[Stas spb]

Здравствуйте ,Valeri

Лог Combofix после добавления CFScript
ComboFix 10-10-18.03 — Stas 22.10.2010 0:33.3.2 — x86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.2046.1542 [GMT 4:00]
Running from: C:ComboFix.exe
Command switches used :: c:documents and settingsStasРабочий столCFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:documents and settingsStasApplication Dataltzqai.exe
c:windowssystem3232.exe
c:windowsTemptmp2.tmp
c:windowsTemptmp3.tmp

.
((((((((((((((((((((((((( Files Created from 2010-09-21 to 2010-10-21 )))))))))))))))))))))))))))))))
.

2010-10-19 20:31 . 2010-10-19 20:31

---

d

---

w- C:rsit
2010-10-19 20:09 . 2010-10-19 20:09 339991 —-a-w- C:RSIT.exe
2010-10-19 15:48 . 2010-10-19 15:48

---

d

---

w- c:program filesMicrosoft LifeCam
2010-10-18 22:16 . 2010-10-18 22:16 288654 —-a-w- C:SafeBootKeyRepair.exe
2010-10-18 19:00 . 2010-10-18 19:00

---

d

---

w- c:documents and settingsStasApplication DataSUPERAntiSpyware.com
2010-10-18 19:00 . 2010-10-18 19:00

---

d

---

w- c:documents and settingsAll UsersApplication DataSUPERAntiSpyware.com
2010-10-18 19:00 . 2010-10-19 08:13

---

d

---

w- c:program filesSUPERAntiSpyware
2010-10-16 20:54 . 2010-10-16 20:54

---

d

---

w- C:Log
2010-10-13 18:24 . 2008-07-05 19:09 60032 —-a-w- c:windowssystem32driversUSBAUDIO.sys
2010-10-13 18:23 . 2008-07-05 19:09 54272 —-a-w- c:windowssystem32vfwwdm32.dll
2010-10-13 18:23 . 2008-07-05 19:09 20992 —-a-w- c:windowssystem32dshowext.ax
2010-10-13 18:23 . 2008-07-05 19:09 121984 —-a-w- c:windowssystem32driversusbvideo.sys
2010-10-13 18:21 . 2010-05-20 11:27 677232 —-a-w- c:windowssystem32LCCoin32.dll
2010-10-13 18:21 . 2010-05-20 11:27 503152 —-a-w- c:windowssystem32LcProxy.ax
2010-10-13 18:21 . 2010-05-20 11:27 39280 —-a-w- c:windowssystem32nx6000res.dll
2010-10-13 18:21 . 2010-05-20 11:27 30576 —-a-w- c:windowssystem32driversnx6000.sys
2010-10-13 10:30 . 2010-10-16 00:13

---

d—a-w- C:Kaspersky Rescue Disk 10.0
2010-10-09 20:53 . 2010-10-09 20:53 4754637 —-a-w- C:IpTvPlayer-setup.exe
2010-10-09 09:10 . 2010-10-09 09:10

---

d

---

w- c:program filesCommon Filesf4e6a6e1
2010-10-03 21:26 . 2010-10-03 21:26

---

d

---

w- c:program filesNotepad GNU
2010-10-03 21:26 . 2010-10-03 21:26 1259984 —-a-w- C:28036_Notepad GNU Installer.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

---

Sigcheck

---

[-] 2008-07-05 23:09 . EC04245E83AF4B7BD43E52E0F48FB871 . 96512 . . . . c:windowssystem32driversatapi.sys

[-] 2008-05-31 . ACCF5A9A1FFAA490F33DBA1C632B95E1 . 361344 . . [5.1.2600.5512] . . c:windowssystem32driverstcpip.sys

[-] 2008-07-05 . 04B7472B0B9C2F6831F7ADC6723B46B3 . 2137600 . . [5.1.2600.5586] . . c:windowssystem32ntoskrnl.exe

[-] 2008-07-05 . E4DDC132FACF8393D90C545498B7751B . 1571840 . . [5.1.2600.5512] . . c:windowssystem32sfcfiles.dll

[-] 2008-05-31 . CDB13F1E48540E19F4B961E77904F168 . 295936 . . [5.1.2600.5512] . . c:windowssystem32termsrv.dll

[-] 2008-07-05 . 3E2ED20BD4A3EBA2FF74E0AA8F21A91D . 2016256 . . [5.1.2600.5586] . . c:windowssystem32ntkrnlpa.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE~Browser Helper Objects{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-12-09 15:40 333192 —-a-w- c:program filesAskBarDisbarbinaskBar.dll

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{3041d03e-fd4b-44e0-b742-2d9b88305f98}»= «c:program filesAskBarDisbarbinaskBar.dll» [2008-12-09 333192]

[HKEY_CLASSES_ROOTclsid{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOTTypeLib{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{3041D03E-FD4B-44E0-B742-2D9B88305F98}»= «c:program filesAskBarDisbarbinaskBar.dll» [2008-12-09 333192]

[HKEY_CLASSES_ROOTclsid{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOTTypeLib{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«AlfaClock Classic»=»c:program filesAlfaClock Free EditionAlfaClock.exe» [2005-07-13 405504]
«Download Master»=»c:program filesDownload Masterdmaster.exe» [2010-07-27 3803968]
«DAEMON Tools Lite»=»c:program filesDAEMON Tools Litedaemon.exe» [2008-01-03 486856]
«Skype»=»c:program filesSkypePhoneSkype.exe» [2010-09-02 13351304]
«SUPERAntiSpyware»=»c:program filesSUPERAntiSpywareSUPERAntiSpyware.exe» [2010-09-28 2424560]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«RTHDCPL»=»RTHDCPL.EXE» [2008-04-10 16861184]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2001-07-09 155648]
«HPDJ Taskbar Utility»=»c:windowssystem32spooldriversw32x863hpztsb11.exe» [2004-04-06 172032]
«HPHUPD06″=»c:program filesHP{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}hphupd06.exe» [2004-06-07 49152]
«HP Software Update»=»c:program filesHPHP Software UpdateHPWuSchd2.exe» [2004-02-12 49152]
«HP Component Manager»=»c:program filesHPhpcoretechhpcmpmgr.exe» [2004-05-12 241664]
«HPHmon06″=»c:windowssystem32hphmon06.exe» [2004-06-07 659456]
«avgnt»=»c:program filesAviraAntiVir Desktopavgnt.exe» [2009-03-02 209153]
«nwiz»=»nwiz.exe» [2007-04-12 1626112]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2007-04-12 8429568]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2007-04-12 81920]
«LifeCam»=»c:program filesMicrosoft LifeCamLifeExp.exe» [2010-05-20 119152]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«Rebuild Icon Cache»=»REBUILDI.EXE» [2007-11-04 172032]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» [2008-07-05 124928]
«IE7_012″=»advpack.dll» [2008-07-05 124928]

c:documents and settingsStasѓ« ў­®Ґ ¬Ґ­оЏа®Ја ¬¬лЂўв®§ Јаг§Є 
RBTray.lnk — c:program filesRBTrayRBTray.exe [2008-12-22 57344]

c:documents and settingsAll Usersѓ« ў­®Ґ ¬Ґ­оЏа®Ја ¬¬лЂўв®§ Јаг§Є 
Adobe Gamma Loader.lnk — c:program filesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe [2010-5-26 113664]
Adobe Reader Speed Launch.lnk — c:program filesAdobeReader 8.0Readerreader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk — c:program filesAdobeReader 8.0ReaderAdobeCollabSync.exe [2006-10-23 734872]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoThumbnailCache»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)
«NoAutoUpdate»= 1 (0x1)

[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«ForceClassicControlPanel»= 1 (0x1)
«NoThumbnailCache»= 1 (0x1)

[hkey_local_machinesoftwaremicrosoftwindowscurrentversionexplorerShellExecuteHooks]
«{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}»= «c:program filesSUPERAntiSpywareSASSEH.DLL» [2008-05-13 77824]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotify!SASWinLogon]
2009-09-03 22:21 548352 —-a-w- c:program filesSUPERAntiSpywareSASWINLO.DLL

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetcontrolsession manager]
BootExecute REG_MULTI_SZ

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusOverride»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«DisableNotifications»= 1 (0x1)
«DisableUnicastResponsesToMulticastBroadcast»= 0 (0x0)

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\uTorrent\utorrent.exe»=
«c:\Program Files\Abital\ArbitalDC+\StrongDC.exe»=
«c:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe»=
«c:\Program Files\ICQ6.5\ICQ.exe»=
«c:\Program Files\Skype\Plugin Manager\skypePM.exe»=
«c:\Program Files\Opera\opera.exe»=
«c:\Program Files\Microsoft LifeCam\LifeCam.exe»=
«c:\Program Files\Microsoft LifeCam\LifeEnC2.exe»=
«c:\Program Files\Microsoft LifeCam\LifeExp.exe»=
«c:\Program Files\Microsoft LifeCam\LifeTray.exe»=
«c:\Program Files\Skype\Phone\Skype.exe»=

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«6844:TCP»= 6844:TCP:wxxsl
«9249:TCP»= 9249:TCP

R1 SASDIFSV;SASDIFSV;c:program filesSUPERAntiSpywaresasdifsv.sys [17.02.2010 22:25 12872]
R1 SASKUTIL;SASKUTIL;c:program filesSUPERAntiSpywareSASKUTIL.SYS [10.05.2010 22:41 67656]
R2 AntiVirSchedulerService;Avira AntiVir Планировщик;c:program filesAviraAntiVir Desktopsched.exe [12.01.2010 22:02 108289]
R2 Transbase TECDOC CD 2_2009 Service;Transbase TECDOC CD 2_2009 Service;f:tecdoc_cd2_2009dbtbmux32.exe [24.02.2009 15:47 356352]
R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:windowssystem32driversnx6000.sys [13.10.2010 22:21 30576]
S4 ICQ Service;ICQ Service;c:program filesICQ6ToolbarICQ Service.exe [26.07.2009 20:16 222456]
S4 sptd;sptd;c:windowssystem32driverssptd.sys [22.12.2008 23:08 715248]
.
Contents of the ‘Scheduled Tasks’ folder

2009-05-15 c:windowsTasksHP Usg Daily FY04.job
— c:program filesHP{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}pexpresshphped06.exe [2004-06-07 04:53]

2010-10-19 c:windowsTasksMicrosoft_Hardware_Launch_IcePick_exe.job
— c:program filesMicrosoft LifeCamIcePick.exe [2010-05-20 11:27]

2010-10-19 c:windowsTasksMicrosoft_Hardware_Launch_LifeExp_exe.job
— c:program filesMicrosoft LifeCamLifeExp.exe [2010-05-20 11:27]
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.yandex.ru/?clid=40488
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
IE: Закачать ВСЕ при помощи Download Master — c:program filesDownload Masterdmieall.htm
IE: Закачать при помощи Download Master — c:program filesDownload Masterdmie.htm
IE: Передать на удаленную закачку DM — c:program filesDownload Masterremdown.htm
IE: {{8B2D996F-B7D1-4961-A929-414D9CF5BA7B} — http://support.microsoft.com/default.aspx?scid=FH;EN-US;KBHOWTO
TCP: {E2755207-2388-446A-9242-01E900C9CBC4} = 10.59.3.19
.
.

---

LOCKED REGISTRY KEYS

---

[HKEY_USERSS-1-5-21-1993962763-854245398-1801674531-1004SoftwareMicrosoftSystemCertificatesAddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘winlogon.exe'(1208)
c:program filesSUPERAntiSpywareSASWINLO.DLL
.
Completion time: 2010-10-22 00:38:06
ComboFix-quarantined-files.txt 2010-10-21 20:38
ComboFix2.txt 2010-10-19 08:51

Pre-Run: 3 556 339 712 байт свободно
Post-Run: 3 554 119 680 байт свободно

— — End Of File — — 56C43579BE1AE3CCD5DFCB0EF76C6D0F

Результат сканирования VirusTotal файла c:windowssystem32driversatapi.sys

File already submitted: The file sent has already been analysed by VirusTotal in the past. This is same basic info regarding the sample itself and its last analysis: MD5: ec04245e83af4b7bd43e52e0f48fb871
Date first seen: 2009-10-19 23:06:41 (UTC)
Date last seen: 2010-08-26 15:56:26 (UTC)
Detection ratio: 1/40

Antivirus Version Last Update Result
AhnLab-V3 2010.08.26.00 2010.08.25 —
AntiVir 8.2.4.46 2010.08.26 —
Antiy-AVL 2.0.3.7 2010.08.26 —
Authentium 5.2.0.5 2010.08.26 —
Avast 4.8.1351.0 2010.08.26 —
Avast5 5.0.594.0 2010.08.26 —
AVG 9.0.0.851 2010.08.26 —
BitDefender 7.2 2010.08.26 —
CAT-QuickHeal 11.00 2010.08.24 —
ClamAV 0.96.2.0-git 2010.08.26 —
Comodo 5864 2010.08.26 —
DrWeb 5.0.2.03300 2010.08.26 —
Emsisoft 5.0.0.37 2010.08.26 —
eTrust-Vet 36.1.7818 2010.08.26 —
F-Prot 4.6.1.107 2010.08.26 —
Fortinet 4.1.143.0 2010.08.26 —
GData 21 2010.08.26 —
Ikarus T3.1.1.88.0 2010.08.26 —
Jiangmin 13.0.900 2010.08.26 —
Kaspersky 7.0.0.125 2010.08.26 —
McAfee 5.400.0.1158 2010.08.26 —
McAfee-GW-Edition 2010.1B 2010.08.26 —
Microsoft 1.6103 2010.08.26 —
NOD32 5399 2010.08.26 —
Norman 6.05.11 2010.08.25 —
nProtect 2010-08-26.01 2010.08.26 —
Panda 10.0.2.7 2010.08.26 —
PCTools 7.0.3.5 2010.08.26 —
Prevx 3.0 2010.08.26 —
Rising 22.62.03.01 2010.08.26 —
Sophos 4.56.0 2010.08.26 —
Sunbelt 6797 2010.08.26 —
SUPERAntiSpyware 4.40.0.1006 2010.08.26 —
Symantec 20101.1.1.7 2010.08.26 WS.Reputation.1
TheHacker 6.5.2.1.356 2010.08.26 —
TrendMicro 9.120.0.1004 2010.08.26 —
TrendMicro-HouseCall 9.120.0.1004 2010.08.26 —
VBA32 3.12.14.0 2010.08.25 —
ViRobot 2010.8.26.4009 2010.08.26 —
VirusBuster 5.0.27.0 2010.08.26 —

С уважением Станислав.

[Stas spb]

Вот лог Combofix

ComboFix 10-10-18.03 — Stas 19.10.2010 12:47:21.2.2 — x86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.2046.1464 [GMT 4:00]
Running from: C:ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:windowsTemptmp2.tmp
c:windowsTemptmp3.tmp
.
—- Previous Run

---

.
c:documents and settingsStasApplication Dataltzqai.exe
c:documents and settingsStasApplication Datawiaserva.log
c:program filesIEToolbar404find404.com search enginetbHElper.dll
c:windowscfdrive32.exe
c:windowsInstallDelay.exe
c:windowsInstalldocs.rtf
c:windowsInstalllicense.rtf
c:windowsInstallPresetup.exe
c:windowsInstallPresetup.INI
c:windowsInstallreadme.rtf
c:windowsInstallShots7-Zip.jpg
c:windowsInstallShotsAClock.jpg
c:windowsInstallShotsAIMP.jpg
c:windowsInstallShotsBitMeter.jpg
c:windowsInstallShotsCCleaner.jpg
c:windowsInstallShotsCDBurner.jpg
c:windowsInstallShotsCPL.jpg
c:windowsInstallShotsDefrag.jpg
c:windowsInstallShotsDirectX.jpg
c:windowsInstallShotsDMaster.jpg
c:windowsInstallShotsDotNet.jpg
c:windowsInstallShotsFileMenu.jpg
c:windowsInstallShotsFlash.jpg
c:windowsInstallShotsFSImage.jpg
c:windowsInstallShotsHashTab.jpg
c:windowsInstallShotsHWMon.jpg
c:windowsInstallShotsJavaRE.jpg
c:windowsInstallShotsKMPlayer.jpg
c:windowsInstallShotsNotepad.jpg
c:windowsInstallShotsOpera.jpg
c:windowsInstallShotsPCWizard.jpg
c:windowsInstallShotsPROWiSe.jpg
c:windowsInstallShotsPuntoSW.jpg
c:windowsInstallShotsRBTray.jpg
c:windowsInstallShotsRecuva.jpg
c:windowsInstallShotsRHacker.jpg
c:windowsInstallShotsRnQ.jpg
c:windowsInstallShotsSamLab.jpg
c:windowsInstallShotsSTDU.jpg
c:windowsInstallShotsTaskSw.jpg
c:windowsInstallShotsTotalCmd.jpg
c:windowsInstallShotsUnlocker.jpg
c:windowsInstallShotsuTorrent.jpg
c:windowsInstallShotsVistaGUI.jpg
c:windowsInstallShotsWinRAR.jpg
c:windowsInstallShowCmdParam.exe
c:windowsInstallSkinACTIVATE.WAV
c:windowsInstallSkinBREAK.WAV
c:windowsInstallSkinBULB_PICT.BMP
c:windowsInstallSkinCANCEL_BT.BMP
c:windowsInstallSkinCHECK_BT.BMP
c:windowsInstallSkinCHECKALL_BT.BMP
c:windowsInstallSkinCHECKNONE_BT.BMP
c:windowsInstallSkinCHECKTG_BT.BMP
c:windowsInstallSkinCLICK.WAV
c:windowsInstallSkinCLOSE_BT.BMP
c:windowsInstallSkinCOLLAPSE_BT.BMP
c:windowsInstallSkinDEFAULT_BT.BMP
c:windowsInstallSkinDONE.WAV
c:windowsInstallSkinEXPAND_BT.BMP
c:windowsInstallSkinFINISH_BT.BMP
c:windowsInstallSkinGROUP_BIG.BMP
c:windowsInstallSkinGROUP_SMALL.BMP
c:windowsInstallSkinHELP_BT.BMP
c:windowsInstallSkinLEFT_BT.BMP
c:windowsInstallSkinPRCHECK_PICT.BMP
c:windowsInstallSkinRIGHT_BT.BMP
c:windowsInstallSkinSkin.INI
c:windowsInstallSkinTRAY_BT.BMP
c:windowsInstallSkinTREESELECTOR_BIG.BMP
c:windowsInstallSkinTREESELECTOR_SMALL.BMP
c:windowsInstallSkinWALLPAPERS.bmp
c:windowslogfile32.txt
c:windowssystem3238.exe
c:windowssystem32browseit.log
c:windowssystem32Install.cmd
c:windowssystem32kr_done1
c:windowssystem32msvmiode.exe
c:windowssystem32qmopt.dll
c:windowssystem32service13092009_TIS17_SfFniAU.log
c:windowssystem32service18102009_TIS17_SfFniAU.log
c:windowssystem32service22092009_TIS17_SfFniAU.log
c:windowssystem32service26102009_TIS17_SfFniAU.log
c:windowssystem32sm.exe
c:windowsTemptmp2.tmp

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

---

Legacy_ACPI32

---

Legacy_SECURENTM

---

Service_acpi32

((((((((((((((((((((((((( Files Created from 2010-09-19 to 2010-10-19 )))))))))))))))))))))))))))))))
.

2010-10-18 22:16 . 2010-10-18 22:16 288654 —-a-w- C:SafeBootKeyRepair.exe
2010-10-18 19:00 . 2010-10-18 19:00

---

d

---

w- c:documents and settingsStasApplication DataSUPERAntiSpyware.com
2010-10-18 19:00 . 2010-10-18 19:00

---

d

---

w- c:documents and settingsAll UsersApplication DataSUPERAntiSpyware.com
2010-10-18 19:00 . 2010-10-19 08:13

---

d

---

w- c:program filesSUPERAntiSpyware
2010-10-16 20:54 . 2010-10-16 20:54

---

d

---

w- C:Log
2010-10-13 18:24 . 2008-07-05 19:09 60032 —-a-w- c:windowssystem32driversUSBAUDIO.sys
2010-10-13 18:23 . 2008-07-05 19:09 54272 —-a-w- c:windowssystem32vfwwdm32.dll
2010-10-13 18:23 . 2008-07-05 19:09 20992 —-a-w- c:windowssystem32dshowext.ax
2010-10-13 18:23 . 2008-07-05 19:09 121984 —-a-w- c:windowssystem32driversusbvideo.sys
2010-10-13 18:21 . 2010-05-20 11:27 677232 —-a-w- c:windowssystem32LCCoin32.dll
2010-10-13 18:21 . 2010-05-20 11:27 503152 —-a-w- c:windowssystem32LcProxy.ax
2010-10-13 18:21 . 2010-05-20 11:27 39280 —-a-w- c:windowssystem32nx6000res.dll
2010-10-13 18:21 . 2010-05-20 11:27 30576 —-a-w- c:windowssystem32driversnx6000.sys
2010-10-13 10:30 . 2010-10-16 00:13

---

d—a-w- C:Kaspersky Rescue Disk 10.0
2010-10-09 20:53 . 2010-10-09 20:53 4754637 —-a-w- C:IpTvPlayer-setup.exe
2010-10-09 09:10 . 2010-10-09 09:10

---

d

---

w- c:program filesCommon Filesf4e6a6e1
2010-10-03 21:26 . 2010-10-03 21:26

---

d

---

w- c:program filesNotepad GNU
2010-10-03 21:26 . 2010-10-03 21:26 1259984 —-a-w- C:28036_Notepad GNU Installer.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

---

Sigcheck

---

[-] 2008-07-05 23:09 . EC04245E83AF4B7BD43E52E0F48FB871 . 96512 . . . . c:windowssystem32driversatapi.sys

[-] 2008-05-31 . ACCF5A9A1FFAA490F33DBA1C632B95E1 . 361344 . . [5.1.2600.5512] . . c:windowssystem32driverstcpip.sys

[-] 2008-07-05 . 04B7472B0B9C2F6831F7ADC6723B46B3 . 2137600 . . [5.1.2600.5586] . . c:windowssystem32ntoskrnl.exe

[-] 2008-07-05 . E4DDC132FACF8393D90C545498B7751B . 1571840 . . [5.1.2600.5512] . . c:windowssystem32sfcfiles.dll

[-] 2008-05-31 . CDB13F1E48540E19F4B961E77904F168 . 295936 . . [5.1.2600.5512] . . c:windowssystem32termsrv.dll

[-] 2008-07-05 . 3E2ED20BD4A3EBA2FF74E0AA8F21A91D . 2016256 . . [5.1.2600.5586] . . c:windowssystem32ntkrnlpa.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE~Browser Helper Objects{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-12-09 15:40 333192 —-a-w- c:program filesAskBarDisbarbinaskBar.dll

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{3041d03e-fd4b-44e0-b742-2d9b88305f98}»= «c:program filesAskBarDisbarbinaskBar.dll» [2008-12-09 333192]

[HKEY_CLASSES_ROOTclsid{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOTTypeLib{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{3041D03E-FD4B-44E0-B742-2D9B88305F98}»= «c:program filesAskBarDisbarbinaskBar.dll» [2008-12-09 333192]

[HKEY_CLASSES_ROOTclsid{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOTTypeLib{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«AlfaClock Classic»=»c:program filesAlfaClock Free EditionAlfaClock.exe» [2005-07-13 405504]
«Download Master»=»c:program filesDownload Masterdmaster.exe» [2010-07-27 3803968]
«DAEMON Tools Lite»=»c:program filesDAEMON Tools Litedaemon.exe» [2008-01-03 486856]
«Skype»=»c:program filesSkype\PhoneSkype.exe» [2010-09-02 13351304]
«SUPERAntiSpyware»=»c:program filesSUPERAntiSpywareSUPERAntiSpyware.exe» [2010-09-28 2424560]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«RTHDCPL»=»RTHDCPL.EXE» [2008-04-10 16861184]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2001-07-09 155648]
«HPDJ Taskbar Utility»=»c:windowssystem32spooldriversw32x863hpztsb11.exe» [2004-04-06 172032]
«HPHUPD06″=»c:program filesHP{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}hphupd06.exe» [2004-06-07 49152]
«HP Software Update»=»c:program filesHPHP Software UpdateHPWuSchd2.exe» [2004-02-12 49152]
«HP Component Manager»=»c:program filesHPhpcoretechhpcmpmgr.exe» [2004-05-12 241664]
«HPHmon06″=»c:windowssystem32hphmon06.exe» [2004-06-07 659456]
«avgnt»=»c:program filesAviraAntiVir Desktopavgnt.exe» [2009-03-02 209153]
«nwiz»=»nwiz.exe» [2007-04-12 1626112]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2007-04-12 8429568]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2007-04-12 81920]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«Rebuild Icon Cache»=»REBUILDI.EXE» [2007-11-04 172032]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» [2008-07-05 124928]
«IE7_012″=»advpack.dll» [2008-07-05 124928]

c:documents and settingsStasѓ« ў­®Ґ ¬Ґ­оЏа®Ја ¬¬лЂўв®§ Јаг§Є 
RBTray.lnk — c:program filesRBTrayRBTray.exe [2008-12-22 57344]

c:documents and settingsAll Usersѓ« ў­®Ґ ¬Ґ­оЏа®Ја ¬¬лЂўв®§ Јаг§Є 
Adobe Gamma Loader.lnk — c:program filesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe [2010-5-26 113664]
Adobe Reader Speed Launch.lnk — c:program filesAdobeReader 8.0Readerreader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk — c:program filesAdobeReader 8.0ReaderAdobeCollabSync.exe [2006-10-23 734872]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoThumbnailCache»= 1 (0x1)
«NoSMConfigurePrograms»= 1 (0x1)
«NoAutoUpdate»= 1 (0x1)

[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«ForceClassicControlPanel»= 1 (0x1)
«NoThumbnailCache»= 1 (0x1)

[hkey_local_machinesoftwaremicrosoftwindowscurrentversionexplorerShellExecuteHooks]
«{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}»= «c:program filesSUPERAntiSpywareSASSEH.DLL» [2008-05-13 77824]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotify!SASWinLogon]
2009-09-03 22:21 548352 —-a-w- c:program filesSUPERAntiSpywareSASWINLO.DLL

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetcontrolsession manager]
BootExecute REG_MULTI_SZ

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusOverride»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«DisableNotifications»= 1 (0x1)
«DisableUnicastResponsesToMulticastBroadcast»= 0 (0x0)

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\uTorrent\utorrent.exe»=
«c:\Program Files\Abital\ArbitalDC+\StrongDC.exe»=
«c:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe»=
«c:\Program Files\ICQ6.5\ICQ.exe»=
«c:\Program Files\Skype\Plugin Manager\skypePM.exe»=
«c:\Program Files\Opera\opera.exe»=
«c:\Program Files\Skype\Phone\Skype.exe»=

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«6844:TCP»= 6844:TCP:wxxsl
«9249:TCP»= 9249:TCP

R1 SASDIFSV;SASDIFSV;c:program filesSUPERAntiSpywaresasdifsv.sys [17.02.2010 22:25 12872]
R1 SASKUTIL;SASKUTIL;c:program filesSUPERAntiSpywareSASKUTIL.SYS [10.05.2010 22:41 67656]
R2 AntiVirSchedulerService;Avira AntiVir Планировщик;c:program filesAviraAntiVir Desktopsched.exe [12.01.2010 22:02 108289]
R2 Transbase TECDOC CD 2_2009 Service;Transbase TECDOC CD 2_2009 Service;f:tecdoc_cd2_2009dbtbmux32.exe [24.02.2009 15:47 356352]
S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:windowssystem32driversnx6000.sys [13.10.2010 22:21 30576]
S4 ICQ Service;ICQ Service;c:program filesICQ6ToolbarICQ Service.exe [26.07.2009 20:16 222456]
S4 sptd;sptd;c:windowssystem32driverssptd.sys [22.12.2008 23:08 715248]

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSvchost — NetSvcs
vambupfi
gkdos
tuxloxje
ygvvi
.
Contents of the ‘Scheduled Tasks’ folder

2009-05-15 c:windowsTasksHP Usg Daily FY04.job
— c:program filesHP{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}pexpresshphped06.exe [2004-06-07 04:53]
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.yandex.ru/?clid=40488
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
IE: Закачать ВСЕ при помощи Download Master — c:program filesDownload Masterdmieall.htm
IE: Закачать при помощи Download Master — c:program filesDownload Masterdmie.htm
IE: Передать на удаленную закачку DM — c:program filesDownload Masterremdown.htm
IE: {{8B2D996F-B7D1-4961-A929-414D9CF5BA7B} — http://support.microsoft.com/default.aspx?scid=FH;EN-US;KBHOWTO
TCP: {E2755207-2388-446A-9242-01E900C9CBC4} = 10.59.3.19
.
— — — — ORPHANS REMOVED — — — —

Toolbar-{17679b4f-3bcc-644b-8f28-a47597fbb905} — (no file)
WebBrowser-{17679b4f-3bcc-644b-8f28-a47597fbb905} — (no file)
HKLM-Run-UfSeAgnt.exe — c:program filesTrend MicroInternet SecurityUfSeAgnt.exe

.

---

LOCKED REGISTRY KEYS

---

[HKEY_USERSS-1-5-21-1993962763-854245398-1801674531-1004SoftwareMicrosoftSystemCertificatesAddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘winlogon.exe'(1208)
c:program filesSUPERAntiSpywareSASWINLO.DLL
.
Completion time: 2010-10-19 12:51:37
ComboFix-quarantined-files.txt 2010-10-19 08:51

Pre-Run: 3 831 418 880 байт свободно
Post-Run: 3 802 034 176 байт свободно

— — End Of File — — 685B63F48C4A6A403CFDA573CE360652

С уважением Станислав.

[Автор]

Сообщения