[Sunny]

Здравствуйте, спасибо, что откликнулись 🙂
Вот лог

ComboFix 09-10-11.03 — 11 12.10.2009 17:16.1.2 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.959.669 [GMT 3:00]
Running from: c:documents and settings11Рабочий столComboFix.exe
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: Персональный файервол ESET *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr0.dat
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr1.dat
c:program files\setup.exe

---

BITS: Possible infected sites

---

hxxp://soft.export.yandex.ru
hxxp://download.yandex.ru
.
((((((((((((((((((((((((( Files Created from 2009-09-12 to 2009-10-12 )))))))))))))))))))))))))))))))
.

2009-10-10 19:48 . 2009-10-10 19:48

---

d

---

w- c:documents and settings11Local SettingsApplication DataAhead
2009-10-10 17:45 . 2009-10-12 13:59

---

d

---

w- c:documents and settings11Local SettingsApplication DataAskToolbar
2009-10-10 17:43 . 2009-10-10 17:43

---

d

---

w- c:program filesSopCast
2009-10-10 17:43 . 2009-10-10 17:43

---

d

---

w- c:program filesAsk.com
2009-10-10 08:23 . 2009-10-10 08:23

---

d

---

w- c:documents and settingsAll UsersApplication DataKaspersky Lab Setup Files
2009-10-09 22:19 . 2009-10-09 22:19

---

d

---

w- c:program filesMicrosoft CAPICOM 2.1.0.2
2009-10-08 17:00 . 2009-10-08 17:01

---

d

---

w- C:rsit
2009-10-08 17:00 . 2009-10-08 17:01

---

d

---

w- c:program filestrend micro
2009-10-08 14:12 . 2009-10-08 14:12

---

d

---

w- c:program filesYandex
2009-10-08 14:12 . 2009-10-08 14:12

---

d

---

w- c:documents and settings11Local SettingsApplication DataYandex
2009-10-08 14:12 . 2009-10-08 14:12

---

d

---

w- c:documents and settings11Application DataYandex
2009-10-08 14:12 . 2009-10-08 14:12

---

d—h—w- c:windowsmsdownld.tmp
2009-10-08 14:11 . 2009-10-08 14:11

---

dc-h—w- c:windowsie8
2009-10-08 10:02 . 2009-10-08 13:58

---

d

---

w- c:windowsie8updates
2009-10-08 09:54 . 2009-06-15 11:10 80896 -c—-w- c:windowssystem32dllcachetlntsess.exe
2009-10-08 09:54 . 2009-06-15 10:45 79872 -c—-w- c:windowssystem32dllcachetelnet.exe
2009-10-08 09:54 . 2009-06-10 06:17 134144 -c—-w- c:windowssystem32dllcachewkssvc.dll
2009-10-08 09:53 . 2009-06-10 14:14 85504 -c—-w- c:windowssystem32dllcacheavifil32.dll
2009-10-08 09:53 . 2009-07-17 19:03 58880 -c—-w- c:windowssystem32dllcacheatl.dll
2009-10-08 09:53 . 2009-08-05 09:01 204800 -c—-w- c:windowssystem32dllcachemswebdvd.dll
2009-10-08 09:50 . 2009-06-21 21:48 153088 -c—-w- c:windowssystem32dllcachetriedit.dll
2009-10-08 09:50 . 2009-07-10 13:28 1315328 -c—-w- c:windowssystem32dllcachemsoe.dll
2009-10-08 09:50 . 2009-07-03 17:00 55296 -c—-w- c:windowssystem32dllcachemsfeedsbs.dll
2009-10-08 09:50 . 2009-07-03 17:00 246272 -c—-w- c:windowssystem32dllcacheieproxy.dll
2009-10-08 09:50 . 2009-07-03 17:00 12800 -c—-w- c:windowssystem32dllcachexpshims.dll
2009-10-08 09:50 . 2009-07-03 17:00 1985536 -c—-w- c:windowssystem32dllcacheiertutil.dll
2009-10-08 09:50 . 2009-07-03 17:00 594432 -c—-w- c:windowssystem32dllcachemsfeeds.dll
2009-10-08 09:45 . 2009-05-07 15:16 347136 -c—-w- c:windowssystem32dllcachelocalspl.dll
2009-10-08 09:45 . 2009-06-03 19:12 1292800 -c—-w- c:windowssystem32dllcachequartz.dll
2009-10-08 09:45 . 2008-06-20 17:45 247296 -c—-w- c:windowssystem32dllcachemswsock.dll
2009-10-08 09:45 . 2008-06-20 17:45 147968 -c—-w- c:windowssystem32dllcachednsapi.dll
2009-10-08 09:45 . 2008-06-20 11:59 361600 -c—-w- c:windowssystem32dllcachetcpip.sys
2009-10-08 09:45 . 2008-06-20 11:48 138496 -c—-w- c:windowssystem32dllcacheafd.sys
2009-10-08 09:45 . 2008-06-20 11:16 225856 -c—-w- c:windowssystem32dllcachetcpip6.sys
2009-10-08 08:58 . 2009-10-08 08:58

---

d

---

w- c:documents and settingsAll UsersApplication DataWinferno
2009-10-08 08:54 . 2005-07-13 15:09 679936 —-a-w- c:windowsLiving 3D Waterfalls Full.scr
2009-10-08 08:54 . 2009-10-08 08:54

---

d

---

w- c:program filesFreeze.com
2009-10-08 08:53 . 2009-10-08 08:53

---

d

---

w- c:program filesFree Offers from Freeze.com
2009-10-08 08:53 . 2009-10-08 08:53

---

d

---

w- c:program filesCommon FilesWinferno
2009-10-08 08:53 . 2006-10-09 10:06 495616 —-a-w- c:windowssystem32WINUTIL5.DLL
2009-10-08 08:53 . 2006-05-17 05:40 393216 —-a-w- c:windowssystem32WINLCTL5.DLL
2009-10-08 08:53 . 2009-10-08 08:53

---

d

---

w- c:program filesWinferno
2009-10-08 08:52 . 2009-10-08 17:32

---

d

---

w- c:program filesWeemi
2009-10-08 08:52 . 2009-10-08 17:31

---

d

---

w- c:documents and settingsAll UsersApplication DataWeemi
2009-10-07 15:56 . 2009-10-07 15:58

---

d

---

w- c:program filesvanBasco’s Karaoke Player
2009-10-06 17:15 . 2006-03-14 03:09 176128

---

w- c:windowssystem32nvuide.exe
2009-10-06 17:15 . 2006-03-16 10:51 290304 —-a-r- c:windowssystem32idecoiins.dll
2009-10-06 17:15 . 2006-03-16 10:51 290304 —-a-r- c:windowssystem32idecoi.dll
2009-10-06 17:15 . 2006-03-14 03:09 35840 —-a-r- c:windowssystem32NVCOI.DLL
2009-10-06 17:15 . 2006-03-16 10:51 99840 —-a-r- c:windowssystem32driversnvata.sys
2009-10-06 17:15 . 2009-10-06 17:15

---

d

---

w- c:windowsNV18362316.TMP
2009-10-06 16:55 . 2006-02-17 02:28 222592 —-a-r- c:windowssystem32driversnvsnpu.sys
2009-09-19 21:33 . 2009-09-19 21:33

---

d

---

w- c:windowssystem32LogFiles
2009-09-19 21:31 . 2008-04-13 21:15 26112 —-a-w- c:windowssystem32driversusbser.sys
2009-09-19 21:29 . 2009-09-19 21:33

---

d

---

w- c:documents and settings11Application DataPC Suite
2009-09-19 21:29 . 2009-09-19 21:32

---

d

---

w- c:documents and settingsAll UsersApplication DataPC Suite
2009-09-19 21:29 . 2009-09-19 21:32

---

d

---

w- c:documents and settings11Application DataNokia
2009-09-19 21:28 . 2009-09-19 21:28

---

d

---

w- c:program filesCommon FilesPCSuite
2009-09-19 21:28 . 2009-09-19 21:28

---

d

---

w- c:program filesCommon FilesNokia
2009-09-19 21:28 . 2009-09-19 21:28

---

d

---

w- c:program filesDIFX
2009-09-19 21:28 . 2007-09-17 12:53 21632 —-a-w- c:windowssystem32driverspccsmcfd.sys
2009-09-19 21:26 . 2009-09-19 21:26

---

d

---

w- c:program filesPC Connectivity Solution
2009-09-19 21:26 . 2007-11-29 07:39 8064 —-a-w- c:windowssystem32driversusbser_lowerfltj.sys
2009-09-19 21:26 . 2007-11-29 07:39 8064 —-a-w- c:windowssystem32driversusbser_lowerflt.sys
2009-09-19 21:26 . 2007-11-29 07:39 19328 —-a-w- c:windowssystem32driversccdcmbo.sys
2009-09-19 21:26 . 2007-11-29 07:39 95744 —-a-w- c:windowssystem32nmwcdcocls.dll
2009-09-19 21:26 . 2007-11-29 07:39 16896 —-a-w- c:windowssystem32driversccdcmb.sys
2009-09-19 21:26 . 2007-11-29 07:33 1419232 —-a-w- c:windowssystem32wdfcoinstaller01005.dll
2009-09-19 21:26 . 2007-11-29 07:32 48128 —-a-w- c:windowssystem32nmwcdcls.dll
2009-09-19 21:23 . 2009-09-19 21:24

---

d

---

w- c:documents and settingsAll UsersApplication DataInstallations
2009-09-19 21:17 . 2009-09-19 21:17

---

d-sh—w- c:windowsftpcache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-09 14:25 . 2009-07-19 12:37

---

d

---

w- c:program filesCommon FilesAdobe
2009-10-08 10:07 . 2009-07-19 12:37

---

d

---

w- c:program filesMicrosoft Silverlight
2009-10-08 10:02 . 2009-07-19 15:20

---

d

---

w- c:documents and settingsAll UsersApplication DataMicrosoft Help
2009-10-06 17:21 . 2008-04-15 12:00 84938 —-a-w- c:windowssystem32perfc019.dat
2009-10-06 17:21 . 2008-04-15 12:00 487442 —-a-w- c:windowssystem32perfh019.dat
2009-09-19 21:31 . 2009-09-19 21:31 0 —ha-w- c:windowssystem32driversMsft_Kernel_ccdcmb_01005.Wdf
2009-09-19 21:31 . 2009-09-19 21:31 0 —ha-w- c:windowssystem32driversMsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-09-19 18:24 . 2009-07-19 14:02

---

d

---

w- c:program filesCommon FilesACD Systems
2009-09-08 08:49 . 2009-09-08 08:48

---

d

---

w- c:program filesOpera7
2009-08-17 21:20 . 2009-08-17 21:20 24100 —ha-w- c:windowssystem32mlfcache.dat
2009-08-14 21:07 . 2009-08-14 21:07

---

d

---

w- c:documents and settings11Application DataApple Computer
2009-08-14 21:07 . 2009-08-14 21:07

---

d

---

w- c:program filesSafari
2009-08-14 21:06 . 2009-08-14 21:06

---

d

---

w- c:program filesBonjour
2009-08-14 21:06 . 2009-08-14 21:06

---

d

---

w- c:program filesApple Software Update
2009-08-14 21:06 . 2009-08-14 21:06

---

d

---

w- c:documents and settingsAll UsersApplication DataApple
2009-08-14 18:13 . 2009-08-14 18:13

---

d

---

w- c:program filesdirectx
2009-08-14 18:09 . 2009-07-24 14:37

---

d—h—w- c:program filesInstallShield Installation Information
2009-08-14 18:01 . 2009-08-14 18:01

---

d

---

w- c:program filesAlternative Software Ltd
2009-08-14 17:56 . 2009-07-19 14:05

---

d

---

w- c:documents and settings11Application DataWinamp
2009-08-10 17:14 . 2009-08-10 17:14 125 —-a-w- c:documents and settings11Local SettingsApplication Datafusioncache.dat
2009-08-10 17:10 . 2009-07-19 12:48 31568 —-a-w- c:documents and settings11Local SettingsApplication DataGDIPFONTCACHEV1.DAT
2009-08-05 09:01 . 2008-04-15 12:00 204800 —-a-w- c:windowssystem32mswebdvd.dll
2009-07-31 18:46 . 2009-07-31 18:46 0 —-a-w- c:windowsnsreg.dat
2009-07-19 12:37 . 2009-07-19 12:37 721904 —-a-w- c:windowssystem32driverssptd.sys
2009-07-19 12:37 . 2009-07-19 12:37 9509 —-a-w- c:windowsunins000.dat
2009-07-19 12:37 . 2009-07-19 12:37 713135 —-a-w- c:windowsunins000.exe
2009-07-19 12:30 . 2009-07-19 12:30 22564 —-a-w- c:windowssystem32emptyregdb.dat
2009-07-17 19:03 . 2008-04-15 12:00 58880 —-a-w- c:windowssystem32atl.dll
.

---

Sigcheck

---

[-] 2009-04-25 . AC23CF5D73E19F836172C490DB87593A . 634368 . . [5.1.2600.5512] . . c:windowssystem32user32.dll
[7] 2008-04-14 . A9CDF92EA1CFFB67448EF26F5DF21A6F . 579072 . . [5.1.2600.5512] . . c:windowsResPatchBackupuser32.dll

[-] 2009-04-25 . 7E6654A9CF11089A17883E876C14BC93 . 1571840 . . [5.1.2600.5512] . . c:windowssystem32sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE~Browser Helper Objects{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-06-04 15:04 1144712 —-a-w- c:program filesAsk.comGenericAskToolbar.dll

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2009-03-25 3697952]
«{D4027C7F-154A-4066-A1AD-4243D8127440}»= «c:program filesAsk.comGenericAskToolbar.dll» [2009-06-04 1144712]

[HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar]

[HKEY_CLASSES_ROOTclsid{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOTGenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOTTypeLib{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOTGenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2009-03-25 3697952]
«{D4027C7F-154A-4066-A1AD-4243D8127440}»= «c:program filesAsk.comGenericAskToolbar.dll» [2009-06-04 1144712]

[HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar]

[HKEY_CLASSES_ROOTclsid{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOTGenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOTTypeLib{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOTGenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2009-01-11 132096]
«MSMSGS»=»c:program filesMessengermsmsgs.exe» [2008-04-14 1695232]
«Nokia.PCSync»=»d:nokiaNokia PC Suite 6PCSync2.exe» [2008-03-26 1232896]
«PC Suite Tray»=»d:nokiaNokia PC Suite 6PCSuite.exe» [2008-04-16 1079808]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«TaskSwitchXP»=»c:program filesTaskSwitchXPTaskSwitchXP.exe» [2007-03-09 62976]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2008-05-03 13529088]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2008-05-03 86016]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2006-01-12 155648]
«CyberMania»=»c:program filesESETCyberMania.exe» [2008-07-03 556175]
«egui»=»c:program filesESETESET Smart Securityegui.exe» [2009-04-09 2029640]
«AdobeCS4ServiceManager»=»c:program filesCommon FilesAdobeCS4ServiceManagerCS4ServiceManager.exe» [2008-08-14 611712]
«Download Master»=»d:download masterdmaster.exe» [2002-10-16 448473]
«Adobe Reader Speed Launcher»=»c:program filesAdobeReader 8.0ReaderReader_sl.exe» [2007-10-10 39792]
«SoundMan»=»SOUNDMAN.EXE» — c:windowsSOUNDMAN.EXE [2006-01-11 577536]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-15 15360]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2009-01-11 132096]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«ForceClassicControlPanel»= 1 (0x1)

[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«ForceClassicControlPanel»= 1 (0x1)

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«UpdatesDisableNotify»=dword:00000001
«AntiVirusOverride»=dword:00000001
«FirewallOverride»=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)
«DisableUnicastResponsesToMulticastBroadcast»= 0 (0x0)

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\Skype\Phone\Skype.exe»=
«c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE»=
«c:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe»=
«c:\Program Files\Bonjour\mDNSResponder.exe»=
«d:\Download Master\dmaster.exe»=

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«5353:TCP»= 5353:TCP:Adobe CSI CS4

R1 ehdrv;ehdrv;c:windowssystem32driversehdrv.sys [09.04.2009 14:18 107256]
R2 ekrn;ESET Service;c:program filesESETESET Smart Securityekrn.exe [09.04.2009 14:19 731840]
S3 FXDrv32;FXDrv32;E:FXDrv32.sys [14.08.2005 19:49 16352]
.
Contents of the ‘Scheduled Tasks’ folder

2009-10-10 c:windowsTasksAppleSoftwareUpdate.job
— c:program filesApple Software UpdateSoftwareUpdate.exe [2008-07-30 09:34]

2009-10-12 c:windowsTasksPCConfidential.job
— c:program filesWinfernoPC ConfidentialPCConfidential.exe [2009-10-08 11:10]

2009-10-12 c:windowsTasksRegPowerClean.job
— c:program filesWinfernoRegistryPowerCleanerRegPowerClean.exe [2009-10-08 11:48]

2009-10-12 c:windowsTasksRPCReminder.job
— c:program filesWinfernoRegistryPowerCleanerRPCReminder.exe [2009-10-08 11:34]

2009-10-12 c:windowsTasksScheduled Update for Ask Toolbar.job
— c:program filesAsk.comUpdateTask.exe [2009-06-04 15:04]

2009-10-12 c:windowsTasksUser_Feed_Synchronization-{51F17FAC-69F2-430E-8152-FB4B100E4B77}.job
— c:windowssystem32msfeedssync.exe [2009-03-08 01:31]
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://about:blank
uInternet Settings,ProxyOverride =
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
IE: Download using Download &Express — file://c:windowssystem32MetaProductsAdd_Url.htm
IE: Закачать при помощи Download Master — d:download masterdmie.htm
IE: Настроить параметры перевода — c:program filesPRMT8PRMTIEoptions.htm
IE: Незнакомые слова — c:program filesPRMT8PRMTIEinfopanel.htm
IE: Перевести — c:program filesPRMT8PRMTIEtranslat.htm
IE: Перевести страницу — c:program filesPRMT8PRMTIEpage.htm
IE: Поиск в Интернете — c:program filesPRMT8PRMTIEsearch.htm
IE: {{7A2EFD41-E6B3-11D2-89E3-00E0292EE574} — c:program filesX-Translator DIAMONDPROMTIE4promtie5.htm
IE: {{7A2EFD41-E6B3-11D2-89E3-00E0292EE575} — c:program filesX-Translator DIAMONDPROMTIE4options.htm
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a}
TCP: {4B68C232-AE2B-438C-AF3F-A597F8D2E839} = 195.5.46.12,192.168.1.1
Name-Space Handler: ftpHIEClickCatcher — {E131C96E-4DDB-11D4-84B8-008048B33DEA} — c:windowssystem32MetaProductsmdpph.dll
Name-Space Handler: httpHIEClickCatcher — {E131C96E-4DDB-11D4-84B8-008048B33DEA} — c:windowssystem32MetaProductsmdpph.dll
Name-Space Handler: httpsHIEClickCatcher — {E131C96E-4DDB-11D4-84B8-008048B33DEA} — c:windowssystem32MetaProductsmdpph.dll
FF — ProfilePath — c:documents and settings11Application DataMozillaFirefoxProfiles8ofh3n63.default
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnppl3260.dll
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnprpjplug.dll
FF — plugin: c:program filesOpera7ProgramPluginsnpdrmv2.dll
FF — plugin: c:program filesOpera7ProgramPluginsnpdsplay.dll
FF — plugin: c:program filesOpera7ProgramPluginsNPSWF32.dll
FF — plugin: c:program filesOpera7ProgramPluginsnpwmsdrm.dll
FF — HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} — c:windowsMicrosoft.NETFrameworkv3.5Windows Presentation FoundationDotNetAssistantExtension
.
— — — — ORPHANS REMOVED — — — —

HKCU-Run-EDLauncher — c:program filesPRMT8PRMTEDEDLauncher.exe
HKCU-Run-AdobeBridge — (no file)
HKLM-Run-nwiz — nwiz.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-12 17:22
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘explorer.exe'(704)
c:windowssystem32WININET.dll
c:windowssystem32msi.dll
c:windowssystem32wpdshserviceobj.dll
d:nokiaNokia PC Suite 6phonebrowser.dll
d:nokiaNokia PC Suite 6NGSCM.DLL
d:nokiaNokia PC Suite 6LangPhoneBrowser_rus.nlr
d:nokiaNokia PC Suite 6ResourcePhoneBrowser_Nokia.ngr
c:windowssystem32webcheck.dll
c:windowssystem32portabledevicetypes.dll
c:windowssystem32portabledeviceapi.dll
.

---

Other Running Processes

---

.
c:program filesBonjourmDNSResponder.exe
c:program filesFolderSizeFolderSizeSvc.exe
c:program filesCommon FilesMicrosoft SharedVS7DEBUGmdm.exe
c:windowssystem32nvsvc32.exe
c:windowssystem32rundll32.exe
c:program filesPC Connectivity SolutionServiceLayer.exe
c:program filesCommon FilesNokiaMPAPIMPAPI3s.exe
c:program filesPC Connectivity SolutionTransportsNclUSBSrv.exe
c:program filesPC Connectivity SolutionTransportsNclIrSrv.exe
c:program filesPC Connectivity SolutionTransportsNclRSSrv.exe
.
**************************************************************************
.
Completion time: 2009-10-12 17:26 — machine was rebooted
ComboFix-quarantined-files.txt 2009-10-12 14:26

Pre-Run: 10 079 354 880 байт свободно
Post-Run: 11 501 879 296 байт свободно

289 — E O F — 2009-10-09 22:19

[Автор]

Сообщения