ComboFix 09-05-25.A2 — Admin 26.05.2009 23:37.4 — NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.1023.451 [GMT 4:00] Running from: c:documents and settingsAdminРабочий столComboFix.exe Command switches used :: c:documents and settingsAdminРабочий столWindowsXP-KB310994-SP2-Pro-BootDisk-RUS.exe AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} FW: Outpost Firewall Pro *enabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD} . ((((((((((((((((((((((((( Files Created from 2009-04-26 to 2009-05-26 ))))))))))))))))))))))))))))))) .

…и лог файл Logfile of random’s system information tool 1.06 (written by random/random) Run by Langley at 2009-05-26 21:37:26 Microsoft® Windows Vista™ Ultimate Service Pack 1 System drive C: has 7 GB (23%) free of 31 GB Total RAM: 3326 MB (63% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:37:38, on 26.05.2009

Logfile of random’s system information tool 1.06 (written by random/random) Run by Admin at 2009-05-23 12:56:50 Microsoft Windows XP Professional Service Pack 3 System drive C: has 49 GB (89%) free of 55 GB Total RAM: 2046 MB (81% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:56:52, on 23.05.2009 Platform: Windows XP

ComboFix 09-05-19.08 — Core2Duo 20.05.2009 19:01.5 — NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.1022.547 [GMT 4:00] Running from: c:documents and settingsCore2DuoРабочий столComboFix.exe Command switches used :: c:documents and settingsCore2DuoРабочий столCFScript.txt AV: avast! antivirus 4.8.1335 [VPS 090519-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} AV: Doctor Web Anti-Virus *On-access scanning disabled* (Updated) {3454C8F1-ECBC-4180-A6F4-04632FBA762B} WARNING -THIS MACHINE DOES NOT HAVE

========== PROCESSES ========== Process explorer.exe killed successfully. ========== REGISTRY ========== Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9D64F819-9380-8473-DAB2-702FCB3D7A3E}\ not found. ========== FILES ========== File/Folder C:Documents and SettingsАдминистраторApplication Databpfeed.dll not found. ========== COMMANDS ========== User’s Temp folder emptied. User’s Internet Explorer cache folder emptied. File delete failed. C:Documents and SettingsАртурLocal SettingsTemporary Internet FilesContent.IE5index.dat scheduled to be deleted on reboot.

2.folder====== C:Windowstasks1-Click Maintenance.job C:WindowstasksGoogle Software Updater.job C:WindowstasksUser_Feed_Synchronization-{362C3894-33A6-4C99-8DB5-81C5454622B0}.job ======Registry dump====== [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] Adobe PDF Reader Link Helper — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll [2006-10-23 62080] [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}] FGCatchUrl — C:Program FilesFlashGetjccatch.dll [2007-08-06 94308] [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}] IEVkbdBHO Class — C:Program FilesKaspersky LabKaspersky Internet Security 2009ievkbd.dll [2008-11-11 62728] [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}] Search Helper — C:Program FilesMicrosoftSearch Enhancement

Добрый день! Спс за ответ. Explorer я конечно первым дело пробовал переустановить, но но эти проблемы не исчезли… 🙄 Отправляю два файла 1.Logfile of random’s system information tool 1.06 (written by random/random) Run by Vladimir Svetin at 2009-05-18 17:20:14 Microsoft® Windows Vista™ Home Premium Service Pack 1 System drive C: has 25 GB (27%) free

ГРОМАДНОЕ СПАСИБО!!!! Баннер пропал. Ура!!!!!! ComboFix 09-05-17.04 — Галюня 18.05.2009 16:18.2 — NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.895.583 [GMT 3:00] Running from: c:documents and settingsГалюня.COMPРабочий столOTMoveIt3 by OldTimerCombofixComboFix.exe Command switches used :: c:documents and settingsГалюня.COMPРабочий столOTMoveIt3 by OldTimerCFScript.txt AV: Антивирусная система Eset NOD32 2.51 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} AV: AGAVA ANTISPY *On-access scanning enabled*

BITS: Possible infected sites hxxp://soft.export.yandex.ru . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . Service_System ((((((((((((((((((((((((( Files Created from 2009-04-18 to 2009-05-18 ))))))))))))))))))))))))))))))) . 2009-05-05 10:46 . 2009-05-05 10:46 d w c:program filessxcodec 2009-05-02 12:31 . 2009-05-02 12:31 d w c:documents and settingsГалюня.COMPLocal SettingsApplication DataPC 2009-05-02 12:31 . 2009-05-02 12:31 d w c:documents and settingsГалюня.COMPLocal SettingsApplication DataWheelman 2009-05-01 12:34