Созданные ответы форума
-
Сообщения
-
COMBOFIX
ComboFix 09-05-15.01 — Kamikaze Minato 15.05.2009 22:35.1 — FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1251.7.1049.18.2045.1616 [GMT 4:00]
Running from: c:docume~1KAMIKA~1РАБОЧИ~1ЦУНАДЕComboFix.exeWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.c:windowsdirectx.sys
c:windowssvchost.com
c:windowswebsys.exe.
((((((((((((((((((((((((( Files Created from 2009-04-15 to 2009-05-15 )))))))))))))))))))))))))))))))
.2009-05-15 16:15 . 2009-05-15 16:15
d
w c:program filestrend micro
2009-05-15 16:15 . 2009-05-15 16:15
d
w C:rsit
2009-05-06 20:00 . 2009-05-06 20:00
d
w c:program filesCounter-Strike 1.6
2009-05-06 10:53 . 2009-05-06 10:53
d
w c:program filesIP
2009-04-24 21:31 . 2009-04-24 21:31
d
w c:windowssystem32CatRoot_bak
2009-04-24 14:04 . 2009-04-24 14:04
d
w c:windowsl2schemas
2009-04-24 14:04 . 2009-04-24 14:04
d
w c:windowssystem32ru
2009-04-24 14:04 . 2009-04-24 14:04
d
w c:windowssystem32bits
2009-04-24 13:59 . 2004-08-18 08:00 526848 —-a-w c:windowssystem32dllcachep2psvc.dll
2009-04-20 17:39 . 2009-04-20 17:39
d
w c:documents and settingsKamikaze MinatoApplication Datateamspeak2
2009-04-20 17:39 . 2009-04-20 17:39
d
w c:program filesTeamspeak2_RC2
2009-04-18 12:59 . 2009-04-18 12:59
d
w c:program filesArtMoney
2009-04-16 20:52 . 2009-04-16 20:52
d-sh—w C:FOUND.003.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-24 19:48 . 2009-02-19 20:21 44752 —-a-w c:documents and settingsKamikaze MinatoLocal SettingsApplication DataGDIPFONTCACHEV1.DAT
2009-04-19 19:20 . 2004-08-18 08:00 50408 —-a-w c:windowssystem32perfc019.dat
2009-04-19 19:20 . 2004-08-18 08:00 349532 —-a-w c:windowssystem32perfh019.dat
2009-03-06 14:47 . 2004-08-18 08:00 284160 —-a-w c:windowssystem32pdh.dll
2009-03-03 00:15 . 2004-08-18 08:00 826368 —-a-w c:windowssystem32wininet.dll
2009-02-20 17:13 . 2004-08-18 08:00 78336 —-a-w c:windowssystem32ieencode.dll
2009-02-19 05:49 . 2009-02-19 05:49 315392 —-a-w c:windowsHideWin.exe
2009-02-19 05:08 . 2009-02-19 05:08 22564 —-a-w c:windowssystem32emptyregdb.dat
.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]
«{95289393-33EA-4F8D-B952-483415B9C955}»= «c:documents and settingsKamikaze MinatoApplication DataMicrosoftInternet Explorerqipsearchbar.dll» [2008-12-30 131072][HKEY_CLASSES_ROOTclsid{95289393-33ea-4f8d-b952-483415b9c955}]
[HKEY_CLASSES_ROOTqipbar.QIPBHO.1]
[HKEY_CLASSES_ROOTTypeLib{45FF696B-5284-4781-B2CA-ECF3A742A17B}]
[HKEY_CLASSES_ROOTqipbar.QIPBHO][HKEY_LOCAL_MACHINE~Browser Helper Objects{95289393-33EA-4F8D-B952-483415B9C955}]
2008-12-30 11:56 131072 —-a-w c:documents and settingsKamikaze MinatoApplication DataMicrosoftInternet Explorerqipsearchbar.dll[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2004-08-18 15360]
«MSMSGS»=»c:program filesMessengermsmsgs.exe» [2004-08-17 1667584][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«DiskeeperSystray»=»c:program filesDiskeeper CorporationDiskeeperDkIcon.exe» [2006-02-24 196709]
«Gainward»=»c:program filesVDOToolTBPanel.exe» [2007-06-26 2165272]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2007-07-23 8466432]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2007-07-23 81920]
«RTHDCPL»=»RTHDCPL.EXE» — c:windowsRTHDCPL.exe [2007-06-13 16377344]
«nwiz»=»nwiz.exe» — c:windowssystem32nwiz.exe [2007-07-23 1626112][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2004-08-18 15360][HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«d:\Miranda IM zeleboba’s pack\miranda32.exe»=
«d:\Program Files\QIP\qip.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«d:\Резерв\волейбол\volley.exe»=
«c:\WINDOWS\System32\dplaysvr.exe»=
«c:\Documents and Settings\Kamikaze Minato\Рабочий стол\блоби\volley.exe»=
«c:\Program Files\IP\qip.exe»=
«c:\Program Files\Counter-Strike 1.6\hl.exe»=R3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);c:windowssystem32driversRMSPPPOE.SYS [01.01.2009 22:38 31424]
.
— — — — ORPHANS REMOVED — — — —Notify-dimsntfy — (no file)
.
Supplementary Scan
.
uStart Page = start.qip.ru
uDefault_Search_URL = hxxp://search.qip.ru
uSearchURL,(Default) = hxxp://search.qip.ru/search?query=%s&from=IE
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
TCP: {1622F522-2000-480A-9FBB-AC7338E4C270} = 213.148.160.1 213.148.161.1
.**************************************************************************
catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-15 22:37
Windows 5.1.2600 Service Pack 2 FAT NTAPIscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘explorer.exe'(3156)
c:windowssystem32WPDShServiceObj.dll
c:windowssystem32PortableDeviceTypes.dll
c:windowssystem32PortableDeviceApi.dll
.
Other Running Processes
.
c:program filesDISKEEPER CORPORATIONDISKEEPERDKSERVICE.EXE
c:windowsSYSTEM32NVSVC32.EXE
c:windowsSYSTEM32WSCNTFY.EXE
c:windowsSYSTEM32WBEMWMIAPSRV.EXE
c:windowsSYSTEM32RUNDLL32.EXE
.
**************************************************************************
.
Completion time: 2009-05-15 22:38 — machine was rebooted
ComboFix-quarantined-files.txt 2009-05-15 18:38Pre-Run: 7 298 318 336 байт свободно
Post-Run: 8 230 191 104 байт свободно117 — E O F — 2009-04-25 09:03
