Созданные ответы форума
-
Сообщения
-
Большой мерси, Валерий. Кажется все в норме, но судя по вопросу еще должны быть отклонения?
Огромное спасибо за помощь! Вот что получилось:
ComboFix 09-02-15.01 — Юрий 2009-02-17 0:28:36.7 — NTFSx86
Running from: c:documents and settingsЮрийРабочий столComboFix.exe
Command switches used :: c:documents and settingsЮрийРабочий столCFScript.txt
* Created a new restore pointWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
c:systemSecurityDriveGuard.exe
c:windowssystem32WinSecSys.exe
e:systemSecurityDriveGuard.exe
.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.c:windowssystem32WinSecSys.exe
.
((((((((((((((((((((((((( Files Created from 2009-01-16 to 2009-02-16 )))))))))))))))))))))))))))))))
.2009-02-17 00:26 . 2009-02-17 00:26
d
c:windowssystem32CatRoot_bak
2009-02-17 00:16 . 2009-02-17 00:18d
c:windowsLastGood
2009-02-12 01:28 . 2009-02-12 01:28d
c:documents and settingsЮрийApplication DataMedia Player Classic
2009-02-12 01:27 . 2008-11-06 19:37 3,596,288 —a
c:windowssystem32qt-dx331.dll
2009-02-12 01:27 . 2008-12-29 01:48 2,330,643 —a
c:windowssystem32x264vfw.dll
2009-02-12 01:27 . 2008-09-24 21:41 839,680 —a
c:windowssystem32lameACM.acm
2009-02-12 01:27 . 2008-12-07 21:08 795,648 —a
c:windowssystem32xvidcore.dll
2009-02-12 01:27 . 2008-11-06 19:33 684,032 —a
c:windowssystem32divx.dll
2009-02-12 01:27 . 2006-04-02 15:47 630,784 —a
c:windowssystem32vp7vfw.dll
2009-02-12 01:27 . 2004-12-10 11:03 438,272 —a
c:windowssystem32vp6vfw.dll
2009-02-12 01:27 . 2004-01-25 19:18 217,088 —a
c:windowssystem32yv12vfw.dll
2009-02-12 01:27 . 2008-09-16 22:23 168,448 —a
c:windowssystem32unrar.dll
2009-02-12 01:27 . 2008-12-07 21:08 130,048 —a
c:windowssystem32xvidvfw.dll
2009-02-12 01:27 . 2008-12-11 03:33 86,016 —a
c:windowssystem32dpl100.dll
2009-02-12 01:27 . 2008-10-03 15:30 414 —a
c:windowssystem32lame_acm.xml
2009-02-12 01:26 . 2009-02-12 01:27d
c:program filesK-Lite Codec Pack
2009-02-12 01:26 . 2008-12-08 14:53 57,344 —a
c:windowssystem32ff_vfw.dll
2009-02-12 01:26 . 2007-07-10 19:10 547 —a
c:windowssystem32ff_vfw.dll.manifest
2009-02-12 01:08 . 2007-09-21 03:52 118,784 —a
c:windowssystem32ac3acm.acm
2009-02-12 00:29 . 2009-02-12 00:31d
c:program filesCoreAVC_1.3
2009-02-10 00:48 . 2009-02-10 00:48 322,560 —a
c:documents and settingsAll UsersApplication Datamzdlib.dll
2009-02-09 23:27 . 2009-02-09 23:27d
c:documents and settingsЮрийApplication Datadvdcss
2009-02-09 23:26 . 2009-02-09 23:26d
c:program filesVideoLAN
2009-02-01 23:10 . 2009-02-01 23:10d
c:documents and settingsЮрийApplication DataPegasys Inc
2009-01-31 23:01 . 2009-02-05 23:42d
C:divx
2009-01-31 21:47 . 2008-11-06 19:37 129,784
c:windowssystem32pxafs.dll
2009-01-31 21:47 . 2008-11-06 19:37 9,464
c:windowssystem32driverscdralw2k.sys
2009-01-31 21:47 . 2008-11-06 19:37 9,336
c:windowssystem32driverscdr4_xp.sys
2009-01-31 21:44 . 2009-02-09 23:31d
c:program filesDivX
2009-01-31 21:44 . 2009-01-31 21:57d
c:documents and settingsЮрийApplication DataDr. DivX 2.0 OSS
2009-01-31 21:33 . 2009-01-31 21:33dra-s—- c:program filesFlashGuard
2009-01-19 20:02 . 2008-07-26 18:26 4,658,584 —a
c:windowssystem32driverslvuvc.sys
2009-01-19 20:02 . 2008-07-26 18:25 627,864 —a
c:windowssystem32driverslvrs.sys
2009-01-19 20:02 . 2008-07-26 18:26 490,008 —a
c:windowssystem32LVUI2.dll
2009-01-19 20:02 . 2008-07-26 18:26 465,432 —a
c:windowssystem32LVUI2RC.dll
2009-01-19 20:02 . 2008-07-26 18:23 416,280 —a
c:windowssystem32lvcodec2.dll
2009-01-19 20:02 . 2008-07-26 18:23 195,096 —a
c:windowssystem32lvci11801048.dll
2009-01-19 20:02 . 2008-07-26 17:42 66,482 —a
c:windowssystem32lvcoinst.ini
2009-01-19 20:02 . 2008-07-26 18:26 41,752 —a
c:windowssystem32driversLVUSBSta.sys
2009-01-19 20:02 . 2008-07-26 17:46 25,974 —a
c:windowssystem32Repository.reg
2009-01-19 20:02 . 2008-07-26 18:26 23,832 —a
c:windowssystem32driverslvuvcflt.sys
2009-01-19 20:01 . 2009-01-19 20:01d
c:program filesLogitech
2009-01-19 00:10 . 2004-08-03 23:10 78,464 —a
c:windowssystem32driversusbvideo.sys
2009-01-19 00:10 . 2004-08-03 23:10 78,464 —a
c:windowssystem32dllcacheusbvideo.sys.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-15 17:24
d
w c:documents and settingsЮрийApplication DataSkype
2009-02-15 16:47
d
w c:documents and settingsЮрийApplication DataskypePM
2009-02-15 09:34
d
w c:documents and settingsЮрийApplication DatauTorrent
2009-02-14 18:58 0 —-a-w c:windowssystem32driverslvuvc.hs
2009-02-14 18:58 0 —-a-w c:windowssystem32driverslogiflt.iad
2009-02-11 21:39
d
w c:documents and settingsЮрийApplication DataDivX
2009-01-19 22:48
d
w c:program filesGoogle
2009-01-19 17:03
d
w c:program filesCommon FilesLogiShrd
2009-01-19 17:01
d
w c:documents and settingsAll UsersApplication DataLogishrd
2009-01-18 21:37
d
w c:program filesNokia
2009-01-15 18:08
d
w c:documents and settingsAll UsersApplication DataLogitech
2009-01-12 08:17
d
w c:documents and settingsЮрийApplication DataNokia
2008-12-26 22:53
d
w c:program filesMarriage
2008-12-25 22:38
d
w c:program filesuTorrent
2008-12-24 22:22
d
w c:program fileseMule
2008-12-17 21:47
d
w c:program filesAlawar.ru
2008-12-17 21:47
d
w c:documents and settingsAll UsersApplication DataEgoset
2008-12-17 21:47
d
w c:documents and settingsAll UsersApplication DataAlawarWrapper
2008-12-09 02:28 593,920 —-a-w c:windowssystem32dpuGUI11.dll
2008-12-09 02:28 57,344 —-a-w c:windowssystem32dpv11.dll
2008-12-09 02:28 344,064 —-a-w c:windowssystem32dpus11.dll
2008-12-09 02:28 294,912 —-a-w c:windowssystem32dpu11.dll
2008-11-21 21:47 120,056
w c:windowssystem32pxcpyi64.exe
2008-11-21 21:47 118,520
w c:windowssystem32pxinsi64.exe
2006-11-29 14:54 20,016 —-a-w c:documents and settingsЮрийApplication DataGDIPFONTCACHEV1.DAT
.((((((((((((((((((((((((((((( SnapShot@2009-02-10_ 1.01.55,39 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-04-16 18:45:36 203,096 —-a-w c:windowsLastGoodsystem32wuweb.dll
— 2007-04-16 18:45:36 203,096 —-a-w c:windowssystem32dllcachewuweb.dll
+ 2008-10-16 11:13:40 202,776 —-a-w c:windowssystem32dllcachewuweb.dll
— 2007-04-16 18:45:36 203,096 —-a-w c:windowssystem32wuweb.dll
+ 2008-10-16 11:13:40 202,776 —-a-w c:windowssystem32wuweb.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2004-08-18 15360]
«H/PC Connection Agent»=»c:program filesMicrosoft ActiveSyncwcescomm.exe» [2006-06-27 1211176]
«Skype»=»c:program filesSkypePhoneSkype.exe» [2008-06-04 21718312]
«NBJ»=»c:program filesAheadNero BackItUpNBJ.exe» [2006-09-15 2048000]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2003-11-12 207872]
«swg»=»c:program filesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe» [2008-04-19 68856][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«TPKMAPHELPER»=»c:program filesThinkPadUtilitiesTpKmapAp.exe» [2004-02-04 897024]
«TPHOTKEY»=»c:progra~1ThinkPadPkgMgrHOTKEYTPHKMGR.exe» [2005-03-03 94208]
«ControlCenter»=»c:program filesIBM fingerprint softwarectlcntr.exe» [2004-11-04 284766]
«EZEJMNAP»=»c:progra~1ThinkPadUTILIT~1EzEjMnAp.Exe» [2004-11-24 212992]
«UC_Start»=»c:program filesIBMUpdater\ucstartup.exe» [2004-07-14 36864]
«PWRMGRTR»=»c:progra~1ThinkPadUTILIT~1PWRMGRTR.DLL» [2006-05-26 151552]
«BLOG»=»c:progra~1ThinkPadUTILIT~1BatLogEx.DLL» [2006-05-26 208896]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2006-01-12 155648]
«IgfxTray»=»c:windowssystem32igfxtray.exe» [2004-12-13 155648]
«HotKeysCmds»=»c:windowssystem32hkcmd.exe» [2004-12-13 126976]
«LogitechCommunicationsManager»=»c:program filesCommon FilesLogiShrdLComMgrCommunications_Helper.exe» [2008-08-14 565008]
«LogitechQuickCamRibbon»=»c:program filesLogitechQuickCamQuickcam.exe» [2008-08-14 2407184]
«FlashGuard»=»c:program filesFlashGuardFlashGuard.exe» [2008-04-21 212599]
«TrackPointSrv»=»tp4serv.exe» [2004-10-28 c:windowssystem32tp4serv.exe]
«TpShocks»=»TpShocks.exe» [2005-01-24 c:windowssystem32TpShocks.exe]
«TP4EX»=»tp4ex.exe» [2004-11-12 c:windowssystem32TP4EX.exe][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2004-08-18 15360]c:documents and settingsAll Usersѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
Adobe Reader Speed Launch.lnk — c:program filesAdobeAcrobat 7.0Readerreader_sl.exe [2004-12-14 29696]
BTTray.lnk — c:program filesThinkPadBluetooth SoftwareBTTray.exe [2006-05-31 622653]
Digital Line Detect.lnk — c:program filesDigital Line DetectDLG.exe [2005-10-23 24576]
Microsoft Office.lnk — c:program filesMicrosoft OfficeOffice10OSA.EXE [2001-02-13 83360][HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotifypsfus]
2004-11-04 08:51 108636 c:program filesIBM fingerprint softwarepsfus.dll[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotifytphotkey]
2004-08-12 19:11 24576 c:windowssystem32tphklock.dll[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]
«msacm.l3radius»= l3codecp.acm
«VIDC.X264″= x264vfw.dll[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«AntiVirusDisableNotify»=dword:00000001
«UpdatesDisableNotify»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\IBM\Updater\jre\bin\java.exe»=
«c:\Program Files\IBM\Updater\jre\bin\javaw.exe»=
«c:\Program Files\IBM\Updater\ucsmb.exe»=
«c:program filesMicrosoft ActiveSyncrapimgr.exe»= c:program filesMicrosoft ActiveSyncrapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
«c:program filesMicrosoft ActiveSyncwcescomm.exe»= c:program filesMicrosoft ActiveSyncwcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
«c:program filesMicrosoft ActiveSyncWCESMgr.exe»= c:program filesMicrosoft ActiveSyncWCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
«c:\Program Files\uTorrent\utorrent.exe»=
«c:\Program Files\Skype\Phone\Skype.exe»=[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«26675:TCP»= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync ServiceR2 appdrvrem01;Application Driver Auto Removal Service (01); [x]
S0 Shockprf;Shockprf; [x]
S0 TPDiskPM;TPDiskPM; [x]
S1 appdrv01;Application Driver (01);c:windowssystem32Driversappdrv01.sys [2008-11-13 2220136]
S1 ShockMgr;ShockMgr; [x]
S1 TPPWRIF;TPPWRIF;c:windowssystem32driversTppwrif.sys [2006-05-26 4442]
S3 Tp4Track;IBM PS/2 TrackPoint Driver;c:windowssystem32DRIVERStp4track.sys [2004-10-28 13904]
S3 TPInput;TPInput;c:windowssystem32DRIVERSTPInput.sys [2004-12-02 6016]— Other Services/Drivers In Memory —
*Deregistered* — AegisP
*Deregistered* — AFD
*Deregistered* — ALG
*Deregistered* — appdrv01
*Deregistered* — appdrvrem01
*Deregistered* — AudioSrv
*Deregistered* — Beep
*Deregistered* — BITS
*Deregistered* — Browser
*Deregistered* — BTKRNL
*Deregistered* — btwdins
*Deregistered* — Compbatt
*Deregistered* — CryptSvc
*Deregistered* — DcomLaunch
*Deregistered* — Dhcp
*Deregistered* — dmio
*Deregistered* — dmload
*Deregistered* — dmserver
*Deregistered* — Dnscache
*Deregistered* — ERSvc
*Deregistered* — EventSystem
*Deregistered* — EvtEng
*Deregistered* — Fastfat
*Deregistered* — FastUserSwitchingCompatibility
*Deregistered* — Fips
*Deregistered* — FltMgr
*Deregistered* — Ftdisk
*Deregistered* — Gpc
*Deregistered* — gusvc
*Deregistered* — helpsvc
*Deregistered* — HTTP
*Deregistered* — i2omgmt
*Deregistered* — IBMPMSVC
*Deregistered* — IpNat
*Deregistered* — IPSec
*Deregistered* — irda
*Deregistered* — Irmon
*Deregistered* — KSecDD
*Deregistered* — lanmanserver
*Deregistered* — lanmanworkstation
*Deregistered* — LmHosts
*Deregistered* — LVCOMSer
*Deregistered* — LVPr2Mon
*Deregistered* — LVPrcSrv
*Deregistered* — LVUSBSta
*Deregistered* — MDM
*Deregistered* — mdmxsdk
*Deregistered* — mnmdd
*Deregistered* — MountMgr
*Deregistered* — MRxDAV
*Deregistered* — MRxSmb
*Deregistered* — Msfs
*Deregistered* — mssmbios
*Deregistered* — Mup
*Deregistered* — NDIS
*Deregistered* — NdisTapi
*Deregistered* — Ndisuio
*Deregistered* — NdisWan
*Deregistered* — NDProxy
*Deregistered* — NetBIOS
*Deregistered* — NetBT
*Deregistered* — Netman
*Deregistered* — Nla
*Deregistered* — Npfs
*Deregistered* — Ntfs
*Deregistered* — Null
*Deregistered* — PartMgr
*Deregistered* — PMEM
*Deregistered* — PolicyAgent
*Deregistered* — PptpMiniport
*Deregistered* — ProtectedStorage
*Deregistered* — PSched
*Deregistered* — RasAcd
*Deregistered* — Rasirda
*Deregistered* — Rasl2tp
*Deregistered* — RasMan
*Deregistered* — RasPppoe
*Deregistered* — Raspti
*Deregistered* — Rdbss
*Deregistered* — RDPCDD
*Deregistered* — rdpdr
*Deregistered* — RegSrvc
*Deregistered* — RemoteRegistry
*Deregistered* — ROOTMODEM
*Deregistered* — RpcSs
*Deregistered* — S24EventMonitor
*Deregistered* — s24trans
*Deregistered* — SamSs
*Deregistered* — Schedule
*Deregistered* — seclogon
*Deregistered* — SENS
*Deregistered* — SharedAccess
*Deregistered* — ShellHWDetection
*Deregistered* — ShockMgr
*Deregistered* — Smapint
*Deregistered* — Spooler
*Deregistered* — sr
*Deregistered* — srservice
*Deregistered* — Srv
*Deregistered* — SSDPSRV
*Deregistered* — StarOpen
*Deregistered* — stisvc
*Deregistered* — swenum
*Deregistered* — TapiSrv
*Deregistered* — Tcpip
*Deregistered* — TDSMAPI
*Deregistered* — TermDD
*Deregistered* — TermService
*Deregistered* — Themes
*Deregistered* — TPHDEXLGSVC
*Deregistered* — TPHKDRV
*Deregistered* — TpKmpSVC
*Deregistered* — TPPWRIF
*Deregistered* — TrkWks
*Deregistered* — TSMAPIP
*Deregistered* — UMWdf
*Deregistered* — Update
*Deregistered* — VgaSave
*Deregistered* — VolSnap
*Deregistered* — vtserver
*Deregistered* — W32Time
*Deregistered* — Wanarp
*Deregistered* — WebClient
*Deregistered* — winmgmt
*Deregistered* — wscsvc
*Deregistered* — wuauserv
*Deregistered* — WZCSVC
.
Contents of the ‘Scheduled Tasks’ folder2009-02-16 c:windowsTasksPMTask.job
— c:progra~1ThinkPadUTILIT~1PWMIDTSK.EXE [2006-05-26 00:13]2006-08-23 c:windowsTasksНапоминание о регистрации 2.job
— c:windowssystem32OOBEoobebaln.exe [2004-08-18 04:00]2006-08-23 c:windowsTasksНапоминание о регистрации 3.job
— c:windowssystem32OOBEoobebaln.exe [2004-08-18 04:00]
.
.
Supplementary Scan
.
uStart Page = hxxp://www.rbc.ru/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uInternet Settings,ProxyServer = 192.168.1.1:80
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Отправить на устройство Bluetooth… — c:program filesThinkPadBluetooth Softwarebtsendto_ie_ctx.htm
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office10EXCEL.EXE/3000
IE: Отправить через &Bluetooth — c:program filesIBMBluetooth Softwarebtsendto_ie_ctx.htm
TCP: {ADEC064A-229C-4DBF-9A33-4E5E661BCEE1} = 192.168.1.1
.**************************************************************************
catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-17 00:34:21
Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
**************************************************************************
.
LOCKED REGISTRY KEYS
[HKEY_USERSS-1-5-21-1819262009-3079328092-198345661-1005SoftwareMicrosoftSystemCertificatesAddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(1000)
c:program filesIBM fingerprint softwarepsfus.dll
c:program filesCommon FilesVirtual Tokenpsutil.dll
c:windowssystem32tphklock.dll
c:windowssystem32igfxsrvc.dll
c:windowssystem32hccutils.DLL
.
Completion time: 2009-02-17 0:38:23
ComboFix-quarantined-files.txt 2009-02-16 21:37:06
ComboFix2.txt 2009-02-10 00:03:28
ComboFix3.txt 2009-02-09 23:35:18
ComboFix4.txt 2009-02-09 22:03:29
ComboFix5.txt 2009-02-16 21:27:22Pre-Run: 5 059 842 048 байт свободно
Post-Run: 5,569,085,440 байт свободно343 — E O F — 2007-07-23 14:33:35
