[MaxHagi]

Спасибо большое, я не только избавился от трояна, но и хаменил видеокарту-она сгорела.Спасибо за помощь и потраченое время

[MaxHagi]

Похоже на проблему с блоком питания.

И что теперь делать?? везти к программисту?

[MaxHagi]

Да после нескольких нажатий кнопки..Подскажите что делать?, а то я уже замучался тратить время на включениекомпьютера…

[MaxHagi]

Нажимаю кнопку включения, появляется чёрный экран.. и всё. Заново приходиться нажимать и так раз 20-30. ТОлько потом включается и спрашивают как загрузить компьютер: безопасный режим , безопасный режим с драйверами и обычная загрузка

[MaxHagi]

Всё также, компьютер включается, но не загружается, я так наверно минут 10 его включаю!

[MaxHagi]

Мне теперь этот файл удалять?

[MaxHagi]

---

ОТЧЕТ О ПРОВЕРКЕ KASPERSKY ONLINE SCANNER 7.0
23 Июль 2009 г.
Операционная система: Microsoft Windows Vista Ultimate Edition, 32-bit Service Pack 1 (build 6001)
Версия Kaspersky Online Scanner: 7.0.26.13
Последнее обновление баз: Thursday, July 23, 2009 07:14:58
Количество записей в базах: 2517974

---

Параметры проверки:
проверять, используя следующие базы: расширенные
Проверять архивы: да
Проверять почтовые базы: да

Область проверки — Мой компьютер:
A:
C:
D:
E:

Статистика проверки:
Проверено объектов: 170241
Обнаружено угроз: 1
Обнаружено зараженных объектов: 1
Обнаружено подозрительных объектов: 0
Время проверки: 02:59:27

Имя файла / Имя угрозы / Количество угроз
C:UsersИринаУстановкаVKMusic.rar Зараженный: Trojan-Ransom.Win32.Taras.i 1

Выбранная область проверена.

[MaxHagi]

[attachment=0:2g91bmll]отч.txt[/attachment:2g91bmll]

[MaxHagi]

ещё сегодня днём заметил что компьютер стал включаться только опсле нескольких раз нажатия перезагрузки!

[MaxHagi]

ComboFix 09-07-19.04 — Ирина 20.07.2009 9:20.1.2 — NTFSx86
Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1251.7.1049.18.2047.1364 [GMT 5:00]
Running from: c:usersИринаDesktopComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:program filesINSTALL.LOG
c:program filesMail.RuAgentMradllnewmrasearch.dll
D:Autorun.inf
D:install.exe

.
((((((((((((((((((((((((( Files Created from 2009-06-20 to 2009-07-20 )))))))))))))))))))))))))))))))
.

2009-07-19 07:10 . 2009-07-19 07:10

---

d

---

w- c:usersИринаAppDataLocalESET
2009-07-19 06:54 . 2009-07-19 06:57

---

d

---

w- c:program filestrend micro
2009-07-19 06:54 . 2009-07-19 06:57

---

d

---

w- C:rsit
2009-07-19 06:44 . 2009-07-19 06:44

---

d

---

w- c:program filesESET
2009-07-19 03:52 . 2009-07-19 04:34 35628544 —-a-w- c:usersИринаeav_nt32_rus.msi
2009-07-19 03:31 . 2009-07-19 03:31

---

d

---

w- c:program filesElectronic Arts
2009-07-17 09:45 . 2009-07-17 09:45

---

d

---

w- c:program filesГоворилка
2009-07-17 09:45 . 2009-07-18 12:23

---

d

---

w- c:windowsLhsp
2009-07-17 09:07 . 2009-07-17 09:07

---

d

---

w- c:usersИринаAppDataRoamingQIP
2009-07-17 09:07 . 2009-01-20 08:09 131072 —-a-w- c:usersИринаAppDataRoamingMicrosoftInternet Explorerqipsearchbar.dll
2009-07-17 09:06 . 2009-07-17 09:30

---

d

---

w- c:program filesQIP Infium
2009-07-17 05:33 . 2009-07-17 05:34 1213410 —-a-w- c:usersИрина1204724700_dds_converter_v21.zip
2009-07-17 05:17 . 2009-07-17 05:17

---

d

---

w- c:program filesPresets
2009-07-17 05:17 . 2009-07-17 05:17

---

d

---

w- c:program filesPlug-Ins
2009-07-17 05:17 . 2009-07-17 05:17

---

d

---

w- c:program filesNVIDIA Corporation
2009-07-17 05:02 . 2009-07-17 05:05 2485701 —-a-w- c:usersИринаsims3workshop.msi.zip
2009-07-16 09:58 . 2009-07-16 11:31

---

d

---

w- c:programdataKaspersky Lab
2009-07-16 09:56 . 2009-07-16 09:56

---

d

---

w- c:programdataKaspersky Lab Setup Files
2009-07-16 07:35 . 2009-07-16 07:35

---

d

---

w- c:programdataWindowsSearch
2009-07-14 07:06 . 2009-07-14 07:06

---

d

---

w- c:usersИринаAppDataRoamingDAEMON Tools
2009-07-14 07:06 . 2009-07-14 07:06

---

d

---

w- c:usersÈðèíà
2009-07-14 07:06 . 2009-07-14 07:06

---

d

---

w- c:users???°???­? 
2009-07-14 07:06 . 2009-07-14 07:06 278728 —-a-w- c:windowssystem32driversatksgt.sys
2009-07-14 07:06 . 2009-07-14 07:06 25416 —-a-w- c:windowssystem32driverslirsgt.sys
2009-07-14 06:53 . 2008-04-07 06:01 3702216 —-a-w- c:program filesdaemon4123-lite.exe
2009-07-13 05:08 . 2009-07-13 05:08

---

d

---

w- c:program files1С
2009-07-10 10:04 . 2009-07-10 10:04

---

d

---

w- c:usersИринаAppDataRoamingMalwarebytes
2009-07-10 10:04 . 2009-06-17 06:27 38160 —-a-w- c:windowssystem32driversmbamswissarmy.sys
2009-07-10 10:04 . 2009-07-10 10:04

---

d

---

w- c:programdataMalwarebytes
2009-07-10 10:04 . 2009-07-10 10:04

---

d

---

w- c:program filesMalwarebytes’ Anti-Malware
2009-07-10 10:04 . 2009-06-17 06:27 19096 —-a-w- c:windowssystem32driversmbam.sys
2009-07-10 09:41 . 2009-07-10 09:41

---

d

---

w- c:usersИринаAppDataLocalMigWiz
2009-07-07 04:37 . 2009-07-07 04:37

---

d

---

w- c:program filesXviD
2009-07-07 04:37 . 2009-07-07 04:37

---

d

---

w- c:program filesAviSynth 2.5
2009-07-07 04:37 . 2009-07-07 04:37

---

d

---

w- c:program filesGabest
2009-07-07 04:35 . 2009-07-07 04:35

---

d

---

w- c:program filesWinMPG Video Convert
2009-07-07 04:22 . 2009-07-07 04:22

---

d

---

w- c:usersИринаAppDataRoamingBroad Intelligence
2009-07-07 04:22 . 2009-07-07 04:22

---

d

---

w- c:program filesMediaCoder PSP Edition
2009-07-07 04:12 . 2009-07-07 04:12 7680 —-a-w- c:usersИринаAppDataRoamingThinstallMemoriesOnTV 440000034900002iMotv.exe
2009-07-07 04:12 . 2009-07-07 04:12

---

d

---

w- c:usersИринаAppDataRoamingThinstall
2009-07-07 04:12 . 2009-07-07 04:12

---

d

---

w- c:usersИринаAppDataLocalThinstall
2009-07-06 06:20 . 2009-07-06 06:20

---

d

---

w- c:program filesKalypso
2009-07-06 05:10 . 2009-07-06 05:21

---

d

---

w- c:program filesCheMaxRus
2009-07-06 04:29 . 2009-07-06 04:29

---

d

---

w- c:usersИринаAppDataLocalMy Games
2009-07-06 04:20 . 2009-07-06 04:20

---

d

---

w- c:program filesAGEIA Technologies
2009-07-06 04:20 . 2009-07-06 04:20

---

d

---

w- c:windowssystem32AGEIA
2009-07-06 04:20 . 2009-07-06 04:20

---

d

---

w- c:program filesCommon FilesWise Installation Wizard
2009-07-06 04:12 . 2009-07-06 04:12

---

d

---

w- c:usersИринаAppDataLocalApple Computer
2009-07-04 04:23 . 2009-07-04 04:23

---

d

---

w- c:program filesAlawar.ru
2009-07-03 17:34 . 2009-07-18 13:37

---

d

---

w- c:programdataAlawarWrapper
2009-07-03 05:34 . 2009-07-03 05:34

---

d

---

w- c:programdataApple Computer
2009-07-02 14:59 . 2009-07-02 14:59

---

d

---

w- c:windowsDownloaded Installations
2009-07-02 14:52 . 2009-07-02 14:52

---

d

---

w- c:program filesDisc2Phone
2009-07-02 14:34 . 2009-07-02 15:00

---

d

---

w- c:usersИринаAppDataLocalApplicationHistory
2009-07-02 14:34 . 2009-07-02 14:34 93 —-a-w- c:usersИринаAppDataLocalfusioncache.dat
2009-07-02 14:30 . 2009-07-02 14:30

---

d

---

w- c:windowssystem32URTTEMP
2009-07-02 12:42 . 2009-07-02 12:42

---

d

---

w- c:usersИринаAppDataRoamingGrym
2009-07-02 10:32 . 2009-07-18 13:19

---

d

---

w- c:program filesMad Scientist Productions
2009-07-02 07:32 . 2009-07-02 12:17

---

d

---

w- c:programdata2GIS
2009-07-02 07:32 . 2009-07-02 07:32

---

d

---

w- c:program files2gis
2009-07-02 07:02 . 2009-07-02 07:02

---

d

---

w- c:usersИринаAppDataRoamingrambler.ru
2009-07-02 07:02 . 2009-07-06 05:11

---

d

---

w- c:program filesRambler Assistant
2009-07-02 07:02 . 2009-07-02 07:02

---

d

---

w- c:usersИринаAppDataRoamingMozilla
2009-07-02 06:53 . 2009-07-02 07:14

---

d

---

w- c:usersИринаAppDataRoamingICQ
2009-07-02 06:53 . 2009-07-02 07:14

---

d

---

w- c:program filesICQ6.5
2009-07-02 05:26 . 2009-07-02 05:26

---

d

---

w- c:program filesOpenAL
2009-07-02 05:26 . 2006-08-30 14:11 749568 —-a-w- c:windowssystem32OpenALwEAX.exe
2009-07-02 05:18 . 2009-07-02 05:18

---

d

---

w- c:usersИринаAppDataRoamingInstallShield
2009-07-01 12:18 . 2009-07-01 12:18

---

d

---

w- c:windowsFLV Player
2009-07-01 12:18 . 2009-07-01 12:18

---

d

---

w- c:program filesFLV Player
2009-07-01 12:15 . 2009-07-01 12:15

---

d

---

w- c:program filesQuickTime
2009-07-01 12:14 . 2009-07-01 12:14

---

d

---

w- c:program filesXilisoft
2009-07-01 08:36 . 2009-07-16 08:23

---

d

---

w- c:program filesDirectX
2009-07-01 07:33 . 2009-07-01 07:33 10134 —-a-r- c:usersИринаAppDataRoamingMicrosoftInstaller{68E910DE-008D-40B1-BDBC-18AF3A8A380D}_A97D9A52106DCF1D306D12.exe
2009-07-01 07:33 . 2009-07-01 07:33 10134 —-a-r- c:usersИринаAppDataRoamingMicrosoftInstaller{68E910DE-008D-40B1-BDBC-18AF3A8A380D}_6D128718A608789CF13C63.exe
2009-07-01 07:33 . 2009-07-01 07:33

---

d

---

w- c:program filesgoodlogin
2009-07-01 06:49 . 2009-07-01 06:49

---

d

---

w- c:usersИринаAppDataRoamingMacromedia
2009-06-30 15:36 . 2009-06-30 15:36 10134 —-a-r- c:usersИринаAppDataRoamingMicrosoftInstaller{E3E71D07-CD27-46CB-8448-16D4FB29AA13}ARPPRODUCTICON.exe
2009-06-30 15:36 . 2009-06-30 15:36

---

d

---

w- c:program filesMicrosoft WSE
2009-06-30 15:35 . 2006-09-28 12:05 2414360 —-a-w- c:windowssystem32d3dx9_31.dll
2009-06-30 15:29 . 2009-06-30 15:29

---

d

---

w- c:windowssystem32Macromed
2009-06-30 15:04 . 2006-10-02 07:38 10368 —-a-w- c:windowssystem32driverspfc.sys
2009-06-30 15:04 . 2009-07-01 07:12

---

d

---

w- c:program filesMemoriesOnTV4
2009-06-30 15:01 . 2009-06-30 15:01

---

d

---

w- c:usersИринаAppDataRoamingOpera
2009-06-30 15:01 . 2009-06-30 15:01

---

d

---

w- c:usersИринаAppDataLocalOpera
2009-06-30 15:01 . 2009-06-30 15:01

---

d

---

w- c:program filesOpera
2009-06-30 15:01 . 2009-06-30 15:01

---

d

---

w- c:usersИринаAppDataRoamingkantaris
2009-06-30 15:00 . 2009-07-10 06:45

---

d

---

w- c:program filesKantaris
2009-06-30 14:23 . 2008-06-23 20:20 86528 —-a-w- c:programdataCanonBJIJPrinterCNMWindowsCanon MP540 series PrinterLanguageModules413CNMsr9E.dll
2009-06-30 14:22 . 2009-06-30 14:22

---

d

---

w- c:program filesCommon FilesCANON
2009-06-30 14:19 . 2009-07-19 11:30

---

d

---

r- c:usersИринаУстановка
2009-06-30 14:19 . 2009-06-30 14:19

---

d—h—w- c:programdataCanonBJ
2009-06-30 14:18 . 2009-06-30 14:18

---

d—h—w- c:windowssystem32CanonIJ Uninstaller Information
2009-06-30 14:15 . 2008-05-26 20:00 230912 —-a-w- c:windowssystem32CNMLM9E.DLL
2009-06-30 14:15 . 2009-06-30 14:15

---

d—h—w- c:program filesCanonBJ
2009-06-30 14:14 . 2009-06-30 14:24

---

d

---

w- c:program filesCanon
2009-06-30 13:55 . 2009-07-07 08:14

---

d

---

w- c:usersИринаAppDataRoamingMra
2009-06-30 13:55 . 2009-06-30 13:55

---

d

---

w- c:program filesMail.Ru
2009-06-30 13:49 . 1999-06-25 05:55 149504 —-a-w- c:program filesUNWISE.EXE
2009-06-29 22:01 . 2009-06-29 21:06

---

d

---

w- c:windowsPanther
2009-06-29 22:01 . 2009-06-29 22:01

---

d-sh—w- C:Boot
2009-06-29 21:55 . 2009-06-29 21:55

---

d

---

w- c:usersИринаAppDataRoamingMedia Player Classic
2009-06-29 21:51 . 2009-07-17 05:06

---

d

---

w- c:usersИринаAppDataRoamingAdobe
2009-06-29 21:51 . 2009-07-09 08:39

---

d

---

w- c:usersИринаAppDataLocalAdobe
2009-06-29 21:51 . 2009-06-29 21:51

---

d

---

w- c:usersPublicCyberLink
2009-06-29 21:50 . 2009-06-29 21:50

---

d

---

w- c:usersИринаAppDataRoamingCyberLink
2009-06-29 21:50 . 2009-07-07 09:09

---

d

---

w- c:programdataCyberLink
2009-06-29 21:50 . 2009-06-29 21:50

---

d

---

w- c:program filesCommon FilesCyberLink
2009-06-29 21:49 . 2009-06-29 21:50

---

d

---

w- c:program filesCyberLink
2009-06-29 21:49 . 2002-01-07 12:30 24576 —-a-w- c:windowssystem32msxml3a.dll
2009-06-29 21:48 . 2009-06-29 21:48

---

d

---

w- c:usersИринаAppDataLocalACD Systems
2009-06-29 21:48 . 2009-06-29 21:48

---

d

---

w- c:usersИринаAppDataRoamingACD Systems
2009-06-29 21:48 . 2009-06-29 21:48

---

d

---

w- c:programdataACD Systems
2009-06-29 21:47 . 2009-06-29 21:48

---

d

---

w- c:program filesCommon FilesACD Systems
2009-06-29 21:47 . 2009-06-29 21:47

---

d

---

w- c:program filesACD Systems
2009-06-29 21:32 . 2009-06-30 14:13

---

d

---

w- c:usersИринаAppDataLocalMicrosoft Games
2009-06-29 21:30 . 2009-06-30 13:50

---

d

---

w- c:program filesCommon FilesAdobe
2009-06-29 21:29 . 2009-06-29 21:29

---

d

---

w- c:usersИринаAppDataRoamingNero
2009-06-29 21:28 . 2009-06-29 21:28

---

d

---

w- c:usersИринаAppDataLocalAhead
2009-06-29 21:25 . 2009-06-29 21:25

---

d

---

w- c:program filesNero
2009-06-29 21:25 . 2009-06-29 21:26

---

d

---

w- c:program filesCommon FilesNero
2009-06-29 21:25 . 2009-06-29 21:25

---

d

---

w- c:programdataNero
2009-06-29 21:16 . 2009-06-29 21:16

---

d

---

w- c:usersИринаAppDataRoamingWinRAR
2009-06-29 21:11 . 2009-06-29 21:52

---

d

---

w- c:windowsDebug
2009-06-29 21:11 . 2009-06-29 21:11

---

d

---

w- c:programdataDAEMON Tools Lite

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-20 04:26 . 2009-06-29 20:13 2097152 —sha-w- c:usersИринаNTUSER.DAT
2009-07-20 03:51 . 2009-06-29 20:58 48175 —-a-w- c:programdatanvModes.dat
2009-07-19 04:34 . 2009-07-19 03:52 35628544 —-a-w- c:usersИринаeav_nt32_rus.msi
2009-07-19 02:51 . 2009-06-29 21:10

---

d

---

w- c:usersИринаAppDataRoamingWinamp
2009-07-17 10:06 . 2009-06-29 20:13 100256 —-a-w- c:usersИринаAppDataLocalGDIPFONTCACHEV1.DAT
2009-07-17 09:45 . 2009-07-17 09:45

---

d

---

w- c:program filesГоворилка
2009-07-17 09:15 . 2008-01-21 05:44 665318 —-a-w- c:windowssystem32perfh019.dat
2009-07-17 09:15 . 2008-01-21 05:44 131230 —-a-w- c:windowssystem32perfc019.dat
2009-07-17 09:07 . 2009-07-17 09:07

---

d

---

w- c:usersИринаAppDataRoamingQIP
2009-07-17 05:34 . 2009-07-17 05:33 1213410 —-a-w- c:usersИрина1204724700_dds_converter_v21.zip
2009-07-17 05:06 . 2009-06-29 21:51

---

d

---

w- c:usersИринаAppDataRoamingAdobe
2009-07-17 05:05 . 2009-07-17 05:02 2485701 —-a-w- c:usersИринаsims3workshop.msi.zip
2009-07-14 07:06 . 2009-07-14 07:06

---

d

---

w- c:usersИринаAppDataRoamingDAEMON Tools
2009-07-14 06:52 . 2009-07-01 07:04 115432 —-a-w- c:windowssystem32OpenAL32.dll
2009-07-14 06:52 . 2009-07-01 07:04 418480 —-a-w- c:windowssystem32wrap_oal.dll
2009-07-11 04:06 . 2009-06-29 20:13

---

d-s—w- c:usersИринаAppDataRoamingMicrosoft
2009-07-10 10:04 . 2009-07-10 10:04

---

d

---

w- c:usersИринаAppDataRoamingMalwarebytes
2009-07-07 08:14 . 2009-06-30 13:55

---

d

---

w- c:usersИринаAppDataRoamingMra
2009-07-07 04:22 . 2009-07-07 04:22

---

d

---

w- c:usersИринаAppDataRoamingBroad Intelligence
2009-07-07 04:12 . 2009-07-07 04:12 7680 —-a-w- c:usersИринаAppDataRoamingThinstallMemoriesOnTV 440000034900002iMotv.exe
2009-07-07 04:12 . 2009-07-07 04:12

---

d

---

w- c:usersИринаAppDataRoamingThinstall
2009-07-02 14:34 . 2009-07-02 14:34 93 —-a-w- c:usersИринаAppDataLocalfusioncache.dat
2009-07-02 12:42 . 2009-07-02 12:42

---

d

---

w- c:usersИринаAppDataRoamingGrym
2009-07-02 07:14 . 2009-07-02 06:53

---

d

---

w- c:usersИринаAppDataRoamingICQ
2009-07-02 07:02 . 2009-07-02 07:02

---

d

---

w- c:usersИринаAppDataRoamingrambler.ru
2009-07-02 07:02 . 2009-07-02 07:02

---

d

---

w- c:usersИринаAppDataRoamingMozilla
2009-07-02 05:18 . 2009-07-02 05:18

---

d

---

w- c:usersИринаAppDataRoamingInstallShield
2009-07-01 07:33 . 2009-07-01 07:33 10134 —-a-r- c:usersИринаAppDataRoamingMicrosoftInstaller{68E910DE-008D-40B1-BDBC-18AF3A8A380D}_A97D9A52106DCF1D306D12.exe
2009-07-01 07:33 . 2009-07-01 07:33 10134 —-a-r- c:usersИринаAppDataRoamingMicrosoftInstaller{68E910DE-008D-40B1-BDBC-18AF3A8A380D}_6D128718A608789CF13C63.exe
2009-07-01 06:49 . 2009-07-01 06:49

---

d

---

w- c:usersИринаAppDataRoamingMacromedia
2009-06-30 15:36 . 2009-06-30 15:36 10134 —-a-r- c:usersИринаAppDataRoamingMicrosoftInstaller{E3E71D07-CD27-46CB-8448-16D4FB29AA13}ARPPRODUCTICON.exe
2009-06-30 15:01 . 2009-06-30 15:01

---

d

---

w- c:usersИринаAppDataRoamingOpera
2009-06-30 15:01 . 2009-06-30 15:01

---

d

---

w- c:usersИринаAppDataRoamingkantaris
2009-06-29 21:55 . 2009-06-29 21:55

---

d

---

w- c:usersИринаAppDataRoamingMedia Player Classic
2009-06-29 21:50 . 2009-06-29 21:50

---

d

---

w- c:usersИринаAppDataRoamingCyberLink
2009-06-29 21:48 . 2009-06-29 21:10 353576

---

w- c:windowssystem32msvcr71.dll
2009-06-29 21:48 . 2009-06-29 21:48

---

d

---

w- c:usersИринаAppDataRoamingACD Systems
2009-06-29 21:39 . 2009-06-29 21:39 0 —ha-w- c:windowssystem32driversMsft_User_WpdFs_01_00_00.Wdf
2009-06-29 21:29 . 2009-06-29 21:29

---

d

---

w- c:usersИринаAppDataRoamingNero
2009-06-29 21:16 . 2009-06-29 21:16

---

d

---

w- c:usersИринаAppDataRoamingWinRAR
2009-06-29 21:11 . 2009-06-29 21:11

---

d

---

w- c:usersИринаAppDataRoamingDAEMON Tools Lite
2009-06-29 21:10 . 2009-06-29 21:10

---

d

---

w- c:program files7-Zip
2009-06-29 21:10 . 2009-06-29 21:10

---

d

---

w- c:program filesWinamp
2009-06-29 21:10 . 2009-06-29 21:10

---

d

---

w- c:program filesK-Lite Codec Pack
2009-06-29 21:10 . 2009-06-29 21:10

---

d

---

w- c:usersИринаAppDataRoamingReal
2009-06-29 21:10 . 2009-06-29 21:10

---

d

---

w- c:program filesCCleaner
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE~Browser Helper Objects{95289393-33EA-4F8D-B952-483415B9C955}]
2009-01-20 08:09 131072 —-a-w- c:usersИринаAppDataRoamingMicrosoftInternet Explorerqipsearchbar.dll

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«Sidebar»=»c:program filesWindows Sidebarsidebar.exe» [2008-01-21 1233920]
«ICQ»=»c:progra~1ICQ6.5ICQ.exe» [2009-03-01 172792]
«WindowsWelcomeCenter»=»oobefldr.dll» — c:windowsSystem32oobefldr.dll [2008-01-21 2153472]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«Windows Defender»=»c:program filesWindows DefenderMSASCui.exe» [2008-01-21 1008184]
«GrooveMonitor»=»c:program filesMicrosoft OfficeOffice12GrooveMonitor.exe» [2008-10-25 31072]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2008-12-26 13736480]
«RtHDVCpl»=»c:program filesRealtekAudioHDARtHDVCpl.exe» [2009-05-06 7440928]
«WinampAgent»=»c:program filesWinampwinampa.exe» [2009-04-10 37888]
«NeroFilterCheck»=»c:program filesCommon FilesNeroLibNeroCheck.exe» [2007-03-01 153136]
«Adobe Reader Speed Launcher»=»c:program filesAdobeReader 9.0ReaderReader_sl.exe» [2009-02-27 35696]
«RemoteControl8″=»c:program filesCyberLinkPowerDVD8PDVD8Serv.exe» [2008-03-20 83240]
«PDVD8LanguageShortcut»=»c:program filesCyberLinkPowerDVD8LanguageLanguage.exe» [2007-12-14 50472]
«BDRegion»=»c:program filesCyberlinkShared Filesbrs.exe» [2008-06-27 91432]
«MAgent»=»c:program filesMail.RuAgentMAgent.exe» [2009-07-07 7975096]
«CanonSolutionMenu»=»c:program filesCanonSolutionMenuCNSLMAIN.exe» [2008-03-10 689488]
«CanonMyPrinter»=»c:program filesCanonMyPrinterBJMyPrt.exe» [2008-03-17 1848648]
«egui»=»c:program filesESETESET NOD32 Antivirusegui.exe» [2009-05-14 2029640]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]
«EnableLUA»= 0 (0x0)
«EnableUIADesktopToggle»= 0 (0x0)

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]
«aux»=wdmaud.drv

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalWinDefend]
@=»Service»

[HKLM~servicessharedaccessparametersfirewallpolicyFirewallRules]
«{CD4C9B58-A006-4809-91F4-E52098E94094}»= TCP:6004|c:program filesMicrosoft OfficeOffice12outlook.exe:Microsoft Office Outlook
«{803207A8-64EA-40DB-9C14-D7AC853F7D54}»= UDP:c:program filesMicrosoft OfficeOffice12GROOVE.EXE:Microsoft Office Groove
«{E1A0DD85-ABF1-4F8D-BAC7-E73A8094AC4D}»= TCP:c:program filesMicrosoft OfficeOffice12GROOVE.EXE:Microsoft Office Groove
«{52DC368A-32AC-452D-8CA4-75BB3DB21B72}»= UDP:c:program filesMicrosoft OfficeOffice12ONENOTE.EXE:Microsoft Office OneNote
«{C435ADB7-00DE-4C88-8F88-A46A7F56D0E0}»= TCP:c:program filesMicrosoft OfficeOffice12ONENOTE.EXE:Microsoft Office OneNote
«{37F45BB5-3229-4D26-870C-22F7E427FFCB}»= c:program filesCyberLinkPowerDVD8PowerDVD8.EXE:CyberLink PowerDVD 8.0
«TCP Query User{96B4678D-58B8-4DCC-9E03-8E13EF90388C}c:\programdata\kaspersky lab setup files\kaspersky anti-virus 7.0.1.325\russian\setup.exe»= UDP:c:programdatakaspersky lab setup fileskaspersky anti-virus 7.0.1.325russiansetup.exe:Программа установки Антивируса Касперского 7.0
«UDP Query User{2E240870-B1CA-476A-AB9F-1961F5BA97E1}c:\programdata\kaspersky lab setup files\kaspersky anti-virus 7.0.1.325\russian\setup.exe»= TCP:c:programdatakaspersky lab setup fileskaspersky anti-virus 7.0.1.325russiansetup.exe:Программа установки Антивируса Касперского 7.0

R1 ehdrv;ehdrv;c:windowsSystem32driversehdrv.sys [14.05.2009 15:47 107256]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};c:program filesCyberLinkPowerDVD800.fcl [27.06.2008 16:50 61424]
R2 ekrn;ESET Service;c:program filesESETESET NOD32 Antivirusekrn.exe [14.05.2009 15:47 731840]
R2 epfwwfpr;epfwwfpr;c:windowsSystem32driversepfwwfpr.sys [14.05.2009 15:49 93312]
R3 Atc002;NDIS Miniport Driver for Atheros L2 Fast Ethernet Controller;c:windowsSystem32driversl260x86.sys [30.06.2009 1:53 29184]
S0 OemBiosDevice;Royalty OEM Bios Extension;c:windowsSystem32driversroyal.sys [30.06.2009 1:26 240128]
S3 CrystalSysInfo;CrystalSysInfo;c:program filesMediaCoder PSP EditionSysInfo.sys [25.09.2007 19:59 15152]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled components>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
«c:windowsSystem32rundll32.exe» «c:windowsSystem32iedkcs32.dll»,BrandIEActiveSetup SIGNUP
.
.

---

Supplementary Scan

---

.
uStart Page = start.qip.ru
uDefault_Search_URL = hxxp://search.qip.ru
uSearchURL,(Default) = hxxp://search.qip.ru/search?query=%s&from=IE
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
IE: Добавить в Rambler-Закладки — c:program filesRambler AssistantramblertoolbarU0.dll/zakladki.htm
IE: Найти с помощью Рамблера — c:program filesRambler AssistantramblertoolbarU0.dll/search.htm
IE: Перевести с помощью словарей Рамблера — c:program filesRambler AssistantramblertoolbarU0.dll/dic.htm
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:program filesMail.RuAgentmagent.exe
TCP: {00DFF694-929E-4A5A-B093-6942ACCAD170} = 62.213.0.12,62.213.2.1
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-20 09:28
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-07-20 9:30
ComboFix-quarantined-files.txt 2009-07-20 04:30

Pre-Run: 33 759 379 456 байт свободно
Post-Run: 34 055 360 512 байт свободно

269

[Автор]

Сообщения