SPYWARE-RU.COM

Созданные ответы форума

Просмотр 15 сообщений - с 1 по 15 (из 33 всего)

1 2 3 →

Автор

Сообщения
2 сентября, 2011 в 6:22 пп в ответ на: Подозрение на инфекцию. #32218
QERIBAN
Participant
- Темы:6
- Сообщений:39
Logfile of random’s system information tool 1.06 (written by random/random)
Run by 123 at 2011-09-03 00:02:22
Microsoft Windows XP Professional Service Pack 2
System drive C: has 4 GB (18%) free of 20 GB
Total RAM: 1015 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0:03:00, on 03.09.2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Documents and SettingsAll UsersApplication DataDatacardServiceDCService.exe
C:Program FilesMail.RuGuardGuardMailRu.exe
C:WINDOWSTEMPGuardGuard.exe
C:Program FilesCyberLinkShared FilesRichVideo.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSExplorer.EXE
C:Program FilesAthanAthan.exe
C:Program FilesMail.RuGuardGuardMailRu.exe
C:Program FilesCyberLinkPowerDVDPDVDServ.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesMail.RuAgentmagent.exe
C:Program FilesInternet Exploreriexplore.exe
C:Program FilesMail.RuSputnikSputnikHelper.exe
C:Program FilesMail.RuSputnikSputnikFlashPlayer.exe
C:Program FilesInternet Exploreriexplore.exe
C:Program FilesInternet Exploreriexplore.exe
C:Documents and Settings123Рабочий столRSIT.exe
C:Program Filestrend micro123.exe

R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://webalta.ru
R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://webalta.ru/poisk
R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://webalta.ru/poisk
R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://webalta.ru/poisk
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.rambler.ru/
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://webalta.ru
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://webalta.ru/poisk
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://webalta.ru/poisk
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://webalta.ru/poisk
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://webalta.ru
R1 — HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://webalta.ru/poisk
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://webalta.ru/poisk
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: Rambler-Ассистент — {468CD8A9-7C25-45FA-969E-3D925C689DC4} — C:Program FilesRambler AssistantramblertoolbarU5950.dll
R3 — URLSearchHook: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O2 — BHO: Adobe PDF Link Helper — {18DF081C-E8AD-4283-A596-FA578C2EBDC3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelperShim.dll
O2 — BHO: MailRuBHO Class — {8984B388-A5BB-4DF7-B274-77B879E179DB} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O2 — BHO: IE 4.x-6.x BHO for Download Master — {9961627E-4059-41B4-8E0E-A7D6B3854ADF} — C:PROGRA~1DOWNLO~1dmiehlp.dll
O3 — Toolbar: Rambler-Ассистент — {468CD8A9-7C25-45FA-969E-3D925C689DC4} — C:Program FilesRambler AssistantramblertoolbarU5950.dll
O3 — Toolbar: DM Bar — {0E1230F8-EA50-42A9-983C-D22ABC2EED3C} — C:Program FilesDownload Masterdmbar.dll
O3 — Toolbar: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O3 — Toolbar: Яндекс.Бар — {91397D20-1446-11D4-8AF4-0040CA1127B6} — C:Program FilesYandexYandexBarIEyndbar.dll
O4 — HKLM..Run: [MAgent] C:Program FilesMail.RuAgentMAgent.exe -LM
O4 — HKLM..Run: [Athan] C:Program FilesAthanAthan.exe
O4 — HKLM..Run: [Guard.Mail.ru.gui] «C:Program FilesMail.RuGuardGuardMailRu.exe» /gui
O4 — HKLM..Run: [RemoteControl] «C:Program FilesCyberLinkPowerDVDPDVDServ.exe»
O4 — HKLM..Run: [Adobe ARM] «C:Program FilesCommon FilesAdobeARM1.0AdobeARM.exe»
O4 — HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [VPetsPlayer] C:Program FilesVPetsVPets.exe
O4 — HKCU..Run: [ETraffic] C:Program FilesETraffic 2.8.4.0ETraffic.exe
O4 — HKCU..Run: [QQIntl] «C:Program FilesTencentQQIntlBinQQ.exe» /background
O4 — HKCU..Run: [Skype] «C:Program FilesSkypePhoneSkype.exe» /nosplash /minimized
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 — Extra context menu item: Google ВикиКомментарии… — res://C:Program FilesGoogleGoogle ToolbarComponentGoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O8 — Extra context menu item: Добавить в Rambler-Закладки — res://C:Program FilesRambler AssistantramblertoolbarU5950.dll/zakladki.htm
O8 — Extra context menu item: Закачать ВСЕ при помощи Download Master — C:Program FilesDownload Masterdmieall.htm
O8 — Extra context menu item: Закачать при помощи Download Master — C:Program FilesDownload Masterdmie.htm
O8 — Extra context menu item: Найти с помощью Рамблера — res://C:Program FilesRambler AssistantramblertoolbarU5950.dll/search.htm
O8 — Extra context menu item: Перевести с помощью словарей Рамблера — res://C:Program FilesRambler AssistantramblertoolbarU5950.dll/dic.htm
O8 — Extra context menu item: Передать на удаленную закачку DM — C:Program FilesDownload Masterremdown.htm
O9 — Extra button: PalTalk — {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} — C:Program FilesPaltalk MessengerPaltalk.exe (file missing)
O9 — Extra button: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra ‘Tools’ menuitem: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra button: Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
O9 — Extra ‘Tools’ menuitem: &Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
O9 — Extra button: Справочные материалы — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O10 — Unknown file in Winsock LSP: c:windowssystem32nwprovau.dll
O15 — Trusted Zone: http://www.otaq.net
O16 — DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} — http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 — Service: DCService.exe — Unknown owner — C:Documents and SettingsAll UsersApplication DataDatacardServiceDCService.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Guard.Mail.ru — Unknown owner — C:Program FilesMail.RuGuardGuardMailRu.exe
O23 — Service: Служба Google Update (gupdate) (gupdate) — Google Inc. — C:Program FilesGoogleUpdateGoogleUpdate.exe
O23 — Service: Служба Google Update (gupdatem) (gupdatem) — Google Inc. — C:Program FilesGoogleUpdateGoogleUpdate.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: NetMeeting Remote Desktop Sharing (mnmsrvc) — Корпорация Майкрософт — C:WINDOWSsystem32mnmsrvc.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Cyberlink RichVideo Service(CRVS) (RichVideo) — Unknown owner — C:Program FilesCyberLinkShared FilesRichVideo.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe

—
End of file — 8742 bytes

======Scheduled tasks folder======

C:WINDOWStasksGoogleUpdateTaskMachineCore.job
C:WINDOWStasksGoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelperShim.dll [2011-06-06 63912]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{8984B388-A5BB-4DF7-B274-77B879E179DB}]
MailRuBHO Class — C:Program FilesMail.RuSputnikMailRuSputnik.dll [2011-06-19 1546960]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9961627E-4059-41B4-8E0E-A7D6B3854ADF}]
IE 4.x-6.x BHO for Download Master — C:PROGRA~1DOWNLO~1dmiehlp.dll [2011-08-04 165440]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{468CD8A9-7C25-45FA-969E-3D925C689DC4} — Rambler-Ассистент — C:Program FilesRambler AssistantramblertoolbarU5950.dll [2008-12-09 845296]
{0E1230F8-EA50-42A9-983C-D22ABC2EED3C} — DM Bar — C:Program FilesDownload Masterdmbar.dll [2010-06-03 185664]
{09900DE8-1DCA-443F-9243-26FF581438AF} — Спутник@Mail.Ru — C:Program FilesMail.RuSputnikMailRuSputnik.dll [2011-06-19 1546960]
{91397D20-1446-11D4-8AF4-0040CA1127B6} — Яндекс.Бар — C:Program FilesYandexYandexBarIEyndbar.dll [2010-06-01 10336584]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«MAgent»=C:Program FilesMail.RuAgentMAgent.exe [2010-10-06 12270784]
«Athan»=C:Program FilesAthanAthan.exe [2010-03-27 1122304]
«Guard.Mail.ru.gui»=C:Program FilesMail.RuGuardGuardMailRu.exe [2011-06-19 1472720]
«RemoteControl»=C:Program FilesCyberLinkPowerDVDPDVDServ.exe [2006-11-23 56928]
«Adobe ARM»=C:Program FilesCommon FilesAdobeARM1.0AdobeARM.exe [2011-06-06 937920]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«ctfmon.exe»=C:WINDOWSsystem32ctfmon.exe [2004-08-17 15360]
«VPetsPlayer»=C:Program FilesVPetsVPets.exe []
«ETraffic»=C:Program FilesETraffic 2.8.4.0ETraffic.exe [2011-04-02 616448]
«QQIntl»=C:Program FilesTencentQQIntlBinQQ.exe [2011-06-15 144760]
«Skype»=C:Program FilesSkypePhoneSkype.exe [2011-06-15 15141768]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAnti Trojan Elite]
C:Program FilesAnti Trojan EliteTJEnder.exe :NO []

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregCTFMON.EXE]
C:WINDOWSsystem32ctfmon.exe [2004-08-17 15360]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregFree Download Manager]
C:Program FilesFree Download Managerfdm.exe -autorun []

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregHotKeysCmds]
C:WINDOWSsystem32hkcmd.exe [2008-02-14 159744]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIgfxTray]
C:WINDOWSsystem32igfxtray.exe [2008-02-14 135168]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregKernelFaultCheck]
C:WINDOWSsystem32dumprep 0 -k []

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPersistence]
C:WINDOWSsystem32igfxpers.exe [2008-02-14 131072]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSoftware Informer]
C:Program FilesSoftware Informersoftinfo.exe -autorun []

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupfolderC:^Documents and Settings^123^Главное меню^Программы^Автозагрузка^_uninst_setup_9.0.0.722_06.10.2010_16-33.exe.lnk]
C:Documents and Settings123Local SettingsTemp_uninst_setup_9.0.0.722_06.10.2010_16-33.exe.bat []

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigservices]
«avast! Web Scanner»=3
«avast! Mail Scanner»=3
«avast! Antivirus»=2
«lanmanworkstation»=2
«lanmanserver»=2

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyigfxcui]
C:WINDOWSsystem32igfxdev.dll [2008-02-14 208896]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlLsa]
«authentication packages»=msv1_0
nwprovau

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«DisableTaskMgr»=1

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=145

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«HonorAutoRunSetting»=

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesSkypePhoneSkype.exe»=»C:Program FilesSkypePhoneSkype.exe:*:Enabled:Skype «
«C:Documents and Settings123Рабочий столfg706pFreeU18.exe»=»C:Documents and Settings123Рабочий столfg706pFreeU18.exe:*:Enabled:Fast and Secure Gateway to Internet Freedom»
«C:Program FilesMail.RuAgentmagent.exe»=»C:Program FilesMail.RuAgentmagent.exe:*:Enabled:Mail.Ru Агент»
«C:Program FilesTencentQQIntlBinQQ.exe»=»C:Program FilesTencentQQIntlBinQQ.exe:*:Enabled:QQ International»
«C:Program FilesTencentQQPlayerQQDeskUpdate.exe»=»C:Program FilesTencentQQPlayerQQDeskUpdate.exe:*:Enabled:QQPlayerUpdate»
«C:Program FilesTencentQQPlayerQQPlayer.exe»=»C:Program FilesTencentQQPlayerQQPlayer.exe:*:Enabled:QQPlayer»
«C:Program FilesTencentQQPlayerQPUp.exe»=»C:Program FilesTencentQQPlayerQPUp.exe:*:Enabled:QPUpdate»
«C:Program FilesCommon FilesTencentQQDownload104Tencentdl.exe»=»C:Program FilesCommon FilesTencentQQDownload104Tencentdl.exe:*:Enabled:МЪС¶ІъЖ·ПВФШЧйјю»
«C:Documents and Settings123Рабочий столfg706pFreeU17.exe»=»C:Documents and Settings123Рабочий столfg706pFreeU17.exe:*:Enabled:Fast and Secure Gateway to Internet Freedom»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{3fdfb9bf-03d6-11e0-b742-00ff7e4e6c91}]
shellAutoRuncommand — G:autorun.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{97b730c1-d12f-11df-93d5-ac6d2a1ac6b6}]
shellAutoRuncommand — G:setup.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{bf83ca6a-6bd5-11e0-8719-00ff4bddae35}]
shellAutoRuncommand — G:autorun.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{c21bae2d-03d5-11e0-ad5b-001cbf8ca5a5}]
shellAutoRuncommand — G:autorun.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{e04340d3-6bc8-11e0-8715-00ff4bddae35}]
shellAutoRuncommand — G:autorun.exe

======File associations======

.ini — open — C:WINDOWSSystem32NOTEPAD.EXE %1
.txt — open — C:WINDOWSnotepad.exe %1

======List of files/folders created in the last 1 months======

2011-09-03 00:02:22 —-D—- C:rsit
2011-08-21 00:25:08 —-D—- C:Program FilesYandex
2011-08-21 00:25:08 —-D—- C:Documents and SettingsAll UsersApplication DataYandex

======List of files/folders modified in the last 1 months======

2011-09-03 00:03:00 —-D—- C:Program FilesTrend Micro
2011-09-03 00:02:28 —-D—- C:WINDOWSPrefetch
2011-09-02 23:51:38 —-D—- C:Documents and Settings123Application DataSkype
2011-09-02 23:31:11 —-D—- C:Program FilesConverter Amr-Wav
2011-09-02 23:20:07 —-D—- C:WINDOWSsystem32CatRoot2
2011-09-02 23:06:46 —-D—- C:WINDOWSTemp
2011-09-02 23:04:54 —-A—- C:WINDOWSSchedLgU.Txt
2011-08-31 01:04:59 —-A—- C:WINDOWSModemLog_HUAWEI Mobile Connect — 3G Modem.txt
2011-08-31 00:40:06 —-D—- C:Documents and Settings123Application Datachinatelecom
2011-08-31 00:00:27 —-A—- C:WINDOWSModemLog_HUAWEI Mobile Connect — 3G Modem #2.txt
2011-08-27 01:07:38 —-A—- C:WINDOWSQQPlayer.INI
2011-08-21 00:25:16 —-SHD—- C:WINDOWSInstaller
2011-08-21 00:25:08 —-RD—- C:Program Files
2011-08-21 00:25:08 —-D—- C:Documents and Settings123Application DataYandex
2011-08-21 00:24:48 —-D—- C:Program FilesDownload Master
2011-08-19 16:03:38 —-D—- C:Program FilesIslamic Encyclopedia
2011-08-19 16:03:38 —-A—- C:WINDOWSMNTKHB_H.INI
2011-08-19 14:45:23 —-D—- C:WINDOWSsystem32
2011-08-07 15:55:45 —-D—- C:Program FilesAlawar
2011-08-06 00:48:46 —-D—- C:WINDOWSHelp
2011-08-05 11:58:36 —-D—- C:WINDOWS
2011-08-05 00:48:37 —-A—- C:WINDOWSsystem.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 eawdmfd;EAWDMFD; C:WINDOWSsystem32DRIVERSeawdmfd.sys [1999-10-29 24348]
R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2004-08-17 40448]
R1 kbdhid;Драйвер клавиатуры HID; C:WINDOWSsystem32DRIVERSkbdhid.sys [2004-08-17 14848]
R1 WmiAcpi;Интерфейс управления для ACPI Microsoft Windows; C:WINDOWSsystem32DRIVERSwmiacpi.sys [2004-08-03 8832]
R2 NwlnkIpx;NWLink IPX/SPX/NetBIOS-совместимый транспортный протокол; C:WINDOWSsystem32DRIVERSnwlnkipx.sys [2004-08-03 88448]
R2 NwlnkNb;NWLink NetBIOS; C:WINDOWSsystem32DRIVERSnwlnknb.sys [2001-10-20 63232]
R2 NwlnkSpx;Протокол NWLink SPX/SPXII; C:WINDOWSsystem32DRIVERSnwlnkspx.sys [2001-10-20 55936]
R3 CmBatt;Драйвер батареи с ACPI-управлением (Майкрософт); C:WINDOWSsystem32DRIVERSCmBatt.sys [2004-08-03 14080]
R3 E100B;Intel(R) PRO Network Connection Driver; C:WINDOWSsystem32DRIVERSe100b325.sys [2007-11-15 165496]
R3 HBtnKey;HBtnKey; C:WINDOWSsystem32DRIVERScpqbttn.sys [2009-04-19 9344]
R3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:WINDOWSsystem32driversCHDAud.sys [2007-02-13 625664]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:WINDOWSsystem32DRIVERSHDAudBus.sys [2005-01-07 138752]
R3 hidusb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2001-10-20 9600]
R3 HpqKbFiltr;HpqKbFilter Driver; C:WINDOWSsystem32DRIVERSHpqKbFiltr.sys [2007-06-18 16768]
R3 HSF_DPV;HSF_DPV; C:WINDOWSsystem32DRIVERSHSF_DP.sys [2009-08-23 985856]
R3 HSFHWAZL;HSFHWAZL; C:WINDOWSsystem32DRIVERSHSF_HWAZL.sys [2009-08-23 210048]
R3 ialm;ialm; C:WINDOWSsystem32DRIVERSigxpmp32.sys [2008-02-15 5854752]
R3 mouhid;Драйвер мыши HID; C:WINDOWSsystem32DRIVERSmouhid.sys [2001-10-20 12160]
R3 NWRDR;NetWare Rdr; C:WINDOWSsystem32DRIVERSnwrdr.sys [2004-08-03 163584]
R3 rasuw;ChinaNet WLAN Adapter; C:WINDOWSsystem32DRIVERSrasuw.sys [2009-10-12 33280]
R3 usbccgp;Драйвер универсального родительского устройства USB (Microsoft); C:WINDOWSsystem32DRIVERSusbccgp.sys [2004-08-03 31616]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2004-08-03 26624]
R3 usbhub;USB Root Hub (usbport); C:WINDOWSsystem32DRIVERSusbhub.sys [2004-08-03 57600]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2004-08-03 20480]
R3 usbvideo;USB-видеоустройство (WDM); C:WINDOWSSystem32Driversusbvideo.sys [2004-08-03 78464]
R3 Wdf01000;Wdf01000; C:WINDOWSsystem32DRIVERSWdf01000.sys [2006-11-01 492000]
R3 winachsf;winachsf; C:WINDOWSsystem32DRIVERSHSF_CNXT.sys [2009-08-23 731264]
S1 12139221;12139221; C:WINDOWSsystem32DRIVERS12139221.sys []
S2 ATE_PROCMON;ATE_PROCMON; ??C:Program FilesAnti Trojan EliteATEPMon.sys []
S3 CCDECODE;Closed Caption декодер; C:WINDOWSsystem32DRIVERSCCDECODE.sys [2004-08-03 17024]
S3 DKbFltr;Dritek Keyboard Filter Driver; C:WINDOWSsystem32DRIVERSDKbFltr.sys [2004-12-08 16896]
S3 eaps2kbd;Compaq Easy Access PS2 Internet Keyboard (Win2K); C:WINDOWSsystem32DRIVERSeaps2kbd.sys [2001-12-28 24035]
S3 ewusbnet;HUAWEI USB-NDIS miniport; C:WINDOWSsystem32DRIVERSewusbnet.sys [2009-12-08 114432]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:WINDOWSsystem32DRIVERSewusbmdm.sys [2009-12-07 102912]
S3 hwusbdev;Huawei DataCard USB PNP Device; C:WINDOWSsystem32DRIVERSewusbdev.sys [2009-10-12 100736]
S3 MSTEE;Преобразователь потоков Tee/Sink-to-Sink Microsoft; C:WINDOWSsystem32driversMSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI кодек; C:WINDOWSsystem32DRIVERSNABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft видео или ТВ подключение; C:WINDOWSsystem32DRIVERSNdisIP.sys [2004-08-03 10880]
S3 NETwLx32; Драйвер адаптера Intel(R) Wireless WiFi Link серии 5000 для Windows XP 32 Bit ; C:WINDOWSsystem32DRIVERSNETwLx32.sys [2010-07-04 6606208]
S3 SLIP;BDA Slip De-Framer; C:WINDOWSsystem32DRIVERSSLIP.sys [2004-08-03 11136]
S3 streamip;BDA IPSink; C:WINDOWSsystem32DRIVERSStreamIP.sys [2004-08-03 15360]
S3 usbscan;Драйвер USB-сканера; C:WINDOWSsystem32DRIVERSusbscan.sys [2004-08-03 15104]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2004-08-03 26496]
S3 WpdUsb;WpdUsb; C:WINDOWSsystem32DRIVERSwpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;World Standard Teletext кодек; C:WINDOWSsystem32DRIVERSWSTCODEC.SYS [2004-08-03 19328]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 DCService.exe;DCService.exe; C:Documents and SettingsAll UsersApplication DataDatacardServiceDCService.exe [2009-11-20 212992]
R2 Guard.Mail.ru;Guard.Mail.ru; C:Program FilesMail.RuGuardGuardMailRu.exe [2011-06-19 1472720]
R2 NWCWorkstation;Клиент для сетей NetWare; C:WINDOWSsystem32svchost.exe [2004-08-17 14336]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:Program FilesCyberLinkShared FilesRichVideo.exe [2005-08-07 167936]
R2 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2004-08-17 14336]
S2 gupdate;Служба Google Update (gupdate); C:Program FilesGoogleUpdateGoogleUpdate.exe [2010-11-27 136176]
S3 gupdatem;Служба Google Update (gupdatem); C:Program FilesGoogleUpdateGoogleUpdate.exe [2010-11-27 136176]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2003-07-28 89136]

EOF
8 апреля, 2009 в 6:18 дп в ответ на: КОМП СТАЛ ОЧENЬ МEДЛENNO РАБОТАТЬ. #22635
QERIBAN
Participant
- Темы:6
- Сообщений:39
второй RSIT лог
8 апреля, 2009 в 6:15 дп в ответ на: КОМП СТАЛ ОЧENЬ МEДЛENNO РАБОТАТЬ. #22634
QERIBAN
Participant
- Темы:6
- Сообщений:39
gmer loq
8 апреля, 2009 в 6:10 дп в ответ на: КОМП СТАЛ ОЧENЬ МEДЛENNO РАБОТАТЬ. #22633
QERIBAN
Participant
- Темы:6
- Сообщений:39
//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 3)
Wed Apr 08 14:06:55 2009

14:06:47: Error: Invalid registry syntax in command:
«HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{A6C514F6-D7D8-F038-464A-0AAE17B106DE}»
Only registry keys under the HKEY_LOCAL_MACHINE hive are accessible to this program.
Skipping line. (Registry key deletion mode)

//////////////////////////////////////////

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Completed script processing.

*******************

Finished! Terminate.
8 апреля, 2009 в 6:04 дп в ответ на: КОМП СТАЛ ОЧENЬ МEДЛENNO РАБОТАТЬ. #22632
QERIBAN
Participant
- Темы:6
- Сообщений:39
COMBOFIX LOQ Окозалось слишком большим
4 апреля, 2009 в 6:50 пп в ответ на: КОМП СТАЛ ОЧENЬ МEДЛENNO РАБОТАТЬ. #22630
QERIBAN
Participant
- Темы:6
- Сообщений:39
НЕ ЗНАЮ ЭТО ЛИ ВЫ ХОТИТЕ ОТ МЕНЯ?

Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 62 !
2 апреля, 2009 в 11:37 пп в ответ на: КОМП СТАЛ ОЧENЬ МEДЛENNO РАБОТАТЬ. #22628
QERIBAN
Participant
- Темы:6
- Сообщений:39
GMER LOQ
2 апреля, 2009 в 11:28 пп в ответ на: КОМП СТАЛ ОЧENЬ МEДЛENNO РАБОТАТЬ. #22627
QERIBAN
Participant
- Темы:6
- Сообщений:39
ComboFix 09-04-01.01 — 123 2009-04-03 7:24:24.7 — FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1251.1.1049.18.1015.600 [GMT 4:00]
Running from: c:documents and settings123Рабочий столComboFix.exe
Command switches used :: c:documents and settings123Рабочий столCFScript..txt
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2009-03-03 to 2009-04-03 )))))))))))))))))))))))))))))))
.

2009-04-02 17:19 . 2009-04-02 17:19 d—h

C:$AVG8.VAULT$
2009-04-02 16:53 . 2009-04-02 16:53 d—s—- c:documents and settings123UserData
2009-04-02 16:46 . 2009-04-02 16:46 d

c:windowssystem32driversAvg
2009-04-02 16:46 . 2009-04-02 16:46 d

c:program filesAVG
2009-04-02 16:46 . 2009-04-02 16:46 d

c:documents and settingsAll UsersApplication Dataavg8
2009-04-02 16:46 . 2009-04-02 16:46 d

c:documents and settings123Application DataAVGTOOLBAR
2009-04-02 16:46 . 2009-04-02 16:46 325,640 —a

c:windowssystem32driversavgldx86.sys
2009-04-02 16:46 . 2009-04-02 16:46 107,912 —a

c:windowssystem32driversavgtdix.sys
2009-04-02 16:46 . 2009-04-02 16:46 10,520 —a

c:windowssystem32avgrsstx.dll
2009-04-01 00:40 . 2009-04-01 00:40 d

c:documents and settings123Application DataMail.Ru
2009-03-30 18:14 . 2009-03-30 18:14 d

c:program filesMSECache
2009-03-27 16:30 . 2009-03-27 16:30 d

c:program filesDownload Master
2009-03-24 23:17 . 2009-03-24 23:17 d

c:documents and settingsAll UsersApplication DataAvira
2009-03-24 20:40 . 2009-03-24 20:44 4,496,273 —a

c:program filesazan.exe
2009-03-24 14:02 . 2009-03-24 14:02 d

c:windowssystem32ru-ru
2009-03-24 14:02 . 2009-03-24 14:02 d

c:windowssystem32ru
2009-03-24 14:02 . 2009-03-24 14:02 d

c:windowssystem32bits
2009-03-24 14:02 . 2009-03-24 14:02 d

c:windowsl2schemas
2009-03-24 13:59 . 2009-03-24 13:59 d

c:windowsServicePackFiles
2009-03-23 20:03 . 2009-03-23 20:03 d

c:program filesYandex
2009-03-23 20:03 . 2009-03-23 20:03 d

c:documents and settings123Application DataYandex
2009-03-23 03:00 . 2009-03-23 03:00 d

c:program filesMSXML 4.0
2009-03-22 20:01 . 2008-10-16 14:08 27,672 —a

c:windowssystem32wuapi.dll.mui
2009-03-21 23:07 . 2009-03-21 23:07 d

c:documents and settingsAll UsersApplication DataESET
2009-03-19 01:24 . 2009-03-19 01:25 4,114 —a

c:windowssystem32secushr.dat
2009-03-19 01:24 . 2009-03-19 01:24 248 —a

c:windowssystem32secustat.dat
2009-03-19 01:23 . 2009-03-19 01:23 d

c:documents and settings123Application DataFlashgetSetup
2009-03-19 01:18 . 2009-03-19 01:18 d

c:documents and settings123Application DataMedia Player Classic

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-28 14:26 737,280 —-a-w c:windowsiun6002.exe
2009-03-23 16:17 2,516 —sha-w c:windowssystem32KGyGaAvL.sys
2009-02-11 06:19 38,496 —-a-w c:windowssystem32driversmbamswissarmy.sys
2009-02-11 06:19 15,504 —-a-w c:windowssystem32driversmbam.sys
2009-02-09 13:07 1,846,912 —-a-w c:windowssystem32win32k.sys
2009-02-09 13:07 1,846,912

w c:windowssystem32dllcachewin32k.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]
«{ecdee021-0d17-467f-a1ff-c7a115230949}»= «c:program filesfree-downloads.nettbfree.dll» [2007-12-10 1510424]

[HKEY_CLASSES_ROOTclsid{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_LOCAL_MACHINE~Browser Helper Objects{ecdee021-0d17-467f-a1ff-c7a115230949}]
2007-12-10 13:46 1510424 —a

c:program filesfree-downloads.nettbfree.dll

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{ecdee021-0d17-467f-a1ff-c7a115230949}»= «c:program filesfree-downloads.nettbfree.dll» [2007-12-10 1510424]

[HKEY_CLASSES_ROOTclsid{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{ECDEE021-0D17-467F-A1FF-C7A115230949}»= «c:program filesfree-downloads.nettbfree.dll» [2007-12-10 1510424]

[HKEY_CLASSES_ROOTclsid{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2008-04-14 15360]
«AlcoholAutomount»=»d:alcohol 120% 1.9.7.6022Alcohol 120axcmd.exe» [2007-12-22 222080]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«IgfxTray»=»c:windowssystem32igfxtray.exe» [2007-09-18 141848]
«HotKeysCmds»=»c:windowssystem32hkcmd.exe» [2007-09-18 166424]
«Persistence»=»c:windowssystem32igfxpers.exe» [2007-09-18 137752]
«V0330Mon.exe»=»c:windowsV0330Mon.exe» [2007-04-30 32768]
«ISUSPM Startup»=»c:program filesCommon FilesInstallShieldUpdateServiceisuspm.exe» [2005-08-11 249856]
«ISUSScheduler»=»c:program filesCommon FilesInstallShieldUpdateServiceissch.exe» [2005-08-11 81920]
«MAgent»=»c:program filesMail.RuAgentMAgent.exe» [2009-01-13 5598392]
«Athan»=»c:program filesAthanAthan.exe» [2005-10-09 954368]
«AVG8_TRAY»=»c:progra~1AVGAVG8avgtray.exe» [2009-04-02 1932568]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-14 15360]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotifyavgrsstarter]
2009-04-02 16:46 10520 c:windowssystem32avgrsstx.dll

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe Reader Speed Launcher]
—a

2008-06-12 02:38 34672 c:program filesAdobeReader 9.0Readerreader_sl.exe

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\Messenger\msmsgs.exe»=
«d:\uTorrent.exe»=
«c:\Program Files\Windows Live\Messenger\msnmsgr.exe»=
«c:\Program Files\Windows Live\Messenger\livecall.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«d:\SKYPE\Phone\Skype.exe»=
«d:\ICQ6.5\ICQ.exe»=
«$INSTDIR\FlvDetector.exe»= c:\Program Files\FlashGet Network\FlashGet 3\FlvDetector.exe
«c:\Program Files\AVG\AVG8\avgupd.exe»=
«c:\Program Files\AVG\AVG8\avgnsx.exe»=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:windowssystem32driversavgldx86.sys [2009-04-02 325640]
R1 AvgTdiX;AVG Free8 Network Redirector;c:windowssystem32driversavgtdix.sys [2009-04-02 107912]
R2 avg8wd;AVG Free8 WatchDog;c:progra~1AVGAVG8avgwdsvc.exe [2009-04-02 298264]
R3 V0330VID;WebCam Vista/Live! Cam Chat;c:windowssystem32driversV0330Vid.sys [2008-10-15 157696]
S2 ccosm;Contrl Center of Storm Media;c:program filesStormIIstormliv.exe /asservice —> c:program filesStormIIstormliv.exe [?]

— Other Services/Drivers In Memory —

*NewlyCreated* — MBR
*Deregistered* — mbr
.
.

Supplementary Scan

.
uStart Page = hxxp://www.google.ru/ig?hl=ru
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
IE: Добавить в Rambler-Закладки — d:rambler assistantramblertoolbarU5950.dll/zakladki.htm
IE: Закачать ВСЕ при помощи Download Master — c:program filesDownload Masterdmieall.htm
IE: Закачать все при помощи FlashGet — c:program filesFlashGetjc_all.htm
IE: Закачать при помощи Download Master — c:program filesDownload Masterdmie.htm
IE: Закачать при помощи FlashGet — c:program filesFlashGetjc_link.htm
IE: Найти с помощью Рамблера — d:rambler assistantramblertoolbarU5950.dll/search.htm
IE: Опубликовать в Дневнике — d:rambler assistantramblertoolbarU5950.dll/planet.htm
IE: Перевести с помощью словарей Рамблера — d:rambler assistantramblertoolbarU5950.dll/dic.htm
IE: Поиск@Mail.Ru — c:program filesMail.RuSputnikMailRuSputnik.dll/282
IE: Словари@Mail.Ru — c:program filesMail.RuSputnikMailRuSputnik.dll/283
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:program filesMail.RuAgentmagent.exe
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe
FF — ProfilePath — c:documents and settings123Application DataMozillaFirefoxProfileslb4yf04o.default
FF — prefs.js: browser.search.defaulturl — hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF — prefs.js: browser.search.selectedEngine — Р’РёРєРёРїРµРґРёСЏ (ru)
FF — prefs.js: browser.startup.homepage — hxxp://www.yahoo.com/
FF — prefs.js: keyword.URL — hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF — component: c:program filesMozilla Firefoxextensions{DB9127A2-3381-41ec-82B3-1B6ED4C6F29A}componentsFlashgetXpi.dll
FF — plugin: d:real alternativebrowserpluginsnppl3260.dll
FF — plugin: d:real alternativebrowserpluginsnprpjplug.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-03 07:25:25
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-04-03 7:26:07
ComboFix2.txt 2009-03-29 20:05:04
ComboFix-quarantined-files.txt 2009-04-03 03:26:06

Pre-Run: 5 925 978 112 байт свободно
Post-Run: 6,020,988,928 байт свободно

149 — E O F — 2009-03-31 18:56:42
31 марта, 2009 в 9:24 дп в ответ на: КОМП СТАЛ ОЧENЬ МEДЛENNO РАБОТАТЬ. #22625
QERIBAN
Participant
- Темы:6
- Сообщений:39
GMER 1.0.15.14944 — http://www.gmer.net
Rootkit scan 2009-03-31 17:19:04
Windows 5.1.2600 Service Pack 3

—- System — GMER 1.0.15 —-

SSDT spah.sys ZwCreateKey [0xF730A0E0]
SSDT spah.sys ZwEnumerateKey [0xF7327CA2]
SSDT spah.sys ZwEnumerateValueKey [0xF7328030]
SSDT spah.sys ZwOpenKey [0xF730A0C0]
SSDT spah.sys ZwQueryKey [0xF7328108]
SSDT spah.sys ZwQueryValueKey [0xF7327F88]
SSDT spah.sys ZwSetValueKey [0xF732819A]

INT 0x62 ? 86D68BF8
INT 0x82 ? 86D68BF8
INT 0xB4 ? 869A3F00
INT 0xB4 ? 869A3F00

—- Kernel code sections — GMER 1.0.15 —-

? spah.sys Íå óäàåòñÿ íàéòè óêàçàííûé ôàéë. !
.text USBPORT.SYS!DllUnload F65F08AC 5 Bytes JMP 869A34E0
.text ahn6uhib.SYS F64FF384 1 Byte [20]
.text ahn6uhib.SYS F64FF384 37 Bytes [20, 00, 00, 68, 00, 00, 00, …]
.text ahn6uhib.SYS F64FF3AA 24 Bytes [00, 00, 20, 00, 00, E0, 00, …]
.text ahn6uhib.SYS F64FF3C4 3 Bytes [00, 00, 00]
.text ahn6uhib.SYS F64FF3C9 1 Byte [00]
.text …

—- Kernel IAT/EAT — GMER 1.0.15 —-

IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] IAT atapi.sys[HAL.dll!READ_PORT_USHORT] IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] IAT SystemRootSystem32Driversahn6uhib.SYS[HAL.dll!KfAcquireSpinLock] IAT SystemRootSystem32Driversahn6uhib.SYS[HAL.dll!READ_PORT_UCHAR] IAT SystemRootSystem32Driversahn6uhib.SYS[HAL.dll!KeGetCurrentIrql] IAT SystemRootSystem32Driversahn6uhib.SYS[HAL.dll!KfRaiseIrql] IAT SystemRootSystem32Driversahn6uhib.SYS[HAL.dll!KfLowerIrql] IAT SystemRootSystem32Driversahn6uhib.SYS[HAL.dll!HalGetInterruptVector] IAT SystemRootSystem32Driversahn6uhib.SYS[HAL.dll!HalTranslateBusAddress] IAT SystemRootSystem32Driversahn6uhib.SYS[HAL.dll!KeStallExecutionProcessor] IAT SystemRootSystem32Driversahn6uhib.SYS[HAL.dll!KfReleaseSpinLock] IAT SystemRootSystem32Driversahn6uhib.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] IAT SystemRootSystem32Driversahn6uhib.SYS[HAL.dll!READ_PORT_USHORT] IAT SystemRootSystem32Driversahn6uhib.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] IAT SystemRootSystem32Driversahn6uhib.SYS[HAL.dll!WRITE_PORT_UCHAR] IAT SystemRootSystem32Driversahn6uhib.SYS[WMILIB.SYS!WmiSystemControl] IAT SystemRootSystem32Driversahn6uhib.SYS[WMILIB.SYS!WmiCompleteRequest] [F730B040] spah.sys
[F730B13C] spah.sys
[F730B0BE] spah.sys
[F730B7FC] spah.sys
[F730B6D2] spah.sys
00000034
0000008E
00000043
00000044
000000C4
000000DE
000000E9
000000CB
00000054
0000007B
00000094
00000032
000000A6
00000023
0000003D

—- Devices — GMER 1.0.15 —-

Device FileSystemFastfat FatCdrom 86D671F8
Device Driverusbuhci DeviceUSBPDO-0 86A76500
Device Driverdmio DeviceDmControlDmIoDaemon 86DD91F8
Device Driverdmio DeviceDmControlDmConfig 86DD91F8
Device Driverdmio DeviceDmControlDmPnP 86DD91F8
Device Driverdmio DeviceDmControlDmInfo 86DD91F8
Device Driverusbehci DeviceUSBPDO-1 86B141F8
Device DriverFtdisk DeviceHarddiskVolume1 86D691F8
Device DriverFtdisk DeviceHarddiskVolume2 86D691F8
Device DriverCdrom DeviceCdRom0 86A561F8
Device DriverFtdisk DeviceHarddiskVolume3 86D691F8
Device DriverCdrom DeviceCdRom1 86A561F8
Device DriverNetBT DeviceNetBT_Tcpip_{11BD6EB6-C0DE-41CD-8455-DEE482CA4083} 86914500
Device DriverNetBT DeviceNetBt_Wins_Export 86914500
Device Driversptd Device3905048580 spah.sys
Device DriverNetBT DeviceNetbiosSmb 86914500
Device DriverPCI_PNP3580 Device000004f spah.sys
Device Driverusbuhci DeviceUSBFDO-0 86A76500
Device Driverusbehci DeviceUSBFDO-1 86B141F8
Device FileSystemMRxSmb DeviceLanmanDatagramReceiver 86978500
Device FileSystemMRxSmb DeviceLanmanRedirector 86978500
Device DriverNetBT DeviceNetBT_Tcpip_{8CF33562-65EC-43D1-9720-278EE0D512A5} 86914500
Device DriverFtdisk DeviceFtControl 86D691F8
Device Driverahn6uhib DeviceScsiahn6uhib1Port2Path0Target0Lun0 86904500
Device Driverahn6uhib DeviceScsiahn6uhib1 86904500
Device FileSystemFastfat Fat 86D671F8
Device FileSystemCdfs Cdfs 868F8500

—- Registry — GMER 1.0.15 —-

Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (L002TP) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPTP) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPPoE) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@374@4O4494 ?0404@0404;4;0454;4L4=4K494 ?4>4@4B4 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (IP) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 ?4;0404=484@4>0424I484:0404 ?0404:0454B4>0424 1?2?3?
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@s1 771343423
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@s2 285507792
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@h0 1
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04@p0 D:Alcohol 120% 1.9.7.6022Alcohol 120
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04@h0 0
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04@ujdew 0x95 0xD7 0x59 0x93 …
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001@ujdew 0xCE 0xA4 0x35 0xAE …
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40@ujdew 0xF7 0x2F 0xE0 0xF0 …
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04@p0 D:Alcohol 120% 1.9.7.6022Alcohol 120
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04@h0 0
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04@ujdew 0x95 0xD7 0x59 0x93 …
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@ujdew 0xCE 0xA4 0x35 0xAE …
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40@ujdew 0xF7 0x2F 0xE0 0xF0 …
Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (L002TP) 1?
Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPTP) 1?
Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPPoE) 1?
Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@374@4O4494 ?0404@0404;4;0454;4L4=4K494 ?4>4@4B4 1?
Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (IP) 1?
Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 ?4;0404=484@4>0424I484:0404 ?0404:0454B4>0424 1?2?3?
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D04
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D04@p0 D:Alcohol 120% 1.9.7.6022Alcohol 120
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D04@h0 0
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D04@ujdew 0x95 0xD7 0x59 0x93 …
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@ujdew 0xCE 0xA4 0x35 0xAE …
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40@ujdew 0xF7 0x2F 0xE0 0xF0 …
Reg HKCUSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{A6C514F6-D7D8-F038-464A-0AAE17B106DE}
Reg HKCUSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{A6C514F6-D7D8-F038-464A-0AAE17B106DE}@japeajgiohefniblbipd 0x6B 0x61 0x64 0x67 …
Reg HKCUSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{A6C514F6-D7D8-F038-464A-0AAE17B106DE}@iafaghhpjphbpdcief 0x6B 0x61 0x64 0x67 …

—- Disk sectors — GMER 1.0.15 —-

Disk DeviceHarddisk0DR0 sector 62: copy of MBR

—- EOF — GMER 1.0.15 —-
29 марта, 2009 в 4:09 пп в ответ на: КОМП СТАЛ ОЧENЬ МEДЛENNO РАБОТАТЬ. #22623
QERIBAN
Participant
- Темы:6
- Сообщений:39
ComboFix 09-03-28.06 — 123 2009-03-30 0:02:58.6 — FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1251.1.1049.18.1015.626 [GMT 4:00]
Running from: c:documents and settings123Рабочий столComboFix.exe
Command switches used :: c:documents and settings123Рабочий столCFScript.txt
AV: Avira Premium Security Suite *On-access scanning disabled* (Updated)
FW: Avira Firewall *disabled*
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:123.exe
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr0.dat
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr1.dat
c:program filesStormII
c:program filesStormIIcodec264be.dll
c:program filesStormIIcodec264dmmx.dll
c:program filesStormIIcodec264dsse.dll
c:program filesStormIIcodec264dsse2.dll
c:program filesStormIIcodec264dsse3.dll
c:program filesStormIIcodecaasc32.dll
c:program filesStormIIcodecac3filter.ax
c:program filesStormIIcodecacelpdec.ax
c:program filesStormIIcodecasusasv1.dll
c:program filesStormIIcodecasusasv2.dll
c:program filesStormIIcodecativcr2.dll
c:program filesStormIIcodecavcodec.dll
c:program filesStormIIcodecavformat.dll
c:program filesStormIIcodecavidavicodec.dll
c:program filesStormIIcodecAviSplitter.ax
c:program filesStormIIcodecavutil.dll
c:program filesStormIIcodecbass.dll
c:program filesStormIIcodecbass_aac.dll
c:program filesStormIIcodecbass_alac.dll
c:program filesStormIIcodecbass_ape.dll
c:program filesStormIIcodecbass_flac.dll
c:program filesStormIIcodecbass_mpc.dll
c:program filesStormIIcodecbass_tta.dll
c:program filesStormIIcodecbass_wv.dll
c:program filesStormIIcodecbinkw32.dll
c:program filesStormIIcodecBSPVDEC.dll
c:program filesStormIIcodecbw10.dll
c:program filesStormIIcodeccddareader.ax
c:program filesStormIIcodeccdxareader.ax
c:program filesStormIIcodecChpSrcFilter.ax
c:program filesStormIIcodecCinemasterAudio.DLL
c:program filesStormIIcodeccl264dec.ax
c:program filesStormIIcodecCLNavX.ax
c:program filesStormIIcodecCLRVIDDC.DLL
c:program filesStormIIcodecclrviddd.dll
c:program filesStormIIcodecCLVc1Dec.ax
c:program filesStormIIcodecCLVSD.ax
c:program filesStormIIcodecclvsdx.ax
c:program filesStormIIcodeccoreavc.ax
c:program filesStormIIcodecCUVCcodc.dll
c:program filesStormIIcodecDCBassSource.ax
c:program filesStormIIcodecDECVW_32.DLL
c:program filesStormIIcodecdivxdec.ax
c:program filesStormIIcodecDmoDec.dll
c:program filesStormIIcodecDSMSplitter.ax
c:program filesStormIIcodecempgdmx.ax
c:program filesStormIIcodecff_kernelDeint.dll
c:program filesStormIIcodecff_liba52.dll
c:program filesStormIIcodecff_libavcodec.dll
c:program filesStormIIcodecff_libdts.dll
c:program filesStormIIcodecff_libfaad2.dll
c:program filesStormIIcodecff_libmad.dll
c:program filesStormIIcodecff_libmpeg2.dll
c:program filesStormIIcodecff_libmplayer.dll
c:program filesStormIIcodecff_realaac.dll
c:program filesStormIIcodecff_samplerate.dll
c:program filesStormIIcodecff_theora.dll
c:program filesStormIIcodecff_TomsMoComp.dll
c:program filesStormIIcodecff_tremor.dll
c:program filesStormIIcodecff_unrar.dll
c:program filesStormIIcodecff_wmv9.dll
c:program filesStormIIcodecff_xvidcore.dll
c:program filesStormIIcodecffdshow.ax
c:program filesStormIIcodecffdshow.ax.manifest
c:program filesStormIIcodecffmpeg.dll
c:program filesStormIIcodecffsource.ax
c:program filesStormIIcodecFlash.ocx
c:program filesStormIIcodecFLT_ffdshow.dll
c:program filesStormIIcodecFLVSplitter.ax
c:program filesStormIIcodecfrapsvid.dll
c:program filesStormIIcodecG722ADEC.dll
c:program filesStormIIcodecGeoCodec.dll
c:program filesStormIIcodecH264VDEC.dll
c:program filesStormIIcodecHikAudioDec.ax
c:program filesStormIIcodecHikFileSource.ax
c:program filesStormIIcodecHikFileSplitter.ax
c:program filesStormIIcodecHIKM4DEC.dll
c:program filesStormIIcodecHikVideoDec.ax
c:program filesStormIIcodeci263_32.drv
c:program filesStormIIcodecicmw_32.dll
c:program filesStormIIcodeciconv.dll
c:program filesStormIIcodeckdh4.dll
c:program filesStormIIcodeckdm4.dll
c:program filesStormIIcodeckeys.dat
c:program filesStormIIcodecl3codecx.ax
c:program filesStormIIcodecLCodcCMP.dll
c:program filesStormIIcodeclibavcodec.dll
c:program filesStormIIcodeclibmpeg2_ff.dll
c:program filesStormIIcodeclibmplayer.dll
c:program filesStormIIcodecLMVRGBxf.dll
c:program filesStormIIcodecLMVYUVxf.dll
c:program filesStormIIcodeclsvxdec.dll
c:program filesStormIIcodecmfplat.dll
c:program filesStormIIcodecmkunicode.dll
c:program filesStormIIcodecmkx.dll
c:program filesStormIIcodecmkzlib.dll
c:program filesStormIIcodecmmamrdmx.ax
c:program filesStormIIcodecMp3Decdll.dll
c:program filesStormIIcodecMP3DMOD.DLL
c:program filesStormIIcodecmp4.dll
c:program filesStormIIcodecmp43dmod.dll
c:program filesStormIIcodecmp4sdmod.dll
c:program filesStormIIcodecMP4Splitter.ax
c:program filesStormIIcodecMpaDecFilter.ax
c:program filesStormIIcodecMpaSplitter.ax
c:program filesStormIIcodecmpcvideodec.ax
c:program filesStormIIcodecMpeg2DecFilter.ax
c:program filesStormIIcodecmpeg2dmx.ax
c:program filesStormIIcodecMpegSplitter.ax
c:program filesStormIIcodecmpg2splt.ax
c:program filesStormIIcodecmpg4dmod.dll
c:program filesStormIIcodecmsdmo.dll
c:program filesStormIIcodecmsms001.vwp
c:program filesStormIIcodecmsvcp71.dll
c:program filesStormIIcodecmsvcr71.dll
c:program filesStormIIcodecMZP4_DEC.DLL
c:program filesStormIIcodecNDParser.ax
c:program filesStormIIcodecNeMP4Splitter.ax
c:program filesStormIIcodecnvviddec.ax
c:program filesStormIIcodecOggSplitter.ax
c:program filesStormIIcodecPluginsnppl3260.dll
c:program filesStormIIcodecPluginsnppl3260.xpt
c:program filesStormIIcodecPluginsnpqtplugin.dll
c:program filesStormIIcodecPluginsnprpjplug.dll
c:program filesStormIIcodecPluginsnsIQTScriptablePlugin.xpt
c:program filesStormIIcodecPluginsnsJSRealPlayerPlugin.xpt
c:program filesStormIIcodecPluginsQuickTimePlugin.class
c:program filesStormIIcodecPmpSplt.ax
c:program filesStormIIcodecpncrt.dll
c:program filesStormIIcodecpndx5016.dll
c:program filesStormIIcodecpndx5032.dll
c:program filesStormIIcodecpthreadVC2.dll
c:program filesStormIIcodecpvmjpg21.dll
c:program filesStormIIcodecPVWV220.DLL
c:program filesStormIIcodecqasf.dll
c:program filesStormIIcodecQTSystemCFCharacterSetBitmaps.bitmap
c:program filesStormIIcodecQTSystemCoreVideo.qtx
c:program filesStormIIcodecQTSystemCoreVideo.ResourcesCoreVideo.qtr
c:program filesStormIIcodecQTSystemCoreVideo.Resourcesen.lprojCoreVideoLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTime.qts
c:program filesStormIIcodecQTSystemQuickTime.Resourcesen.lprojQuickTimeLocalized.dll
c:program filesStormIIcodecQTSystemQuickTime.Resourcesen.lprojQuickTimeLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTime.ResourcesQuickTime.dll
c:program filesStormIIcodecQTSystemQuickTime.ResourcesQuickTime.qtr
c:program filesStormIIcodecQTSystemQuickTime.ResourcesQuickTime.qtxs
c:program filesStormIIcodecQTSystemQuickTime3GPP.qtx
c:program filesStormIIcodecQTSystemQuickTime3GPP.Resourcesen.lprojQuickTime3GPPLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTime3GPP.ResourcesQuickTime3GPP.qtr
c:program filesStormIIcodecQTSystemQuickTimeAudioSupport.qtx
c:program filesStormIIcodecQTSystemQuickTimeAudioSupport.Resourcesen.lprojQuickTimeAudioSupportLocalized.dll
c:program filesStormIIcodecQTSystemQuickTimeAudioSupport.Resourcesen.lprojQuickTimeAudioSupportLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTimeAudioSupport.ResourcesQuickTimeAudioSupport.qtr
c:program filesStormIIcodecQTSystemQuickTimeEssentials.qtx
c:program filesStormIIcodecQTSystemQuickTimeEssentials.Resourcesen.lprojQuickTimeEssentialsLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTimeEssentials.ResourcesQuickTimeEssentials.qtr
c:program filesStormIIcodecQTSystemQuickTimeH264.qtx
c:program filesStormIIcodecQTSystemQuickTimeH264.Resourcesen.lprojQuickTimeH264Localized.qtr
c:program filesStormIIcodecQTSystemQuickTimeH264.ResourcesQuickTimeH264.qtr
c:program filesStormIIcodecQTSystemQuickTimeInternetExtras.qtx
c:program filesStormIIcodecQTSystemQuickTimeInternetExtras.Resourcesen.lprojQuickTimeInternetExtrasLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTimeInternetExtras.ResourcesQuickTimeInternetExtras.qtr
c:program filesStormIIcodecQTSystemQuickTimeMPEG4.qtx
c:program filesStormIIcodecQTSystemQuickTimeMPEG4.Resourcesen.lprojQuickTimeMPEG4Localized.qtr
c:program filesStormIIcodecQTSystemQuickTimeMPEG4.ResourcesQuickTimeMPEG4.qtr
c:program filesStormIIcodecQTSystemQuickTimeMusic.qtx
c:program filesStormIIcodecQTSystemQuickTimeMusic.Resourcesen.lprojQuickTimeMusicLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTimeMusic.ResourcesQuickTimeMusic.qtr
c:program filesStormIIcodecQTSystemQuickTimeStreaming.qtx
c:program filesStormIIcodecQTSystemQuickTimeStreaming.Resourcesen.lprojQuickTimeStreamingLocalized.dll
c:program filesStormIIcodecQTSystemQuickTimeStreaming.Resourcesen.lprojQuickTimeStreamingLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTimeStreaming.ResourcesQuickTimeStreaming.qtr
c:program filesStormIIcodecQTSystemQuickTimeStreamingExtras.qtx
c:program filesStormIIcodecQTSystemQuickTimeStreamingExtras.Resourcesen.lprojQuickTimeStreamingExtrasLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTimeStreamingExtras.ResourcesQuickTimeStreamingExtras.qtr
c:program filesStormIIcodecQTSystemQuickTimeVR.qtx
c:program filesStormIIcodecQTSystemQuickTimeVR.Resourcesen.lprojQuickTimeVRLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTimeVR.ResourcesQuickTimeVR.qtr
c:program filesStormIIcodecQuickTime.qts
c:program filesStormIIcodecQuickTimeVR.qtx
c:program filesStormIIcodecRadGtSplitter.ax
c:program filesStormIIcodecRealCodecs14_43260.dll
c:program filesStormIIcodecRealCodecs28_83260.dll
c:program filesStormIIcodecRealCodecsatrc.dll
c:program filesStormIIcodecRealCodecscook.dll
c:program filesStormIIcodecRealCodecsddnt3260.dll
c:program filesStormIIcodecRealCodecsdnet3260.dll
c:program filesStormIIcodecRealCodecsdrv1.dll
c:program filesStormIIcodecRealCodecsdrv2.dll
c:program filesStormIIcodecRealCodecsdrvc.dll
c:program filesStormIIcodecRealCodecshxltcolor.dll
c:program filesStormIIcodecRealCodecsraac.dll
c:program filesStormIIcodecRealCodecsralf.dll
c:program filesStormIIcodecRealCodecsrv10.dll
c:program filesStormIIcodecRealCodecsrv20.dll
c:program filesStormIIcodecRealCodecsrv30.dll
c:program filesStormIIcodecRealCodecsrv40.dll
c:program filesStormIIcodecRealCodecssipr.dll
c:program filesStormIIcodecRealCommonobjb3201.dll
c:program filesStormIIcodecRealCommonpnen3260.dll
c:program filesStormIIcodecRealCommonpngu3267.dll
c:program filesStormIIcodecRealCommonpnrs3260.dll
c:program filesStormIIcodecRealCommonrppr3260.dll
c:program filesStormIIcodecRealCommonsecurity.dll
c:program filesStormIIcodecRealPluginsaudplin.dll
c:program filesStormIIcodecRealPluginsauthmgr.dll
c:program filesStormIIcodecRealPluginsclbascauth.dll
c:program filesStormIIcodecRealPluginsclntxres.dll
c:program filesStormIIcodecRealPluginsExtResourcescoreres.xrs
c:program filesStormIIcodecRealPluginsfpsechnd.dll
c:program filesStormIIcodecRealPluginshttpfsys.dll
c:program filesStormIIcodecRealPluginshxsdp.dll
c:program filesStormIIcodecRealPluginshxxml.dll
c:program filesStormIIcodecRealPluginsimgrender.dll
c:program filesStormIIcodecRealPluginsmemfsys.dll
c:program filesStormIIcodecRealPluginsmp3fformat.dll
c:program filesStormIIcodecRealPluginsmp3render.dll
c:program filesStormIIcodecRealPluginsmp4arender.dll
c:program filesStormIIcodecRealPluginsntlmauth.dll
c:program filesStormIIcodecRealPluginsoggfformat.dll
c:program filesStormIIcodecRealPluginspacplin.dll
c:program filesStormIIcodecRealPluginsplusplin.dll
c:program filesStormIIcodecRealPluginspxcb3210.dll
c:program filesStormIIcodecRealPluginsramfformat.dll
c:program filesStormIIcodecRealPluginsramrender.dll
c:program filesStormIIcodecRealPluginsrarender.dll
c:program filesStormIIcodecRealPluginsrmfformat.dll
c:program filesStormIIcodecRealPluginsrmxfpln.dll
c:program filesStormIIcodecRealPluginsrmxrend.dll
c:program filesStormIIcodecRealPluginsrn5auth.dll
c:program filesStormIIcodecRealPluginsrtfformat.dll
c:program filesStormIIcodecRealPluginsrtrender.dll
c:program filesStormIIcodecRealPluginsrvrender.dll
c:program filesStormIIcodecRealPluginssdpplin.dll
c:program filesStormIIcodecRealPluginssecurity.dll
c:program filesStormIIcodecRealPluginssmlfformat.dll
c:program filesStormIIcodecRealPluginssmlrender.dll
c:program filesStormIIcodecRealPluginssmmrender.dll
c:program filesStormIIcodecRealPluginssmplfsys.dll
c:program filesStormIIcodecRealPluginsstubdrm.dll
c:program filesStormIIcodecRealPluginstfilesys.dll
c:program filesStormIIcodecRealPluginsvidplin.dll
c:program filesStormIIcodecRealPluginsvidsite.dll
c:program filesStormIIcodecRealPluginsvorbisrend.dll
c:program filesStormIIcodecRealPluginsvsrlocal.dll
c:program filesStormIIcodecRealrppluginscnembed_cn.dll
c:program filesStormIIcodecRealrppluginscnrpclsvc_cn.dll
c:program filesStormIIcodecRealrppluginsembd3260.dll
c:program filesStormIIcodecRealrppluginsrpcl3260.dll
c:program filesStormIIcodecRealrppluginsrput3260.dll
c:program filesStormIIcodecRLMPCDec.ax
c:program filesStormIIcodecrmoc3260.dll
c:program filesStormIIcodecRMSplt.ax
c:program filesStormIIcodecSc726dec.ax
c:program filesStormIIcodecscmpack.dll
c:program filesStormIIcodecscsource.ax
c:program filesStormIIcodecsmackw32.dll
c:program filesStormIIcodecSonicLicenseManager9.dll
c:program filesStormIIcodecsplitter.ax
c:program filesStormIIcodecTomsMoComp_ff.dll
c:program filesStormIIcodects.dll
c:program filesStormIIcodectsccvid.dll
c:program filesStormIIcodecTTL2Dec.dll
c:program filesStormIIcodecv2k2_dec.dll
c:program filesStormIIcodecv2kdspde.dll
c:program filesStormIIcodecvc1dc.dll
c:program filesStormIIcodecvc1dmmx.dll
c:program filesStormIIcodecvc1dsse.dll
c:program filesStormIIcodecvc1dsse2.dll
c:program filesStormIIcodecvc1wp.ax
c:program filesStormIIcodecVDODEC32.dll
c:program filesStormIIcodecvdowave.drv
c:program filesStormIIcodecVgmAudio.ax
c:program filesStormIIcodecvgmbgr.ax
c:program filesStormIIcodecVgmSplt.ax
c:program filesStormIIcodecvgmv2k2.ax
c:program filesStormIIcodecVid1Dec.dll
c:program filesStormIIcodecvmnc.dll
c:program filesStormIIcodecvoxmsdec.ax
c:program filesStormIIcodecvp6vfw.dll
c:program filesStormIIcodecvp7vfw.dll
c:program filesStormIIcodecvssver2.scc
c:program filesStormIIcodecWMADMOD.dll
c:program filesStormIIcodecwmpasf.dll
c:program filesStormIIcodecwmsdmod.dll
c:program filesStormIIcodecWMVDECOD.dll
c:program filesStormIIcodecwmvdmod.dll
c:program filesStormIIcodecxvid.ax
c:program filesStormIIcodecxvidcore.dll
c:program filesStormIIcurrent.ecs
c:program filesStormIIjscript.dll
c:program filesStormIIkeys.dat
c:program filesStormIImediadefdef.flv
c:program filesStormIImediadefdef.ini
c:program filesStormIImediaempty.swf
c:program filesStormIImediamedia4in1.swf
c:program filesStormIImediamediabp.swf
c:program filesStormIImediaothers.xml
c:program filesStormIImediaothers.xml.ini
c:program filesStormIImediastcon.ini
c:program filesStormIImediatoff.ini
c:program filesStormIImediavideo_material_list.xml
c:program filesStormIImediavideo_material_list.xml.ini
c:program filesStormIImediavideo_style_list.xml
c:program filesStormIImediavideo_style_list.xml.ini
c:program filesStormIIMedia2.dll
c:program filesStormIImee.db
c:program filesStormIIMovieInfo.dll
c:program filesStormIImps.dll
c:program filesStormIImsscript.ocx
c:program filesStormIImsvcp60.dll
c:program filesStormIIrndrmgr.dll
c:program filesStormIIscore.dll
c:program filesStormIIsexpert.dll
c:program filesStormIISkinјыБъР¶јЧ.zip
c:program filesStormIISkin±©·з1ѕµд.zip
c:program filesStormIISkin±©·з2ѕµд.zip
c:program filesStormIIspfa.dll
c:program filesStormIIsplayers.dll
c:program filesStormIIsprobe.dll
c:program filesStormIIStorm.exe
c:program filesStormIIstormliv.exe
c:program filesStormIIstormply.exe
c:program filesStormIIStormRes.dll
c:program filesStormIIsubdecoder.dll
c:program filesStormIIuninst.exe

BITS: Possible infected sites

hxxp://soft.export.yandex.ru
.
((((((((((((((((((((((((( Files Created from 2009-02-28 to 2009-03-29 )))))))))))))))))))))))))))))))
.

2009-03-27 16:30 . 2009-03-27 16:30 d

c:program filesDownload Master
2009-03-25 00:59 . 2009-03-25 00:59 d

c:documents and settings123Application DataAvira
2009-03-24 23:17 . 2009-03-24 23:17 d

c:program filesAvira
2009-03-24 23:17 . 2009-03-24 23:17 d

c:documents and settingsAll UsersApplication DataAvira
2009-03-24 23:17 . 2008-05-07 13:20 71,592 —a

c:windowssystem32driversavfwot.sys
2009-03-24 23:17 . 2008-05-07 09:51 71,464 —a

c:windowssystem32driversavfwim.sys
2009-03-24 20:40 . 2009-03-24 20:44 4,496,273 —a

c:program filesazan.exe
2009-03-24 14:02 . 2009-03-24 14:02 d

c:windowssystem32ru-ru
2009-03-24 14:02 . 2009-03-24 14:02 d

c:windowssystem32ru
2009-03-24 14:02 . 2009-03-24 14:02 d

c:windowssystem32bits
2009-03-24 14:02 . 2009-03-24 14:02 d

c:windowsl2schemas
2009-03-24 13:59 . 2009-03-24 13:59 d

c:windowsServicePackFiles
2009-03-23 20:03 . 2009-03-23 20:03 d

c:program filesYandex
2009-03-23 20:03 . 2009-03-23 20:03 d

c:documents and settings123Application DataYandex
2009-03-23 03:00 . 2009-03-23 03:00 d

c:program filesMSXML 4.0
2009-03-22 20:01 . 2008-10-16 14:08 27,672 —a

c:windowssystem32wuapi.dll.mui
2009-03-21 23:07 . 2009-03-21 23:07 d

c:documents and settingsAll UsersApplication DataESET
2009-03-19 01:24 . 2009-03-19 01:25 4,114 —a

c:windowssystem32secushr.dat
2009-03-19 01:24 . 2009-03-19 01:24 248 —a

c:windowssystem32secustat.dat
2009-03-19 01:23 . 2009-03-19 01:23 d

c:documents and settings123Application DataFlashgetSetup
2009-03-19 01:18 . 2009-03-19 01:18 d

c:documents and settings123Application DataMedia Player Classic

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-28 14:26 737,280 —-a-w c:windowsiun6002.exe
2009-03-23 16:17 2,516 —sha-w c:windowssystem32KGyGaAvL.sys
2009-02-11 06:19 38,496 —-a-w c:windowssystem32driversmbamswissarmy.sys
2009-02-11 06:19 15,504 —-a-w c:windowssystem32driversmbam.sys
2009-02-09 13:07 1,846,912 —-a-w c:windowssystem32win32k.sys
2009-02-09 13:07 1,846,912

w c:windowssystem32dllcachewin32k.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]
«{ecdee021-0d17-467f-a1ff-c7a115230949}»= «c:program filesfree-downloads.nettbfree.dll» [2007-12-10 1510424]

[HKEY_CLASSES_ROOTclsid{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_LOCAL_MACHINE~Browser Helper Objects{ecdee021-0d17-467f-a1ff-c7a115230949}]
2007-12-10 13:46 1510424 —a

c:program filesfree-downloads.nettbfree.dll

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{ecdee021-0d17-467f-a1ff-c7a115230949}»= «c:program filesfree-downloads.nettbfree.dll» [2007-12-10 1510424]

[HKEY_CLASSES_ROOTclsid{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{ECDEE021-0D17-467F-A1FF-C7A115230949}»= «c:program filesfree-downloads.nettbfree.dll» [2007-12-10 1510424]

[HKEY_CLASSES_ROOTclsid{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2008-04-14 15360]
«AlcoholAutomount»=»d:alcohol 120% 1.9.7.6022Alcohol 120axcmd.exe» [2007-12-22 222080]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«IgfxTray»=»c:windowssystem32igfxtray.exe» [2007-09-18 141848]
«HotKeysCmds»=»c:windowssystem32hkcmd.exe» [2007-09-18 166424]
«Persistence»=»c:windowssystem32igfxpers.exe» [2007-09-18 137752]
«V0330Mon.exe»=»c:windowsV0330Mon.exe» [2007-04-30 32768]
«ISUSPM Startup»=»c:program filesCommon FilesInstallShieldUpdateServiceisuspm.exe» [2005-08-11 249856]
«ISUSScheduler»=»c:program filesCommon FilesInstallShieldUpdateServiceissch.exe» [2005-08-11 81920]
«MAgent»=»c:program filesMail.RuAgentMAgent.exe» [2009-01-13 5598392]
«Athan»=»c:program filesAthanAthan.exe» [2005-10-09 954368]
«avgnt»=»c:program filesAviraAvira Premium Security Suiteavgnt.exe» [2008-06-12 266497]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-14 15360]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe Reader Speed Launcher]
—a

2008-06-12 02:38 34672 c:program filesAdobeReader 9.0Readerreader_sl.exe

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\Messenger\msmsgs.exe»=
«d:\uTorrent.exe»=
«c:\Program Files\Windows Live\Messenger\msnmsgr.exe»=
«c:\Program Files\Windows Live\Messenger\livecall.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«d:\SKYPE\Phone\Skype.exe»=
«d:\ICQ6.5\ICQ.exe»=
«$INSTDIR\FlvDetector.exe»= c:\Program Files\FlashGet Network\FlashGet 3\FlvDetector.exe

R1 avfwot;avfwot;c:windowssystem32driversavfwot.sys [2009-03-24 71592]
R2 AntiVirFirewallService;Avira Premium Security Suite Firewall;c:program filesAviraAvira Premium Security Suiteavfwsvc.exe [2009-03-24 344321]
R2 AntiVirMailService;Avira Premium Security Suite MailGuard;c:program filesAviraAvira Premium Security Suiteavmailc.exe [2009-03-24 164097]
R2 antivirwebservice;Avira Premium Security Suite WebGuard;c:program filesAviraAvira Premium Security Suiteavwebgrd.exe [2009-03-24 258305]
R2 AVEService;Вспомогательная служба Avira Premium Security Suite MailGuard (Защита почты).;c:program filesAviraAvira Premium Security Suiteavesvc.exe [2009-03-24 41217]
R3 avfwim;AvFw Packet Filter Miniport;c:windowssystem32driversavfwim.sys [2009-03-24 71464]
R3 V0330VID;WebCam Vista/Live! Cam Chat;c:windowssystem32driversV0330Vid.sys [2008-10-15 157696]
S2 ccosm;Contrl Center of Storm Media;c:program filesStormIIstormliv.exe /asservice —> c:program filesStormIIstormliv.exe [?]
.
.

Supplementary Scan

.
uStart Page = hxxp://www.google.ru/ig?hl=ru
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
IE: Добавить в Rambler-Закладки — d:rambler assistantramblertoolbarU5950.dll/zakladki.htm
IE: Закачать ВСЕ при помощи Download Master — c:program filesDownload Masterdmieall.htm
IE: Закачать все при помощи FlashGet — c:program filesFlashGetjc_all.htm
IE: Закачать при помощи Download Master — c:program filesDownload Masterdmie.htm
IE: Закачать при помощи FlashGet — c:program filesFlashGetjc_link.htm
IE: Найти с помощью Рамблера — d:rambler assistantramblertoolbarU5950.dll/search.htm
IE: Опубликовать в Дневнике — d:rambler assistantramblertoolbarU5950.dll/planet.htm
IE: Перевести с помощью словарей Рамблера — d:rambler assistantramblertoolbarU5950.dll/dic.htm
IE: Поиск@Mail.Ru — c:program filesMail.RuSputnikMailRuSputnik.dll/282
IE: Словари@Mail.Ru — c:program filesMail.RuSputnikMailRuSputnik.dll/283
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:program filesMail.RuAgentmagent.exe
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe
LSP: avsda.dll
FF — ProfilePath — c:documents and settings123Application DataMozillaFirefoxProfileslb4yf04o.default
FF — prefs.js: browser.search.defaulturl — hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF — prefs.js: browser.search.selectedEngine — Р’РёРєРёРїРµРґРёСЏ (ru)
FF — prefs.js: browser.startup.homepage — hxxp://www.yahoo.com/
FF — prefs.js: keyword.URL — hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF — component: c:program filesMozilla Firefoxextensions{DB9127A2-3381-41ec-82B3-1B6ED4C6F29A}componentsFlashgetXpi.dll
FF — plugin: d:real alternativebrowserpluginsnppl3260.dll
FF — plugin: d:real alternativebrowserpluginsnprpjplug.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-30 00:04:23
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

DLLs Loaded Under Running Processes

— — — — — — — > ‘lsass.exe'(1348)
c:windowssystem32avsda.dll
.
Completion time: 2009-03-30 0:05:01
ComboFix-quarantined-files.txt 2009-03-29 20:05:00

Pre-Run: 7 529 594 880 байт свободно
Post-Run: 8,216,150,016 байт свободно

479 — E O F — 2009-03-24 18:09:06
27 марта, 2009 в 4:19 дп в ответ на: КОМП СТАЛ ОЧENЬ МEДЛENNO РАБОТАТЬ. #22621
QERIBAN
Participant
- Темы:6
- Сообщений:39
GMER 1.0.15.14944 — http://www.gmer.net
Rootkit scan 2009-03-27 12:16:04
Windows 5.1.2600 Service Pack 3

—- System — GMER 1.0.15 —-

SSDT spcs.sys ZwCreateKey [0xF730A0E0]
SSDT F7C48844 ZwCreateThread
SSDT spcs.sys ZwEnumerateKey [0xF7327CA2]
SSDT spcs.sys ZwEnumerateValueKey [0xF7328030]
SSDT spcs.sys ZwOpenKey [0xF730A0C0]
SSDT F7C48830 ZwOpenProcess
SSDT F7C48835 ZwOpenThread
SSDT spcs.sys ZwQueryKey [0xF7328108]
SSDT spcs.sys ZwQueryValueKey [0xF7327F88]
SSDT spcs.sys ZwSetValueKey [0xF732819A]
SSDT F7C4883F ZwTerminateProcess
SSDT F7C4883A ZwWriteVirtualMemory

INT 0x62 ? 86D68BF8
INT 0x82 ? 86D68BF8
INT 0xB4 ? 86AE2BF8
INT 0xB4 ? 86AE2BF8

—- Kernel code sections — GMER 1.0.15 —-

? spcs.sys Íå óäàåòñÿ íàéòè óêàçàííûé ôàéë. !
.text USBPORT.SYS!DllUnload F683C8AC 5 Bytes JMP 86AE21D8
.text a0h3kmdv.SYS F674B384 1 Byte [20]
.text a0h3kmdv.SYS F674B384 37 Bytes [20, 00, 00, 68, 00, 00, 00, …]
.text a0h3kmdv.SYS F674B3AA 24 Bytes [00, 00, 20, 00, 00, E0, 00, …]
.text a0h3kmdv.SYS F674B3C4 3 Bytes [00, 00, 00]
.text a0h3kmdv.SYS F674B3C9 1 Byte [00]
.text …

—- Kernel IAT/EAT — GMER 1.0.15 —-

IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F730B040] spcs.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F730B13C] spcs.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F730B0BE] spcs.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F730B7FC] spcs.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F730B6D2] spcs.sys
IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!KfAcquireSpinLock] 00000034
IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!READ_PORT_UCHAR] 0000008E
IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!KeGetCurrentIrql] 00000043
IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!KfRaiseIrql] 00000044
IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!KfLowerIrql] 000000C4
IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!HalGetInterruptVector] 000000DE
IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!HalTranslateBusAddress] 000000E9
IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!KeStallExecutionProcessor] 000000CB
IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!KfReleaseSpinLock] 00000054
IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] 0000007B
IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!READ_PORT_USHORT] 00000094
IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] 00000032
IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!WRITE_PORT_UCHAR] 000000A6
IAT SystemRootSystem32Driversa0h3kmdv.SYS[WMILIB.SYS!WmiSystemControl] 00000023
IAT SystemRootSystem32Driversa0h3kmdv.SYS[WMILIB.SYS!WmiCompleteRequest] 0000003D

—- Devices — GMER 1.0.15 —-

Device FileSystemFastfat FatCdrom 86D671F8

AttachedDevice DriverTcpip DeviceIp avfwot.sys (TDI filtering kernel driver/Avira GmbH)

Device Driverusbuhci DeviceUSBPDO-0 86B591F8
Device Driverusbehci DeviceUSBPDO-1 86A311F8
Device Driverdmio DeviceDmControlDmIoDaemon 86DD81F8
Device Driverdmio DeviceDmControlDmConfig 86DD81F8
Device Driverdmio DeviceDmControlDmPnP 86DD81F8
Device Driverdmio DeviceDmControlDmInfo 86DD81F8
Device DriverPCI_PNP7718 Device0000055 spcs.sys

AttachedDevice DriverTcpip DeviceTcp avfwot.sys (TDI filtering kernel driver/Avira GmbH)

Device DriverFtdisk DeviceHarddiskVolume1 86D691F8
Device DriverFtdisk DeviceHarddiskVolume2 86D691F8
Device DriverCdrom DeviceCdRom0 86A88500
Device DriverFtdisk DeviceHarddiskVolume3 86D691F8
Device DriverCdrom DeviceCdRom1 86A88500
Device DriverNetBT DeviceNetBT_Tcpip_{11BD6EB6-C0DE-41CD-8455-DEE482CA4083} 86947500
Device DriverNetBT DeviceNetBt_Wins_Export 86947500
Device DriverNetBT DeviceNetbiosSmb 86947500

AttachedDevice DriverTcpip DeviceUdp avfwot.sys (TDI filtering kernel driver/Avira GmbH)
AttachedDevice DriverTcpip DeviceRawIp avfwot.sys (TDI filtering kernel driver/Avira GmbH)

Device Driversptd Device2507090218 spcs.sys
Device Driverusbuhci DeviceUSBFDO-0 86B591F8
Device Driverusbehci DeviceUSBFDO-1 86A311F8
Device FileSystemMRxSmb DeviceLanmanDatagramReceiver 86B671F8
Device FileSystemMRxSmb DeviceLanmanRedirector 86B671F8
Device DriverNetBT DeviceNetBT_Tcpip_{8CF33562-65EC-43D1-9720-278EE0D512A5} 86947500
Device DriverFtdisk DeviceFtControl 86D691F8
Device Drivera0h3kmdv DeviceScsia0h3kmdv1 86951500
Device Drivera0h3kmdv DeviceScsia0h3kmdv1Port2Path0Target0Lun0 86951500
Device FileSystemFastfat Fat 86D671F8

AttachedDevice FileSystemFastfat Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device FileSystemCdfs Cdfs 8686B1F8

—- Registry — GMER 1.0.15 —-

Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (L002TP) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPTP) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPPoE) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@374@4O4494 ?0404@0404;4;0454;4L4=4K494 ?4>4@4B4 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (IP) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 ?4;0404=484@4>0424I484:0404 ?0404:0454B4>0424 1?2?3?
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@s1 771343423
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@s2 285507792
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@h0 1
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04@p0 D:Alcohol 120% 1.9.7.6022Alcohol 120
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04@h0 0
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04@ujdew 0x95 0xD7 0x59 0x93 …
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001@ujdew 0xCE 0xA4 0x35 0xAE …
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40@ujdew 0xF7 0x2F 0xE0 0xF0 …
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04@p0 D:Alcohol 120% 1.9.7.6022Alcohol 120
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04@h0 0
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04@ujdew 0x95 0xD7 0x59 0x93 …
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@ujdew 0xCE 0xA4 0x35 0xAE …
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40@ujdew 0xF7 0x2F 0xE0 0xF0 …
Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (L002TP) 1?
Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPTP) 1?
Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPPoE) 1?
Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@374@4O4494 ?0404@0404;4;0454;4L4=4K494 ?4>4@4B4 1?
Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (IP) 1?
Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 ?4;0404=484@4>0424I484:0404 ?0404:0454B4>0424 1?2?3?
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D04
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D04@p0 D:Alcohol 120% 1.9.7.6022Alcohol 120
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D04@h0 0
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D04@ujdew 0x95 0xD7 0x59 0x93 …
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@ujdew 0xCE 0xA4 0x35 0xAE …
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40@ujdew 0xF7 0x2F 0xE0 0xF0 …
Reg HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows@DeviceNotSelectedTimeout 15
Reg HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows@GDIProcessHandleQuota 10000
Reg HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows@Spooler yes
Reg HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows@swapdisk
Reg HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows@TransmissionRetryTimeout 90
Reg HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows@USERProcessHandleQuota 10000
Reg HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows@appinit_dlls
Reg HKCUSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{A6C514F6-D7D8-F038-464A-0AAE17B106DE}
Reg HKCUSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{A6C514F6-D7D8-F038-464A-0AAE17B106DE}@japeajgiohefniblbipd 0x6B 0x61 0x64 0x67 …
Reg HKCUSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{A6C514F6-D7D8-F038-464A-0AAE17B106DE}@iafaghhpjphbpdcief 0x6B 0x61 0x64 0x67 …

—- Disk sectors — GMER 1.0.15 —-

Disk DeviceHarddisk0DR0 sector 62: copy of MBR

—- EOF — GMER 1.0.15 —-
27 марта, 2009 в 4:04 дп в ответ на: БЕРМУДСКИЙ ТРЕУГОЛЬНИК #22780
QERIBAN
Participant
- Темы:6
- Сообщений:39
OK
23 марта, 2009 в 7:47 пп в ответ на: КОМП СТАЛ ОЧENЬ МEДЛENNO РАБОТАТЬ. #22619
QERIBAN
Participant
- Темы:6
- Сообщений:39
GMER лог — ЧТО ЕТО?
23 марта, 2009 в 7:41 пп в ответ на: БЕРМУДСКИЙ ТРЕУГОЛЬНИК #22778
QERIBAN
Participant
- Темы:6
- Сообщений:39
ДА. ОНА САМАЯ. А ИНОГДА ЯРЛЫКИ НЕ МОГУТ НАЙТИ ФАЙЛ.И ЕЩО ИНОГДА ВДУГ КАССКАДОМ НАЧЕНАЮТ ОТКРЫВАТЬСА ОКНО. ПОКА Я НЕ ВЫКЛЮЧУ КОМП. ВОТ ТАКАЯ ЧЕРТОВШИНА.
20 марта, 2009 в 3:23 пп в ответ на: БЕРМУДСКИЙ ТРЕУГОЛЬНИК #22776
QERIBAN
Participant
- Темы:6
- Сообщений:39
А КАК ВСЕ ЕТО ПРОВЕРИТЬ?
Автор

Сообщения