Созданные ответы форума
-
Сообщения
-
Компьютер качает вируси!!
Проверил, пока вроде нормально…
Посмотрите!!ComboFix 09-01-08.04 — Anatoliy 2009-01-09 12:35:07.2 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1251.1.1049.18.511.239 [GMT 2:00]
Running from: c:documents and settingsAnatoliyРабочий столComboFix.exe
Command switches used :: c:documents and settingsAnatoliyРабочий столCFScript.txt
* Created a new restore pointWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
c:windowssystem32driversati8syxx.sys
.
ADS — svchost.exe: deleted 25600 bytes in 1 streams.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.c:windowssystem32driversati8syxx.sys
c:windowssystem32mbqdaxp.dll
c:windowssystem32mbqdaxp32.dll.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
Legacy_ATI8SYXX
Legacy_ICF
Service_ati8syxx
Service_ICF
Service_restore((((((((((((((((((((((((( Files Created from 2008-12-09 to 2009-01-09 )))))))))))))))))))))))))))))))
.2009-01-01 21:59 . 2004-12-23 05:25 55,288 -ra
c:windowssystem32driversbtwusb.sys
2009-01-01 21:59 . 2004-12-23 05:25 17,516 -ra
c:windowssystem32driversfrmupgr.sys
2008-12-29 11:50 . 2008-12-29 11:50d
c:documents and settingsАдминистраторApplication DataAVG7
2008-12-29 10:18 . 2008-12-29 10:18d
c:documents and settingsАдминистраторDoctorWeb
2008-12-29 10:18 . 2008-12-29 10:18d
c:documents and settingsАдминистраторDoctorWeb
2008-12-23 11:56 . 2008-12-23 11:56 0 —a
c:windowsnsreg.dat
2008-12-10 12:09 . 2008-12-10 12:09d
C:nautemp
2008-12-10 12:09 . 2001-06-06 14:09 17,928
C:user.d32.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-09 10:05
d
w c:documents and settingsAnatoliyApplication DataAVG7
2009-01-09 10:00 12,800 —-a-w c:windowssystem32svchost.exe
2009-01-09 10:00 12,800 —-a-w c:windowssystem32DllCachesvchost.exe
2009-01-05 09:39 11,951,624 —-a-w C:launch.exe
.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowsSystem32ctfmon.exe» [2004-04-01 13312]
«MSMSGS»=»c:program filesMessengermsmsgs.exe» [2002-08-20 1511453][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«Apoint»=»c:program filesApointApoint.exe» [2004-02-02 155648]
«SunJavaUpdateSched»=»c:program filesJavaj2re1.4.2_03binjusched.exe» [2003-11-19 32881]
«ATIPTA»=»c:program filesATI TechnologiesATI Control Panelatiptaxx.exe» [2004-06-10 339968]
«Dell QuickSet»=»c:program filesDellQuickSetquickset.exe» [2004-03-04 487424]
«PRONoMgr.exe»=»c:program filesIntelPROSetWirelessNCSPROSetPRONoMgr.exe» [2003-12-19 86016]
«DVDSentry»=»c:windowsSystem32DSentry.exe» [2002-07-17 28672]
«AdaptecDirectCD»=»c:program filesRoxioEasy CD Creator 5DirectCDDirectCD.exe» [2002-12-17 684032]
«AVG7_CC»=»c:progra~1GrisoftAVG7avgcc.exe» [2008-10-23 590848]
«Adobe Reader Speed Launcher»=»c:program filesAdobeReader 8.0ReaderReader_sl.exe» [2008-01-11 39792][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowsSystem32CTFMON.EXE» [2004-04-01 13312]
«AVG7_Run»=»c:progra~1GrisoftAVG7avgw.exe» [2008-03-12 219136]c:documents and settingsAll Usersѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
BTTray.lnk — c:program filesDellBluetooth SoftwareBTTray.exe [2003-03-25 389181]
Digital Line Detect.lnk — c:program filesDigital Line DetectDLG.exe [2004-09-27 24576][HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotifySebring]
2004-01-13 16:17 110592 c:windowssystem32LgNotify.dll.
— — — — ORPHANS REMOVED — — — —SafeBoot-ati8syxx.sys
.
Supplementary Scan
.
uStart Page = hxxp://www.lardi-trans.com/gruz
mStart Page = hxxp://www.euro.dell.com/
uInternet Connection Wizard,ShellNext = hxxp://www.euro.dell.com/
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
IE: Отправить через &Bluetooth — c:program filesDellПрограммное обеспечение Bluetoothbtsendto_ie_ctx.htm
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} — %SystemRoot%webrelated.htm
TCP: {89FAFAB4-5717-4CEC-8EBE-2D1FC8D04EC9} = 192.168.1.1
FF — ProfilePath — c:documents and settingsAnatoliyApplication DataMozillaFirefoxProfilesn8crb278.default
FF — prefs.js: browser.startup.homepage — hxxp://www.lardi-trans.com/gruz
FF — plugin: c:program filesJavaj2re1.4.2_03binNPJava11.dll
FF — plugin: c:program filesJavaj2re1.4.2_03binNPJava12.dll
FF — plugin: c:program filesJavaj2re1.4.2_03binNPJava13.dll
FF — plugin: c:program filesJavaj2re1.4.2_03binNPJava14.dll
FF — plugin: c:program filesJavaj2re1.4.2_03binNPJava32.dll
FF — plugin: c:program filesJavaj2re1.4.2_03binNPJPI142_03.dll
FF — plugin: c:program filesJavaj2re1.4.2_03binNPOJI610.dll
.**************************************************************************
catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-09 12:37:54
Windows 5.1.2600 Service Pack 1 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(604)
c:windowsSystem32ODBC32.dll
c:windowssystem32Ati2evxx.dll
c:windowsSystem32LgNotify.dll— — — — — — — > ‘lsass.exe'(660)
c:windowsSystem32dssenh.dll
.
Other Running Processes
.
c:windowssystem32ati2evxx.exe
c:windowssystem32S24EvMon.exe
c:windowssystem32ZCfgSvc.exe
c:windowssystem32ati2evxx.exe
c:windowssystem321XConfig.exe
c:progra~1GrisoftAVG7avgamsvr.exe
c:progra~1GrisoftAVG7avgupsvc.exe
c:progra~1GrisoftAVG7avgemc.exe
c:windowssystem32BAsfIpM.exe
c:program filesDellBluetooth Softwarebinbtwdins.exe
c:program filesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
c:windowssystem32RegSrvc.exe
c:windowssystem32scardsvr.exe
c:windowssystem32tlntsvr.exe
c:program filesApointApntEx.exe
c:progra~1DellBLUETO~1BTSTAC~1.EXE
.
**************************************************************************
.
Completion time: 2009-01-09 12:38:59 — machine was rebooted
ComboFix-quarantined-files.txt 2009-01-09 10:38:57Pre-Run: 15 892 172 800 байт свободно
Post-Run: 15,865,380,864 байт свободно134
