[ni-kola]

Все сделал. Можно ли вздохнуть свободно?
Вот итог:

ComboFix 09-04-25.A3 — Anatoly 27.04.2009 19:45.1 — NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1251.7.1049.18.1022.695 [GMT 4:00]
Running from: c:documents and settingsAnatolyРабочий столComboFix.exe
Command switches used :: c:documents and settingsAnatolyРабочий столWindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
AV: Outpost Security Suite Pro *On-access scanning disabled* (Updated)
FW: COMODO Firewall Pro *enabled*
FW: Outpost Security Suite Pro *disabled*
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:program filesautorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

---

Legacy_SYSMONLOGSHELLHWDETECTION

---

Service_SysmonLogShellHWDetection

((((((((((((((((((((((((( Files Created from 2009-05-27 to 2009-4-27 )))))))))))))))))))))))))))))))
.

2009-04-25 08:23 . 2009-04-25 08:23

---

d

---

w c:program filestrend micro
2009-04-25 08:23 . 2009-04-25 08:23

---

d

---

w C:rsit
2009-04-25 07:03 . 2009-04-06 07:37 704384 —-a-w c:windowssystem32driversSandBox.sys
2009-04-25 07:03 . 2009-04-03 11:23 1175256 —-a-w c:windowssystem32driversVBEngNT.sys
2009-04-25 07:03 . 2009-02-10 12:15 257432 —-a-w c:windowssystem32driversafwcore.sys
2009-04-25 07:02 . 2009-04-14 06:22 49 —-a-w c:windowstransp.gif
2009-04-25 07:02 . 2009-02-18 13:30 31128 —-a-w c:windowssystem32driversafw.sys
2009-04-25 07:02 . 2009-04-27 13:47

---

d

---

w c:windowssystem32Filt
2009-04-25 07:02 . 2009-04-25 07:02

---

d

---

w c:documents and settingsAll UsersApplication DataAgnitum
2009-04-24 11:20 . 2009-04-24 11:20

---

d

---

w c:documents and settingsAnatolyApplication DataMalwarebytes
2009-04-24 11:20 . 2009-04-24 11:20

---

d

---

w c:documents and settingsAll UsersApplication DataMalwarebytes
2009-04-24 11:17 . 2009-04-25 06:33

---

d

---

w c:program filesMalwareBytes
2009-04-16 04:28 . 2009-02-06 10:10 227840 -c—-w c:windowssystem32dllcachewmiprvse.exe
2009-04-16 04:28 . 2009-03-06 14:23 284672 -c—-w c:windowssystem32dllcachepdh.dll
2009-04-16 04:28 . 2009-02-09 11:25 111104 -c—-w c:windowssystem32dllcacheservices.exe
2009-04-16 04:28 . 2009-02-09 10:54 731136 -c—-w c:windowssystem32dllcachelsasrv.dll
2009-04-16 04:28 . 2009-02-09 10:54 687616 -c—-w c:windowssystem32dllcacheadvapi32.dll
2009-04-16 04:28 . 2009-02-09 10:54 401408 -c—-w c:windowssystem32dllcacherpcss.dll
2009-04-16 04:28 . 2009-02-09 10:54 473600 -c—-w c:windowssystem32dllcachefastprox.dll
2009-04-16 04:28 . 2009-02-09 10:54 453120 -c—-w c:windowssystem32dllcachewmiprvsd.dll
2009-04-16 04:28 . 2009-02-09 10:54 718848 -c—-w c:windowssystem32dllcachentdll.dll
2009-04-16 04:27 . 2009-03-27 06:58 1203922 -c—-w c:windowssystem32dllcachesysmain.sdb
2009-04-16 04:27 . 2008-04-21 21:15 218624 -c—-w c:windowssystem32dllcachewordpad.exe
2009-04-15 05:04 . 2009-04-15 18:36 32 —s-a-w c:windowssystem323907087178.dat
2009-04-12 07:29 . 2009-04-12 07:29 2560 —-a-w c:windows_MSRSTRT.EXE
2009-04-12 07:11 . 2009-04-25 07:02

---

d

---

w c:program filesAgnitum
2009-04-09 15:14 . 2009-04-09 15:14

---

d

---

w c:documents and settingsAnatolyApplication DataLavasoft
2009-04-09 10:04 . 2009-04-09 10:04

---

d

---

w C:TEMP
2009-04-09 10:04 . 2009-04-09 10:04

---

d

---

w c:windowsCOREL

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-16 13:01 . 2006-03-02 12:00 51806 —-a-w c:windowssystem32perfc019.dat
2009-04-16 13:01 . 2006-03-02 12:00 350684 —-a-w c:windowssystem32perfh019.dat
2009-04-08 14:17 . 2009-02-06 19:43 20608 —-a-w c:documents and settingsAnatolyLocal SettingsApplication DataGDIPFONTCACHEV1.DAT
2009-03-06 14:23 . 2006-03-02 12:00 284672 —-a-w c:windowssystem32pdh.dll
2009-03-03 00:15 . 2006-03-02 12:00 826368 —-a-w c:windowssystem32wininet.dll
2009-02-20 17:13 . 2006-03-02 12:00 78336 —-a-w c:windowssystem32ieencode.dll
2009-02-09 14:07 . 2006-03-02 12:00 1846912 —-a-w c:windowssystem32win32k.sys
2009-02-09 11:26 . 2004-08-17 15:58 2025984 —-a-w c:windowssystem32ntkrnlpa.exe
2009-02-09 11:25 . 2006-03-02 12:00 2147328 —-a-w c:windowssystem32ntoskrnl.exe
2009-02-09 11:25 . 2006-03-02 12:00 111104 —-a-w c:windowssystem32services.exe
2009-02-09 10:54 . 2006-03-02 12:00 731136 —-a-w c:windowssystem32lsasrv.dll
2009-02-09 10:54 . 2006-03-02 12:00 687616 —-a-w c:windowssystem32advapi32.dll
2009-02-09 10:54 . 2006-03-02 12:00 401408 —-a-w c:windowssystem32rpcss.dll
2009-02-09 10:54 . 2006-03-02 12:00 718848 —-a-w c:windowssystem32ntdll.dll
2009-02-07 12:15 . 2006-03-02 12:00 251152 —sha-r C:ntldr
2009-02-06 18:48 . 2007-09-06 07:35 23820 —-a-w c:windowssystem32emptyregdb.dat
2009-02-06 18:48 . 2009-02-06 18:48 879 —-a-w c:windowsInfCOMAA.tmp
2009-02-06 10:39 . 2006-03-02 12:00 35328 —-a-w c:windowssystem32sc.exe
2009-02-03 19:58 . 2006-03-02 12:00 56832 —-a-w c:windowssystem32secur32.dll
2007-03-29 22:58 . 2008-02-29 10:02 511676 —-a-w c:program filesWinBootstrapper1.cab
2007-03-29 22:58 . 2008-02-29 10:02 1823744 —-a-w c:program filesWinBootstrapper.msi
2007-03-29 22:55 . 2008-02-29 10:04 508 —-a-w c:program filesDeployment.xml
2007-03-13 23:46 . 2008-02-29 10:04 20607 —-a-w c:program filesIllustrator CS3 Read Me.html
.

---

Sigcheck

---

[7] 2008-06-20 10:44 360960 744E57C99232201AE98C49168B918F48 c:windows$hf_mig$KB951748SP2QFEtcpip.sys
[7] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:windows$hf_mig$KB951748SP3GDRtcpip.sys
[7] 2008-06-20 11:59 361600 AD978A1B783B5719720CFF204B666C8E c:windows$hf_mig$KB951748SP3QFEtcpip.sys
[7] 2008-06-20 10:45 360320 2A5554FC5B1E04E131230E3CE035C3F9 c:windows$NtServicePackUninstall$tcpip.sys
[7] 2008-04-13 19:20 361344 93EA8D04EC73A85DB02EB8805988F733 c:windows$NtUninstallKB951748$tcpip.sys
[7] 2006-03-02 12:00 359040 9F4B36614A0FC234525BA224957DE55C c:windows$NtUninstallKB951748_0$tcpip.sys
[-] 2008-04-13 19:20 361344 ACCF5A9A1FFAA490F33DBA1C632B95E1 c:windowsServicePackFilesi386tcpip.sys
[-] 2008-06-20 11:51 361600 9425B72F40257B45D45D24773273DAD0 c:windowssystem32dllcachetcpip.sys
[-] 2008-06-20 11:51 361600 9425B72F40257B45D45D24773273DAD0 c:windowssystem32driverstcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2008-04-14 15360]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2004-07-01 4112384]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2004-07-01 81920]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2001-07-09 155648]
«ISUSPM Startup»=»c:program filesCommon FilesInstallShieldUpdateServiceisuspm.exe» [2005-08-11 249856]
«ISUSScheduler»=»c:program filesCommon FilesInstallShieldUpdateServiceissch.exe» [2005-08-11 81920]
«OutpostMonitor»=»c:progra~1AgnitumOUTPOS~1op_mon.exe» [2009-04-15 1289048]
«OutpostFeedBack»=»c:program filesAgnitumOutpost Security Suite Profeedback.exe» [2009-04-14 433496]
«nwiz»=»nwiz.exe» — c:windowssystem32nwiz.exe [2004-07-01 843776]
«SoundMan»=»SOUNDMAN.EXE» — c:windowssoundman.exe [2006-03-01 577536]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-14 15360]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoring]
«DisableMonitoring»=dword:00000001

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringSymantecAntiVirus]
«DisableMonitoring»=dword:00000001

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringSymantecFirewall]
«DisableMonitoring»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\Bonjour\mDNSResponder.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«c:\Program Files\Total Commander\Totalcmd.exe»=
«c:\WINDOWS\system32\verclsid.exe»=
«c:\WINDOWS\system32\Restore\rstrui.exe»=
«c:\WINDOWS\system32\control.exe»=
«c:\Program Files\ACD Systems\ACDSee\ACDSee.exe»=
«c:\WINDOWS\system32\sol.exe»=
«c:\Program Files\WinRAR\WinRAR.exe»=
«c:\WINDOWS\system32\netsh.exe»=
«c:\Program Files\Windows Media Player\wmplayer.exe»=
«c:\Program Files\Corel\CorelDRAW Graphics Suite 13\Programs\CorelDRW.exe»=
«c:\Program Files\Adobe\Photoshop CS\Photoshop.exe»=
«d:\SOFT\БизнесПак\2008\bp.exe»=
«c:\WINDOWS\system32\rasautou.exe»=
«c:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE»=
«c:\WINDOWS\SOUNDMAN.EXE»=
«c:\WINDOWS\system32\logon.scr»=
«c:\WINDOWS\system32\userinit.exe»=
«c:\Program Files\Common Files\InstallShield\UpdateService\issch.exe»=

R3 Rtl96n2mndat;Rtl96n2mndat; [x]
S1 SandBox;SandBox;c:windowssystem32driversSandBox.sys [2009-04-06 704384]
S2 acssrv;Agnitum Client Security Service;c:progra~1AgnitumOUTPOS~1acs.exe [2009-04-14 1605976]
S3 afw;Agnitum firewall driver;c:windowssystem32DRIVERSafw.sys [2009-02-18 31128]
S3 afwcore;afwcore;c:windowssystem32driversafwcore.sys [2009-02-10 257432]
S3 ASWFilt;ASWFilt;c:windowssystem32FiltASWFilt.dll [2009-04-06 33888]
S3 VBEngNT;VBEngNT;c:windowssystem32driversVBEngNT.sys [2009-04-03 1175256]
S3 VBFilt;VBFilt;c:windowssystem32FiltVBFilt.dll [2009-04-06 234304]

.
— — — — ORPHANS REMOVED — — — —

HKCU-Run-Anatoly — c:documents and settingsAnatolyAnatoly.exe
HKLM-Run-CorelDRAW Graphics Suite 11b — c:program filesCorelCorel Graphics 12LanguagesENProgramsRegistration.exe

.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.mail.ru/
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-27 19:48
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

Other Running Processes

---

.
c:windowssystem32rundll32.exe
c:program filesBonjourmDNSResponder.exe
c:program filesAgnitumOutpost Security Suite Proop_mon.exe
c:windowssystem32nvsvc32.exe
.
**************************************************************************
.
Completion time: 2009-04-27 19:50 — machine was rebooted
ComboFix-quarantined-files.txt 2009-04-27 15:50

Pre-Run: 36 591 337 472 байт свободно
Post-Run: 36 836 958 208 байт свободно

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)WINDOWS
[operating systems]
c:cmdconsBOOTSECT.DAT=»Microsoft Windows Recovery Console» /cmdcons
multi(0)disk(0)rdisk(0)partition(1)WINDOWS=»Microsoft Windows XP Home Edition RU» /noexecute=optin /fastdetect

184 — E O F — 2009-04-16 13:09

[Автор]

Сообщения