[kolkasp]

у меня тажа проблема, я сделал все эти два шага как вы сказали и вот мой лог. ComboFix 09-08-10.06 — Admin 16.08.2009 20:30.5.2 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.1023.535 [GMT 4:00]
Running from: c:documents and settingsAdminРабочий столComboFix.exe
Command switches used :: c:documents and settingsAdminРабочий столCFScript.txt
AV: avast! antivirus 4.8.1335 [VPS 090815-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2009-07-16 to 2009-08-16 )))))))))))))))))))))))))))))))
.

2009-08-16 15:04 . 2008-04-15 12:00 26624 —-a-w- c:documents and settingsLocalServiceApplication DataMicrosoftUPnP Device Hostupnphostudhisapi.dll
2009-08-16 12:00 . 2009-08-16 12:00

---

d

---

w- c:windowsDownloaded Installations
2009-08-14 14:45 . 2009-02-05 20:08 93296 —-a-w- c:windowssystem32driversaswmon.sys
2009-08-14 14:45 . 2009-02-05 20:08 94032 —-a-w- c:windowssystem32driversaswmon2.sys
2009-08-14 14:45 . 2009-02-05 20:07 114768 —-a-w- c:windowssystem32driversaswSP.sys
2009-08-14 14:45 . 2009-02-05 20:07 20560 —-a-w- c:windowssystem32driversaswFsBlk.sys
2009-08-14 14:45 . 2009-02-05 20:06 51376 —-a-w- c:windowssystem32driversaswTdi.sys
2009-08-14 14:45 . 2009-02-05 20:06 23152 —-a-w- c:windowssystem32driversaswRdr.sys
2009-08-14 14:45 . 2009-02-05 20:05 26944 —-a-w- c:windowssystem32driversaavmker4.sys
2009-08-14 14:45 . 2009-02-05 20:04 97480 —-a-w- c:windowssystem32AvastSS.scr
2009-08-14 14:45 . 2009-02-05 20:11 1256296 —-a-w- c:windowssystem32aswBoot.exe
2009-08-14 12:26 . 2009-08-14 12:26

---

d

---

w- c:program filesKaspersky Lab
2009-08-14 12:26 . 2009-08-14 12:26

---

d

---

w- C:kav
2009-08-14 10:04 . 2009-08-14 10:04

---

d

---

w- c:documents and settingsAdminLocal SettingsApplication DataESET
2009-08-14 09:57 . 2009-08-14 09:57

---

d

---

w- c:documents and settingsAll UsersApplication DataESET
2009-08-11 20:26 . 2008-04-15 12:00 2560 —-a-w- c:documents and settingsAll UsersApplication DataMicrosoftUSMTiconlib.dll
2009-08-11 16:13 . 2009-08-11 16:13

---

d

---

w- c:documents and settingsAdminLocal SettingsApplication DataGoogle
2009-08-11 16:13 . 2009-08-15 18:37

---

d

---

w- c:program filesGoogle
2009-08-11 15:34 . 2009-08-11 19:29

---

d

---

w- c:program filesYandex
2009-08-11 15:34 . 2009-08-11 19:29

---

d

---

w- c:documents and settingsAdminLocal SettingsApplication DataYandex
2009-08-11 15:34 . 2009-08-11 15:34

---

d

---

w- c:documents and settingsAdminApplication DataYandex
2009-08-11 15:34 . 2009-08-11 15:34

---

d

---

w- C:VKLife
2009-08-10 20:44 . 2009-08-10 20:44

---

d

---

w- c:documents and settingsAdminLocal SettingsApplication DataIdentities
2009-08-10 16:07 . 2009-08-11 15:31

---

d

---

w- c:documents and settingsAdminApplication DataVKLife
2009-08-09 11:00 . 2009-08-09 11:00

---

d

---

w- c:documents and settingsAdminApplication DataNeroDigital(TM)
2009-08-08 18:09 . 2009-08-08 18:10

---

d

---

w- c:program filesCanon
2009-08-08 18:00 . 2005-08-26 05:00 8704 —-a-w- c:windowssystem32CNMVS78.DLL
2009-08-08 18:00 . 2005-08-26 05:00 140288 —-a-w- c:windowssystem32CNMLM78.DLL
2009-08-08 18:00 . 2008-08-19 16:15 25856 -c—a-w- c:windowssystem32dllcacheusbprint.sys
2009-08-08 18:00 . 2008-08-19 16:15 25856 —-a-w- c:windowssystem32driversusbprint.sys
2009-08-08 17:46 . 2004-04-27 07:26 5824 —-a-w- c:windowssystem32driversASUSHWIO.SYS
2009-08-07 15:44 . 2009-08-07 15:45

---

d

---

w- c:program filesQIP
2009-08-07 15:44 . 2008-12-30 11:56 131072 —-a-w- c:documents and settingsAdminApplication DataMicrosoftInternet Explorerqipsearchbar.dll
2009-08-07 13:28 . 2009-08-07 13:28

---

d

---

w- c:documents and settingsAdminApplication DataMedia Player Classic
2009-08-07 11:48 . 2009-08-07 11:48

---

d

---

w- c:documents and settingsAdminBluetooth Software
2009-08-07 11:47 . 2009-08-07 11:47

---

d

---

w- c:program filesWIDCOMM
2009-08-07 02:00 . 2008-08-19 20:15 6272 —-a-w- c:windowssystem32driverssplitter.sys
2009-08-07 02:00 . 2008-08-19 20:15 142592 —-a-w- c:windowssystem32driversaec.sys
2009-08-07 02:00 . 2008-08-19 20:15 56576 —-a-w- c:windowssystem32driversswmidi.sys
2009-08-07 02:00 . 2008-08-19 20:15 52864 —-a-w- c:windowssystem32driversDMusic.sys
2009-08-07 02:00 . 2008-08-19 20:15 7552 —-a-w- c:windowssystem32driversMSKSSRV.sys
2009-08-07 02:00 . 2008-08-19 20:15 5376 —-a-w- c:windowssystem32driversMSPCLOCK.sys
2009-08-07 02:00 . 2008-08-19 20:15 2944 —-a-w- c:windowssystem32driversdrmkaud.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-16 14:37 . 2009-08-07 08:41

---

d

---

w- c:documents and settingsAll UsersApplication DataNero
2009-08-09 14:13 . 2009-08-06 22:05 86327 —-a-w- c:windowspchealthhelpctrOfflineCacheindex.dat
2009-08-08 18:01 . 2009-08-08 18:01

---

d—h—w- c:documents and settingsAll UsersApplication DataCanonBJ
2009-08-08 11:11 . 2009-08-06 22:23

---

d

---

w- c:program filesOpera
2009-08-07 13:50 . 2009-08-07 08:51

---

d

---

w- c:documents and settingsAdminApplication DataNero
2009-08-07 09:20 . 2009-08-07 09:08 12328 —-a-w- c:documents and settingsAdminLocal SettingsApplication DataGDIPFONTCACHEV1.DAT
2009-08-07 09:20 . 2009-08-07 09:20

---

d

---

w- c:documents and settingsAll UsersApplication DataAdobe Systems
2009-08-07 09:19 . 2009-08-07 09:19

---

d

---

w- c:program filesCommon FilesAdobe Systems Shared
2009-08-07 09:18 . 2009-08-07 09:18

---

d

---

w- c:program filesCommon FilesAdobe
2009-08-07 09:06 . 2009-08-07 08:41

---

d

---

w- c:program filesCommon FilesNero
2009-08-07 08:54 . 2008-04-15 12:00 76880 —-a-w- c:windowssystem32perfc019.dat
2009-08-07 08:54 . 2008-04-15 12:00 448696 —-a-w- c:windowssystem32perfh019.dat
2009-08-07 08:53 . 2009-08-07 08:41

---

d

---

w- c:program filesNero
2009-08-07 08:51 . 2009-08-07 08:51

---

d

---

w- c:program filesWindows Sidebar
2009-08-07 01:59 . 2009-08-07 01:59

---

d

---

w- c:program filesAnalog Devices
2009-08-07 01:58 . 2009-08-07 01:58 0 —-a-w- c:windowsativpsrm.bin
2009-08-06 22:36 . 2009-08-06 22:32

---

d

---

w- c:documents and settingsAdminApplication DataWinamp
2009-08-06 22:32 . 2009-08-06 22:32

---

d

---

w- c:program filesWinamp
2009-08-06 22:32 . 2009-08-06 22:32

---

d

---

w- c:program filesK-Lite Codec Pack
2009-08-06 22:22 . 2009-08-06 22:22

---

d

---

w- c:program filesAlwil Software
2009-08-06 22:19 . 2009-08-06 22:19

---

d

---

w- c:program filesNetUP
2009-08-06 22:09 . 2009-08-06 22:09

---

d

---

w- c:program filesVistaDriveIcon
2009-08-06 22:09 . 2009-08-06 22:09 717296 —-a-w- c:windowssystem32driverssptd.sys
2009-08-06 22:09 . 2009-08-06 22:09

---

d

---

w- c:program filesPaint.NET
2009-08-06 22:08 . 2009-08-06 22:08

---

d

---

w- c:program filesCommon FilesJava
2009-08-06 22:02 . 2009-08-06 22:02 22564 —-a-w- c:windowssystem32emptyregdb.dat
2009-08-06 22:02 . 2009-08-06 22:02

---

d

---

w- c:program filesWindows Media Connect 2
.

---

Sigcheck

---

[-] 2008-08-19 16:23 579072 23B7D3F3F5EC8FEEA75EC381C71CBD5E c:windowssystem32user32.dll

[-] 2008-08-19 16:23 952832 40B6EA7C0D015C1C7589D6C522E6788C c:windowssystem32wininet.dll

[-] 2008-08-19 16:20 361600 6A104BA98D99D53AB0C91825CE659FC6 c:windowssystem32driverstcpip.sys

[-] 2008-08-19 16:22 1721344 62EA07EDF5E3F3FF34EFF9BF7619BC64 c:windowsexplorer.exe

[-] 2008-08-19 16:21 30208 B8B35F99DADAA5459FBA639F20045FE2 c:windowssystem32ctfmon.exe

[-] 2008-08-19 16:23 80584 12C93B7A07D53F41AF31E3AE2276328D c:windowssystem32wuauclt.exe

[-] 2008-08-19 16:21 855040 4B75AE37D40D76FB155139758D17940B c:windowssystem32comres.dll

[-] 2008-08-21 17:34 1571840 66452823532746FA58EFEDBA320F46A2 c:windowssystem32sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-08-15_16.46.09 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-08-16 16:14 . 2009-08-16 16:14 16384 c:windowsTempPerflib_Perfdata_648.dat
+ 2004-04-01 12:30 . 2004-04-01 12:30 10368 c:windowssystem32driverspfc.sys
+ 2009-08-16 12:02 . 2009-08-16 12:02 65536 c:windowsInstaller{86EF9FC4-F209-4520-B7E1-C7FF0EEBDFFF}NewShortcut4_E3A4979EE8C048379F3D271B50BA9E7C.exe
+ 2009-08-16 12:02 . 2009-08-16 12:02 65536 c:windowsInstaller{86EF9FC4-F209-4520-B7E1-C7FF0EEBDFFF}NewShortcut2_E3A4979EE8C048379F3D271B50BA9E7C.exe
+ 2009-08-16 12:02 . 2009-08-16 12:02 65536 c:windowsInstaller{86EF9FC4-F209-4520-B7E1-C7FF0EEBDFFF}NewShortcut1_E3A4979EE8C048379F3D271B50BA9E7C.exe
+ 2009-08-16 12:02 . 2009-08-16 12:02 65536 c:windowsInstaller{86EF9FC4-F209-4520-B7E1-C7FF0EEBDFFF}ARPPRODUCTICON.exe
+ 2004-04-05 06:31 . 2004-04-05 06:31 348160 c:windowsInstaller$PatchCache$Managed4CF9FE68902F02547B1E7CFFE0BEFDFF1.5.0msvcr71.dll
+ 2004-04-05 06:31 . 2004-04-05 06:31 499712 c:windowsInstaller$PatchCache$Managed4CF9FE68902F02547B1E7CFFE0BEFDFF1.5.0msvcp71.dll
+ 2004-04-05 06:31 . 2004-04-05 06:31 1060864 c:windowsInstaller$PatchCache$Managed4CF9FE68902F02547B1E7CFFE0BEFDFF1.5.0mfc71.dll
+ 2009-08-16 12:02 . 2009-08-16 12:02 11162112 c:windowsInstaller3d278.msi
+ 2009-08-16 12:00 . 2009-08-16 12:00 31057920 c:windowsDownloaded Installations{35C2718C-FF5F-493C-BAB7-9366A3D34245}Adobe Audition 1.5.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
«utm5_wintray»=»c:program filesNetUPUTM5_wintrayutm5_wintray.exe» [2005-12-25 462848]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«SoundMAXPnP»=»c:program filesAnalog DevicesCoresmax4pnp.exe» [2007-03-16 868352]
«WinampAgent»=»c:program filesWinampwinampa.exe» [2008-09-12 36352]
«avast!»=»c:progra~1ALWILS~1Avast4ashDisp.exe» [2009-02-05 81000]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-08-19 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» — c:windowssystem32advpack.dll [2008-08-19 124928]
«IE7_012″=»advpack.dll» — c:windowssystem32advpack.dll [2008-08-19 124928]

c:documents and settingsAll Usersѓ« ў­®Ґ ¬Ґ­оЏа®Ја ¬¬лЂўв®§ Јаг§Є 
BTTray.lnk — c:program filesWIDCOMMЏа®Ја ¬¬­®Ґ ®ЎҐбЇҐзҐ­ЁҐ BluetoothBTTray.exe [2006-5-12 581693]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesDisableNotify»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusOverride»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=

R1 aswSP;avast! Self Protection;c:windowssystem32driversaswSP.sys [14.08.2009 18:45 114768]
R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [14.08.2009 18:45 20560]
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.yandex.ru/?clid=47540
uDefault_Search_URL = hxxp://search.qip.ru
uSearchURL,(Default) = hxxp://search.qip.ru/search?query=%s&from=IE
IE: Отправить через &Bluetooth — c:program filesWIDCOMMПрограммное обеспечение Bluetoothbtsendto_ie_ctx.htm
TCP: {70FDB89E-D0E0-4336-86A6-8CB52AA2032A} = 172.20.254.244
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-16 20:32
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘winlogon.exe'(692)
c:windowssystem32SETUPAPI.dll
c:windowssystem32Ati2evxx.dll
c:windowssystem32cscui.dll
c:windowssystem32COMRes.dll

— — — — — — — > ‘lsass.exe'(748)
c:windowssystem32setupapi.dll

— — — — — — — > ‘explorer.exe'(43696)
c:windowssystem32SHDOCVW.dll
c:windowssystem32COMRes.dll
c:windowsSystem32cscui.dll
c:windowssystem32NETSHELL.dll
c:windowssystem32SETUPAPI.dll
c:windowssystem32wpdshserviceobj.dll
c:windowssystem32portabledevicetypes.dll
c:windowssystem32portabledeviceapi.dll
c:windowssystem32msxml3.dll
c:windowssystem32msi.dll
.
Completion time: 2009-08-16 20:33
ComboFix-quarantined-files.txt 2009-08-16 16:33
ComboFix2.txt 2009-08-16 16:27
ComboFix3.txt 2009-08-16 16:20
ComboFix4.txt 2009-08-15 16:56
ComboFix5.txt 2009-08-16 16:30

Pre-Run: 12 270 157 824 байт свободно
Post-Run: 12 261 380 096 байт свободно

192

[kolkasp]

как убрать эту дрянь? C:Documents and SettingsNetworkServiceLocal SettingsTemporary Internet FilesContent.IE5189W4RQSvsweps[1].bmp — Win32/Conficker.Z червь —

[kolkasp]

про проблему скажу следующие. вот когда в интернете сидшь, через некоторое время соединение прекращается и все виснит, что даже в пуск зайти нельзя. только кнопка перезагрузки спасает. А после перезагрузки все работает и через некоторое время опять тоже самое.

[kolkasp]

C:Documents and SettingsNetworkServiceLocal SettingsTemporary Internet FilesContent.IE5189W4RQSvsweps[1].bmp — Win32/Conficker.Z червь — очищен удалением — изолирован. сканирую nod32 и опять появляется. сейчас сканировал вот этой прогComboFix.exe, на данный момент нод32 не чего не нашел. Эта прога ComboFix.exe удалала его или он глубже ушел?

[kolkasp]

что вы можете сказать?

[Автор]

Сообщения