Созданные ответы форума
-
Сообщения
-
Здравствуйте и спасибо огромное!!! Обновления пошли.
Вот лог с Combofix. А вот с RootkitRevealer получается проблема. При запуске программы она выкидывает меня с рабочего стола куда-то на серый экран, где и проводит сканирование, поминутно выходя из системы на экран выбора пользователя. По окончании сканирования прога просто выключилась, не дав сохранить лог 🙁[attachment=0:1gwijgq4]ComboFix.txt[/attachment:1gwijgq4]
Здравствуйте. Вот сделал, что нужно…
ComboFix 09-04-25.A3 — TOSH! 26.04.2009 9:25.1 — NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1251.7.1049.18.3071.2145 [GMT 11:00]
Running from: c:downloadsПрограммыComboFix.exe
AV: ESET Smart Security 3.0 *On-access scanning enabled* (Updated)
FW: Персональный файервол ESET *enabled*
* Created a new restore point
* Resident AV is active.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.c:windowssystem32gaopdxcounter
.
((((((((((((((((((((((((( Files Created from 2009-05-25 to 2009-4-25 )))))))))))))))))))))))))))))))
.2009-04-25 07:57 . 2009-04-25 07:57
d
w c:usersTOSH!AppDataRoaming2K Sports
2009-04-25 07:54 . 2008-10-09 17:52 452440 —-a-w c:windowssystem32d3dx10_40.dll
2009-04-25 07:54 . 2008-10-09 17:52 4379984 —-a-w c:windowssystem32D3DX9_40.dll
2009-04-25 07:54 . 2008-10-09 17:52 2036576 —-a-w c:windowssystem32D3DCompiler_40.dll
2009-04-25 07:54 . 2008-10-26 23:04 514384 —-a-w c:windowssystem32XAudio2_3.dll
2009-04-25 07:54 . 2008-10-26 23:04 235856 —-a-w c:windowssystem32xactengine3_3.dll
2009-04-25 07:54 . 2008-10-26 23:04 23376 —-a-w c:windowssystem32X3DAudio1_5.dll
2009-04-25 07:54 . 2008-10-26 23:04 70992 —-a-w c:windowssystem32XAPOFX1_2.dll
2009-04-25 06:11 . 2009-04-25 06:11
d
w c:usersAll UsersUbisoft
2009-04-25 06:11 . 2009-04-25 06:11
d
w c:programdataUbisoft
2009-04-25 04:47 . 2009-04-25 04:47
d
w c:program filesKALiNKOsoft
2009-04-25 04:35 . 2009-04-25 04:35
d
w c:usersTOSH!AppDataRoamingKALiNKOsoft
2009-04-25 03:31 . 2009-04-25 03:31
d
w c:usersAll UsersSaitek
2009-04-25 03:31 . 2009-04-25 03:31
d
w c:programdataSaitek
2009-04-21 19:09 . 2009-04-21 19:09 316816 —-a-w c:windowssystem32appdrvrem01.exe
2009-04-21 19:09 . 2009-04-21 19:09 3110512 —-a-w c:windowssystem32driversappdrv01.sys
2009-04-21 08:10 . 2009-04-21 12:50
d
w c:usersTOSH!AppDataLocalWheelman
2009-04-21 08:10 . 2009-04-21 08:10
d
w c:usersTOSH!AppDataLocalPC
2009-04-20 07:44 . 2009-04-20 07:44
d
w C:rsit
2009-04-20 07:44 . 2009-04-20 07:44
d
w c:program filestrend micro
2009-04-19 19:28 . 2009-03-09 19:06 15688 —-a-w c:windowssystem32lsdelete.exe
2009-04-19 19:22 . 2009-03-09 19:06 64160 —-a-w c:windowssystem32driversLbd.sys
2009-04-19 19:21 . 2009-04-19 19:21
dc-h—w c:usersAll Users{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-04-19 19:21 . 2009-04-19 19:21
dc-h—w c:programdata{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-04-19 19:21 . 2009-04-19 19:22
d
w c:usersAll UsersLavasoft
2009-04-19 19:21 . 2009-04-19 19:22
d
w c:programdataLavasoft
2009-04-19 19:21 . 2009-04-19 19:21
d
w c:program filesLavasoft
2009-04-19 08:37 . 2009-04-19 08:37
d
w c:usersTOSH!DoctorWeb
2009-04-18 11:06 . 2009-04-25 22:15
d
w c:program filesSteam
2009-04-18 01:27 . 2009-04-18 01:27
d
w C:VundoFix Backups
2009-04-18 01:17 . 2009-04-18 01:17
d
w c:windowsSun
2009-04-17 23:39 . 2009-04-17 23:39 410984 —-a-w c:windowssystem32deploytk.dll
2009-04-17 23:38 . 2009-04-17 23:38
d
w c:program filesJava
2009-04-16 09:43 . 2009-04-16 09:43 199 —-a-w C:DARE.INI
2009-04-16 09:43 . 2009-04-16 09:43
d
w c:usersTOSH!AppDataLocalUbisoft
2009-04-12 00:44 . 2009-04-12 00:44
d
w c:program filesMicrosoft Windows OneCare Live
2009-04-11 01:16 . 2009-04-11 01:18
d
w c:program filesABBYY FineReader 8.0 Professional Edition
2009-04-11 01:14 . 2005-08-25 09:38 65536 —-a-w c:tempautorun.exe
2009-04-11 01:14 . 2005-08-25 09:38 344064 —-a-w c:tempsetup.exe
2009-04-11 01:14 . 2003-04-21 04:09 245408 —-a-w c:tempunicows.dll
2009-04-11 01:14 . 2002-03-11 01:06 1822520 —-a-w c:tempinstmsiW.exe
2009-04-11 01:14 . 2005-10-27 06:56
d
w c:tempReadMe
2009-04-11 01:13 . 2009-04-12 03:42
d
w c:tempCrack
2009-04-11 01:13 . 2005-10-27 06:56
d
w c:tempFineReader 8.0
2009-04-09 09:00 . 2009-04-09 09:11
d
w c:usersTOSH!AppDataRoamingAveDesk
2009-04-07 09:01 . 2009-04-07 09:01
d
w c:program filesCommon FilesStardock
2009-04-07 08:07 . 2009-04-07 08:07
d
w c:program filesStardock
2009-04-06 08:52 . 2008-03-31 00:59 3034624 —-a-w c:windowssystem32The Lost Watch 3D Screensaver.exe
2009-04-06 08:52 . 2008-03-28 07:40 855552 —-a-w c:windowssystem32The_Lost_Watch_3D_Screensaver.scr
2009-04-06 08:52 . 2009-04-06 08:52
d
w c:program filesThe Lost Watch 3D Screensaver
2009-04-06 08:44 . 2008-03-31 01:02 11068928 —-a-w c:windowssystem32Coral Clock 3D Screensaver.exe
2009-04-06 08:44 . 2009-04-06 08:44
d
w c:program filesCoral Clock 3D Screensaver
2009-04-06 08:44 . 2008-03-28 07:44 843776 —-a-w c:windowssystem32Coral_Clock_3D_Screensaver.scr
2009-04-06 08:30 . 2009-04-06 08:31
d
w c:program filesFireplace 3D Screensaver
2009-04-06 08:12 . 2009-04-07 07:56
d
w c:usersTOSH!AppDataLocalStardock
2009-04-04 06:21 . 2009-04-04 06:21
d
w c:program filesTunatic
2009-04-03 09:37 . 2009-01-14 22:19 453152 —-a-w c:windowssystem32nvuninst.exe
2009-04-03 09:29 . 2007-08-27 14:59 307200 —-a-w c:windowssystem32nvexpbar.dll
2009-04-03 09:27 . 2009-04-03 09:27
d
w c:program filesMicrosoft
2009-04-03 09:26 . 2009-04-03 09:26
d
w c:program filesWindows Live SkyDrive
2009-04-03 09:26 . 2009-04-03 09:27
d
w c:program filesWindows Live
2009-04-03 09:26 . 2009-04-03 09:26
d
w c:program filesMicrosoft SQL Server Compact Edition
2009-04-03 08:47 . 2009-04-03 08:47
d
w c:program filesCommon FilesWindows Live.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-25 22:23 . 2008-07-01 06:02
d
w c:programdataBitmeter2
2009-04-25 22:15 . 2009-04-25 04:31 119296 —-a-w c:windowsSystem32zlib.dll
2009-04-25 22:14 . 2009-04-19 21:22 4925 —-a-w C:aaw7boot.log
2009-04-25 07:50 . 2008-05-22 05:48
d
w c:programdataMicrosoft Help
2009-04-25 06:30 . 2008-05-30 09:56
d
w c:usersTOSH!AppDataRoamingXnView
2009-04-25 06:02 . 2008-05-17 23:58
d—h—w c:program filesInstallShield Installation Information
2009-04-25 03:39 . 2008-10-27 12:34
d
w c:usersTOSH!AppDataRoamingAIMP
2009-04-25 03:32 . 2006-11-02 10:25 51200 —-a-w c:windowsInfinfpub.dat
2009-04-25 03:32 . 2006-11-02 10:25 143360 —-a-w c:windowsInfinfstrng.dat
2009-04-25 03:32 . 2006-11-02 10:25 86016 —-a-w c:windowsInfinfstor.dat
2009-04-24 07:09 . 2009-04-24 07:03 1716 —-a-w C:avenger.txt
2009-04-22 11:44 . 2008-07-11 03:47
d
w c:program filesSpeedFan
2009-04-22 08:46 . 2006-11-09 07:21 656154 —-a-w c:windowsSystem32perfh019.dat
2009-04-22 08:46 . 2006-11-09 07:21 126450 —-a-w c:windowsSystem32perfc019.dat
2009-04-21 09:46 . 2009-03-15 12:59
d
w c:usersTOSH!AppDataRoamingSkype
2009-04-19 13:00 . 2009-03-23 09:11
d
w c:usersTOSH!AppDataRoamingAny Video Converter
2009-04-18 11:24 . 2008-05-26 11:02
d
w c:programdataMedia Center Programs
2009-04-18 11:08 . 2008-07-24 04:43
d
w c:program filesCommon FilesSteam
2009-04-18 11:06 . 2009-01-28 10:01
d
w c:program filesMicrosoft Games for Windows — LIVE
2009-04-18 01:40 . 2009-04-18 01:27 135 —-a-w C:VundoFix.txt
2009-04-16 20:43 . 2009-03-17 11:13
d
w c:usersTOSH!AppDataRoaminguTorrent
2009-04-12 02:03 . 2009-03-22 02:43
d
w c:program filesWindows Live Safety Center
2009-04-10 07:49 . 2008-06-11 06:06
d
w c:usersTOSH!AppDataRoamingMra
2009-04-09 05:18 . 2008-07-27 04:01
d
w c:program filesBonjour
2009-04-03 09:53 . 2008-05-16 05:52
d
w c:programdataNVIDIA
2009-04-03 09:48 . 2008-11-13 03:32
d
w c:program filesCommon FilesWise Installation Wizard
2009-04-03 09:48 . 2008-11-13 03:32
d
w c:program filesAGEIA Technologies
2009-04-03 09:39 . 2008-05-16 05:45 1356 —-a-w c:usersTOSH!AppDataLocald3d9caps.dat
2009-03-28 22:23 . 2009-01-17 03:15
d
w c:usersTOSH!AppDataRoamingNokia
2009-03-28 22:03 . 2009-01-17 03:13
d
w c:program filesCommon FilesNokia
2009-03-28 22:03 . 2009-01-17 02:59
d
w c:program filesNokia
2009-03-28 22:02 . 2009-01-17 03:25
d
w c:programdataInstallations
2009-03-23 09:12 . 2009-03-23 09:11
d
w c:program filesAny Video Converter
2009-03-23 09:11 . 2009-03-15 10:40
d
w c:program filesXilisoft
2009-03-22 12:56 . 2008-06-15 10:25
d
w c:program filesICQ6
2009-03-22 08:10 . 2008-05-23 21:45
d
w c:program filesDownload Master
2009-03-22 06:37 . 2006-11-02 11:18
d
w c:program filesWindows Mail
2009-03-17 11:13 . 2009-03-17 11:13
d
w c:program filesuTorrent
2009-03-15 21:00 . 2008-06-09 02:22
d—a-w c:programdataTEMP
2009-03-15 12:59 . 2009-03-15 12:59
d
r c:program filesSkype
2009-03-15 12:59 . 2008-07-01 06:09
d
w c:programdataSkype
2009-03-15 12:51 . 2008-07-01 06:12
d
w c:usersTOSH!AppDataRoamingskypePM
2009-03-15 10:42 . 2009-03-15 10:42
d
w c:usersTOSH!AppDataRoamingdvdcss
2009-03-14 02:08 . 2008-05-22 06:42
d
w c:program filesOpera
2009-03-09 12:01 . 2009-03-09 12:01
d
w c:program filesVistaCodecPack
2009-03-09 12:01 . 2009-03-09 12:01
d
w c:programdataVistaCodecs
2009-03-08 10:50 . 2008-05-17 23:58
d
w c:program filesCyberLink
2009-03-08 10:49 . 2008-05-18 00:02
d
w c:usersTOSH!AppDataRoamingCyberLink
2009-03-08 10:49 . 2008-05-18 00:00
d
w c:programdataCyberLink
2009-03-08 08:53 . 2009-03-08 08:53
d
w c:programdataInterVideo
2009-03-08 08:53 . 2009-03-08 08:52
d
w c:program filesCommon FilesUlead Systems
2009-03-08 08:52 . 2009-03-08 08:50
d
w c:program filesCorel
2009-03-08 08:52 . 2009-03-05 12:13
d
w c:programdataUlead Systems
2009-03-08 08:49 . 2008-05-26 10:43
d
w c:program filesCCleaner
2009-03-08 04:58 . 2008-07-24 01:00
d
w c:usersTOSH!AppDataRoamingAuslogics
2009-03-08 04:33 . 2008-07-24 01:00
d
w c:program filesAuslogics
2009-03-06 02:55 . 2009-03-05 12:15
d
w c:usersTOSH!AppDataRoamingUlead Systems
2009-03-05 12:40 . 2009-03-05 12:40
d
w c:program filesCommon FilesCyberLink
2009-03-05 12:39 . 2008-05-17 23:59 29480 —-a-w c:windowsSystem32msxml3a.dll
2009-03-05 12:36 . 2008-05-16 05:45 89656 —-a-w c:usersTOSH!AppDataLocalGDIPFONTCACHEV1.DAT
2009-03-05 12:34 . 2009-03-05 11:56
d
w c:usersTOSH!AppDataRoaminggtk-2.0
2009-03-05 12:14 . 2009-03-05 12:14
d
w c:program filesWindows Media Components
2009-03-05 11:54 . 2009-03-05 11:54
d
w c:usersTOSH!AppDataRoamingavidemux
2009-02-26 08:21 . 2008-05-22 19:36
d
w c:program filesMicrosoft Silverlight
2009-02-25 03:35 . 2009-02-25 03:34
d
w c:programdata{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-02-25 03:35 . 2009-02-25 03:34
d
w c:program filesiTunes
2009-02-25 03:34 . 2009-02-25 03:34
d
w c:program filesiPod
2009-02-25 03:34 . 2008-06-23 07:32
d
w c:program filesCommon FilesApple
2009-02-25 03:34 . 2009-02-25 03:33
d
w c:program filesQuickTime
2009-02-25 03:33 . 2008-06-23 07:33
d
w c:programdataApple Computer
2009-02-09 03:10 . 2009-03-22 06:19 2033152 —-a-w c:windowsSystem32win32k.sys
2009-02-06 08:29 . 2009-02-06 08:29 308104 —-a-w c:windowsWLXPGSS.SCR
2008-05-17 03:13 . 2006-11-02 12:50 174 —sha-w c:program filesdesktop.ini
.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«EPSON Stylus CX3900 Series»=»c:windowssystem32spoolDRIVERSW32X863E_FATIBEP.EXE» [2006-09-20 139264]
«ehTray.exe»=»c:windowsehomeehTray.exe» [2008-01-18 125952]
«AutoPowerOn»=»c:program filesAutoPowerOnAutoPowerOn.exe» [2007-03-04 2786816]
«PC Suite Tray»=»c:program filesNokiaNokia PC Suite 7PCSuite.exe» [2008-12-03 1205760]
«Steam»=»c:program filesSteamSteam.exe» [2009-04-18 1410296][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«egui»=»c:program filesESETESET Smart Securityegui.exe» [2008-03-13 1443072]
«snp2std»=»c:windowsvsnp2std.exe» [2006-12-04 675840]
«googletalk»=»c:program filesGoogleGoogle Talkgoogletalk.exe» [2007-01-01 3739648]
«WheelMouse»=»c:program filesA4TechMouseAmoumain.exe» [2007-05-15 204800]
«UVS12 Preload»=»c:program filesCorelCorel VideoStudio 12uvPL.exe» [2008-06-09 397456]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2009-02-09 13683232]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2009-02-09 92704]
«MAgent»=»c:program filesMail.RuAgentmagent.exe» [2009-04-10 6210744]
«SunJavaUpdateSched»=»c:program filesJavajre6binjusched.exe» [2009-04-17 148888]
«Ad-Watch»=»c:program filesLavasoftAd-AwareAAWTray.exe» [2009-03-09 515416]c:usersTOSH!AppDataRoamingMicrosoftWindowsStart MenuProgramsStartup
Stardock ObjectDock.lnk — c:program filesStardockObjectDockObjectDock.exe [2009-4-7 3581680]
‘®¤Ґа¦ ЁҐ OneNote.onetoc2 [2008-5-26 3656]c:programdataMicrosoftWindowsStart MenuProgramsStartup
Bitmeter2.lnk — c:program filesCodeboxBitMeterBitMeter2.exe [2008-5-8 1458176][HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]
«EnableLUA»= 0 (0x0)
«EnableUIADesktopToggle»= 0 (0x0)[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalLavasoft Ad-Aware Service]
@=»Service»[HKLM~startupfolderC:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Nokia Ovi Suite.lnk]
path=c:programdataMicrosoftWindowsStart MenuProgramsNokiaNokia Ovi Suite.lnk
backup=c:windowspssNokia Ovi Suite.lnk.CommonStartup
backupExtension=.CommonStartup[HKLM~startupfolderC:^Users^TOSH!^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Вырезка экрана и программа запуска для OneNote 2007.lnk]
backup=c:windowspssВырезка экрана и программа запуска для OneNote 2007.lnk.Startup
backupExtension=.Startup
HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregLanguageShortcut
HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNokiaMServer
HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregRemoteControl
HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregRGSC[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerSvcS-1-5-21-3304611937-2532547366-3295552813-1000]
«EnableNotificationsRef»=dword:00000002[HKLM~servicessharedaccessparametersfirewallpolicyFirewallRules]
«{D86C6617-790F-47DF-BDA5-26511176397B}»= UDP:c:windowsSystem32trafinspag.exe:trafinspag.exe
«{1235559C-D9A8-416A-A628-E4DEB1DC9993}»= TCP:c:windowsSystem32trafinspag.exe:trafinspag.exe
«{5B377EE2-0559-42DD-97D7-18C95C5E944F}»= TCP:6004|c:program filesMicrosoft OfficeOffice12outlook.exe:Microsoft Office Outlook
«{9ACEB5B5-695F-48C6-AAF7-5365138AA576}»= UDP:c:program filesMicrosoft OfficeOffice12ONENOTE.EXE:Microsoft Office OneNote
«{01648D3B-9DCE-4ECA-9888-388E8401CC36}»= TCP:c:program filesMicrosoft OfficeOffice12ONENOTE.EXE:Microsoft Office OneNote
«{CABEB9C8-9275-4B54-BD66-216C6F417008}»= UDP:c:gamesCodemastersGRIDGRID.exe:GRID
«{91A03E45-A284-4DAB-8246-4CDF4EC092C4}»= TCP:c:gamesCodemastersGRIDGRID.exe:GRID
«{5017074F-6C6F-4A2B-A2D6-C70CA5B4D081}»= UDP:c:program filesiTunesiTunes.exe:iTunes
«{E9F21B55-D863-4241-9E4F-33AFC4DC25E1}»= TCP:c:program filesiTunesiTunes.exe:iTunes
«{82B638BA-F28F-4070-88DB-3CE0DAE540AA}»= UDP:c:program filesGoogleGoogle Talkgoogletalk.exe:Google Talk
«{3BF05882-722E-4AE9-B0E7-D0241998A4C1}»= TCP:c:program filesGoogleGoogle Talkgoogletalk.exe:Google Talk
«{44DA6333-A763-4596-9050-B67C8E7F85B2}»= UDP:990:LocalSubnet:LocalSubnet|IF={34B6824B-491B-4674-AE0A-CAB252F0770E}|%SystemRoot%system32svchost.exe|Svc=rapimgr:@%systemroot%WindowsMobilewmdSync.exe,-4001
«{A4E22374-D892-4A9F-8A3F-5CD72C66BD65}»= UDP:c:program filesiTunesiTunes.exe:iTunes
«{406086A9-95FE-4B76-8676-3283EA25DDC3}»= TCP:c:program filesiTunesiTunes.exe:iTunes
«{C2C93764-275C-41A7-9B67-1B5993E8CE7A}»= c:program filesCyberLinkPowerDVD8PowerDVD8.EXE:CyberLink PowerDVD 8.0
«{C181DF5A-4374-44A9-BEFB-ED9673C744CD}»= UDP:c:gamesEA GamesMirror’s EdgeBinariesMirrorsEdge.exe:Mirror’s Edge™
«{CC6EA890-7217-4401-B8E6-368ABA8D7F56}»= TCP:c:gamesEA GamesMirror’s EdgeBinariesMirrorsEdge.exe:Mirror’s Edge™
«{25A4ABD8-F584-491F-967E-BBD6EC655861}»= c:program filesSkypePhoneSkype.exe:Skype
«{4BEA4D01-B9FE-4268-BF47-EA2DE7569C10}»= UDP:c:program filesuTorrentuTorrent.exe:µTorrent (TCP-In)
«{ABBBCF89-2FF7-468B-99AE-B7AABA90886C}»= TCP:c:program filesuTorrentuTorrent.exe:µTorrent (UDP-In)
«{03F683BA-D73B-4159-B43D-9165482A9B5E}»= c:program filesWindows LiveSyncWindowsLiveSync.exe:Windows Live Sync
«{750DEF01-F791-453B-B3E9-9DBF6ED05EFE}»= UDP:c:program filesuTorrentuTorrent.exe:µTorrent
«{F746D5A5-2FF1-4424-A7A9-C9050F7F8069}»= TCP:c:program filesuTorrentuTorrent.exe:µTorrent
«{7BBCEB66-C07B-42BD-9A1A-5CCF844FE83A}»= UDP:c:program filesSkypePhoneSkype.exe:Skype
«{18E59B87-8644-4AD2-B60C-42FA343EF11A}»= TCP:c:program filesSkypePhoneSkype.exe:Skype
«{5D9AC09A-E0C0-4264-B7FB-4077E0E012AE}»= UDP:c:program filesBonjourmDNSResponder.exe:Bonjour
«{CFC76CA8-D516-4FA1-9B57-AECD9B836675}»= TCP:c:program filesBonjourmDNSResponder.exe:Bonjour
«{B75C9B2B-232E-49C9-A695-C76590BC7034}»= UDP:c:gamesUbisoftShaun White SnowboardingShaunWhiteSnowboardingGame.exe:Shaun White Snowboarding
«{5749BC73-F5D1-4274-9918-0D41ED53BAF9}»= TCP:c:gamesUbisoftShaun White SnowboardingShaunWhiteSnowboardingGame.exe:Shaun White Snowboarding[HKLM~servicessharedaccessparametersfirewallpolicyPublicProfile]
«EnableFirewall»= 0 (0x0)R2 appdrvrem01;Application Driver Auto Removal Service (01); [x]
R2 gupdate1c991a6cf4c27d3;Служба Google Update (gupdate1c991a6cf4c27d3);c:program filesGoogleUpdateGoogleUpdate.exe [2009-02-18 133104]
R3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:program filesLavasoftAd-AwareAAWService.exe [2009-03-09 951632]
R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:windowssystem32driversnmwcdnsu.sys [2008-02-01 138112]
R3 nmwcdnsuc;Nokia USB Flashing Generic;c:windowssystem32driversnmwcdnsuc.sys [2008-02-01 8320]
R3 s716bus;Sony Ericsson Device 716 driver (WDM);c:windowssystem32DRIVERSs716bus.sys [2007-04-04 83208]
R3 s716mdfl;Sony Ericsson Device 716 USB WMC Modem Filter;c:windowssystem32DRIVERSs716mdfl.sys [2007-04-04 15112]
R3 s716mdm;Sony Ericsson Device 716 USB WMC Modem Driver;c:windowssystem32DRIVERSs716mdm.sys [2007-04-04 108552]
R3 s716mgmt;Sony Ericsson Device 716 USB WMC Device Management Drivers (WDM);c:windowssystem32DRIVERSs716mgmt.sys [2007-04-04 100360]
R3 s716nd5;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (NDIS);c:windowssystem32DRIVERSs716nd5.sys [2007-04-04 23176]
R3 s716obex;Sony Ericsson Device 716 USB WMC OBEX Interface;c:windowssystem32DRIVERSs716obex.sys [2007-04-04 98568]
R3 s716unic;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (WDM);c:windowssystem32DRIVERSs716unic.sys [2007-04-04 98952]
R3 SaiH040C;SaiH040C;c:windowssystem32DRIVERSSaiH040C.sys [2007-05-01 132232]
R3 SaiU040C;SaiU040C;c:windowssystem32DRIVERSSaiU040C.sys [2007-05-01 28416]
S0 Lbd;Lbd;c:windowssystem32DRIVERSLbd.sys [2009-03-09 64160]
S1 appdrv01;Application Driver (01);c:windowssystem32Driversappdrv01.sys [2009-04-21 3110512]
S2 ekrn;Eset Service;c:program filesESETESET Smart Securityekrn.exe [2008-03-13 472320]
S3 EthDriver;D-Link DGE-528T Vista 32-bit Driver;c:windowssystem32DRIVERSDLKRT32.sys [2007-01-24 70144][HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionsvchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{0abe1362-7967-11dd-a601-001b115998dd}]
shellAutoRuncommand — c:windowssystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycledautorun.exe
shellOpencommand — Recycledautorun.exe[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{7f1a04d9-2342-11dd-ad9c-806e6f6e6963}]
shellAutoRuncommand — E:Autorun.exe[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{d6a6f2f0-9055-11dd-8416-001b115998dd}]
shellAutoRuncommand — c:windowssystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycledautorun.exe
shellOpencommand — Recycledautorun.exe
.
Contents of the ‘Scheduled Tasks’ folder2009-04-19 c:windowsTasksAd-Aware Update (Weekly).job
— c:program filesLavasoftAd-AwareAd-AwareAdmin.exe [2009-03-09 19:06]2009-04-25 c:windowsTasksGoogleUpdateTaskMachine.job
— c:program filesGoogleUpdateGoogleUpdate.exe [2009-02-18 08:56]2009-04-25 c:windowsTasksGoogleUpdateTaskUserS-1-5-21-3304611937-2532547366-3295552813-1000.job
— c:usersTOSH!AppDataLocalGoogleUpdateGoogleUpdate.exe [2009-01-30 09:53]
.
— — — — ORPHANS REMOVED — — — —SSODL-okmdepgb-{499B1A17-2876-4C6B-980C-AA507428E8FA} — (no file)
.
Supplementary Scan
.
uStart Page = about:blank
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
IE: Закачать ВСЕ при помощи Download Master — c:program filesDownload Masterdmieall.htm
IE: Закачать при помощи Download Master — c:program filesDownload Masterdmie.htm
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:program filesMail.RuAgentmagent.exe
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe
Handler: solores — {8FA1F4E9-444B-48BF-98CD-B8ECA88E6BA5} — c:progra~1Solo9SoloRes.dll
.**************************************************************************
catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-26 09:28
Windows 6.0.6001 Service Pack 1 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
c:usersTOSH!AppDataLocalTempcatchme.dll 53248 bytes executable
scan completed successfully
hidden files: 1**************************************************************************
.
LOCKED REGISTRY KEYS
[HKEY_LOCAL_MACHINESystemControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0000AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
«BlindDial»=dword:00000000[HKEY_LOCAL_MACHINESystemControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0001AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
«BlindDial»=dword:00000000[HKEY_LOCAL_MACHINESystemControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0002AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
«BlindDial»=dword:00000000
.
Completion time: 2009-04-25 9:30
ComboFix-quarantined-files.txt 2009-04-25 22:30Pre-Run: 10 085 474 304 байт свободно
Post-Run: 10 098 806 784 байт свободно315 — E O F — 2009-04-03 09:29
Здравствуйте и спасибо, что взялись решать мою проблему. Вот лог, хотя, как я понял, никаких руткитов не найдено…
Может быть есть еще идеи?Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.comPlatform: Windows Vista
*******************
Script file opened successfully.
Script file read successfully.Backups directory opened successfully at C:Avenger
*******************
Beginning to process script file:
Rootkit scan active.
No rootkits found!Completed script processing.
*******************
Finished! Terminate.
