-05 19:05

Pre-Run: 15 807 598 592 байт свободно
Post-Run: 21 158 793 216 байт свободно

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)WINDOWS
[operating systems]
c:cmdconsBOOTSECT.DAT=»Microsoft Windows Recovery Console» /cmdcons
multi(0)disk(0)rdisk(0)partition(1)WINDOWS=»Microsoft Windows XP Professional RU» /execute /fastdetect

268 — E O F — 2009-10-05 18:56

Спасибо за ответ!

[Автор]

Сообщения