SPYWARE-RU.COM

Созданные ответы форума

Просмотр 5 сообщений - с 1 по 5 (из 5 всего)

Автор

Сообщения
21 апреля, 2010 в 6:53 пп в ответ на: надеюсь на вашу помощь!! #28062
Mandarina
Participant
- Темы:1
- Сообщений:6
сделала так, как вы сказали…

после того, как ComboFix выдал свой лог, Avira опять нашла эту гадину…
вот лог:

ComboFix 10-04-21.01 — Nely 21.04.2010 21:42:00.2.2 — FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1033.18.2013.1469 [GMT 3:00]
Running from: c:documents and settingsNelyDesktopComboFix.exe
Command switches used :: c:documents and settingsNelyDesktopCFScript.txt
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr0.dat
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr1.dat
c:documents and settingsNelyLocal SettingsTemporary Internet FilesSF0ED.gif

BITS: Possible infected sites

hxxp://soft.export.yandex.ru
hxxp://download.yandex.ru
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

Legacy_OIXSOPOB

Service_oixsopob

((((((((((((((((((((((((( Files Created from 2010-03-21 to 2010-04-21 )))))))))))))))))))))))))))))))
.

2010-04-20 07:22 . 2010-04-20 07:22

d

w- c:documents and settingsAll UsersApplication DataMcAfee
2010-04-20 07:22 . 2010-04-20 07:23 1924976 —-a-w- c:documents and settingsAll UsersApplication DataNOSAdobe_Downloadsinstall_flash_player.exe
2010-04-20 07:22 . 2010-04-20 07:22

d

w- c:documents and settingsAll UsersApplication DataNOS
2010-04-13 12:14 . 2010-04-13 12:14

d

w- c:windowssystem32xircom
2010-04-13 12:14 . 2010-04-13 12:14

d

w- c:windowssystem32wbemsnmp
2010-04-13 12:14 . 2010-04-13 12:14

d

w- c:program filesmicrosoft frontpage
2010-04-12 15:37 . 2010-04-12 15:37

d

w- c:program filestrend micro
2010-04-12 15:37 . 2010-04-12 15:37

d

w- C:rsit
2010-04-12 10:05 . 2010-04-12 10:05

d

w- C:FOUND.004
2010-04-10 14:45 . 2010-04-10 14:45

d

w- C:FOUND.003
2010-04-10 14:24 . 2010-04-10 14:24

d

w- C:FOUND.002
2010-04-10 14:19 . 2010-03-09 10:12 162640 —-a-w- c:windowssystem32driversaswSP.sys
2010-04-10 14:19 . 2010-03-09 10:08 19024 —-a-w- c:windowssystem32driversaswFsBlk.sys
2010-04-10 14:19 . 2010-03-09 10:09 23376 —-a-w- c:windowssystem32driversaswRdr.sys
2010-04-10 14:19 . 2010-03-09 10:12 46672 —-a-w- c:windowssystem32driversaswTdi.sys
2010-04-10 14:19 . 2010-03-09 10:08 100432 —-a-w- c:windowssystem32driversaswmon2.sys
2010-04-10 14:19 . 2010-03-09 10:08 94800 —-a-w- c:windowssystem32driversaswmon.sys
2010-04-10 14:19 . 2010-03-09 10:08 28880 —-a-w- c:windowssystem32driversaavmker4.sys
2010-04-10 14:19 . 2010-03-09 10:24 38848 —-a-w- c:windowssystem32avastSS.scr
2010-04-10 14:19 . 2010-03-09 10:24 153184 —-a-w- c:windowssystem32aswBoot.exe
2010-04-10 14:19 . 2010-04-10 14:19

d

w- c:documents and settingsAll UsersApplication DataAlwil Software
2010-04-10 12:53 . 2010-04-10 12:53

d

w- c:program filesAnVir Task Manager
2010-04-10 12:51 . 2010-04-10 12:51

d

w- c:documents and settingsNelyLocal SettingsApplication DataAnVir
2010-04-06 16:32 . 2010-04-06 16:32

d

w- C:FOUND.001
2010-04-05 20:04 . 2010-04-21 18:45 804864 —-a-w- c:windowssystem32driversoixsopob.sys
2010-04-05 16:36 . 2010-04-05 16:36

d

w- c:documents and settingsNelyDoctorWeb

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-13 11:53 . 2009-09-16 23:24 86327 —-a-w- c:windowspchealthhelpctrOfflineCacheindex.dat
2010-04-11 15:18 . 2010-04-11 15:18 8 —-a-w- c:documents and settingsNelyApplication Datagmzalr.dat
2010-03-22 16:44 . 2010-03-22 16:44

d

w- c:program filesEnglish Practice
2010-03-18 14:08 . 2010-03-18 14:08

d

w- c:documents and settingsAll UsersApplication DataKnowledge Adventure
2010-03-13 17:41 . 2010-03-13 17:41

d

w- c:program filesLizardTech
2010-03-02 09:25 . 2010-03-02 09:25

d

w- c:program filesICQ7.0
2010-03-01 16:51 . 2010-03-01 16:51

d

w- c:program filesPoigraika
2010-02-21 06:26 . 2010-02-21 06:26

d

w- c:program filesIDDK
2010-02-18 14:44 . 2010-02-18 14:42 3741179 —-a-w- c:program filesuiso9_pe.exe
2010-02-14 08:08 . 2010-02-14 08:08 98304 —-a-w- c:windowssystem32CmdLineExt.dll
2010-02-07 07:29 . 2010-02-07 07:28 563864 —-a-w- c:program filesChromeSetup.exe
2010-02-05 09:30 . 2009-09-16 20:59 691696 —-a-w- c:windowssystem32driverssptd.sys
2010-01-29 12:46 . 2010-01-29 12:43 12109496 —-a-w- c:program filesinstall_icq7.exe
.

Sigcheck

[-] 2008-12-30 . 5AE1C2695F6523AD98B948F2887D8C5E . 361600 . . [5.1.2600.5649] . . c:windowssystem32driverstcpip.sys
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:windows$hf_mig$KB951748SP3QFEtcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:windowssystem32dllcachetcpip.sys

c:windowsSystem32wscntfy.exe … is missing !!
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«avgnt»=»c:program filesAviraAntiVir Desktopavgnt.exe» [2009-03-02 209153]
«BIH»=»bih.dll» [2009-09-16 208896]
«Adobe Reader Speed Launcher»=»c:program filesAdobeReader 9.0ReaderReader_sl.exe» [2010-04-04 36272]
«Adobe ARM»=»c:program filesCommon FilesAdobeARM1.0AdobeARM.exe» [2010-03-24 952768]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«ctfmon.exe»=»c:windowssystem32ctfmon.exe» [2008-04-14 15360]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«_nltide_3″=»advpack.dll» [2008-04-14 99840]

c:documents and settingsNelyStart MenuProgramsStartup
Punto Switcher.lnk — c:program filesYandexPunto Switcherpunto.exe [2009-9-17 831272]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoResolveTrack»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoResolveTrack»= 1 (0x1)

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotifyLMIinit]
2009-10-02 19:12 87352 —-a-w- c:windowssystem32LMIinit.dll

[HKLM~startupfolderC:^Documents and Settings^All Users^Start Menu^Programs^Startup^IP-TV Player Agent.lnk]
path=c:documents and settingsAll UsersStart MenuProgramsStartupIP-TV Player Agent.lnk
backup=c:windowspssIP-TV Player Agent.lnkCommon Startup

[HKLM~startupfolderC:^Documents and Settings^All Users^Start Menu^Programs^Startup^SJphone 1.65.lnk]
path=c:documents and settingsAll UsersStart MenuProgramsStartupSJphone 1.65.lnk
backup=c:windowspssSJphone 1.65.lnkCommon Startup

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregACMON]
2008-09-30 20:02 851968 —-a-w- c:program filesASUSSplendidACMON.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe Reader Speed Launcher]
2010-04-04 05:42 36272 —-a-w- c:program filesAdobeReader 9.0Readerreader_sl.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregASUS Live Update]
2007-11-30 08:20 51768 —-a-w- c:program filesASUSASUS Live UpdateALU.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregATKHOTKEY]
2009-03-20 17:37 174648 —-a-w- c:program filesASUSATK HotkeyHControl.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregATKMEDIA]
2009-04-07 06:34 159744 —-a-w- c:program filesASUSATK MediaDMedia.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregATKOSD2]
2009-03-04 07:26 8392704 —-a-w- c:program filesASUSATKOSD2ATKOSD2.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregETDWare]
2009-03-30 09:04 418816 —-a-w- c:program filesElantechETDCtrl.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregHControlUser]
2008-08-18 07:56 98304 —-a-w- c:program filesASUSATK HotkeyHControlUser.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregHDAudDeck]
2009-03-23 12:06 33599488 —-a-w- c:program filesVIAVIAudioiHDADeckHDECK.EXE

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregHotKeysCmds]
2009-02-26 10:37 173592 —-a-w- c:windowssystem32hkcmd.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIgfxTray]
2009-02-26 10:37 141336 —-a-w- c:windowssystem32igfxtray.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregMsgTranAgt]
2008-08-18 08:27 117304 —-a-w- c:program filesASUSATK HotkeyMsgTranAgt.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNet4Switch]
2007-11-20 10:44 1145400

w- c:program filesASUSNet4SwitchNet4Switch.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPersistence]
2009-02-26 10:37 142360 —-a-w- c:windowssystem32igfxpers.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregUnlockerAssistant]
2008-05-01 21:15 15872 —-a-w- c:program filesUnlockerUnlockerAssistant.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregWireless Console 3]
2009-02-06 13:13 1593344 —-a-w- c:program filesASUSWireless Console 3wcourier.exe

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«DisableUnicastResponsesToMulticastBroadcast»= 0 (0x0)

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«c:\Program Files\uTorrent\uTorrent.exe»=
«c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE»=
«c:\Program Files\TeamViewer\Version4\TeamViewer.exe»=
«c:\Program Files\SJphone 1.65\SJphone.exe»=
«c:\Program Files\ICQ7.0\ICQ.exe»=
«c:\Program Files\Rosetta Stone\Rosetta Stone Version 3\support\bin\win\RosettaStoneLtdServices.exe»=
«c:\Program Files\Rosetta Stone\Rosetta Stone Version 3\RosettaStoneVersion3.exe»=
«c:\Program Files\ICQ7.0\aolload.exe»=
«c:\WINDOWS\Network Diagnostic\xpnetdiag.exe»=
«c:\WINDOWS\system32\sessmgr.exe»=
«c:\Program Files\Skype\Phone\Skype.exe»=

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«3389:TCP»= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

R1 aswSP;aswSP;c:windowssystem32driversaswSP.sys [10.04.2010 17:19 162640]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:program filesAviraAntiVir Desktopsched.exe [16.09.2009 13:35 108289]
R3 CRFILTER;USB Mass Storage Filter;c:windowssystem32driverscrfilter.sys [07.04.2008 14:00 6656]
R3 ETD;ELAN PS/2 Port Input Device;c:windowssystem32driversETD.sys [16.09.2009 13:13 129024]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:windowssystem32driversviahduaa.sys [17.09.2009 03:00 1057280]
S2 aswFsBlk;aswFsBlk;aswFsBlk.sys —> aswFsBlk.sys [?]
S2 LMIInfo;LogMeIn Kernel Information Provider;??c:program filesLogMeInx86RaInfo.sys —> c:program filesLogMeInx86RaInfo.sys [?]
S3 cmo_bus;Data Modem @ CDMA Composite Device driver (WDM);c:windowssystem32driverscmo_bus.sys [30.11.2009 09:52 58352]
S3 cmo_mdfl;Data Modem @ CDMA Filter;c:windowssystem32driverscmo_mdfl.sys [30.11.2009 09:52 8304]
S3 cmo_mdm;Data Modem @ CDMA Drivers;c:windowssystem32driverscmo_mdm.sys [30.11.2009 09:52 93904]
S3 cmo_serd;Data Modem @ CDMA Diagnostic Serial Port (WDM);c:windowssystem32driverscmo_serd.sys [30.11.2009 09:52 73696]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:windowssystem32driversewusbnet.sys [15.12.2009 17:56 100992]
S3 ICQ Service;ICQ Service;c:program filesICQ6ToolbarICQ Service.exe [29.01.2010 15:54 246520]
S3 ipswuio;ipswuio;c:windowssystem32driversipswuio.sys [16.09.2009 13:10 41656]
S4 sptd;sptd;c:windowssystem32driverssptd.sys [16.09.2009 23:59 691696]

— Other Services/Drivers In Memory —

*NewlyCreated* — ASPI32
.
Contents of the ‘Scheduled Tasks’ folder

2010-03-18 c:windowsTasksGoogleUpdateTaskUserS-1-5-21-117609710-616249376-1801674531-1003Core1cac69151b54ff8.job
— c:documents and settingsNelyLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe [2010-02-07 07:29]
.
.

Supplementary Scan

.
uStart Page = hxxp://www.yandex.ru/?clid=41128
uInternet Connection Wizard,ShellNext = iexplore
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
IE: Add to Google Photos Screensa&ver — c:windowssystem32GPhotos.scr/200
IE: {{88EB38EF-4D2C-436D-ABD3-56B232674062} — c:program filesICQ7.0ICQ.exe
TCP: {8B233879-82D2-4704-83C4-7A4A680231A7} = 192.168.1.1,192.168.1.11,192.168.0.254
FF — ProfilePath — c:documents and settingsNelyApplication DataMozillaFirefoxProfilese25dgtnz.default
FF — prefs.js: browser.search.selectedEngine — Google
FF — prefs.js: browser.startup.homepage — hxxp://bill.quickdialusa.net/bill/
FF — prefs.js: keyword.URL — hxxp://yandex.ru/yandsearch?clid=129579&yasoft=barff&text=
FF — plugin: c:documents and settingsNelyLocal SettingsApplication DataGoogleUpdate1.2.183.23npGoogleOneClick8.dll
FF — plugin: c:program filesGooglePicasa3npPicasa3.dll
FF — plugin: c:program filesMozilla Firefoxpluginsnpdjvu.dll

—- FIREFOX POLICIES —-
c:program filesMozilla Firefoxgreprefsall.js — pref(«ui.use_native_colors», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«ui.use_native_popup_windows», false);
c:program filesMozilla Firefoxgreprefsall.js — pref(«browser.enable_click_image_resizing», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«accessibility.browsewithcaret_shortcut.enabled», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«javascript.options.mem.high_water_mark», 32);
c:program filesMozilla Firefoxgreprefsall.js — pref(«javascript.options.mem.gc_frequency», 1600);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.auth.force-generic-ntlm», false);
c:program filesMozilla Firefoxgreprefsall.js — pref(«svg.smil.enabled», false);
c:program filesMozilla Firefoxgreprefsall.js — pref(«ui.trackpoint_hack.enabled», -1);
c:program filesMozilla Firefoxgreprefsall.js — pref(«browser.formfill.debug», false);
c:program filesMozilla Firefoxgreprefsall.js — pref(«browser.formfill.agedWeight», 2);
c:program filesMozilla Firefoxgreprefsall.js — pref(«browser.formfill.bucketSize», 1);
c:program filesMozilla Firefoxgreprefsall.js — pref(«browser.formfill.maxTimeGroupings», 25);
c:program filesMozilla Firefoxgreprefsall.js — pref(«browser.formfill.timeGroupingSize», 604800);
c:program filesMozilla Firefoxgreprefsall.js — pref(«browser.formfill.boundaryWeight», 25);
c:program filesMozilla Firefoxgreprefsall.js — pref(«browser.formfill.prefixWeight», 5);
c:program filesMozilla Firefoxgreprefsall.js — pref(«html5.enable», false);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js — pref(«security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref», true);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js — pref(«security.ssl.renego_unrestricted_hosts», «»);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js — pref(«security.ssl.treat_unsafe_negotiation_as_broken», false);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js — pref(«security.ssl.require_safe_negotiation», false);
c:program filesMozilla Firefoxdefaultspreffirefox-branding.js — pref(«app.update.download.backgroundInterval», 600);
c:program filesMozilla Firefoxdefaultspreffirefox-branding.js — pref(«app.update.url.manual», «http://www.firefox.com»);
c:program filesMozilla Firefoxdefaultspreffirefox-branding.js — pref(«browser.search.param.yahoo-fr-ja», «mozff»);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name», «chrome://browser/locale/browser.properties»);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description», «chrome://browser/locale/browser.properties»);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«xpinstall.whitelist.add», «addons.mozilla.org»);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«xpinstall.whitelist.add.36», «getpersonas.com»);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«lightweightThemes.update.enabled», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«browser.allTabs.previews», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«plugins.hide_infobar_for_outdated_plugin», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«plugins.update.notifyUser», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«toolbar.customization.usesheet», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«browser.taskbar.previews.enable», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«browser.taskbar.previews.max», 20);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«browser.taskbar.previews.cachetime», 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-21 21:46
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

DLLs Loaded Under Running Processes

— — — — — — — > ‘winlogon.exe'(652)
c:windowssystem32LMIinit.dll

— — — — — — — > ‘explorer.exe'(3116)
c:program filesYandexPunto Switcherpshook.dll
c:windowssystem32msi.dll
.

Other Running Processes

.
c:program filesAviraAntiVir Desktopavguard.exe
c:windowssystem32rundll32.exe
.
**************************************************************************
.
Completion time: 2010-04-21 21:47:22 — machine was rebooted
ComboFix-quarantined-files.txt 2010-04-21 18:47
ComboFix2.txt 2010-04-13 11:26

Pre-Run: 23 765 778 432 bytes free
Post-Run: 23 923 163 136 bytes free

— — End Of File — — B4EA8CD96C41175F95B515AF7C16B51A
20 апреля, 2010 в 8:30 дп в ответ на: надеюсь на вашу помощь!! #28061
Mandarina
Participant
- Темы:1
- Сообщений:6
очень надеюсь, что вы поможете мне…
14 апреля, 2010 в 3:36 пп в ответ на: надеюсь на вашу помощь!! #28058
Mandarina
Participant
- Темы:1
- Сообщений:6
моя история получила продолжение: вот результат сканирования Avira :

то есть теперь у меня остался какой-то паразит? а как его убить??

Avira AntiVir Personal
Report file date: 14 апреля 2010 г. 17:10

Scanning for 1993817 virus strains and unwanted programs.

Licensee : Avira AntiVir Personal — FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows XP
Windows version : (Service Pack 3) [5.1.2600]
Boot mode : Normally booted
Username : SYSTEM
Computer name : NELIA

Version information:
BUILD.DAT : 9.0.0.422 21701 Bytes 09.03.2010 10:29:00
AVSCAN.EXE : 9.0.3.10 466689 Bytes 27.11.2009 10:47:16
AVSCAN.DLL : 9.0.3.0 40705 Bytes 27.02.2009 08:58:26
LUKE.DLL : 9.0.3.2 209665 Bytes 20.02.2009 09:35:50
LUKERES.DLL : 9.0.2.0 12033 Bytes 27.02.2009 08:58:54
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 10:47:16
VBASE001.VDF : 7.10.1.0 1372672 Bytes 19.11.2009 10:47:16
VBASE002.VDF : 7.10.3.1 3143680 Bytes 20.01.2010 13:46:04
VBASE003.VDF : 7.10.3.75 996864 Bytes 26.01.2010 15:17:52
VBASE004.VDF : 7.10.4.203 1579008 Bytes 05.03.2010 09:31:32
VBASE005.VDF : 7.10.4.204 2048 Bytes 05.03.2010 09:31:34
VBASE006.VDF : 7.10.4.205 2048 Bytes 05.03.2010 09:31:34
VBASE007.VDF : 7.10.4.206 2048 Bytes 05.03.2010 09:31:34
VBASE008.VDF : 7.10.4.207 2048 Bytes 05.03.2010 09:31:36
VBASE009.VDF : 7.10.4.208 2048 Bytes 05.03.2010 09:31:36
VBASE010.VDF : 7.10.4.209 2048 Bytes 05.03.2010 09:31:36
VBASE011.VDF : 7.10.4.210 2048 Bytes 05.03.2010 09:31:38
VBASE012.VDF : 7.10.4.211 2048 Bytes 05.03.2010 09:31:38
VBASE013.VDF : 7.10.4.242 153088 Bytes 08.03.2010 09:30:26
VBASE014.VDF : 7.10.5.17 99328 Bytes 10.03.2010 09:30:16
VBASE015.VDF : 7.10.5.44 107008 Bytes 11.03.2010 09:30:16
VBASE016.VDF : 7.10.5.69 92672 Bytes 12.03.2010 11:07:44
VBASE017.VDF : 7.10.5.91 119808 Bytes 15.03.2010 11:07:42
VBASE018.VDF : 7.10.5.121 112640 Bytes 18.03.2010 11:07:44
VBASE019.VDF : 7.10.5.138 139776 Bytes 18.03.2010 11:07:46
VBASE020.VDF : 7.10.5.164 113152 Bytes 22.03.2010 13:56:36
VBASE021.VDF : 7.10.5.182 108032 Bytes 23.03.2010 13:56:36
VBASE022.VDF : 7.10.5.199 123904 Bytes 24.03.2010 13:56:44
VBASE023.VDF : 7.10.5.217 279552 Bytes 25.03.2010 04:20:42
VBASE024.VDF : 7.10.5.234 202240 Bytes 26.03.2010 04:20:44
VBASE025.VDF : 7.10.5.254 187904 Bytes 30.03.2010 09:07:38
VBASE026.VDF : 7.10.6.18 130560 Bytes 01.04.2010 10:04:56
VBASE027.VDF : 7.10.6.34 136192 Bytes 06.04.2010 10:04:56
VBASE028.VDF : 7.10.6.44 232448 Bytes 07.04.2010 10:04:58
VBASE029.VDF : 7.10.6.60 124416 Bytes 12.04.2010 15:20:22
VBASE030.VDF : 7.10.6.61 2048 Bytes 12.04.2010 15:20:22
VBASE031.VDF : 7.10.6.68 71168 Bytes 13.04.2010 15:20:30
Engineversion : 8.2.1.210
AEVDF.DLL : 8.1.1.3 106868 Bytes 25.01.2010 14:19:24
AESCRIPT.DLL : 8.1.3.24 1282425 Bytes 06.04.2010 10:05:08
AESCN.DLL : 8.1.5.0 127347 Bytes 26.02.2010 08:55:54
AESBX.DLL : 8.1.2.1 254323 Bytes 17.03.2010 11:10:44
AERDL.DLL : 8.1.4.3 541043 Bytes 17.03.2010 11:10:26
AEPACK.DLL : 8.2.1.1 426358 Bytes 22.03.2010 13:56:42
AEOFFICE.DLL : 8.1.0.41 201083 Bytes 17.03.2010 11:10:08
AEHEUR.DLL : 8.1.1.16 2503031 Bytes 27.03.2010 04:20:54
AEHELP.DLL : 8.1.11.3 242039 Bytes 06.04.2010 10:05:02
AEGEN.DLL : 8.1.3.6 373108 Bytes 06.04.2010 10:05:00
AEEMU.DLL : 8.1.1.0 393587 Bytes 03.10.2009 19:35:40
AECORE.DLL : 8.1.13.1 188790 Bytes 06.04.2010 10:04:58
AEBB.DLL : 8.1.0.3 53618 Bytes 09.10.2008 12:32:40
AVWINLL.DLL : 9.0.0.3 18177 Bytes 12.12.2008 06:48:00
AVPREF.DLL : 9.0.3.0 44289 Bytes 18.09.2009 20:19:10
AVREP.DLL : 8.0.0.7 159784 Bytes 18.02.2010 14:19:18
AVREG.DLL : 9.0.0.0 36609 Bytes 05.12.2008 08:32:10
AVARKT.DLL : 9.0.0.3 292609 Bytes 24.03.2009 13:05:42
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30.01.2009 08:37:10
SQLITE3.DLL : 3.6.1.0 326401 Bytes 28.01.2009 13:03:50
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 02.02.2009 06:21:34
NETNT.DLL : 9.0.0.0 11521 Bytes 05.12.2008 08:32:12
RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 18.09.2009 20:19:10
RCTEXT.DLL : 9.0.73.0 86785 Bytes 27.11.2009 10:47:16

Configuration settings for the scan:
Jobname………………………..: Complete system scan
Configuration file………………: c:program filesaviraantivir desktopsysscan.avp
Logging………………………..: low
Primary action………………….: interactive
Secondary action………………..: ignore
Scan master boot sector………….: on
Scan boot sector………………..: on
Boot sectors……………………: C:, D:,
Process scan……………………: on
Scan registry…………………..: on
Search for rootkits……………..: on
Integrity checking of system files..: off
Scan all files………………….: All files
Scan archives…………………..: on
Recursion depth…………………: 20
Smart extensions………………..: on
Macro heuristic…………………: on
File heuristic………………….: medium

Start of the scan: 14 апреля 2010 г. 17:10

Starting search for hidden objects.
HKEY_LOCAL_MACHINESystemControlSet001Servicesoixsopobtype
[INFO] The registry entry is invisible.
HKEY_LOCAL_MACHINESystemControlSet001Servicesoixsopobstart
[INFO] The registry entry is invisible.
HKEY_LOCAL_MACHINESystemControlSet001Servicesoixsopoberrorcontrol
[INFO] The registry entry is invisible.
HKEY_LOCAL_MACHINESystemControlSet001Servicesoixsopobgroup
[INFO] The registry entry is invisible.
HKEY_LOCAL_MACHINESystemControlSet001Servicesoixsopobqlms5es8hj
[INFO] The registry entry is invisible.
HKEY_LOCAL_MACHINESystemControlSet001Servicesoixsopobvm4hd5fn2ki4
[INFO] The registry entry is invisible.
HKEY_LOCAL_MACHINESystemControlSet001Servicesoixsopobmt5sa3a7h4
[INFO] The registry entry is invisible.
‘145333’ objects were checked, ‘7’ hidden objects were found.

The scan of running processes will be started
Scan process ‘avscan.exe’ — ‘1’ Module(s) have been scanned
Scan process ‘avcenter.exe’ — ‘1’ Module(s) have been scanned
Scan process ‘taskmgr.exe’ — ‘1’ Module(s) have been scanned
Scan process ‘WinRAR.exe’ — ‘1’ Module(s) have been scanned
Scan process ‘WFICA32.EXE’ — ‘1’ Module(s) have been scanned
Scan process ‘Wfcrun32.exe’ — ‘1’ Module(s) have been scanned
Scan process ‘EXCEL.EXE’ — ‘1’ Module(s) have been scanned
Scan process ‘firefox.exe’ — ‘1’ Module(s) have been scanned
Scan process ‘OUTLOOK.EXE’ — ‘1’ Module(s) have been scanned
Scan process ‘skypePM.exe’ — ‘1’ Module(s) have been scanned
Scan process ‘ICQ.exe’ — ‘1’ Module(s) have been scanned
Scan process ‘Skype.exe’ — ‘1’ Module(s) have been scanned
Scan process ‘uTorrent.exe’ — ‘1’ Module(s) have been scanned
Scan process ‘avscan.exe’ — ‘1’ Module(s) have been scanned
Scan process ‘ALG.EXE’ — ‘1’ Module(s) have been scanned
Scan process ‘punto.exe’ — ‘1’ Module(s) have been scanned
Scan process ‘RUNDLL32.EXE’ — ‘1’ Module(s) have been scanned
Scan process ‘avgnt.exe’ — ‘1’ Module(s) have been scanned
Scan process ‘SVCHOST.EXE’ — ‘1’ Module(s) have been scanned
Scan process ‘avguard.exe’ — ‘1’ Module(s) have been scanned
Scan process ‘CTFMON.EXE’ — ‘1’ Module(s) have been scanned
Scan process ‘EXPLORER.EXE’ — ‘1’ Module(s) have been scanned
Scan process ‘SVCHOST.EXE’ — ‘1’ Module(s) have been scanned
Scan process ‘sched.exe’ — ‘1’ Module(s) have been scanned
Scan process ‘SPOOLSV.EXE’ — ‘1’ Module(s) have been scanned
Scan process ‘SVCHOST.EXE’ — ‘1’ Module(s) have been scanned
Scan process ‘SVCHOST.EXE’ — ‘1’ Module(s) have been scanned
Scan process ‘SVCHOST.EXE’ — ‘1’ Module(s) have been scanned
Scan process ‘SVCHOST.EXE’ — ‘1’ Module(s) have been scanned
Scan process ‘SVCHOST.EXE’ — ‘1’ Module(s) have been scanned
Scan process ‘LSASS.EXE’ — ‘1’ Module(s) have been scanned
Scan process ‘SERVICES.EXE’ — ‘1’ Module(s) have been scanned
Scan process ‘WINLOGON.EXE’ — ‘1’ Module(s) have been scanned
Scan process ‘CSRSS.EXE’ — ‘1’ Module(s) have been scanned
Scan process ‘SMSS.EXE’ — ‘1’ Module(s) have been scanned
35 processes with 35 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector ‘C:’
[INFO] No virus was found!
Boot sector ‘D:’
[INFO] No virus was found!

Starting to scan executable files (registry).
The registry was scanned ( ’54’ files ).

Starting the file scan:

Begin scan in ‘C:’
C:hiberfil.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
C:WINDOWSsystem32driversoixsopob.sys
[DETECTION] Is the TR/Rootkit.Gen Trojan
[WARNING] The file could not be opened!
Begin scan in ‘D:’

Beginning disinfection:
C:WINDOWSsystem32driversoixsopob.sys
[DETECTION] Is the TR/Rootkit.Gen Trojan
[WARNING] An error has occurred and the file was not deleted. ErrorID: 26004
[WARNING] The source file could not be found.
[NOTE] Attempting to perform action using the ARK library.
[NOTE] The file was moved to ‘4c3dd6c1.qua’!

End of the scan: 14 апреля 2010 г. 17:51
Used time: 40:34 Minute(s)

The scan has been done completely.

7533 Scanned directories
220333 Files were scanned
1 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
1 Files were moved to quarantine
0 Files were renamed
2 Files cannot be scanned
220330 Files not concerned
1046 Archives were scanned
2 Warnings
2 Notes
145333 Objects were scanned with rootkit scan
7 Hidden objects were found
13 апреля, 2010 в 11:30 дп в ответ на: надеюсь на вашу помощь!! #28059
Mandarina
Participant
- Темы:1
- Сообщений:6
когда я пошла по вашей ссылке и увидела «автор не рекомендует запускать Combofix пользователям не обладающими хорошими знаниями в компьютерной области.», мне, конечно, стало лестно.. но волосы при этом стали дыбом..

кажется, я все сделала правильно, теперь вроде бы все в порядке, потом комп выключила и при загрузке — синий экран с текстом:
a problem has been detected and windows has been shut down.
DRIVER_IRQL_NOT_LESS_OR_EQUAL

и так несколько раз… что с этим делать и что это такое, я не знаю…

а вот, собственно, лог (надо ли еще что-то делать???):

ComboFix 10-04-12.06 — Nely 13.04.2010 14:22:59.1.2 — FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1033.18.2013.1672 [GMT 3:00]
Running from: c:documents and settingsNelyDesktopComboFix.exe
Command switches used :: c:documents and settingsNelyDesktopWindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr0.dat
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr1.dat
c:documents and settingsNelyApplication Dataavdrn.dat
c:documents and settingsNelyStart MenuProgramsStartupmonsxw32.exe

BITS: Possible infected sites

hxxp://soft.export.yandex.ru
hxxp://download.yandex.ru
.
((((((((((((((((((((((((( Files Created from 2010-03-13 to 2010-04-13 )))))))))))))))))))))))))))))))
.

2010-04-12 15:37 . 2010-04-12 15:37

d

w- c:program filestrend micro
2010-04-12 15:37 . 2010-04-12 15:37

d

w- C:rsit
2010-04-12 10:05 . 2010-04-12 10:05

d

w- C:FOUND.004
2010-04-10 14:45 . 2010-04-10 14:45

d

w- C:FOUND.003
2010-04-10 14:24 . 2010-04-10 14:24

d

w- C:FOUND.002
2010-04-10 14:19 . 2010-03-09 10:12 162640 —-a-w- c:windowssystem32driversaswSP.sys
2010-04-10 14:19 . 2010-03-09 10:08 19024 —-a-w- c:windowssystem32driversaswFsBlk.sys
2010-04-10 14:19 . 2010-03-09 10:09 23376 —-a-w- c:windowssystem32driversaswRdr.sys
2010-04-10 14:19 . 2010-03-09 10:12 46672 —-a-w- c:windowssystem32driversaswTdi.sys
2010-04-10 14:19 . 2010-03-09 10:08 100432 —-a-w- c:windowssystem32driversaswmon2.sys
2010-04-10 14:19 . 2010-03-09 10:08 94800 —-a-w- c:windowssystem32driversaswmon.sys
2010-04-10 14:19 . 2010-03-09 10:08 28880 —-a-w- c:windowssystem32driversaavmker4.sys
2010-04-10 14:19 . 2010-03-09 10:24 38848 —-a-w- c:windowssystem32avastSS.scr
2010-04-10 14:19 . 2010-03-09 10:24 153184 —-a-w- c:windowssystem32aswBoot.exe
2010-04-10 14:19 . 2010-04-10 14:19

d

w- c:documents and settingsAll UsersApplication DataAlwil Software
2010-04-10 12:53 . 2010-04-10 12:53

d

w- c:program filesAnVir Task Manager
2010-04-10 12:51 . 2010-04-10 12:51

d

w- c:documents and settingsNelyLocal SettingsApplication DataAnVir
2010-04-06 16:32 . 2010-04-06 16:32

d

w- C:FOUND.001
2010-04-05 16:36 . 2010-04-05 16:36

d

w- c:documents and settingsNelyDoctorWeb
2010-03-22 16:44 . 2010-03-22 16:44

d

w- c:program filesEnglish Practice
2010-03-18 14:08 . 2010-03-18 14:08

d

w- c:documents and settingsAll UsersApplication DataKnowledge Adventure
2010-03-16 09:51 . 2010-03-16 09:51

d—h—w- c:windowssystem32GroupPolicy

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-11 15:18 . 2010-04-11 15:18 8 —-a-w- c:documents and settingsNelyApplication Datagmzalr.dat
2010-03-13 17:41 . 2010-03-13 17:41

d

w- c:program filesLizardTech
2010-03-02 09:25 . 2010-03-02 09:25

d

w- c:program filesICQ7.0
2010-03-01 16:51 . 2010-03-01 16:51

d

w- c:program filesPoigraika
2010-02-21 06:26 . 2010-02-21 06:26

d

w- c:program filesIDDK
2010-02-18 14:44 . 2010-02-18 14:42 3741179 —-a-w- c:program filesuiso9_pe.exe
2010-02-16 12:37 . 2010-02-16 12:37

d

w- c:program filesMySQL-Front
2010-02-16 12:37 . 2010-02-16 12:37

d

w- c:documents and settingsNelyApplication DataMySQL-Front
2010-02-14 11:52 . 2010-02-14 11:52

d

w- c:program filesCommon FilesMacrovision Shared
2010-02-14 11:52 . 2010-02-14 11:52

d

w- c:program filesRosetta Stone
2010-02-14 11:52 . 2010-02-14 11:52

d

w- c:documents and settingsAll UsersApplication DataRosetta Stone
2010-02-14 08:08 . 2010-02-14 08:08 98304 —-a-w- c:windowssystem32CmdLineExt.dll
2010-02-07 07:29 . 2010-02-07 07:28 563864 —-a-w- c:program filesChromeSetup.exe
2010-02-05 09:30 . 2009-09-16 20:59 691696 —-a-w- c:windowssystem32driverssptd.sys
2010-01-29 12:46 . 2010-01-29 12:43 12109496 —-a-w- c:program filesinstall_icq7.exe
.

Sigcheck

[-] 2008-12-30 . 5AE1C2695F6523AD98B948F2887D8C5E . 361600 . . [5.1.2600.5649] . . c:windowssystem32driverstcpip.sys
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:windows$hf_mig$KB951748SP3QFEtcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:windowssystem32dllcachetcpip.sys

c:windowsSystem32wscntfy.exe … is missing !!
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«DAEMON Tools Lite»=»c:program filesDAEMON Tools LiteDTLite.exe» [2009-10-30 369200]
«AnVir Task Manager»=»c:program filesAnVir Task ManagerAnVir.exe» [2010-04-02 3248352]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«avgnt»=»c:program filesAviraAntiVir Desktopavgnt.exe» [2009-03-02 209153]
«BIH»=»bih.dll» [2009-09-16 208896]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«ctfmon.exe»=»c:windowssystem32ctfmon.exe» [2008-04-14 15360]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«_nltide_3″=»advpack.dll» [2008-04-14 99840]

c:documents and settingsNelyStart MenuProgramsStartup
Punto Switcher.lnk — c:program filesYandexPunto Switcherpunto.exe [2009-9-17 831272]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoResolveTrack»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)

[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoResolveTrack»= 1 (0x1)

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotifyLMIinit]
2009-10-02 19:12 87352 —-a-w- c:windowssystem32LMIinit.dll

[HKLM~startupfolderC:^Documents and Settings^All Users^Start Menu^Programs^Startup^IP-TV Player Agent.lnk]
path=c:documents and settingsAll UsersStart MenuProgramsStartupIP-TV Player Agent.lnk
backup=c:windowspssIP-TV Player Agent.lnkCommon Startup

[HKLM~startupfolderC:^Documents and Settings^All Users^Start Menu^Programs^Startup^SJphone 1.65.lnk]
path=c:documents and settingsAll UsersStart MenuProgramsStartupSJphone 1.65.lnk
backup=c:windowspssSJphone 1.65.lnkCommon Startup

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregACMON]
2008-09-30 20:02 851968 —-a-w- c:program filesASUSSplendidACMON.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe Reader Speed Launcher]
2009-12-21 22:57 35760 —-a-w- c:program filesAdobeReader 9.0Readerreader_sl.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregASUS Live Update]
2007-11-30 08:20 51768 —-a-w- c:program filesASUSASUS Live UpdateALU.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregATKHOTKEY]
2009-03-20 17:37 174648 —-a-w- c:program filesASUSATK HotkeyHControl.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregATKMEDIA]
2009-04-07 06:34 159744 —-a-w- c:program filesASUSATK MediaDMedia.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregATKOSD2]
2009-03-04 07:26 8392704 —-a-w- c:program filesASUSATKOSD2ATKOSD2.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregETDWare]
2009-03-30 09:04 418816 —-a-w- c:program filesElantechETDCtrl.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregHControlUser]
2008-08-18 07:56 98304 —-a-w- c:program filesASUSATK HotkeyHControlUser.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregHDAudDeck]
2009-03-23 12:06 33599488 —-a-w- c:program filesVIAVIAudioiHDADeckHDECK.EXE

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregHotKeysCmds]
2009-02-26 10:37 173592 —-a-w- c:windowssystem32hkcmd.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIgfxTray]
2009-02-26 10:37 141336 —-a-w- c:windowssystem32igfxtray.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregMsgTranAgt]
2008-08-18 08:27 117304 —-a-w- c:program filesASUSATK HotkeyMsgTranAgt.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNet4Switch]
2007-11-20 10:44 1145400

w- c:program filesASUSNet4SwitchNet4Switch.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPersistence]
2009-02-26 10:37 142360 —-a-w- c:windowssystem32igfxpers.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregUnlockerAssistant]
2008-05-01 21:15 15872 —-a-w- c:program filesUnlockerUnlockerAssistant.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregWireless Console 3]
2009-02-06 13:13 1593344 —-a-w- c:program filesASUSWireless Console 3wcourier.exe

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«DisableUnicastResponsesToMulticastBroadcast»= 0 (0x0)

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«c:\Program Files\uTorrent\uTorrent.exe»=
«c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE»=
«c:\Program Files\TeamViewer\Version4\TeamViewer.exe»=
«c:\Program Files\SJphone 1.65\SJphone.exe»=
«c:\Program Files\ICQ7.0\ICQ.exe»=
«c:\Program Files\Rosetta Stone\Rosetta Stone Version 3\support\bin\win\RosettaStoneLtdServices.exe»=
«c:\Program Files\Rosetta Stone\Rosetta Stone Version 3\RosettaStoneVersion3.exe»=
«c:\Program Files\ICQ7.0\aolload.exe»=
«c:\WINDOWS\Network Diagnostic\xpnetdiag.exe»=
«c:\WINDOWS\system32\sessmgr.exe»=
«c:\Program Files\Skype\Phone\Skype.exe»=

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«3389:TCP»= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

R1 aswSP;aswSP;c:windowssystem32driversaswSP.sys [10.04.2010 17:19 162640]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:program filesAviraAntiVir Desktopsched.exe [16.09.2009 13:35 108289]
R3 ETD;ELAN PS/2 Port Input Device;c:windowssystem32driversETD.sys [16.09.2009 13:13 129024]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:windowssystem32driversviahduaa.sys [17.09.2009 03:00 1057280]
S0 sptd;sptd;c:windowssystem32driverssptd.sys [16.09.2009 23:59 691696]
S2 aswFsBlk;aswFsBlk;aswFsBlk.sys —> aswFsBlk.sys [?]
S2 LMIInfo;LogMeIn Kernel Information Provider;??c:program filesLogMeInx86RaInfo.sys —> c:program filesLogMeInx86RaInfo.sys [?]
S3 cmo_bus;Data Modem @ CDMA Composite Device driver (WDM);c:windowssystem32driverscmo_bus.sys [30.11.2009 09:52 58352]
S3 cmo_mdfl;Data Modem @ CDMA Filter;c:windowssystem32driverscmo_mdfl.sys [30.11.2009 09:52 8304]
S3 cmo_mdm;Data Modem @ CDMA Drivers;c:windowssystem32driverscmo_mdm.sys [30.11.2009 09:52 93904]
S3 cmo_serd;Data Modem @ CDMA Diagnostic Serial Port (WDM);c:windowssystem32driverscmo_serd.sys [30.11.2009 09:52 73696]
S3 CRFILTER;USB Mass Storage Filter;c:windowssystem32driverscrfilter.sys [07.04.2008 14:00 6656]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:windowssystem32driversewusbnet.sys [15.12.2009 17:56 100992]
S3 ICQ Service;ICQ Service;c:program filesICQ6ToolbarICQ Service.exe [29.01.2010 15:54 246520]
S3 ipswuio;ipswuio;c:windowssystem32driversipswuio.sys [16.09.2009 13:10 41656]

— Other Services/Drivers In Memory —

*NewlyCreated* — ASPI32
*Deregistered* — oixsopob
.
Contents of the ‘Scheduled Tasks’ folder

2010-03-18 c:windowsTasksGoogleUpdateTaskUserS-1-5-21-117609710-616249376-1801674531-1003Core1cac69151b54ff8.job
— c:documents and settingsNelyLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe [2010-02-07 07:29]
.
.

Supplementary Scan

.
uStart Page = hxxp://www.yandex.ru/?clid=41128
uInternet Connection Wizard,ShellNext = iexplore
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
IE: Add to Google Photos Screensa&ver — c:windowssystem32GPhotos.scr/200
IE: {{88EB38EF-4D2C-436D-ABD3-56B232674062} — c:program filesICQ7.0ICQ.exe
TCP: {8B233879-82D2-4704-83C4-7A4A680231A7} = 192.168.1.1,192.168.1.11,192.168.0.254
FF — ProfilePath — c:documents and settingsNelyApplication DataMozillaFirefoxProfilese25dgtnz.default
FF — prefs.js: browser.search.selectedEngine — Google
FF — prefs.js: browser.startup.homepage — hxxp://bill.quickdialusa.net/bill/
FF — prefs.js: keyword.URL — hxxp://yandex.ru/yandsearch?clid=129579&yasoft=barff&text=
FF — plugin: c:documents and settingsNelyLocal SettingsApplication DataGoogleUpdate1.2.183.23npGoogleOneClick8.dll
FF — plugin: c:program filesGooglePicasa3npPicasa3.dll
FF — plugin: c:program filesMozilla Firefoxpluginsnpdjvu.dll

—- FIREFOX POLICIES —-
c:program filesMozilla Firefoxgreprefsall.js — pref(«ui.use_native_colors», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«ui.use_native_popup_windows», false);
c:program filesMozilla Firefoxgreprefsall.js — pref(«browser.enable_click_image_resizing», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«accessibility.browsewithcaret_shortcut.enabled», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«javascript.options.mem.high_water_mark», 32);
c:program filesMozilla Firefoxgreprefsall.js — pref(«javascript.options.mem.gc_frequency», 1600);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.auth.force-generic-ntlm», false);
c:program filesMozilla Firefoxgreprefsall.js — pref(«svg.smil.enabled», false);
c:program filesMozilla Firefoxgreprefsall.js — pref(«ui.trackpoint_hack.enabled», -1);
c:program filesMozilla Firefoxgreprefsall.js — pref(«browser.formfill.debug», false);
c:program filesMozilla Firefoxgreprefsall.js — pref(«browser.formfill.agedWeight», 2);
c:program filesMozilla Firefoxgreprefsall.js — pref(«browser.formfill.bucketSize», 1);
c:program filesMozilla Firefoxgreprefsall.js — pref(«browser.formfill.maxTimeGroupings», 25);
c:program filesMozilla Firefoxgreprefsall.js — pref(«browser.formfill.timeGroupingSize», 604800);
c:program filesMozilla Firefoxgreprefsall.js — pref(«browser.formfill.boundaryWeight», 25);
c:program filesMozilla Firefoxgreprefsall.js — pref(«browser.formfill.prefixWeight», 5);
c:program filesMozilla Firefoxgreprefsall.js — pref(«html5.enable», false);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js — pref(«security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref», true);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js — pref(«security.ssl.renego_unrestricted_hosts», «»);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js — pref(«security.ssl.treat_unsafe_negotiation_as_broken», false);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js — pref(«security.ssl.require_safe_negotiation», false);
c:program filesMozilla Firefoxdefaultspreffirefox-branding.js — pref(«app.update.download.backgroundInterval», 600);
c:program filesMozilla Firefoxdefaultspreffirefox-branding.js — pref(«app.update.url.manual», «http://www.firefox.com»);
c:program filesMozilla Firefoxdefaultspreffirefox-branding.js — pref(«browser.search.param.yahoo-fr-ja», «mozff»);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name», «chrome://browser/locale/browser.properties»);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description», «chrome://browser/locale/browser.properties»);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«xpinstall.whitelist.add», «addons.mozilla.org»);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«xpinstall.whitelist.add.36», «getpersonas.com»);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«lightweightThemes.update.enabled», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«browser.allTabs.previews», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«plugins.hide_infobar_for_outdated_plugin», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«plugins.update.notifyUser», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«toolbar.customization.usesheet», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«browser.taskbar.previews.enable», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«browser.taskbar.previews.max», 20);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«browser.taskbar.previews.cachetime», 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-13 14:25
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINESystemControlSet001Servicesoixsopob]

.

DLLs Loaded Under Running Processes

— — — — — — — > ‘winlogon.exe'(672)
c:windowssystem32LMIinit.dll
.
Completion time: 2010-04-13 14:26:46
ComboFix-quarantined-files.txt 2010-04-13 11:26

Pre-Run: 21 530 247 168 bytes free
Post-Run: 21 505 097 728 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)WINDOWS
[operating systems]
c:cmdconsBOOTSECT.DAT=»Microsoft Windows Recovery Console» /cmdcons
multi(0)disk(0)rdisk(0)partition(1)WINDOWS=»Microsoft Windows XP Professional» /noexecute=optin /fastdetect /noexecute=alwaysoff

— — End Of File — — A9177A0F500A93907F27D628E2481388
12 апреля, 2010 в 5:15 пп в ответ на: надеюсь на вашу помощь!! #28056
Mandarina
Participant
- Темы:1
- Сообщений:6
также проверила программкой Gmer
вот результат:

GMER 1.0.15.15281 — http://www.gmer.net
Rootkit scan 2010-04-12 20:03:33
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:DOCUME~1NelyLOCALS~1Tempuxtdqpod.sys

—- System — GMER 1.0.15 —-

SSDT SystemRootSystem32DriversaswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xA944CC56] <— ROOTKIT !!!
SSDT SystemRootSystem32DriversaswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteKey [0xA944D0C6] <— ROOTKIT !!!
SSDT SystemRootSystem32DriversaswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xA944CFF0] <— ROOTKIT !!!
SSDT SystemRootSystem32DriversaswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xA944C6E8] <— ROOTKIT !!!
SSDT spxy.sys ZwEnumerateKey [0xF74FCDA4] <— ROOTKIT !!!
SSDT spxy.sys ZwEnumerateValueKey [0xF74FD132] <— ROOTKIT !!!
SSDT BA403922 ZwLoadKey
SSDT SystemRootSystem32DriversaswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xA944CBEC] <— ROOTKIT !!!
SSDT spxy.sys ZwQueryKey [0xF74FD20A] <— ROOTKIT !!!
SSDT SystemRootSystem32DriversaswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xA944CD0C] <— ROOTKIT !!!
SSDT SystemRootSystem32DriversaswSP.SYS (avast! self protection module/ALWIL Software) ZwRenameKey [0xA944D194] <— ROOTKIT !!!
SSDT BA40392C ZwReplaceKey
SSDT SystemRootSystem32DriversaswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xA944CCCC] <— ROOTKIT !!!

INT 0x63 ? 89B6DBF8
INT 0x63 ? 89B6DBF8
INT 0x63 ? 89B6DBF8
INT 0x63 ? 89B6DBF8
INT 0x63 ? 89877F00
INT 0x63 ? 89877F00
INT 0x63 ? 89B6DBF8
INT 0x94 ? 89877F00
INT 0xA4 ? 89877F00
INT 0xB4 ? 89877F00

—- Kernel code sections — GMER 1.0.15 —-

.text ntoskrnl.exe!ZwYieldExecution + 186 804E49C0 4 Bytes CALL C9F78E8B
? spxy.sys The system cannot find the file specified. !
? oixsopob.sys A device attached to the system is not functioning. !
.text USBPORT.SYS!DllUnload B9D98934 5 Bytes JMP 898774E0
.text agtnit31.SYS B9CDC386 35 Bytes [00, 00, 00, 00, 00, 00, 20, …]
.text agtnit31.SYS B9CDC3AA 24 Bytes [00, 00, 00, 00, 00, 00, 00, …]
.text agtnit31.SYS B9CDC3C4 3 Bytes [00, 80, 02]
.text agtnit31.SYS B9CDC3C9 1 Byte [30]
.text agtnit31.SYS B9CDC3C9 11 Bytes [30, 00, 00, 00, 5E, 02, 00, …] {XOR [EAX], AL; ADD [EAX], AL; POP ESI; ADD AL, [EAX]; ADD [EAX], AL; ADD [EAX], AL}
.text …
init C:WINDOWSsystem32driversmonfilt.sys entry point in «init» section [0xA96A7280]

—- User code sections — GMER 1.0.15 —-

.text C:WINDOWSExplorer.EXE[364] ntdll.dll!NtQueryDirectoryFile + 6 7C90D774 4 Bytes [90, 61, 62, 01] {NOP ; POPA ; BOUND EAX, [ECX]}
.text C:Program FilesMicrosoft OfficeOffice12OUTLOOK.EXE[3460] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 5 Bytes JMP 32605629 C:Program FilesCommon FilesMicrosoft Sharedoffice12mso.dll (2007 Microsoft Office component/Microsoft Corporation)
.text C:Program FilesMozilla Firefoxfirefox.exe[3608] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 004013F0 C:Program FilesMozilla Firefoxfirefox.exe (Firefox/Mozilla Corporation)

—- Kernel IAT/EAT — GMER 1.0.15 —-

IAT WINDOWSSystem32DriversSCSIPORT.SYS[ntoskrnl.exe!DbgBreakPoint] IAT pci.sys[ntoskrnl.exe!IoDetachDevice] IAT pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] IAT atapi.sys[HAL.dll!READ_PORT_USHORT] IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] IAT SystemRootsystem32DRIVERSUSBPORT.SYS[ntoskrnl.exe!DbgBreakPoint] IAT SystemRootsystem32DRIVERSi8042prt.sys[HAL.dll!READ_PORT_UCHAR] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!RtlInitUnicodeString] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!swprintf] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!KeSetEvent] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoCreateSymbolicLink] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoGetConfigurationInformation] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoDeleteSymbolicLink] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!MmFreeMappingAddress] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoFreeErrorLogEntry] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoDisconnectInterrupt] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!MmUnmapIoSpace] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!ObReferenceObjectByPointer] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IofCompleteRequest] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!RtlCompareUnicodeString] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IofCallDriver] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!MmAllocateMappingAddress] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoAllocateErrorLogEntry] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoConnectInterrupt] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoDetachDevice] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!KeWaitForSingleObject] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!KeInitializeEvent] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!KeCancelTimer] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!RtlAnsiStringToUnicodeString] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!RtlInitAnsiString] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoBuildDeviceIoControlRequest] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoQueueWorkItem] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!MmMapIoSpace] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoInvalidateDeviceRelations] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoReportDetectedDevice] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoReportResourceForDetection] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!RtlxAnsiStringToUnicodeSize] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!NlsMbCodePageTag] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!PoRequestPowerIrp] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!KeInsertByKeyDeviceQueue] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!PoRegisterDeviceFo IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!sprintf] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!MmMapLockedPagesSpecifyCache] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!ObfDereferenceObject] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoGetAttachedDeviceReference] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoInvalidateDeviceState] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!ZwClose] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!ObReferenceObjectByHandle] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!ZwCreateDirectoryObject] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoBuildSynchronousFsdRequest] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!PoStartNextPowerIrp] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoCreateDevice] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!RtlCopyUnicodeString] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoAllocateDriverOb IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!RtlQueryRegistryValues] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!ZwOpenKey] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!RtlFreeUnicodeString] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoStartTimer] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!KeInitializeTimer] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoInitializeTimer] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!KeInitializeDpc] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!KeInitializeSpinLock] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoInitializeIrp] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!ZwCreateKey] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!RtlAppendUnicodeStringToString] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!RtlIntegerToUnicodeString] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!ZwSetValueKey] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!KeInsertQueueDpc] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!KefAcquireSpinLockAtDpcLevel] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoStartPacket] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!KefReleaseSpinLockFromDpcLevel] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoBuildAsynchronousFsdRequest] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoFreeMdl] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!MmUnlockPages] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoWriteErrorLogEntry] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!KeRemoveByKeyDeviceQueue] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!MmMapLockedPagesWi IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!MmUnmapReservedMapping] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!KeSynchronizeExecution] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoStartNextPacket] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!KeBugCheckEx] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!KeRemoveDeviceQueue] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!KeSetTimer] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!_allmul] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!MmProbeAndLockPages] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!_except_handler3] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!PoSetPowerState] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoOpenDeviceRegistryKey] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!RtlWriteRegistryValue] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!RtlDeleteRegistryValue] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!_aulldiv] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!strstr] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!_strupr] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!KeQuerySystemTime] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoWMIRegistrationControl] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!KeTickCount] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoAttachDeviceToDeviceStack] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoDeleteDevice] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!ExAllocatePoolWithTag] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoAllocateWorkItem] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoAllocateIrp] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoAllocateMdl] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!MmBuildMdlForNonPagedPool] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!MmLockPagableDataSection] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoGetDriverObjectExtension] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!MmUnlockPagableImageSection] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!ExFreePoolWithTag] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoFreeIrp] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!IoFreeWorkItem] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!InitSafeBootMode] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!RtlCompareMemory] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!PoCallDriver] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!memmove] IAT SystemRootSystem32Driversagtnit31.SYS[ntoskrnl.exe!MmHighestUserAddress] IAT SystemRootSystem32Driversagtnit31.SYS[HAL.dll!KfAcquireSpinLock] IAT SystemRootSystem32Driversagtnit31.SYS[HAL.dll!READ_PORT_UCHAR] IAT SystemRootSystem32Driversagtnit31.SYS[HAL.dll!KeGetCurrentIrql] IAT SystemRootSystem32Driversagtnit31.SYS[HAL.dll!KfRaiseIrql] IAT SystemRootSystem32Driversagtnit31.SYS[HAL.dll!KfLowerIrql] IAT SystemRootSystem32Driversagtnit31.SYS[HAL.dll!HalGetInterruptVector] IAT SystemRootSystem32Driversagtnit31.SYS[HAL.dll!HalTranslateBusAddress] IAT SystemRootSystem32Driversagtnit31.SYS[HAL.dll!KeStallExecutionProcessor] IAT SystemRootSystem32Driversagtnit31.SYS[HAL.dll!KfReleaseSpinLock] IAT SystemRootSystem32Driversagtnit31.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] IAT SystemRootSystem32Driversagtnit31.SYS[HAL.dll!READ_PORT_USHORT] IAT SystemRootSystem32Driversagtnit31.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] IAT SystemRootSystem32Driversagtnit31.SYS[HAL.dll!WRITE_PORT_UCHAR] IAT SystemRootSystem32Driversagtnit31.SYS[WMILIB.SYS!WmiSystemControl] IAT SystemRootSystem32Driversagtnit31.SYS[WMILIB.SYS!WmiCompleteRequest] 89BDF2D8
[F750FDDC] spxy.sys
[F750FE30] spxy.sys
[F74E5042] spxy.sys
[F74E513E] spxy.sys
[F74E50C0] spxy.sys
[F74E5800] spxy.sys
[F74E56D6] spxy.sys
898775E0
[F74F4B90] spxy.sys
8800001C
001CBA86
C61AEB00
001C8986
86C61200
00001C8B
96868801
8800001C
001CB286
88968B00
8900001C
001CA496
C6168B00
001CC186
428A0A00
C286880C
8B00001C
24A48DFA
00000000
4B8BDF8B
8D3F0304
CB033043
0673C13B
C13B0003
8366FA72
75000E7B
0B7D80E3
307B8D00
00AA840F
83660000
6A000E7A
C6647400
001CC386
rIdleDetection] 4F8B0200
968D5140
00001C98
22F6E852
478B0000
50016A40
1CB48E8D
E8510000
000022E4
6A18538B
868D5200
00001CA0
22D2E850
jectExtension] 4B8B0000
51016A18
1CBC968D
E8520000
000022C0
8A05478A
001CC38E
30C48300
1CC58688
80E90000
C6000000
001CC386
438B0100
8E8D5018
00001C98
2292E851
538B0000
52016A18
1CB4868D
E8500000
00002280
8A05478A
001CC38E
thReservedMapping] 18C48300
1CC58688
43EB0000
320C538A
88F93BC0
001CC396
F6317300
74070647
75C0841A
05578A0B
968801B0
00001CC5
57B60F66
533B6604
03087408
72F93B3F
8A09EBDA
86880547
00001CC5
88084B8A
001CC68E
40578B00
8D52006A
001CC886
11E85000
8B000022
001CC08E
C4968B00
8900001C
001CCC8E
D0968900
8B00001C
016A4047
D4C68150
5600001C
0021E7E8
18C48300
5D5B5E5F
18C4830E
1C959E88
9E880000
00001CB1
0E798366
74AAB000
8986C636
1A00001C
1C8B86C6
C6020000
001C9686
86C60200
00001CB2
8800001C
001CB99E

—- Devices — GMER 1.0.15 —-

Device FileSystemNtfs Ntfs 88B971F8

AttachedDevice FileSystemNtfs Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

Device FileSystemFastfat FatCdrom 89AEA400
Device FileSystemFastfat FatCdrom 89B6C1F8

AttachedDevice DriverTcpip DeviceIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device Driverusbuhci DeviceUSBPDO-0 89917500
Device Driverdmio DeviceDmControlDmIoDaemon 89BDD1F8
Device Driverdmio DeviceDmControlDmConfig 89BDD1F8
Device Driverdmio DeviceDmControlDmPnP 89BDD1F8
Device Driverdmio DeviceDmControlDmInfo 89BDD1F8
Device Driverusbehci DeviceUSBPDO-1 899281F8
Device Driverusbuhci DeviceUSBPDO-2 89917500
Device Driversptd Device2459516902 spxy.sys
Device DriverNetBT DeviceNetBT_Tcpip_{A60E28E2-2604-4707-9564-C37971ED9F7E} 88CFD1F8
Device Driverusbuhci DeviceUSBPDO-3 89917500
Device Driverusbuhci DeviceUSBPDO-4 89917500

AttachedDevice DriverTcpip DeviceTcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device Driverusbuhci DeviceUSBPDO-5 89917500
Device DriverPCI_PNP0652 Device0000056 spxy.sys
Device DriverPCI_PNP0652 Device0000056 spxy.sys
Device Driverusbehci DeviceUSBPDO-6 899281F8
Device DriverFtdisk DeviceHarddiskVolume1 89B6E1F8
Device Driverusbuhci DeviceUSBPDO-7 89917500
Device DriverFtdisk DeviceHarddiskVolume2 89B6E1F8
Device DriverCdrom DeviceCdRom0 8986B500
Device DriverCdrom DeviceCdRom1 8986B500
Device Driveratapi DeviceIdeIdePort0 [BA67BB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device Driveratapi DeviceIdeIdeDeviceP0T0L0-3 [BA67BB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device Driveratapi DeviceIdeIdePort1 [BA67BB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device Driveratapi DeviceIdeIdePort2 [BA67BB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device Driveratapi DeviceIdeIdePort3 [BA67BB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device Driveratapi DeviceIdeIdeDeviceP1T0L0-e [BA67BB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device DriverNetBT DeviceNetBt_Wins_Export 88CFD1F8
Device DriverNetBT DeviceNetbiosSmb 88CFD1F8

AttachedDevice DriverTcpip DeviceUdp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice DriverTcpip DeviceRawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device Driverusbuhci DeviceUSBFDO-0 89917500
Device Driverusbuhci DeviceUSBFDO-1 89917500
Device Driverusbuhci DeviceUSBFDO-2 89917500
Device Driverusbehci DeviceUSBFDO-3 899281F8
Device Driverusbuhci DeviceUSBFDO-4 89917500
Device DriverFtdisk DeviceFtControl 89B6E1F8
Device Driverusbuhci DeviceUSBFDO-5 89917500
Device Driverusbuhci DeviceUSBFDO-6 89917500
Device Driverusbehci DeviceUSBFDO-7 899281F8
Device Driveragtnit31 DeviceScsiagtnit311Port4Path0Target0Lun0 8990B1F8
Device Driveragtnit31 DeviceScsiagtnit311 8990B1F8
Device FileSystemFastfat Fat 89AEA400
Device FileSystemFastfat Fat 89B6C1F8

AttachedDevice FileSystemFastfat Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice FileSystemFastfat Fat aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

Device FileSystemCdfs Cdfs 856641F8

—- Services — GMER 1.0.15 —-

Service (*** hidden *** ) [BOOT] oixsopob <— ROOTKIT !!!

—- Registry — GMER 1.0.15 —-

Reg HKLMSYSTEMCurrentControlSetServicesoixsopob@Type 1
Reg HKLMSYSTEMCurrentControlSetServicesoixsopob@Start 0
Reg HKLMSYSTEMCurrentControlSetServicesoixsopob@ErrorControl 0
Reg HKLMSYSTEMCurrentControlSetServicesoixsopob@Group Boot Bus Extender
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@s1 771343423
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@s2 285507792
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@h0 1
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xE9 0xF8 0x42 0x79 …
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:Program FilesDAEMON Tools Lite
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 …
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC0000001
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC0000001@hdf12 0xDA 0x61 0xAA 0x2D …
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC0000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC0000001gdq0
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC0000001gdq0@hdf12 0xE7 0x96 0x8D 0x96 …
Reg HKLMSYSTEMControlSet002Servicesoixsopob@Type 1
Reg HKLMSYSTEMControlSet002Servicesoixsopob@Start 0
Reg HKLMSYSTEMControlSet002Servicesoixsopob@ErrorControl 0
Reg HKLMSYSTEMControlSet002Servicesoixsopob@Group Boot Bus Extender
Reg HKLMSYSTEMControlSet002ServicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLMSYSTEMControlSet002ServicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLMSYSTEMControlSet002ServicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xCB 0xF5 0x44 0x99 …
Reg HKLMSYSTEMControlSet002ServicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:Program FilesDAEMON Tools Lite
Reg HKLMSYSTEMControlSet002ServicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 …
Reg HKLMSYSTEMControlSet002ServicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC0000001 (not active ControlSet)
Reg HKLMSYSTEMControlSet002ServicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC0000001@hdf12 0xDA 0x61 0xAA 0x2D …
Reg HKLMSYSTEMControlSet002ServicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC0000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLMSYSTEMControlSet002ServicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC0000001gdq0 (not active ControlSet)
Reg HKLMSYSTEMControlSet002ServicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC0000001gdq0@hdf12 0xE7 0x96 0x8D 0x96 …

—- EOF — GMER 1.0.15 —-
Автор

Сообщения

Просмотр 5 сообщений - с 1 по 5 (из 5 всего)

Mandarina

Созданные ответы форума

Добро пожаловать

Поиск

Важные инструкции

Нет доступа в интернет после удаления вируса — Как восстановить

Как сбросить настройки Firefox (Инструкция)

Как запустить компьютер в безопасном режиме (Safe Mode)

Удалить вирус, всплывающие окна и рекламу в Mac OS X

Как удалить вирус с телефона Андроид (Инструкция)

СПАЙВАРЕ РУ

Нужна помощь?

Ссылки