КОМП СТАЛ ОЧENЬ МEДЛENNO РАБОТАТЬ.

[QERIBAN]

КОМП СТАЛ ОЧENЬ МEДЛENNO РАБОТАТЬ, СКОРОСТИ ВООБШE NEТУ.И EЩО NE РАБОТАЮТ NEKOТОРЫE КNOПКИ АЛФОВИТА.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:20:59, on 13.03.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32igfxtray.exe
C:WINDOWSsystem32igfxsrvc.exe
C:WINDOWSsystem32hkcmd.exe
C:WINDOWSsystem32igfxpers.exe
C:WINDOWSV0330Mon.exe
C:Program FilesAthanAthan.exe
C:Program FilesCommon FilesInstallShieldUpdateServiceissch.exe
C:WINDOWSsystem32ctfmon.exe
D:Download Masterdmaster.exe
c:program filescommon filesinstallshieldupdateserviceisuspm.exe
C:Program FilesStormIIstormliv.exe
D:Alcohol 120% 1.9.7.6022Alcohol 120StarWindStarWindServiceAE.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesStormIIstMgr.exe
C:WINDOWSsystem32wscntfy.exe
C:Program FilesCommon FilesInstallShieldUpdateServiceagent.exe
C:Program FilesCommon FilesMicrosoft SharedWindows LiveWLLoginProxy.exe
C:Program Filesinternet exploreriexplore.exe
C:HijackThis.exe

R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.mail.ru/
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://www.yahoo.com/
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60077
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60077
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.yahoo.com/
R1 — HKLMSoftwareMicrosoftInternet ExplorerSearch,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=13157&gct=&gc=1&q=
R1 — HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: Rambler-Ассистент — {468CD8A9-7C25-45FA-969E-3D925C689DC4} — D:Rambler AssistantramblertoolbarU5950.dll
R3 — URLSearchHook: (no name) — {83821C2B-32A8-4DD7-B6D4-44309A78E668} — C:Program FilesMail.RuAgentMradllnewmrasearch.dll
R3 — URLSearchHook: free-downloads.net Toolbar — {ecdee021-0d17-467f-a1ff-c7a115230949} — C:Program Filesfree-downloads.nettbfree.dll
R3 — URLSearchHook: DefaultSearchHook Class — {C94E154B-1459-4A47-966B-4B843BEFC7DB} — C:Program FilesAskSearchbinDefaultSearch.dll
R3 — URLSearchHook: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O2 — BHO: (no name) — {02478D38-C3F9-4efb-9B51-7695ECA05670} — (no file)
O2 — BHO: AcroIEHelperStub — {18DF081C-E8AD-4283-A596-FA578C2EBDC3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelperShim.dll
O2 — BHO: Skype add-on (mastermind) — {22BF413B-C6D2-4d91-82A9-A0F997BA588C} — D:SKYPEToolbarsInternet ExplorerSkypeIEPlugin.dll
O2 — BHO: (no name) — {7E853D72-626A-48EC-A868-BA8D5E23E045} — (no file)
O2 — BHO: Спутник@Mail.Ru — {8984B388-A5BB-4DF7-B274-77B879E179DB} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O2 — BHO: Помощник по входу в Windows Live — {9030D464-4C02-4ABF-8ECC-5164760863C6} — C:Program FilesCommon FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll
O2 — BHO: IE 4.x-6.x BHO for Download Master — {9961627E-4059-41B4-8E0E-A7D6B3854ADF} — D:DOWNLO~1dmiehlp.dll
O2 — BHO: Windows Live Toolbar Helper — {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} — C:Program FilesWindows Live Toolbarmsntb.dll
O2 — BHO: free-downloads.net Toolbar — {ecdee021-0d17-467f-a1ff-c7a115230949} — C:Program Filesfree-downloads.nettbfree.dll
O3 — Toolbar: (no name) — {E0E899AB-F487-11D5-8D29-0050BA6940E3} — (no file)
O3 — Toolbar: Windows Live Toolbar — {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} — C:Program FilesWindows Live Toolbarmsntb.dll
O3 — Toolbar: free-downloads.net Toolbar — {ecdee021-0d17-467f-a1ff-c7a115230949} — C:Program Filesfree-downloads.nettbfree.dll
O3 — Toolbar: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O3 — Toolbar: Rambler-Ассистент — {468CD8A9-7C25-45FA-969E-3D925C689DC4} — D:Rambler AssistantramblertoolbarU5950.dll
O3 — Toolbar: DM Bar — {0E1230F8-EA50-42A9-983C-D22ABC2EED3C} — D:Download Masterdmbar.dll
O4 — HKLM..Run: [IgfxTray] C:WINDOWSsystem32igfxtray.exe
O4 — HKLM..Run: [HotKeysCmds] C:WINDOWSsystem32hkcmd.exe
O4 — HKLM..Run: [Persistence] C:WINDOWSsystem32igfxpers.exe
O4 — HKLM..Run: [V0330Mon.exe] C:WINDOWSV0330Mon.exe
O4 — HKLM..Run: [Athan] C:Program FilesAthanAthan.exe
O4 — HKLM..Run: [ISUSPM Startup] «c:Program FilesCommon FilesInstallShieldUpdateServiceisuspm.exe» -startup
O4 — HKLM..Run: [ISUSScheduler] «C:Program FilesCommon FilesInstallShieldUpdateServiceissch.exe» -start
O4 — HKLM..Run: [MAgent] C:Program FilesMail.RuAgentMAgent.exe -LM
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [AlcoholAutomount] «D:Alcohol 120% 1.9.7.6022Alcohol 120axcmd.exe» /automount
O4 — HKCU..Run: [Download Master] D:Download Masterdmaster.exe -autorun
O4 — HKCU..RunOnce: [FlashPlayerUpdate] C:WINDOWSsystem32MacromedFlashFlashUtil10a.exe
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — Startup: adsl.lnk = ?
O8 — Extra context menu item: &Windows Live Search — res://C:Program FilesWindows Live Toolbarmsntb.dll/search.htm
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 — Extra context menu item: Добавить в Rambler-Закладки — res://D:Rambler AssistantramblertoolbarU5950.dll/zakladki.htm
O8 — Extra context menu item: Закачать ВСЕ при помощи Download Master — D:Download Masterdmieall.htm
O8 — Extra context menu item: Закачать все при помощи FlashGet — C:Program FilesFlashGetjc_all.htm
O8 — Extra context menu item: Закачать при помощи Download Master — D:Download Masterdmie.htm
O8 — Extra context menu item: Закачать при помощи FlashGet — C:Program FilesFlashGetjc_link.htm
O8 — Extra context menu item: Найти с помощью Рамблера — res://D:Rambler AssistantramblertoolbarU5950.dll/search.htm
O8 — Extra context menu item: Опубликовать в Дневнике — res://D:Rambler AssistantramblertoolbarU5950.dll/planet.htm
O8 — Extra context menu item: Перевести с помощью словарей Рамблера — res://D:Rambler AssistantramblertoolbarU5950.dll/dic.htm
O8 — Extra context menu item: Поиск@Mail.Ru — res://C:Program FilesMail.RuSputnikMailRuSputnik.dll/282
O8 — Extra context menu item: Словари@Mail.Ru — res://C:Program FilesMail.RuSputnikMailRuSputnik.dll/283
O9 — Extra button: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra ‘Tools’ menuitem: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra button: Skype — {77BF5300-1474-4EC7-9980-D32B190E9B07} — D:SKYPEToolbarsInternet ExplorerSkypeIEPlugin.dll
O9 — Extra button: Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — D:Download Masterdmaster.exe
O9 — Extra ‘Tools’ menuitem: &Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — D:Download Masterdmaster.exe
O9 — Extra button: Справочные материалы — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 — Extra button: FlashGet — {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} — C:PROGRA~1FLASHGETflashget.exe (file missing)
O9 — Extra ‘Tools’ menuitem: &FlashGet — {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} — C:PROGRA~1FLASHGETflashget.exe (file missing)
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra button: ICQ6 — {E59EB121-F339-4851-A3BA-FE49C35617C2} — D:ICQ6ICQ.exe
O9 — Extra ‘Tools’ menuitem: ICQ6 — {E59EB121-F339-4851-A3BA-FE49C35617C2} — D:ICQ6ICQ.exe
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O17 — HKLMSystemCCSServicesTcpip..{BEA969AC-7634-4967-8C5C-F4F74DF13E88}: NameServer = 61.128.114.133 61.128.114.166
O18 — Protocol: skype4com — {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} — C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O23 — Service: Adobe LM Service — Unknown owner — C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe
O23 — Service: Adofomtk — Unknown owner — (no file)
O23 — Service: Contrl Center of Storm Media (ccosm) — ???????????? — C:Program FilesStormIIstormliv.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: NetMeeting Remote Desktop Sharing (mnmsrvc) — Корпорация Майкрософт — C:WINDOWSsystem32mnmsrvc.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: StarWind AE Service (StarWindServiceAE) — Unknown owner — C:WINDOWS
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe

—
End of file — 11397 bytes

[Admin]

Здравствуйте, буду рад вам помочь снова.

NE РАБОТАЮТ NEKOТОРЫE КNOПКИ АЛФОВИТА.

С клавиатуры ? Если набирать с помощью виртуальной, тежи буквы не набираются ?

Проверим ваш компьютер с помощью программы которая ищет руткиты.

Скачайте программу GMER кликнув по этой ссылке.
Распакуйте программу на ваш рабочий стол.
Отключите Интернет и все антивирусы.
Запустите программу.
В правой части программы, в небольшом окошке будут перечислены все ваши диски, пожалуйста выделите их галочками.
Кликните по кнопке Scan.
Когда сканирование закончится, кликните по кнопке Copy.
Запустите Блокнот (Пуск -> Выполнить, введите notepad и нажмите Enter).
Вставьте результаты сканирования в блокнот (CTRL + V). Сохраните получившийся файл на ваш рабочий стол.

Скачайте сканер RSIT кликнув по этой ссылке и сохраните файл на вашем рабочем столе.

* Дважды кликните по скачанному файлу.
* Если у вас есть файрвал (firewall) и он покажет, что программа RSIT пытается выйти в Интернет, то разрешите ей.
* Кликните по кнопке Continue.
* Когда программа закончит работу, будут показаны два лога (log.txt и info.txt).

Вставьте GMER лог + оба RSIT лога в ваш ответ. Каждый лог в отдельное сообщение.

[QERIBAN]

GMER 1.0.15.14939 — http://www.gmer.net
Rootkit scan 2009-03-15 20:35:05
Windows 5.1.2600 Service Pack 2

—- System — GMER 1.0.15 —-

SSDT sput.sys ZwCreateKey [0xF738A0E0]
SSDT sput.sys ZwEnumerateKey [0xF73A7CA2]
SSDT sput.sys ZwEnumerateValueKey [0xF73A8030]
SSDT sput.sys ZwOpenKey [0xF738A0C0]
SSDT sput.sys ZwQueryKey [0xF73A8108]
SSDT sput.sys ZwQueryValueKey [0xF73A7F88]
SSDT sput.sys ZwSetValueKey [0xF73A819A]

INT 0x62 ? 86569BF8
INT 0x82 ? 86569BF8
INT 0xB4 ? 862B7F00
INT 0xB4 ? 862B7F00
INT 0xB4 ? 862B7F00

—- Kernel code sections — GMER 1.0.15 —-

? sput.sys Íå óäàåòñÿ íàéòè óêàçàííûé ôàéë. !
.text USBPORT.SYS!DllUnload F6BF562C 5 Bytes JMP 862B74E0
.text am5qseh6.SYS F6AC7384 1 Byte [20]
.text am5qseh6.SYS F6AC7384 37 Bytes [20, 00, 00, 68, 00, 00, 00, …]
.text am5qseh6.SYS F6AC73AA 24 Bytes [00, 00, 20, 00, 00, E0, 00, …]
.text am5qseh6.SYS F6AC73C4 3 Bytes [00, 00, 00]
.text am5qseh6.SYS F6AC73C9 1 Byte [00]
.text …

—- User code sections — GMER 1.0.15 —-

.text C:Program FilesAthanAthan.exe[1852] SHELL32.dll!StrStrW + FFE2AEDD 7C9C42A8 16 Bytes [31, 49, 69, 71, 8D, 48, 69, …]
.text C:Program FilesAthanAthan.exe[1852] SHELL32.dll!StrStrW + FFE2D539 7C9C6904 12 Bytes [31, 49, 69, 71, 8D, 48, 69, …]
.text C:Program FilesAthanAthan.exe[1852] SHELL32.dll!StrStrW + FFE2D5B5 7C9C6980 12 Bytes [31, 49, 69, 71, 8D, 48, 69, …]
.text C:Program FilesAthanAthan.exe[1852] SHELL32.dll!StrStrW + FFE2D5E1 7C9C69AC 4 Bytes [B3, F5, 67, 71]
.text C:Program FilesAthanAthan.exe[1852] SHELL32.dll!StrStrW + FFE2D5F9 7C9C69C4 4 Bytes [B1, 86, 67, 71]
.text …

—- Kernel IAT/EAT — GMER 1.0.15 —-

IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F738B040] sput.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F738B13C] sput.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F738B0BE] sput.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F738B7FC] sput.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F738B6D2] sput.sys
IAT SystemRootSystem32Driversam5qseh6.SYS[HAL.dll!KfAcquireSpinLock] 6C000000
IAT SystemRootSystem32Driversam5qseh6.SYS[HAL.dll!READ_PORT_UCHAR] 56000000
IAT SystemRootSystem32Driversam5qseh6.SYS[HAL.dll!KeGetCurrentIrql] F4000000
IAT SystemRootSystem32Driversam5qseh6.SYS[HAL.dll!KfRaiseIrql] EA000000
IAT SystemRootSystem32Driversam5qseh6.SYS[HAL.dll!KfLowerIrql] 65000000
IAT SystemRootSystem32Driversam5qseh6.SYS[HAL.dll!HalGetInterruptVector] 7A000000
IAT SystemRootSystem32Driversam5qseh6.SYS[HAL.dll!HalTranslateBusAddress] AE000000
IAT SystemRootSystem32Driversam5qseh6.SYS[HAL.dll!KeStallExecutionProcessor] 08000000
IAT SystemRootSystem32Driversam5qseh6.SYS[HAL.dll!KfReleaseSpinLock] BA000000
IAT SystemRootSystem32Driversam5qseh6.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] 78000000
IAT SystemRootSystem32Driversam5qseh6.SYS[HAL.dll!READ_PORT_USHORT] 25000000
IAT SystemRootSystem32Driversam5qseh6.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] 2E000000
IAT SystemRootSystem32Driversam5qseh6.SYS[HAL.dll!WRITE_PORT_UCHAR] 1C000000
IAT SystemRootSystem32Driversam5qseh6.SYS[WMILIB.SYS!WmiSystemControl] B4000000
IAT SystemRootSystem32Driversam5qseh6.SYS[WMILIB.SYS!WmiCompleteRequest] C6000000

—- Devices — GMER 1.0.15 —-

Device FileSystemFastfat FatCdrom 865681F8
Device Driverusbehci DeviceUSBPDO-0 862931F8
Device Driverdmio DeviceDmControlDmIoDaemon 865D81F8
Device Driverdmio DeviceDmControlDmConfig 865D81F8
Device Driverdmio DeviceDmControlDmPnP 865D81F8
Device Driverdmio DeviceDmControlDmInfo 865D81F8
Device Driverusbuhci DeviceUSBPDO-1 862B11F8
Device DriverFtdisk DeviceHarddiskVolume1 8656A1F8
Device DriverFtdisk DeviceHarddiskVolume2 8656A1F8
Device DriverCdrom DeviceCdRom0 86200500
Device DriverFtdisk DeviceHarddiskVolume3 8656A1F8
Device DriverCdrom DeviceCdRom1 86200500
Device Driveratapi DeviceIdeIdeDeviceP0T0L0-3 865691F8
Device Driveratapi DeviceIdeIdePort0 865691F8
Device Driveratapi DeviceIdeIdePort1 865691F8
Device Driveratapi DeviceIdeIdeDeviceP1T0L0-e 865691F8
Device DriverNetBT DeviceNetBT_Tcpip_{11BD6EB6-C0DE-41CD-8455-DEE482CA4083} 8622E500
Device DriverNetBT DeviceNetBt_Wins_Export 8622E500
Device DriverNetBT DeviceNetbiosSmb 8622E500
Device DriverPCI_PNP1340 Device000004d sput.sys
Device Driverusbuhci DeviceUSBFDO-0 862B11F8
Device Driverusbehci DeviceUSBFDO-1 862931F8
Device FileSystemMRxSmb DeviceLanmanDatagramReceiver 861F4500
Device FileSystemMRxSmb DeviceLanmanRedirector 861F4500
Device Driversptd Device2715573840 sput.sys
Device DriverFtdisk DeviceFtControl 8656A1F8
Device Driveram5qseh6 DeviceScsiam5qseh61 861F9500
Device Driveram5qseh6 DeviceScsiam5qseh61Port2Path0Target0Lun0 861F9500
Device FileSystemFastfat Fat 865681F8
Device FileSystemCdfs Cdfs 862F61F8

—- Registry — GMER 1.0.15 —-

Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (L002TP) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPTP) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPPoE) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@374@4O4494 ?0404@0404;4;0454;4L4=4K494 ?4>4@4B4 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (IP) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 ?4;0404=484@4>0424I484:0404 ?0404:0454B4>0424 1?2?3?
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@s1 771343423
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@s2 285507792
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@h0 1
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04@p0 D:Alcohol 120% 1.9.7.6022Alcohol 120
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04@h0 0
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04@ujdew 0x95 0xD7 0x59 0x93 …
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001@ujdew 0xCE 0xA4 0x35 0xAE …
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40@ujdew 0xF7 0x2F 0xE0 0xF0 …
Reg HKLMSYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (L002TP) 1?
Reg HKLMSYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPTP) 1?
Reg HKLMSYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPPoE) 1?
Reg HKLMSYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@374@4O4494 ?0404@0404;4;0454;4L4=4K494 ?4>4@4B4 1?
Reg HKLMSYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (IP) 1?
Reg HKLMSYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 ?4;0404=484@4>0424I484:0404 ?0404:0454B4>0424 1?2?3?
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04@p0 D:Alcohol 120% 1.9.7.6022Alcohol 120
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04@h0 0
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04@ujdew 0x95 0xD7 0x59 0x93 …
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@ujdew 0xCE 0xA4 0x35 0xAE …
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40@ujdew 0xF7 0x2F 0xE0 0xF0 …
Reg HKCUSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{A6C514F6-D7D8-F038-464A-0AAE17B106DE}
Reg HKCUSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{A6C514F6-D7D8-F038-464A-0AAE17B106DE}@japeajgiohefniblbipd 0x6B 0x61 0x64 0x67 …
Reg HKCUSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{A6C514F6-D7D8-F038-464A-0AAE17B106DE}@iafaghhpjphbpdcief 0x6B 0x61 0x6F 0x66 …

—- Disk sectors — GMER 1.0.15 —-

Disk DeviceHarddisk0DR0 sector 62: copy of MBR

—- EOF — GMER 1.0.15 —-

[QERIBAN]

Logfile of random’s system information tool 1.05 (written by random/random)
Run by 123 at 2009-03-15 20:46:00
Microsoft Windows XP Professional Service Pack 2
System drive C: has 9 GB (45%) free of 19 GB
Total RAM: 1015 MB (64% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:46:03, on 15.03.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesStormIIstormliv.exe
C:WINDOWSExplorer.EXE
D:Alcohol 120% 1.9.7.6022Alcohol 120StarWindStarWindServiceAE.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesStormIIstMgr.exe
C:WINDOWSsystem32igfxtray.exe
C:WINDOWSsystem32hkcmd.exe
C:WINDOWSsystem32igfxpers.exe
C:WINDOWSV0330Mon.exe
C:Program FilesAthanAthan.exe
C:Program FilesCommon FilesInstallShieldUpdateServiceissch.exe
C:WINDOWSsystem32ctfmon.exe
D:Download Masterdmaster.exe
C:WINDOWSsystem32igfxsrvc.exe
C:WINDOWSsystem32wscntfy.exe
C:Documents and Settings123Рабочий столgmer.exe
C:Program FilesMicrosoft OfficeOFFICE11WINWORD.EXE
C:WINDOWSsystem32NOTEPAD.EXE
C:Program Filesinternet exploreriexplore.exe
C:Program FilesCommon FilesMicrosoft SharedWindows LiveWLLoginProxy.exe
C:Program FilesWindows Live Toolbarmsn_sl.exe
C:WINDOWSsystem32wuauclt.exe
D:VIRUSRSIT.exe
C:123.exe

R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.mail.ru/
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://www.yahoo.com/
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60077
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60077
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.yahoo.com/
R1 — HKLMSoftwareMicrosoftInternet ExplorerSearch,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=13157&gct=&gc=1&q=
R1 — HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: Rambler-Ассистент — {468CD8A9-7C25-45FA-969E-3D925C689DC4} — D:Rambler AssistantramblertoolbarU5950.dll
R3 — URLSearchHook: (no name) — {83821C2B-32A8-4DD7-B6D4-44309A78E668} — C:Program FilesMail.RuAgentMradllnewmrasearch.dll
R3 — URLSearchHook: free-downloads.net Toolbar — {ecdee021-0d17-467f-a1ff-c7a115230949} — C:Program Filesfree-downloads.nettbfree.dll
R3 — URLSearchHook: DefaultSearchHook Class — {C94E154B-1459-4A47-966B-4B843BEFC7DB} — C:Program FilesAskSearchbinDefaultSearch.dll
R3 — URLSearchHook: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O2 — BHO: (no name) — {02478D38-C3F9-4efb-9B51-7695ECA05670} — (no file)
O2 — BHO: AcroIEHelperStub — {18DF081C-E8AD-4283-A596-FA578C2EBDC3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelperShim.dll
O2 — BHO: Skype add-on (mastermind) — {22BF413B-C6D2-4d91-82A9-A0F997BA588C} — D:SKYPEToolbarsInternet ExplorerSkypeIEPlugin.dll
O2 — BHO: (no name) — {7E853D72-626A-48EC-A868-BA8D5E23E045} — (no file)
O2 — BHO: Спутник@Mail.Ru — {8984B388-A5BB-4DF7-B274-77B879E179DB} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O2 — BHO: Помощник по входу в Windows Live — {9030D464-4C02-4ABF-8ECC-5164760863C6} — C:Program FilesCommon FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll
O2 — BHO: IE 4.x-6.x BHO for Download Master — {9961627E-4059-41B4-8E0E-A7D6B3854ADF} — D:DOWNLO~1dmiehlp.dll
O2 — BHO: Windows Live Toolbar Helper — {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} — C:Program FilesWindows Live Toolbarmsntb.dll
O2 — BHO: free-downloads.net Toolbar — {ecdee021-0d17-467f-a1ff-c7a115230949} — C:Program Filesfree-downloads.nettbfree.dll
O3 — Toolbar: (no name) — {E0E899AB-F487-11D5-8D29-0050BA6940E3} — (no file)
O3 — Toolbar: Windows Live Toolbar — {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} — C:Program FilesWindows Live Toolbarmsntb.dll
O3 — Toolbar: free-downloads.net Toolbar — {ecdee021-0d17-467f-a1ff-c7a115230949} — C:Program Filesfree-downloads.nettbfree.dll
O3 — Toolbar: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O3 — Toolbar: Rambler-Ассистент — {468CD8A9-7C25-45FA-969E-3D925C689DC4} — D:Rambler AssistantramblertoolbarU5950.dll
O3 — Toolbar: DM Bar — {0E1230F8-EA50-42A9-983C-D22ABC2EED3C} — D:Download Masterdmbar.dll
O4 — HKLM..Run: [IgfxTray] C:WINDOWSsystem32igfxtray.exe
O4 — HKLM..Run: [HotKeysCmds] C:WINDOWSsystem32hkcmd.exe
O4 — HKLM..Run: [Persistence] C:WINDOWSsystem32igfxpers.exe
O4 — HKLM..Run: [V0330Mon.exe] C:WINDOWSV0330Mon.exe
O4 — HKLM..Run: [Athan] C:Program FilesAthanAthan.exe
O4 — HKLM..Run: [ISUSPM Startup] «C:Program FilesCommon FilesInstallShieldUpdateServiceisuspm.exe» -startup
O4 — HKLM..Run: [ISUSScheduler] «C:Program FilesCommon FilesInstallShieldUpdateServiceissch.exe» -start
O4 — HKLM..Run: [MAgent] C:Program FilesMail.RuAgentMAgent.exe -LM
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [AlcoholAutomount] «D:Alcohol 120% 1.9.7.6022Alcohol 120axcmd.exe» /automount
O4 — HKCU..Run: [Download Master] D:Download Masterdmaster.exe -autorun
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — Startup: adsl.lnk = ?
O8 — Extra context menu item: &Windows Live Search — res://C:Program FilesWindows Live Toolbarmsntb.dll/search.htm
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 — Extra context menu item: Добавить в Rambler-Закладки — res://D:Rambler AssistantramblertoolbarU5950.dll/zakladki.htm
O8 — Extra context menu item: Закачать ВСЕ при помощи Download Master — D:Download Masterdmieall.htm
O8 — Extra context menu item: Закачать все при помощи FlashGet — C:Program FilesFlashGetjc_all.htm
O8 — Extra context menu item: Закачать при помощи Download Master — D:Download Masterdmie.htm
O8 — Extra context menu item: Закачать при помощи FlashGet — C:Program FilesFlashGetjc_link.htm
O8 — Extra context menu item: Найти с помощью Рамблера — res://D:Rambler AssistantramblertoolbarU5950.dll/search.htm
O8 — Extra context menu item: Опубликовать в Дневнике — res://D:Rambler AssistantramblertoolbarU5950.dll/planet.htm
O8 — Extra context menu item: Перевести с помощью словарей Рамблера — res://D:Rambler AssistantramblertoolbarU5950.dll/dic.htm
O8 — Extra context menu item: Поиск@Mail.Ru — res://C:Program FilesMail.RuSputnikMailRuSputnik.dll/282
O8 — Extra context menu item: Словари@Mail.Ru — res://C:Program FilesMail.RuSputnikMailRuSputnik.dll/283
O9 — Extra button: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra ‘Tools’ menuitem: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra button: Skype — {77BF5300-1474-4EC7-9980-D32B190E9B07} — D:SKYPEToolbarsInternet ExplorerSkypeIEPlugin.dll
O9 — Extra button: Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — D:Download Masterdmaster.exe
O9 — Extra ‘Tools’ menuitem: &Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — D:Download Masterdmaster.exe
O9 — Extra button: Справочные материалы — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 — Extra button: FlashGet — {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} — C:PROGRA~1FLASHGETflashget.exe (file missing)
O9 — Extra ‘Tools’ menuitem: &FlashGet — {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} — C:PROGRA~1FLASHGETflashget.exe (file missing)
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra button: ICQ6 — {E59EB121-F339-4851-A3BA-FE49C35617C2} — D:ICQ6ICQ.exe
O9 — Extra ‘Tools’ menuitem: ICQ6 — {E59EB121-F339-4851-A3BA-FE49C35617C2} — D:ICQ6ICQ.exe
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O17 — HKLMSystemCCSServicesTcpip..{BEA969AC-7634-4967-8C5C-F4F74DF13E88}: NameServer = 61.128.114.133 61.128.114.166
O18 — Protocol: skype4com — {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} — C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O23 — Service: Adobe LM Service — Unknown owner — C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe
O23 — Service: Adofomtk — Unknown owner — (no file)
O23 — Service: Contrl Center of Storm Media (ccosm) — ???????????? — C:Program FilesStormIIstormliv.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: NetMeeting Remote Desktop Sharing (mnmsrvc) — Корпорация Майкрософт — C:WINDOWSsystem32mnmsrvc.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: StarWind AE Service (StarWindServiceAE) — Unknown owner — C:WINDOWS
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe

—
End of file — 11401 bytes

======Scheduled tasks folder======

C:WINDOWStasksПроверка обновлений для Windows Live Toolbar.job

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelperShim.dll [2008-06-11 75128]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) — D:SKYPEToolbarsInternet ExplorerSkypeIEPlugin.dll [2008-08-08 1443112]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{8984B388-A5BB-4DF7-B274-77B879E179DB}]
MailRuBHO Class — C:Program FilesMail.RuSputnikMailRuSputnik.dll [2009-01-13 676704]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Помощник по входу в Windows Live — C:Program FilesCommon FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll [2007-09-20 328752]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9961627E-4059-41B4-8E0E-A7D6B3854ADF}]
IE 4.x-6.x BHO for Download Master — D:DOWNLO~1dmiehlp.dll [2008-10-24 157696]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
Windows Live Toolbar Helper — C:Program FilesWindows Live Toolbarmsntb.dll [2007-10-19 546320]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{ecdee021-0d17-467f-a1ff-c7a115230949}]
free-downloads.net Toolbar — C:Program Filesfree-downloads.nettbfree.dll [2007-12-10 1510424]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3}
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} — Windows Live Toolbar — C:Program FilesWindows Live Toolbarmsntb.dll [2007-10-19 546320]
{ecdee021-0d17-467f-a1ff-c7a115230949} — free-downloads.net Toolbar — C:Program Filesfree-downloads.nettbfree.dll [2007-12-10 1510424]
{09900DE8-1DCA-443F-9243-26FF581438AF} — Спутник@Mail.Ru — C:Program FilesMail.RuSputnikMailRuSputnik.dll [2009-01-13 676704]
{468CD8A9-7C25-45FA-969E-3D925C689DC4} — Rambler-Ассистент — D:Rambler AssistantramblertoolbarU5950.dll [2008-12-09 845296]
{0E1230F8-EA50-42A9-983C-D22ABC2EED3C} — DM Bar — D:Download Masterdmbar.dll [2007-11-26 180224]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«IgfxTray»=C:WINDOWSsystem32igfxtray.exe [2007-09-18 141848]
«HotKeysCmds»=C:WINDOWSsystem32hkcmd.exe [2007-09-18 166424]
«Persistence»=C:WINDOWSsystem32igfxpers.exe [2007-09-18 137752]
«V0330Mon.exe»=C:WINDOWSV0330Mon.exe [2007-04-30 32768]
«Athan»=C:Program FilesAthanAthan.exe [2009-01-19 1081344]
«ISUSPM Startup»=C:Program FilesCommon FilesInstallShieldUpdateServiceisuspm.exe [2005-08-11 249856]
«ISUSScheduler»=C:Program FilesCommon FilesInstallShieldUpdateServiceissch.exe [2005-08-11 81920]
«MAgent»=C:Program FilesMail.RuAgentMAgent.exe [2009-01-13 5598392]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=C:WINDOWSsystem32ctfmon.exe [2004-08-17 15360]
«AlcoholAutomount»=D:Alcohol 120% 1.9.7.6022Alcohol 120axcmd.exe [2007-12-22 222080]
«Download Master»=D:Download Masterdmaster.exe [2008-11-18 3297280]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe Reader Speed Launcher]
C:Program FilesAdobeReader 9.0ReaderReader_sl.exe [2008-06-12 34672]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregswg]
C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe []

C:Documents and Settings123Главное менюПрограммыАвтозагрузка
adsl.lnk —

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyigfxcui]
C:WINDOWSsystem32igfxdev.dll [2007-08-08 208896]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDrives»=0
«NoDriveAutoRun»=FFFFFFFF
«NoDriveTypeAutoRun»=36

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=
«NoDrives»=
«NoDriveAutoRun»=

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesStormIIStorm.exe»=»C:Program FilesStormIIStorm.exe:*:Enabled:±©·зУ°Тф»
«C:Program FilesStormIIstormliv.exe»=»C:Program FilesStormIIstormliv.exe:*:Enabled:±©·зУ°ТфГЅМеїШЦЖЦРРД»
«D:ICQ6ICQ.exe»=»D:ICQ6ICQ.exe:*:Enabled:ICQ6»
«C:Program FilesMessengermsmsgs.exe»=»C:Program FilesMessengermsmsgs.exe:*:Enabled:Windows Messenger»
«D:uTorrent.exe»=»D:uTorrent.exe:*:Enabled:µTorrent»
«C:Program FilesWindows LiveMessengermsnmsgr.exe»=»C:Program FilesWindows LiveMessengermsnmsgr.exe:*:Enabled:Windows Live Messenger»
«C:Program FilesWindows LiveMessengerlivecall.exe»=»C:Program FilesWindows LiveMessengerlivecall.exe:*:Enabled:Windows Live Messenger (Phone)»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«C:Program FilesStormIIBoxStline.exe»=»C:Program FilesStormIIBoxStline.exe:*:Enabled:????»
«C:Program FilesYahoo!MessengerYahooMessenger.exe»=»C:Program FilesYahoo!MessengerYahooMessenger.exe:*:Enabled:Yahoo! Messenger»
«D:SKYPEPhoneSkype.exe»=»D:SKYPEPhoneSkype.exe:*:Enabled:Skype»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesWindows LiveMessengermsnmsgr.exe»=»C:Program FilesWindows LiveMessengermsnmsgr.exe:*:Enabled:Windows Live Messenger»
«C:Program FilesWindows LiveMessengerlivecall.exe»=»C:Program FilesWindows LiveMessengerlivecall.exe:*:Enabled:Windows Live Messenger (Phone)»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»

======List of files/folders created in the last 1 months======

======List of files/folders modified in the last 1 months======

2009-03-15 20:09:02 —-A—- C:WINDOWSsystem32PerfStringBackup.INI
2009-03-15 13:58:54 —-A—- C:WINDOWSSchedLgU.Txt
2009-03-15 13:22:22 —-A—- C:WINDOWSwinamp.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2004-08-17 40448]
R1 ISODrive;ISO CD-ROM Device Driver; ??D:UltraISOdriversISODrive.sys []
R1 WmiAcpi;Интерфейс управления для ACPI Microsoft Windows; C:WINDOWSsystem32DRIVERSwmiacpi.sys [2004-08-03 8832]
R2 mdmxsdk;mdmxsdk; C:WINDOWSsystem32DRIVERSmdmxsdk.sys [2006-06-18 12672]
R3 CmBatt;Драйвер батареи с ACPI-управлением (Майкрософт); C:WINDOWSsystem32DRIVERSCmBatt.sys [2004-08-03 14080]
R3 E100B;Intel(R) PRO Network Connection Driver; C:WINDOWSsystem32DRIVERSe100b325.sys [2006-10-31 165760]
R3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:WINDOWSsystem32driversCHDAud.sys [2007-02-12 625664]
R3 HDAudBus;Драйвер шины Microsoft UAA для High Definition Audio; C:WINDOWSsystem32DRIVERSHDAudBus.sys [2005-01-07 138752]
R3 hidusb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2001-10-20 9600]
R3 HSF_DPV;HSF_DPV; C:WINDOWSsystem32DRIVERSHSF_DPV.sys [2006-12-20 988800]
R3 HSFHWAZL;HSFHWAZL; C:WINDOWSsystem32DRIVERSHSFHWAZL.sys [2006-12-20 209664]
R3 ialm;ialm; C:WINDOWSsystem32DRIVERSigxpmp32.sys [2007-08-08 5776864]
R3 mouhid;Драйвер мыши HID; C:WINDOWSsystem32DRIVERSmouhid.sys [2001-10-20 12160]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2004-08-03 26624]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2004-08-03 57600]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2004-08-03 20480]
R3 winachsf;winachsf; C:WINDOWSsystem32DRIVERSHSF_CNXT.sys [2006-12-20 730112]
S3 am5qseh6;am5qseh6; C:WINDOWSsystem32driversam5qseh6.sys []
S3 aujasnkj;aujasnkj; ??C:DOCUME~1123LOCALS~1Tempaujasnkj.sys []
S3 CCDECODE;Closed Caption декодер; C:WINDOWSsystem32DRIVERSCCDECODE.sys [2004-08-03 17024]
S3 MSTEE;Преобразователь потоков Tee/Sink-to-Sink Microsoft; C:WINDOWSsystem32driversMSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI кодек; C:WINDOWSsystem32DRIVERSNABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft видео или ТВ подключение; C:WINDOWSsystem32DRIVERSNdisIP.sys [2004-08-03 10880]
S3 NETw4x32;Драйвер адаптера Intel(R) Wireless WiFi Link для Windows XP 32 Bit; C:WINDOWSsystem32DRIVERSNETw4x32.sys [2008-03-13 2530176]
S3 SLIP;BDA Slip De-Framer; C:WINDOWSsystem32DRIVERSSLIP.sys [2004-08-03 11136]
S3 streamip;BDA IPSink; C:WINDOWSsystem32DRIVERSStreamIP.sys [2004-08-03 15360]
S3 UIUSys;Conexant Setup API; C:WINDOWSsystem32DRIVERSUIUSYS.SYS []
S3 usbaudio;Аудио драйвер USB (WDM); C:WINDOWSsystem32driversusbaudio.sys [2004-08-03 59264]
S3 usbccgp;Драйвер универсального родительского устройства USB (Microsoft); C:WINDOWSsystem32DRIVERSusbccgp.sys [2004-08-03 31616]
S3 usbscan;Драйвер USB-сканера; C:WINDOWSsystem32DRIVERSusbscan.sys [2004-08-03 15104]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2004-08-03 26496]
S3 usbvideo;USB-видеоустройство (WDM); C:WINDOWSSystem32Driversusbvideo.sys [2004-08-03 78464]
S3 V0330VID;WebCam Vista/Live! Cam Chat; C:WINDOWSsystem32DRIVERSV0330Vid.sys [2007-08-08 157696]
S3 WSTCODEC;World Standard Teletext кодек; C:WINDOWSsystem32DRIVERSWSTCODEC.SYS [2004-08-03 19328]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ccosm;Contrl Center of Storm Media; C:Program FilesStormIIstormliv.exe [2008-12-24 559200]
R2 StarWindServiceAE;StarWind AE Service; D:Alcohol 120% 1.9.7.6022Alcohol 120StarWindStarWindServiceAE.exe [2007-05-28 275968]
S3 Adobe LM Service;Adobe LM Service; C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe [2008-11-16 68096]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2003-07-28 89136]
S3 usnjsvc;Служба Messenger Sharing Folders USN Journal Reader; C:Program FilesWindows LiveMessengerusnsvc.exe [2007-10-18 98328]
S3 WLSetupSvc;Windows Live Setup Service; C:Program FilesWindows LiveinstallerWLSetupSvc.exe [2007-10-25 266240]

---

EOF

---

[QERIBAN]

ЧТО ТАКОE ВИРТУАЛ-Я КЛАВИАТУРА , И КАК СИNМ РОБОТАТ NE ЗNАЮ.

[Admin]

Для запуска виртуальной (экранной) клавиатуры нужно:
Кликните Пуск, Программы, Стандартные, Специальные возможности и выберите Экранная клавиатура.

Скачайте программу Combofix. Закройте все открытые окна и запустите эту программу.
После выполнения будет создан лог файл, пожалуйста вставьте его в ваш ответ.

[QERIBAN]

САЛАМ АЛЙКУМ , ВАЛРИ. НАКОНЕЧТО ВЫ МНЕ ОТВЕТИЛИ А ТО Я ПОДУМАЛ ЧТО ПОПАЛ В СПИСОК НЕЖЕЛАТЕЛЬНЫХ КЛИЕНТОВ.
НА ВИРТУАЛЬНОЙ КЛАВИАТУРЕ ВСЕ РАБОТАЕТ.ЗНАЧИТЬ ПРОБЛЕМА В САОМ НОТБУКЕ.Я ТАК ПОНЯЛ.

ComboFix 09-03-15.01 — 123 2009-03-17 11:53:27.4 — FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1251.1.1049.18.1015.671 [GMT 3:00]
Running from: c:documents and settings123Рабочий столComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:123.exe
c:program filesStormII
c:program filesStormIIBfOptDll.dll
c:program filesStormIIBFThumbs.dll
c:program filesStormIIBoxBoxLog.dll
c:program filesStormIIBoxHttpServer.dll
c:program filesStormIIBoxmini.swf
c:program filesStormIIBoxMovieBoxCore.dll
c:program filesStormIIBoxMovieBoxPS.dll
c:program filesStormIIBoxSkinMovieBox.zip
c:program filesStormIIBoxStline.exe
c:program filesStormIIBoxUILib.dll
c:program filesStormIIBoxUiManager.dll
c:program filesStormIIBoxUiPlay.dll
c:program filesStormIIBoxUitvWrapper_dll.dll
c:program filesStormIIcodec264be.dll
c:program filesStormIIcodec264dmmx.dll
c:program filesStormIIcodec264dsse.dll
c:program filesStormIIcodec264dsse2.dll
c:program filesStormIIcodec264dsse3.dll
c:program filesStormIIcodec3ivx.dll
c:program filesStormIIcodec3ivxDemux.ax
c:program filesStormIIcodec3ivxDSDecoder.ax
c:program filesStormIIcodecaasc32.dll
c:program filesStormIIcodecac3filter.ax
c:program filesStormIIcodecACDV.dll
c:program filesStormIIcodecacelpdec.ax
c:program filesStormIIcodecasusasv1.dll
c:program filesStormIIcodecasusasv2.dll
c:program filesStormIIcodecativcr2.dll
c:program filesStormIIcodecavcodec.dll
c:program filesStormIIcodecavformat.dll
c:program filesStormIIcodecavidavicodec.dll
c:program filesStormIIcodecAviSplitter.ax
c:program filesStormIIcodecavutil.dll
c:program filesStormIIcodecbass.dll
c:program filesStormIIcodecbass_aac.dll
c:program filesStormIIcodecbass_alac.dll
c:program filesStormIIcodecbass_ape.dll
c:program filesStormIIcodecbass_flac.dll
c:program filesStormIIcodecbass_mpc.dll
c:program filesStormIIcodecbass_tta.dll
c:program filesStormIIcodecbass_wv.dll
c:program filesStormIIcodecbinkw32.dll
c:program filesStormIIcodecBSPVDEC.dll
c:program filesStormIIcodecbw10.dll
c:program filesStormIIcodeccddareader.ax
c:program filesStormIIcodeccdxareader.ax
c:program filesStormIIcodecChpSrcFilter.ax
c:program filesStormIIcodecCinemasterAudio.DLL
c:program filesStormIIcodeccl264dec.ax
c:program filesStormIIcodecCLNavX.ax
c:program filesStormIIcodecCLRVIDDC.DLL
c:program filesStormIIcodecclrviddd.dll
c:program filesStormIIcodecCLVc1Dec.ax
c:program filesStormIIcodecCLVSD.ax
c:program filesStormIIcodecclvsdx.ax
c:program filesStormIIcodeccoreavc.ax
c:program filesStormIIcodecCUVCcodc.dll
c:program filesStormIIcodecDCBassSource.ax
c:program filesStormIIcodecDECVW_32.DLL
c:program filesStormIIcodecdivxdec.ax
c:program filesStormIIcodecDmoDec.dll
c:program filesStormIIcodecDSMSplitter.ax
c:program filesStormIIcodecempgdmx.ax
c:program filesStormIIcodecff_kernelDeint.dll
c:program filesStormIIcodecff_liba52.dll
c:program filesStormIIcodecff_libavcodec.dll
c:program filesStormIIcodecff_libdts.dll
c:program filesStormIIcodecff_libfaad2.dll
c:program filesStormIIcodecff_libmad.dll
c:program filesStormIIcodecff_libmpeg2.dll
c:program filesStormIIcodecff_libmplayer.dll
c:program filesStormIIcodecff_realaac.dll
c:program filesStormIIcodecff_samplerate.dll
c:program filesStormIIcodecff_theora.dll
c:program filesStormIIcodecff_TomsMoComp.dll
c:program filesStormIIcodecff_tremor.dll
c:program filesStormIIcodecff_unrar.dll
c:program filesStormIIcodecff_wmv9.dll
c:program filesStormIIcodecff_xvidcore.dll
c:program filesStormIIcodecffdshow.ax
c:program filesStormIIcodecffdshow.ax.manifest
c:program filesStormIIcodecffmpeg.dll
c:program filesStormIIcodecffsource.ax
c:program filesStormIIcodecFlash.ocx
c:program filesStormIIcodecFLT_ffdshow.dll
c:program filesStormIIcodecFLVSplitter.ax
c:program filesStormIIcodecfrapsvid.dll
c:program filesStormIIcodecG722ADEC.dll
c:program filesStormIIcodecGeoCodec.dll
c:program filesStormIIcodecH264VDEC.dll
c:program filesStormIIcodecHikAudioDec.ax
c:program filesStormIIcodecHikFileSource.ax
c:program filesStormIIcodecHikFileSplitter.ax
c:program filesStormIIcodecHIKM4DEC.dll
c:program filesStormIIcodecHikVideoDec.ax
c:program filesStormIIcodeci263_32.drv
c:program filesStormIIcodecicmw_32.dll
c:program filesStormIIcodeciconv.dll
c:program filesStormIIcodeckdh4.dll
c:program filesStormIIcodeckdm4.dll
c:program filesStormIIcodeckeys.dat
c:program filesStormIIcodecl3codecx.ax
c:program filesStormIIcodecLCodcCMP.dll
c:program filesStormIIcodeclibavcodec.dll
c:program filesStormIIcodeclibmpeg2_ff.dll
c:program filesStormIIcodeclibmplayer.dll
c:program filesStormIIcodecLMVRGBxf.dll
c:program filesStormIIcodecLMVYUVxf.dll
c:program filesStormIIcodeclsvxdec.dll
c:program filesStormIIcodecmfplat.dll
c:program filesStormIIcodecmkunicode.dll
c:program filesStormIIcodecmkx.dll
c:program filesStormIIcodecmkzlib.dll
c:program filesStormIIcodecmmamrdmx.ax
c:program filesStormIIcodecMp3Decdll.dll
c:program filesStormIIcodecMP3DMOD.DLL
c:program filesStormIIcodecmp4.dll
c:program filesStormIIcodecmp43dmod.dll
c:program filesStormIIcodecMP4Demux.ax
c:program filesStormIIcodecmp4sdmod.dll
c:program filesStormIIcodecMP4Splitter.ax
c:program filesStormIIcodecMpaDecFilter.ax
c:program filesStormIIcodecMpaSplitter.ax
c:program filesStormIIcodecmpcvideodec.ax
c:program filesStormIIcodecMpeg2DecFilter.ax
c:program filesStormIIcodecmpeg2dmx.ax
c:program filesStormIIcodecMpegSplitter.ax
c:program filesStormIIcodecmpg2splt.ax
c:program filesStormIIcodecmpg4dmod.dll
c:program filesStormIIcodecmpg4ds32.ax
c:program filesStormIIcodecmsdmo.dll
c:program filesStormIIcodecmsms001.vwp
c:program filesStormIIcodecmsscds32.ax
c:program filesStormIIcodecmsvcp71.dll
c:program filesStormIIcodecmsvcr71.dll
c:program filesStormIIcodecMZP4_DEC.DLL
c:program filesStormIIcodecNDParser.ax
c:program filesStormIIcodecNeMP4Splitter.ax
c:program filesStormIIcodecnvviddec.ax
c:program filesStormIIcodecOggSplitter.ax
c:program filesStormIIcodecogm.dll
c:program filesStormIIcodecopenquicktimelib.dll
c:program filesStormIIcodecPluginsnppl3260.dll
c:program filesStormIIcodecPluginsnppl3260.xpt
c:program filesStormIIcodecPluginsnpqtplugin.dll
c:program filesStormIIcodecPluginsnprpjplug.dll
c:program filesStormIIcodecPluginsnsIQTScriptablePlugin.xpt
c:program filesStormIIcodecPluginsnsJSRealPlayerPlugin.xpt
c:program filesStormIIcodecPluginsQuickTimePlugin.class
c:program filesStormIIcodecPmpSplt.ax
c:program filesStormIIcodecpncrt.dll
c:program filesStormIIcodecpndx5016.dll
c:program filesStormIIcodecpndx5032.dll
c:program filesStormIIcodecpthreadVC2.dll
c:program filesStormIIcodecpvmjpg21.dll
c:program filesStormIIcodecPVWV220.DLL
c:program filesStormIIcodecqasf.dll
c:program filesStormIIcodecQTSystemCFCharacterSetBitmaps.bitmap
c:program filesStormIIcodecQTSystemCoreVideo.qtx
c:program filesStormIIcodecQTSystemCoreVideo.ResourcesCoreVideo.qtr
c:program filesStormIIcodecQTSystemCoreVideo.Resourcesen.lprojCoreVideoLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTime.qtp
c:program filesStormIIcodecQTSystemQuickTime.qts
c:program filesStormIIcodecQTSystemQuickTime.Resourcesen.lprojQuickTimeLocalized.dll
c:program filesStormIIcodecQTSystemQuickTime.Resourcesen.lprojQuickTimeLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTime.ResourcesQuickTime.dll
c:program filesStormIIcodecQTSystemQuickTime.ResourcesQuickTime.qtr
c:program filesStormIIcodecQTSystemQuickTime.ResourcesQuickTime.qtxs
c:program filesStormIIcodecQTSystemQuickTime3GPP.qtx
c:program filesStormIIcodecQTSystemQuickTime3GPP.Resourcesen.lprojQuickTime3GPPLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTime3GPP.ResourcesQuickTime3GPP.qtr
c:program filesStormIIcodecQTSystemQuickTimeAudioSupport.qtx
c:program filesStormIIcodecQTSystemQuickTimeAudioSupport.Resourcesen.lprojQuickTimeAudioSupportLocalized.dll
c:program filesStormIIcodecQTSystemQuickTimeAudioSupport.Resourcesen.lprojQuickTimeAudioSupportLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTimeAudioSupport.ResourcesQuickTimeAudioSupport.qtr
c:program filesStormIIcodecQTSystemQuickTimeEssentials.qtx
c:program filesStormIIcodecQTSystemQuickTimeEssentials.Resourcesen.lprojQuickTimeEssentialsLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTimeEssentials.ResourcesQuickTimeEssentials.qtr
c:program filesStormIIcodecQTSystemQuickTimeH264.qtx
c:program filesStormIIcodecQTSystemQuickTimeH264.Resourcesen.lprojQuickTimeH264Localized.qtr
c:program filesStormIIcodecQTSystemQuickTimeH264.ResourcesQuickTimeH264.qtr
c:program filesStormIIcodecQTSystemQuickTimeInternetExtras.qtx
c:program filesStormIIcodecQTSystemQuickTimeInternetExtras.Resourcesen.lprojQuickTimeInternetExtrasLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTimeInternetExtras.ResourcesQuickTimeInternetExtras.qtr
c:program filesStormIIcodecQTSystemQuickTimeMPEG4.qtx
c:program filesStormIIcodecQTSystemQuickTimeMPEG4.Resourcesen.lprojQuickTimeMPEG4Localized.qtr
c:program filesStormIIcodecQTSystemQuickTimeMPEG4.ResourcesQuickTimeMPEG4.qtr
c:program filesStormIIcodecQTSystemQuickTimeMusic.qtx
c:program filesStormIIcodecQTSystemQuickTimeMusic.Resourcesen.lprojQuickTimeMusicLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTimeMusic.ResourcesQuickTimeMusic.qtr
c:program filesStormIIcodecQTSystemQuickTimeStreaming.qtx
c:program filesStormIIcodecQTSystemQuickTimeStreaming.Resourcesen.lprojQuickTimeStreamingLocalized.dll
c:program filesStormIIcodecQTSystemQuickTimeStreaming.Resourcesen.lprojQuickTimeStreamingLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTimeStreaming.ResourcesQuickTimeStreaming.qtr
c:program filesStormIIcodecQTSystemQuickTimeStreamingExtras.qtx
c:program filesStormIIcodecQTSystemQuickTimeStreamingExtras.Resourcesen.lprojQuickTimeStreamingExtrasLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTimeStreamingExtras.ResourcesQuickTimeStreamingExtras.qtr
c:program filesStormIIcodecQTSystemQuickTimeVR.qtx
c:program filesStormIIcodecQTSystemQuickTimeVR.Resourcesen.lprojQuickTimeVRLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTimeVR.ResourcesQuickTimeVR.qtr
c:program filesStormIIcodecQuickTime.qts
c:program filesStormIIcodecQuickTimeVR.qtx
c:program filesStormIIcodecRadGtSplitter.ax
c:program filesStormIIcodecRealCodecs14_43260.dll
c:program filesStormIIcodecRealCodecs28_83260.dll
c:program filesStormIIcodecRealCodecsatrc.dll
c:program filesStormIIcodecRealCodecscook.dll
c:program filesStormIIcodecRealCodecsddnt3260.dll
c:program filesStormIIcodecRealCodecsdnet3260.dll
c:program filesStormIIcodecRealCodecsdrv1.dll
c:program filesStormIIcodecRealCodecsdrv2.dll
c:program filesStormIIcodecRealCodecsdrvc.dll
c:program filesStormIIcodecRealCodecshxltcolor.dll
c:program filesStormIIcodecRealCodecsraac.dll
c:program filesStormIIcodecRealCodecsralf.dll
c:program filesStormIIcodecRealCodecsrv10.dll
c:program filesStormIIcodecRealCodecsrv20.dll
c:program filesStormIIcodecRealCodecsrv30.dll
c:program filesStormIIcodecRealCodecsrv40.dll
c:program filesStormIIcodecRealCodecssipr.dll
c:program filesStormIIcodecRealCommonobjb3201.dll
c:program filesStormIIcodecRealCommonpnen3260.dll
c:program filesStormIIcodecRealCommonpngu3267.dll
c:program filesStormIIcodecRealCommonpnrs3260.dll
c:program filesStormIIcodecRealCommonrppr3260.dll
c:program filesStormIIcodecRealCommonsecurity.dll
c:program filesStormIIcodecRealPluginsaudplin.dll
c:program filesStormIIcodecRealPluginsauthmgr.dll
c:program filesStormIIcodecRealPluginsclbascauth.dll
c:program filesStormIIcodecRealPluginsclntxres.dll
c:program filesStormIIcodecRealPluginsExtResourcescoreres.xrs
c:program filesStormIIcodecRealPluginsfpsechnd.dll
c:program filesStormIIcodecRealPluginshttpfsys.dll
c:program filesStormIIcodecRealPluginshxsdp.dll
c:program filesStormIIcodecRealPluginshxxml.dll
c:program filesStormIIcodecRealPluginsimgrender.dll
c:program filesStormIIcodecRealPluginsmemfsys.dll
c:program filesStormIIcodecRealPluginsmp3fformat.dll
c:program filesStormIIcodecRealPluginsmp3render.dll
c:program filesStormIIcodecRealPluginsmp4arender.dll
c:program filesStormIIcodecRealPluginsntlmauth.dll
c:program filesStormIIcodecRealPluginsoggfformat.dll
c:program filesStormIIcodecRealPluginspacplin.dll
c:program filesStormIIcodecRealPluginsplusplin.dll
c:program filesStormIIcodecRealPluginspxcb3210.dll
c:program filesStormIIcodecRealPluginsramfformat.dll
c:program filesStormIIcodecRealPluginsramrender.dll
c:program filesStormIIcodecRealPluginsrarender.dll
c:program filesStormIIcodecRealPluginsrmfformat.dll
c:program filesStormIIcodecRealPluginsrmxfpln.dll
c:program filesStormIIcodecRealPluginsrmxrend.dll
c:program filesStormIIcodecRealPluginsrn5auth.dll
c:program filesStormIIcodecRealPluginsrtfformat.dll
c:program filesStormIIcodecRealPluginsrtrender.dll
c:program filesStormIIcodecRealPluginsrvrender.dll
c:program filesStormIIcodecRealPluginssdpplin.dll
c:program filesStormIIcodecRealPluginssecurity.dll
c:program filesStormIIcodecRealPluginssmlfformat.dll
c:program filesStormIIcodecRealPluginssmlrender.dll
c:program filesStormIIcodecRealPluginssmmrender.dll
c:program filesStormIIcodecRealPluginssmplfsys.dll
c:program filesStormIIcodecRealPluginsstubdrm.dll
c:program filesStormIIcodecRealPluginstfilesys.dll
c:program filesStormIIcodecRealPluginsvidplin.dll
c:program filesStormIIcodecRealPluginsvidsite.dll
c:program filesStormIIcodecRealPluginsvorbisrend.dll
c:program filesStormIIcodecRealPluginsvsrlocal.dll
c:program filesStormIIcodecRealrppluginscnembed_cn.dll
c:program filesStormIIcodecRealrppluginscnrpclsvc_cn.dll
c:program filesStormIIcodecRealrppluginsembd3260.dll
c:program filesStormIIcodecRealrppluginsrpcl3260.dll
c:program filesStormIIcodecRealrppluginsrput3260.dll
c:program filesStormIIcodecRenderFilter.ax
c:program filesStormIIcodecRLMPCDec.ax
c:program filesStormIIcodecrmoc3260.dll
c:program filesStormIIcodecRMSplt.ax
c:program filesStormIIcodecSc726dec.ax
c:program filesStormIIcodecscmpack.dll
c:program filesStormIIcodecscsource.ax
c:program filesStormIIcodecskinsres.dll
c:program filesStormIIcodecsmackw32.dll
c:program filesStormIIcodecSonicLicenseManager9.dll
c:program filesStormIIcodecsplitter.ax
c:program filesStormIIcodecswscale.dll
c:program filesStormIIcodecTomsMoComp_ff.dll
c:program filesStormIIcodects.dll
c:program filesStormIIcodectsccvid.dll
c:program filesStormIIcodecTTL2Dec.dll
c:program filesStormIIcodecv2k2_dec.dll
c:program filesStormIIcodecv2kdspde.dll
c:program filesStormIIcodecvc1dc.dll
c:program filesStormIIcodecvc1dmmx.dll
c:program filesStormIIcodecvc1dsse.dll
c:program filesStormIIcodecvc1dsse2.dll
c:program filesStormIIcodecvc1wp.ax
c:program filesStormIIcodecVDODEC32.dll
c:program filesStormIIcodecvdowave.drv
c:program filesStormIIcodecVgmAudio.ax
c:program filesStormIIcodecvgmbgr.ax
c:program filesStormIIcodecVgmSplt.ax
c:program filesStormIIcodecvgmv2k2.ax
c:program filesStormIIcodecVid1Dec.dll
c:program filesStormIIcodecVideoTune.ax
c:program filesStormIIcodecvmnc.dll
c:program filesStormIIcodecvoxmsdec.ax
c:program filesStormIIcodecvp6vfw.dll
c:program filesStormIIcodecvp7vfw.dll
c:program filesStormIIcodecvssver2.scc
c:program filesStormIIcodecWMADMOD.dll
c:program filesStormIIcodecwmpasf.dll
c:program filesStormIIcodecwmsdmod.dll
c:program filesStormIIcodecWMVDECOD.dll
c:program filesStormIIcodecwmvdmod.dll
c:program filesStormIIcodecxvid.ax
c:program filesStormIIcodecxvidcore.dll
c:program filesStormIIcorelog.dll
c:program filesStormIIcurrent.ecs
c:program filesStormIIGdiPlus.dll
c:program filesStormIIgetimg.exe
c:program filesStormIIgifParser.dll
c:program filesStormIIjscript.dll
c:program filesStormIIkeys.dat
c:program filesStormIImediadefdef.flv
c:program filesStormIImediadefdef.ini
c:program filesStormIImediaempty.swf
c:program filesStormIImediamedia4in1.swf
c:program filesStormIImediamediabp.swf
c:program filesStormIImediaothers.xml
c:program filesStormIImediaothers.xml.ini
c:program filesStormIImediastcon.ini
c:program filesStormIImediatoff.ini
c:program filesStormIImediavideo_material_list.xml
c:program filesStormIImediavideo_material_list.xml.ini
c:program filesStormIImediavideo_style_list.xml
c:program filesStormIImediavideo_style_list.xml.ini
c:program filesStormIIMedia2.dll
c:program filesStormIImediainfo.dll
c:program filesStormIImedialib.dll
c:program filesStormIImee.db
c:program filesStormIImeedb.dll
c:program filesStormIIMovieInfo.dll
c:program filesStormIImps.dll
c:program filesStormIImsscript.ocx
c:program filesStormIImsvcp60.dll
c:program filesStormIIP2PCLient.dll
c:program filesStormIIplaylist.smpl
c:program filesStormIIrisconn.ini
c:program filesStormIIrndrmgr.dll
c:program filesStormIISkinјыБъР¶јЧ.zip
c:program filesStormIISkin±©·з1ѕ­µд.zip
c:program filesStormIISkin±©·з2ѕ­µд.zip
c:program filesStormIIspfa.dll
c:program filesStormIIsplayers.dll
c:program filesStormIIstMgr.exe
c:program filesStormIIStorm.exe
c:program filesStormIIStormDebug.exe
c:program filesStormIIStormExcept.log
c:program filesStormIIstormliv.exe
c:program filesStormIIstormply.exe
c:program filesStormIIstormpop.exe
c:program filesStormIIStormRes.dll
c:program filesStormIIsubdecoder.dll
c:program filesStormIIswDirScaner.dll
c:program filesStormIIswftudou.swf
c:program filesStormIIuninst.exe
c:program filesStormIIunrar.dll
c:program filesStormIIvideo.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

---

Legacy_ISODRIVE

---

Service_ISODrive

((((((((((((((((((((((((( Files Created from 2009-02-17 to 2009-03-17 )))))))))))))))))))))))))))))))
.

2009-03-15 22:46 . 2009-03-15 22:46 d—s—- c:documents and settings123UserData

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-21 11:45 737,280 —-a-w c:windowsiun6002.exe
2009-01-19 21:10

---

d

---

w c:program filesAthan
2009-01-19 10:32

---

d

---

w c:documents and settings123Application DataDownload Master
2008-11-16 18:36 2,516 —sha-w c:windowssystem32KGyGaAvL.sys
.

---

Sigcheck

---

2004-09-17 12:16 503808 a975a70fcefe2a224412214320c89ded c:windowssystem32winlogon.exe
2008-04-14 20:11 509440 b3b5d5855127e240c88451030aaee76e c:windowsSoftwareDistributionDownloadeced8b5ea8e636fb8bff2b719fa62647winlogon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]
«{ecdee021-0d17-467f-a1ff-c7a115230949}»= «c:program filesfree-downloads.nettbfree.dll» [2007-12-10 1510424]

[HKEY_CLASSES_ROOTclsid{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_LOCAL_MACHINE~Browser Helper Objects{ecdee021-0d17-467f-a1ff-c7a115230949}]
2007-12-10 13:46 1510424 —a

---

c:program filesfree-downloads.nettbfree.dll

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{ecdee021-0d17-467f-a1ff-c7a115230949}»= «c:program filesfree-downloads.nettbfree.dll» [2007-12-10 1510424]

[HKEY_CLASSES_ROOTclsid{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{ECDEE021-0D17-467F-A1FF-C7A115230949}»= «c:program filesfree-downloads.nettbfree.dll» [2007-12-10 1510424]

[HKEY_CLASSES_ROOTclsid{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2004-08-17 15360]
«AlcoholAutomount»=»d:alcohol 120% 1.9.7.6022Alcohol 120axcmd.exe» [2007-12-22 222080]
«ICQ»=»d:icq6.5ICQ.exe» [2009-03-01 172792]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«IgfxTray»=»c:windowssystem32igfxtray.exe» [2007-09-18 141848]
«HotKeysCmds»=»c:windowssystem32hkcmd.exe» [2007-09-18 166424]
«Persistence»=»c:windowssystem32igfxpers.exe» [2007-09-18 137752]
«V0330Mon.exe»=»c:windowsV0330Mon.exe» [2007-04-30 32768]
«Athan»=»c:program filesAthanAthan.exe» [2009-01-19 1081344]
«ISUSPM Startup»=»c:program filesCommon FilesInstallShieldUpdateServiceisuspm.exe» [2005-08-11 249856]
«ISUSScheduler»=»c:program filesCommon FilesInstallShieldUpdateServiceissch.exe» [2005-08-11 81920]
«MAgent»=»c:program filesMail.RuAgentMAgent.exe» [2009-01-13 5598392]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2004-08-17 15360]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe Reader Speed Launcher]
—a

---

2008-06-12 02:38 34672 c:program filesAdobeReader 9.0Readerreader_sl.exe

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\Messenger\msmsgs.exe»=
«d:\uTorrent.exe»=
«c:\Program Files\Windows Live\Messenger\msnmsgr.exe»=
«c:\Program Files\Windows Live\Messenger\livecall.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«d:\SKYPE\Phone\Skype.exe»=
«d:\ICQ6.5\ICQ.exe»=

R3 V0330VID;WebCam Vista/Live! Cam Chat;c:windowssystem32driversV0330Vid.sys [2008-10-15 157696]
S2 ccosm;Contrl Center of Storm Media;c:program filesStormIIstormliv.exe /asservice —> c:program filesStormIIstormliv.exe [?]
S3 Adofomtk;Adofomtk; [x]
.
Contents of the ‘Scheduled Tasks’ folder

2009-03-17 c:windowsTasksПроверка обновлений для Windows Live Toolbar.job
— c:program filesWindows Live ToolbarMSNTBUP.EXE [2007-10-19 11:20]
.
— — — — ORPHANS REMOVED — — — —

MSConfigStartUp-swg — c:program filesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe

.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.rambler.ru/ri6
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: &Windows Live Search — c:program filesWindows Live Toolbarmsntb.dll/search.htm
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
IE: Добавить в Rambler-Закладки — d:rambler assistantramblertoolbarU5950.dll/zakladki.htm
IE: Закачать ВСЕ при помощи Download Master — d:download masterdmieall.htm
IE: Закачать все при помощи FlashGet — c:program filesFlashGetjc_all.htm
IE: Закачать при помощи Download Master — d:download masterdmie.htm
IE: Закачать при помощи FlashGet — c:program filesFlashGetjc_link.htm
IE: Найти с помощью Рамблера — d:rambler assistantramblertoolbarU5950.dll/search.htm
IE: Опубликовать в Дневнике — d:rambler assistantramblertoolbarU5950.dll/planet.htm
IE: Перевести с помощью словарей Рамблера — d:rambler assistantramblertoolbarU5950.dll/dic.htm
IE: Поиск@Mail.Ru — c:program filesMail.RuSputnikMailRuSputnik.dll/282
IE: Словари@Mail.Ru — c:program filesMail.RuSputnikMailRuSputnik.dll/283
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:program filesMail.RuAgentmagent.exe
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — d:download masterdmaster.exe
TCP: {BEA969AC-7634-4967-8C5C-F4F74DF13E88} = 61.128.114.133 61.128.114.166
FF — ProfilePath — c:documents and settings123Application DataMozillaFirefoxProfileslb4yf04o.default
FF — prefs.js: browser.search.defaulturl — hxxp://search.yahoo.com/search?fr=ffsp1&p=
FF — prefs.js: browser.search.selectedEngine — Rambler
FF — prefs.js: browser.startup.homepage — hxxp://www.rambler.ru/ri6
FF — prefs.js: keyword.URL — hxxp://search.yahoo.com/search?fr=ffds1&p=
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-17 11:57:13
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

Other Running Processes

---

.
c:windowsSYSTEM32IGFXSRVC.EXE
d:alcohol 120% 1.9.7.6022Alcohol 120StarWindStarWindServiceAE.exe
c:windowsSYSTEM32WSCNTFY.EXE
.
**************************************************************************
.
Completion time: 2009-03-17 11:58:09 — machine was rebooted
ComboFix-quarantined-files.txt 2009-03-17 08:58:08

Pre-Run: 8 774 762 496 байт свободно
Post-Run: 8,989,523,968 байт свободно

503 — E O F — 2008-11-12 22:48:02

[Admin]

Практически нормально, но есть один драйвер, подозрительный на вид.
Удалим его.

Откройте блокнот (Кликните Пуск, Выполнить, в строке ввода введите notepad и нажмите Enter) и вставьте в него следующий текст:

Driver::

Adofomtk

Запишите получившийся файл на ваш рабочий стол под именем CFScript
Далее перетащите получившийся файл на иконку Combofix, как показано на картинке ниже.

Сombofix запуститься и выполнит процедуры описанные в созданном нами файле.
По результатам работы Combofix будет создан новый лог, его и вставьте в свой следующий ответ.

САЛАМ АЛЙКУМ , ВАЛРИ. НАКОНЕЧТО ВЫ МНЕ ОТВЕТИЛИ А ТО Я ПОДУМАЛ ЧТО ПОПАЛ В СПИСОК НЕЖЕЛАТЕЛЬНЫХ КЛИЕНТОВ.

Хмм 🙂 Для меня нет нежалательных клиентов, всем рад помочь, НО, мало времени. Поэтому просто физически не успеваю. Отвечаю уже ночью.

[QERIBAN]

ComboFix 09-03-19.01 — 123 2009-03-20 18:02:08.5 — FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1251.1.1049.18.1015.693 [GMT 3:00]
Running from: c:documents and settings123Рабочий столComboFix.exe
Command switches used :: c:documents and settings123Рабочий столCFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:documents and settings123Application DataBITS
c:documents and settings123Application DataBITSBITS.ini
c:documents and settings123Application DataFlashGetBHO
c:documents and settings123Application DataFlashGetBHOFlashGetBHO3.dll
c:documents and settings123Application DataFlashGetBHOGetAllUrl.htm
c:documents and settings123Application DataFlashGetBHOGetUrl.htm
c:program filesFlashGet Network
c:program filesFlashGet NetworkFlashGet 3datdirectui00.JPG
c:program filesFlashGet NetworkFlashGet 3datdirectui00.png
c:program filesFlashGet NetworkFlashGet 3datdirectui01.png
c:program filesFlashGet NetworkFlashGet 3datdirectui1.png
c:program filesFlashGet NetworkFlashGet 3datdirectui2.png
c:program filesFlashGet NetworkFlashGet 3datdirectui3.png
c:program filesFlashGet NetworkFlashGet 3datdirectui4.png
c:program filesFlashGet NetworkFlashGet 3datdirectui5.png
c:program filesFlashGet NetworkFlashGet 3datdirectui6.png
c:program filesFlashGet NetworkFlashGet 3datdirectui7.png
c:program filesFlashGet NetworkFlashGet 3datdirectuiclient_021601.jpg
c:program filesFlashGet NetworkFlashGet 3datdirectuiclient_022403.jpg
c:program filesFlashGet NetworkFlashGet 3datdirectuiclient_nrb4322214h.jpg
c:program filesFlashGet NetworkFlashGet 3datdirectuiclient_nrb4355514h.jpg
c:program filesFlashGet NetworkFlashGet 3datdirectuidirectui_1237369420.zip
c:program filesFlashGet NetworkFlashGet 3datdirectuirescenter.txt
c:program filesFlashGet NetworkFlashGet 3datdirectuirescenter_big5.txt
c:program filesFlashGet NetworkFlashGet 3datFlashGet3db.bak
c:program filesFlashGet NetworkFlashGet 3datFlashGet3db.db
c:program filesFlashGet NetworkFlashGet 3datstatadvertisement0323DF98_69E1_D551_936D_854746192388.gif
c:program filesFlashGet NetworkFlashGet 3datstatadvertisement50599DE6_9463_3F07_8ACC_E1F803BCACD1.swf
c:program filesFlashGet NetworkFlashGet 3datstatadvertisement54DC577F_91F6_9AA0_1D14_CE54447F2105.swf
c:program filesFlashGet NetworkFlashGet 3datstatadvertisement7061F9C5_7DF0_9FB7_75C7_75B28D3C5810.gif
c:program filesFlashGet NetworkFlashGet 3datstatadvertisement9CFF3FF4_1B3A_AB95_091A_FA94E63F4D90.swf
c:program filesFlashGet NetworkFlashGet 3datstatadvertisementADF2D26C_4DA9_2A3F_E67F_8FDD36285FA0.swf
c:program filesFlashGet NetworkFlashGet 3datstatadvertisementB3DEEBCE_F456_E863_6C68_2A1AFCFAD4EC.swf
c:program filesFlashGet NetworkFlashGet 3datstatadvertisementD0E7766E_8B26_FC86_46DE_9468CA7A2A32.swf
c:program filesFlashGet NetworkFlashGet 3datstatadvertisementhelp.bmp
c:program filesFlashGet NetworkFlashGet 3datstatskinpreviewpreview_blue3.png
c:program filesFlashGet NetworkFlashGet 3datstatskinpreviewpreview_red3.png
c:program filesFlashGet NetworkFlashGet 3datstatskinpreviewpreview_white.png
c:program filesFlashGet NetworkFlashGet 3P2PCfg.ini
c:program filesFlashGet NetworkFlashGet 3welcomepage.ini
c:program filesStormII
c:program filesStormIIcodec264be.dll
c:program filesStormIIcodec264dmmx.dll
c:program filesStormIIcodec264dsse.dll
c:program filesStormIIcodec264dsse2.dll
c:program filesStormIIcodec264dsse3.dll
c:program filesStormIIcodecaasc32.dll
c:program filesStormIIcodecac3filter.ax
c:program filesStormIIcodecacelpdec.ax
c:program filesStormIIcodecasusasv1.dll
c:program filesStormIIcodecasusasv2.dll
c:program filesStormIIcodecativcr2.dll
c:program filesStormIIcodecavcodec.dll
c:program filesStormIIcodecavformat.dll
c:program filesStormIIcodecavidavicodec.dll
c:program filesStormIIcodecAviSplitter.ax
c:program filesStormIIcodecavutil.dll
c:program filesStormIIcodecbass.dll
c:program filesStormIIcodecbass_aac.dll
c:program filesStormIIcodecbass_alac.dll
c:program filesStormIIcodecbass_ape.dll
c:program filesStormIIcodecbass_flac.dll
c:program filesStormIIcodecbass_mpc.dll
c:program filesStormIIcodecbass_tta.dll
c:program filesStormIIcodecbass_wv.dll
c:program filesStormIIcodecbinkw32.dll
c:program filesStormIIcodecBSPVDEC.dll
c:program filesStormIIcodecbw10.dll
c:program filesStormIIcodeccddareader.ax
c:program filesStormIIcodeccdxareader.ax
c:program filesStormIIcodecChpSrcFilter.ax
c:program filesStormIIcodecCinemasterAudio.DLL
c:program filesStormIIcodeccl264dec.ax
c:program filesStormIIcodecCLNavX.ax
c:program filesStormIIcodecCLRVIDDC.DLL
c:program filesStormIIcodecclrviddd.dll
c:program filesStormIIcodecCLVc1Dec.ax
c:program filesStormIIcodecCLVSD.ax
c:program filesStormIIcodecclvsdx.ax
c:program filesStormIIcodeccoreavc.ax
c:program filesStormIIcodecCUVCcodc.dll
c:program filesStormIIcodecDCBassSource.ax
c:program filesStormIIcodecDECVW_32.DLL
c:program filesStormIIcodecdivxdec.ax
c:program filesStormIIcodecDmoDec.dll
c:program filesStormIIcodecDSMSplitter.ax
c:program filesStormIIcodecempgdmx.ax
c:program filesStormIIcodecff_kernelDeint.dll
c:program filesStormIIcodecff_liba52.dll
c:program filesStormIIcodecff_libavcodec.dll
c:program filesStormIIcodecff_libdts.dll
c:program filesStormIIcodecff_libfaad2.dll
c:program filesStormIIcodecff_libmad.dll
c:program filesStormIIcodecff_libmpeg2.dll
c:program filesStormIIcodecff_libmplayer.dll
c:program filesStormIIcodecff_realaac.dll
c:program filesStormIIcodecff_samplerate.dll
c:program filesStormIIcodecff_theora.dll
c:program filesStormIIcodecff_TomsMoComp.dll
c:program filesStormIIcodecff_tremor.dll
c:program filesStormIIcodecff_unrar.dll
c:program filesStormIIcodecff_wmv9.dll
c:program filesStormIIcodecff_xvidcore.dll
c:program filesStormIIcodecffdshow.ax
c:program filesStormIIcodecffdshow.ax.manifest
c:program filesStormIIcodecffmpeg.dll
c:program filesStormIIcodecffsource.ax
c:program filesStormIIcodecFlash.ocx
c:program filesStormIIcodecFLT_ffdshow.dll
c:program filesStormIIcodecFLVSplitter.ax
c:program filesStormIIcodecfrapsvid.dll
c:program filesStormIIcodecG722ADEC.dll
c:program filesStormIIcodecGeoCodec.dll
c:program filesStormIIcodecH264VDEC.dll
c:program filesStormIIcodecHikAudioDec.ax
c:program filesStormIIcodecHikFileSource.ax
c:program filesStormIIcodecHikFileSplitter.ax
c:program filesStormIIcodecHIKM4DEC.dll
c:program filesStormIIcodecHikVideoDec.ax
c:program filesStormIIcodeci263_32.drv
c:program filesStormIIcodecicmw_32.dll
c:program filesStormIIcodeciconv.dll
c:program filesStormIIcodeckdh4.dll
c:program filesStormIIcodeckdm4.dll
c:program filesStormIIcodeckeys.dat
c:program filesStormIIcodecl3codecx.ax
c:program filesStormIIcodecLCodcCMP.dll
c:program filesStormIIcodeclibavcodec.dll
c:program filesStormIIcodeclibmpeg2_ff.dll
c:program filesStormIIcodeclibmplayer.dll
c:program filesStormIIcodecLMVRGBxf.dll
c:program filesStormIIcodecLMVYUVxf.dll
c:program filesStormIIcodeclsvxdec.dll
c:program filesStormIIcodecmfplat.dll
c:program filesStormIIcodecmkunicode.dll
c:program filesStormIIcodecmkx.dll
c:program filesStormIIcodecmkzlib.dll
c:program filesStormIIcodecmmamrdmx.ax
c:program filesStormIIcodecMp3Decdll.dll
c:program filesStormIIcodecMP3DMOD.DLL
c:program filesStormIIcodecmp4.dll
c:program filesStormIIcodecmp43dmod.dll
c:program filesStormIIcodecmp4sdmod.dll
c:program filesStormIIcodecMP4Splitter.ax
c:program filesStormIIcodecMpaDecFilter.ax
c:program filesStormIIcodecMpaSplitter.ax
c:program filesStormIIcodecmpcvideodec.ax
c:program filesStormIIcodecMpeg2DecFilter.ax
c:program filesStormIIcodecmpeg2dmx.ax
c:program filesStormIIcodecMpegSplitter.ax
c:program filesStormIIcodecmpg2splt.ax
c:program filesStormIIcodecmpg4dmod.dll
c:program filesStormIIcodecmsdmo.dll
c:program filesStormIIcodecmsms001.vwp
c:program filesStormIIcodecmsvcp71.dll
c:program filesStormIIcodecmsvcr71.dll
c:program filesStormIIcodecMZP4_DEC.DLL
c:program filesStormIIcodecNDParser.ax
c:program filesStormIIcodecNeMP4Splitter.ax
c:program filesStormIIcodecnvviddec.ax
c:program filesStormIIcodecOggSplitter.ax
c:program filesStormIIcodecPluginsnppl3260.dll
c:program filesStormIIcodecPluginsnppl3260.xpt
c:program filesStormIIcodecPluginsnpqtplugin.dll
c:program filesStormIIcodecPluginsnprpjplug.dll
c:program filesStormIIcodecPluginsnsIQTScriptablePlugin.xpt
c:program filesStormIIcodecPluginsnsJSRealPlayerPlugin.xpt
c:program filesStormIIcodecPluginsQuickTimePlugin.class
c:program filesStormIIcodecPmpSplt.ax
c:program filesStormIIcodecpncrt.dll
c:program filesStormIIcodecpndx5016.dll
c:program filesStormIIcodecpndx5032.dll
c:program filesStormIIcodecpthreadVC2.dll
c:program filesStormIIcodecpvmjpg21.dll
c:program filesStormIIcodecPVWV220.DLL
c:program filesStormIIcodecqasf.dll
c:program filesStormIIcodecQTSystemCFCharacterSetBitmaps.bitmap
c:program filesStormIIcodecQTSystemCoreVideo.qtx
c:program filesStormIIcodecQTSystemCoreVideo.ResourcesCoreVideo.qtr
c:program filesStormIIcodecQTSystemCoreVideo.Resourcesen.lprojCoreVideoLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTime.qts
c:program filesStormIIcodecQTSystemQuickTime.Resourcesen.lprojQuickTimeLocalized.dll
c:program filesStormIIcodecQTSystemQuickTime.Resourcesen.lprojQuickTimeLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTime.ResourcesQuickTime.dll
c:program filesStormIIcodecQTSystemQuickTime.ResourcesQuickTime.qtr
c:program filesStormIIcodecQTSystemQuickTime.ResourcesQuickTime.qtxs
c:program filesStormIIcodecQTSystemQuickTime3GPP.qtx
c:program filesStormIIcodecQTSystemQuickTime3GPP.Resourcesen.lprojQuickTime3GPPLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTime3GPP.ResourcesQuickTime3GPP.qtr
c:program filesStormIIcodecQTSystemQuickTimeAudioSupport.qtx
c:program filesStormIIcodecQTSystemQuickTimeAudioSupport.Resourcesen.lprojQuickTimeAudioSupportLocalized.dll
c:program filesStormIIcodecQTSystemQuickTimeAudioSupport.Resourcesen.lprojQuickTimeAudioSupportLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTimeAudioSupport.ResourcesQuickTimeAudioSupport.qtr
c:program filesStormIIcodecQTSystemQuickTimeEssentials.qtx
c:program filesStormIIcodecQTSystemQuickTimeEssentials.Resourcesen.lprojQuickTimeEssentialsLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTimeEssentials.ResourcesQuickTimeEssentials.qtr
c:program filesStormIIcodecQTSystemQuickTimeH264.qtx
c:program filesStormIIcodecQTSystemQuickTimeH264.Resourcesen.lprojQuickTimeH264Localized.qtr
c:program filesStormIIcodecQTSystemQuickTimeH264.ResourcesQuickTimeH264.qtr
c:program filesStormIIcodecQTSystemQuickTimeInternetExtras.qtx
c:program filesStormIIcodecQTSystemQuickTimeInternetExtras.Resourcesen.lprojQuickTimeInternetExtrasLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTimeInternetExtras.ResourcesQuickTimeInternetExtras.qtr
c:program filesStormIIcodecQTSystemQuickTimeMPEG4.qtx
c:program filesStormIIcodecQTSystemQuickTimeMPEG4.Resourcesen.lprojQuickTimeMPEG4Localized.qtr
c:program filesStormIIcodecQTSystemQuickTimeMPEG4.ResourcesQuickTimeMPEG4.qtr
c:program filesStormIIcodecQTSystemQuickTimeMusic.qtx
c:program filesStormIIcodecQTSystemQuickTimeMusic.Resourcesen.lprojQuickTimeMusicLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTimeMusic.ResourcesQuickTimeMusic.qtr
c:program filesStormIIcodecQTSystemQuickTimeStreaming.qtx
c:program filesStormIIcodecQTSystemQuickTimeStreaming.Resourcesen.lprojQuickTimeStreamingLocalized.dll
c:program filesStormIIcodecQTSystemQuickTimeStreaming.Resourcesen.lprojQuickTimeStreamingLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTimeStreaming.ResourcesQuickTimeStreaming.qtr
c:program filesStormIIcodecQTSystemQuickTimeStreamingExtras.qtx
c:program filesStormIIcodecQTSystemQuickTimeStreamingExtras.Resourcesen.lprojQuickTimeStreamingExtrasLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTimeStreamingExtras.ResourcesQuickTimeStreamingExtras.qtr
c:program filesStormIIcodecQTSystemQuickTimeVR.qtx
c:program filesStormIIcodecQTSystemQuickTimeVR.Resourcesen.lprojQuickTimeVRLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTimeVR.ResourcesQuickTimeVR.qtr
c:program filesStormIIcodecQuickTime.qts
c:program filesStormIIcodecQuickTimeVR.qtx
c:program filesStormIIcodecRadGtSplitter.ax
c:program filesStormIIcodecRealCodecs14_43260.dll
c:program filesStormIIcodecRealCodecs28_83260.dll
c:program filesStormIIcodecRealCodecsatrc.dll
c:program filesStormIIcodecRealCodecscook.dll
c:program filesStormIIcodecRealCodecsddnt3260.dll
c:program filesStormIIcodecRealCodecsdnet3260.dll
c:program filesStormIIcodecRealCodecsdrv1.dll
c:program filesStormIIcodecRealCodecsdrv2.dll
c:program filesStormIIcodecRealCodecsdrvc.dll
c:program filesStormIIcodecRealCodecshxltcolor.dll
c:program filesStormIIcodecRealCodecsraac.dll
c:program filesStormIIcodecRealCodecsralf.dll
c:program filesStormIIcodecRealCodecsrv10.dll
c:program filesStormIIcodecRealCodecsrv20.dll
c:program filesStormIIcodecRealCodecsrv30.dll
c:program filesStormIIcodecRealCodecsrv40.dll
c:program filesStormIIcodecRealCodecssipr.dll
c:program filesStormIIcodecRealCommonobjb3201.dll
c:program filesStormIIcodecRealCommonpnen3260.dll
c:program filesStormIIcodecRealCommonpngu3267.dll
c:program filesStormIIcodecRealCommonpnrs3260.dll
c:program filesStormIIcodecRealCommonrppr3260.dll
c:program filesStormIIcodecRealCommonsecurity.dll
c:program filesStormIIcodecRealPluginsaudplin.dll
c:program filesStormIIcodecRealPluginsauthmgr.dll
c:program filesStormIIcodecRealPluginsclbascauth.dll
c:program filesStormIIcodecRealPluginsclntxres.dll
c:program filesStormIIcodecRealPluginsExtResourcescoreres.xrs
c:program filesStormIIcodecRealPluginsfpsechnd.dll
c:program filesStormIIcodecRealPluginshttpfsys.dll
c:program filesStormIIcodecRealPluginshxsdp.dll
c:program filesStormIIcodecRealPluginshxxml.dll
c:program filesStormIIcodecRealPluginsimgrender.dll
c:program filesStormIIcodecRealPluginsmemfsys.dll
c:program filesStormIIcodecRealPluginsmp3fformat.dll
c:program filesStormIIcodecRealPluginsmp3render.dll
c:program filesStormIIcodecRealPluginsmp4arender.dll
c:program filesStormIIcodecRealPluginsntlmauth.dll
c:program filesStormIIcodecRealPluginsoggfformat.dll
c:program filesStormIIcodecRealPluginspacplin.dll
c:program filesStormIIcodecRealPluginsplusplin.dll
c:program filesStormIIcodecRealPluginspxcb3210.dll
c:program filesStormIIcodecRealPluginsramfformat.dll
c:program filesStormIIcodecRealPluginsramrender.dll
c:program filesStormIIcodecRealPluginsrarender.dll
c:program filesStormIIcodecRealPluginsrmfformat.dll
c:program filesStormIIcodecRealPluginsrmxfpln.dll
c:program filesStormIIcodecRealPluginsrmxrend.dll
c:program filesStormIIcodecRealPluginsrn5auth.dll
c:program filesStormIIcodecRealPluginsrtfformat.dll
c:program filesStormIIcodecRealPluginsrtrender.dll
c:program filesStormIIcodecRealPluginsrvrender.dll
c:program filesStormIIcodecRealPluginssdpplin.dll
c:program filesStormIIcodecRealPluginssecurity.dll
c:program filesStormIIcodecRealPluginssmlfformat.dll
c:program filesStormIIcodecRealPluginssmlrender.dll
c:program filesStormIIcodecRealPluginssmmrender.dll
c:program filesStormIIcodecRealPluginssmplfsys.dll
c:program filesStormIIcodecRealPluginsstubdrm.dll
c:program filesStormIIcodecRealPluginstfilesys.dll
c:program filesStormIIcodecRealPluginsvidplin.dll
c:program filesStormIIcodecRealPluginsvidsite.dll
c:program filesStormIIcodecRealPluginsvorbisrend.dll
c:program filesStormIIcodecRealPluginsvsrlocal.dll
c:program filesStormIIcodecRealrppluginscnembed_cn.dll
c:program filesStormIIcodecRealrppluginscnrpclsvc_cn.dll
c:program filesStormIIcodecRealrppluginsembd3260.dll
c:program filesStormIIcodecRealrppluginsrpcl3260.dll
c:program filesStormIIcodecRealrppluginsrput3260.dll
c:program filesStormIIcodecRLMPCDec.ax
c:program filesStormIIcodecrmoc3260.dll
c:program filesStormIIcodecRMSplt.ax
c:program filesStormIIcodecSc726dec.ax
c:program filesStormIIcodecscmpack.dll
c:program filesStormIIcodecscsource.ax
c:program filesStormIIcodecsmackw32.dll
c:program filesStormIIcodecSonicLicenseManager9.dll
c:program filesStormIIcodecsplitter.ax
c:program filesStormIIcodecTomsMoComp_ff.dll
c:program filesStormIIcodects.dll
c:program filesStormIIcodectsccvid.dll
c:program filesStormIIcodecTTL2Dec.dll
c:program filesStormIIcodecv2k2_dec.dll
c:program filesStormIIcodecv2kdspde.dll
c:program filesStormIIcodecvc1dc.dll
c:program filesStormIIcodecvc1dmmx.dll
c:program filesStormIIcodecvc1dsse.dll
c:program filesStormIIcodecvc1dsse2.dll
c:program filesStormIIcodecvc1wp.ax
c:program filesStormIIcodecVDODEC32.dll
c:program filesStormIIcodecvdowave.drv
c:program filesStormIIcodecVgmAudio.ax
c:program filesStormIIcodecvgmbgr.ax
c:program filesStormIIcodecVgmSplt.ax
c:program filesStormIIcodecvgmv2k2.ax
c:program filesStormIIcodecVid1Dec.dll
c:program filesStormIIcodecvmnc.dll
c:program filesStormIIcodecvoxmsdec.ax
c:program filesStormIIcodecvp6vfw.dll
c:program filesStormIIcodecvp7vfw.dll
c:program filesStormIIcodecvssver2.scc
c:program filesStormIIcodecWMADMOD.dll
c:program filesStormIIcodecwmpasf.dll
c:program filesStormIIcodecwmsdmod.dll
c:program filesStormIIcodecWMVDECOD.dll
c:program filesStormIIcodecwmvdmod.dll
c:program filesStormIIcodecxvid.ax
c:program filesStormIIcodecxvidcore.dll
c:program filesStormIIcurrent.ecs
c:program filesStormIIjscript.dll
c:program filesStormIIkeys.dat
c:program filesStormIImediadefdef.flv
c:program filesStormIImediadefdef.ini
c:program filesStormIImediaempty.swf
c:program filesStormIImediamedia4in1.swf
c:program filesStormIImediamediabp.swf
c:program filesStormIImediaothers.xml
c:program filesStormIImediaothers.xml.ini
c:program filesStormIImediastcon.ini
c:program filesStormIImediatoff.ini
c:program filesStormIImediavideo_material_list.xml
c:program filesStormIImediavideo_material_list.xml.ini
c:program filesStormIImediavideo_style_list.xml
c:program filesStormIImediavideo_style_list.xml.ini
c:program filesStormIIMedia2.dll
c:program filesStormIImee.db
c:program filesStormIIMovieInfo.dll
c:program filesStormIImps.dll
c:program filesStormIImsscript.ocx
c:program filesStormIImsvcp60.dll
c:program filesStormIIrndrmgr.dll
c:program filesStormIIscore.dll
c:program filesStormIIsexpert.dll
c:program filesStormIISkinјыБъР¶јЧ.zip
c:program filesStormIISkin±©·з1ѕ­µд.zip
c:program filesStormIISkin±©·з2ѕ­µд.zip
c:program filesStormIIspfa.dll
c:program filesStormIIsplayers.dll
c:program filesStormIIsprobe.dll
c:program filesStormIIStorm.exe
c:program filesStormIIstormliv.exe
c:program filesStormIIstormply.exe
c:program filesStormIIStormRes.dll
c:program filesStormIIsubdecoder.dll
c:program filesStormIIuninst.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

---

Service_Adofomtk

((((((((((((((((((((((((( Files Created from 2009-02-20 to 2009-03-20 )))))))))))))))))))))))))))))))
.

2009-03-19 01:24 . 2009-03-19 01:25 4,114 —a

---

c:windowssystem32secushr.dat
2009-03-19 01:24 . 2009-03-19 01:24 248 —a

---

c:windowssystem32secustat.dat
2009-03-19 01:23 . 2009-03-19 01:23 d

---

c:documents and settings123Application DataFlashgetSetup
2009-03-19 01:18 . 2009-03-19 01:18 d

---

c:documents and settings123Application DataMedia Player Classic
2009-03-15 22:46 . 2009-03-15 22:46 d—s—- c:documents and settings123UserData

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-19 22:38 2,516 —sha-w c:windowssystem32KGyGaAvL.sys
2009-01-21 11:45 737,280 —-a-w c:windowsiun6002.exe
.

---

Sigcheck

---

2008-06-20 14:45 360320 01d5eaaff224415a7ff513e4c882be30 c:windowssystem32driverstcpip.sys
2008-06-20 14:45 360320 2a5554fc5b1e04e131230e3ce035c3f9 c:windowssystem32dllcachetcpip.sys
2008-04-13 23:20 361344 93ea8d04ec73a85db02eb8805988f733 c:windowsSoftwareDistributionDownloadeced8b5ea8e636fb8bff2b719fa62647tcpip.sys
2008-06-20 14:44 360960 744e57c99232201ae98c49168b918f48 c:windows$hf_mig$KB951748SP2QFEtcpip.sys
2008-06-20 15:51 361600 9aefa14bd6b182d61e3119fa5f436d3d c:windows$hf_mig$KB951748SP3GDRtcpip.sys
2008-06-20 15:59 361600 ad978a1b783b5719720cff204b666c8e c:windows$hf_mig$KB951748SP3QFEtcpip.sys
2004-08-03 19:14 359040 6a2d53177c1eac531308708e65782304 c:windows$NtUninstallKB951748$tcpip.sys

2004-09-17 12:16 503808 a975a70fcefe2a224412214320c89ded c:windowssystem32winlogon.exe
2008-04-14 20:11 509440 b3b5d5855127e240c88451030aaee76e c:windowsSoftwareDistributionDownloadeced8b5ea8e636fb8bff2b719fa62647winlogon.exe
.
((((((((((((((((((((((((((((( SnapShot@2009-03-17_11.57.43.50 )))))))))))))))))))))))))))))))))))))))))
.
— 2009-01-17 04:11:34 199,344 —-a-w c:windowssystem32FNTCACHE.DAT
+ 2009-03-18 19:31:34 200,936 —-a-w c:windowssystem32FNTCACHE.DAT
— 2009-03-17 08:32:14 40,326 —-a-w c:windowssystem32perfc009.dat
+ 2009-03-20 12:44:48 40,326 —-a-w c:windowssystem32perfc009.dat
— 2009-03-17 08:32:14 49,750 —-a-w c:windowssystem32perfc019.dat
+ 2009-03-20 12:44:48 49,750 —-a-w c:windowssystem32perfc019.dat
— 2009-03-17 08:32:14 311,938 —-a-w c:windowssystem32perfh009.dat
+ 2009-03-20 12:44:48 311,938 —-a-w c:windowssystem32perfh009.dat
— 2009-03-17 08:32:14 346,690 —-a-w c:windowssystem32perfh019.dat
+ 2009-03-20 12:44:48 346,690 —-a-w c:windowssystem32perfh019.dat
+ 2008-09-06 10:00:00 278,528 —-a-w c:windowssystem32pncrt.dll
+ 2008-09-06 10:00:00 6,656 —-a-w c:windowssystem32pndx5016.dll
+ 2008-09-06 10:00:00 5,632 —-a-w c:windowssystem32pndx5032.dll
+ 2008-09-06 10:00:00 185,944 —-a-w c:windowssystem32rmoc3260.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]
«{ecdee021-0d17-467f-a1ff-c7a115230949}»= «c:program filesfree-downloads.nettbfree.dll» [2007-12-10 1510424]

[HKEY_CLASSES_ROOTclsid{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_LOCAL_MACHINE~Browser Helper Objects{ecdee021-0d17-467f-a1ff-c7a115230949}]
2007-12-10 13:46 1510424 —a

---

c:program filesfree-downloads.nettbfree.dll

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{ecdee021-0d17-467f-a1ff-c7a115230949}»= «c:program filesfree-downloads.nettbfree.dll» [2007-12-10 1510424]

[HKEY_CLASSES_ROOTclsid{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{ECDEE021-0D17-467F-A1FF-C7A115230949}»= «c:program filesfree-downloads.nettbfree.dll» [2007-12-10 1510424]

[HKEY_CLASSES_ROOTclsid{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2004-08-17 15360]
«AlcoholAutomount»=»d:alcohol 120% 1.9.7.6022Alcohol 120axcmd.exe» [2007-12-22 222080]
«swg»=»c:program filesGoogleGoogleToolbarNotifier1.2.911.3380GoogleToolbarNotifier.exe» [2009-03-19 162744]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«IgfxTray»=»c:windowssystem32igfxtray.exe» [2007-09-18 141848]
«HotKeysCmds»=»c:windowssystem32hkcmd.exe» [2007-09-18 166424]
«Persistence»=»c:windowssystem32igfxpers.exe» [2007-09-18 137752]
«V0330Mon.exe»=»c:windowsV0330Mon.exe» [2007-04-30 32768]
«Athan»=»c:program filesAthanAthan.exe» [2009-01-19 1081344]
«ISUSPM Startup»=»c:program filesCommon FilesInstallShieldUpdateServiceisuspm.exe» [2005-08-11 249856]
«ISUSScheduler»=»c:program filesCommon FilesInstallShieldUpdateServiceissch.exe» [2005-08-11 81920]
«MAgent»=»c:program filesMail.RuAgentMAgent.exe» [2009-01-13 5598392]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2004-08-17 15360]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe Reader Speed Launcher]
—a

---

2008-06-12 02:38 34672 c:program filesAdobeReader 9.0Readerreader_sl.exe

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\Messenger\msmsgs.exe»=
«d:\uTorrent.exe»=
«c:\Program Files\Windows Live\Messenger\msnmsgr.exe»=
«c:\Program Files\Windows Live\Messenger\livecall.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«d:\SKYPE\Phone\Skype.exe»=
«d:\ICQ6.5\ICQ.exe»=
«$INSTDIR\FlvDetector.exe»= c:\Program Files\FlashGet Network\FlashGet 3\FlvDetector.exe

R3 V0330VID;WebCam Vista/Live! Cam Chat;c:windowssystem32driversV0330Vid.sys [2008-10-15 157696]
S2 ccosm;Contrl Center of Storm Media;c:program filesStormIIstormliv.exe /asservice —> c:program filesStormIIstormliv.exe [?]
.
Contents of the ‘Scheduled Tasks’ folder

2009-03-20 c:windowsTasksПроверка обновлений для Windows Live Toolbar.job
— c:program filesWindows Live ToolbarMSNTBUP.EXE [2007-10-19 11:20]
.
— — — — ORPHANS REMOVED — — — —

HKCU-Run-FlashGet 3 — c:program filesFlashGet NetworkFlashGet 3FlashGet3.exe

.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.mail.ru/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: &Windows Live Search — c:program filesWindows Live Toolbarmsntb.dll/search.htm
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
IE: Добавить в Rambler-Закладки — d:rambler assistantramblertoolbarU5950.dll/zakladki.htm
IE: Закачать ВСЕ при помощи Download Master — d:download masterdmieall.htm
IE: Закачать все при помощи FlashGet — c:program filesFlashGetjc_all.htm
IE: Закачать при помощи Download Master — d:download masterdmie.htm
IE: Закачать при помощи FlashGet — c:program filesFlashGetjc_link.htm
IE: Найти с помощью Рамблера — d:rambler assistantramblertoolbarU5950.dll/search.htm
IE: Опубликовать в Дневнике — d:rambler assistantramblertoolbarU5950.dll/planet.htm
IE: Перевести с помощью словарей Рамблера — d:rambler assistantramblertoolbarU5950.dll/dic.htm
IE: Поиск@Mail.Ru — c:program filesMail.RuSputnikMailRuSputnik.dll/282
IE: Словари@Mail.Ru — c:program filesMail.RuSputnikMailRuSputnik.dll/283
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:program filesMail.RuAgentmagent.exe
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — d:download masterdmaster.exe
TCP: {BEA969AC-7634-4967-8C5C-F4F74DF13E88} = 61.128.114.133 61.128.114.166
FF — ProfilePath — c:documents and settings123Application DataMozillaFirefoxProfileslb4yf04o.default
FF — prefs.js: browser.search.defaulturl — hxxp://search.yahoo.com/search?fr=ffsp1&p=
FF — prefs.js: browser.search.selectedEngine — Rambler
FF — prefs.js: browser.startup.homepage — hxxp://www.rambler.ru/ri6
FF — prefs.js: keyword.URL — hxxp://search.yahoo.com/search?fr=ffds1&p=
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-20 18:05:45
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

Other Running Processes

---

.
c:windowsSYSTEM32IGFXSRVC.EXE
d:alcohol 120% 1.9.7.6022Alcohol 120StarWindStarWindServiceAE.exe
c:windowsSYSTEM32WSCNTFY.EXE
c:program filesinternet exploreriexplore.exe
c:program filesCommon FilesMicrosoft SharedWindows LiveWLLoginProxy.exe
.
**************************************************************************
.
Completion time: 2009-03-20 18:06:43 — machine was rebooted
ComboFix-quarantined-files.txt 2009-03-20 15:06:42
ComboFix2.txt 2009-03-17 08:58:12

Pre-Run: 5 873 270 784 байт свободно
Post-Run: 7,945,060,352 байт свободно

531 — E O F — 2008-11-12 22:48:02

А EЩО У МЕНЯ ПЕРЕСТАЛА РАБОТАТЬ ФУНКЦИЯ CTRL+AL+DELETE.
НА СЧЕТ ДВУХ БУКВ АЛФОВИТА (T,Y) КОТОРЫЕ ПЕРЕСТАЛИ РОБОТАТЬ ВЫ НЕ УТОЧНИЛИ. МОЯ ПРОБЛЕМА В САМОМ НОТБУКЕ? ,БЛОГОДАРЕН ЗА ВСЕ….

[Admin]

Combofix лог выглядит нормально.

А EЩО У МЕНЯ ПЕРЕСТАЛА РАБОТАТЬ ФУНКЦИЯ CTRL+AL+DELETE.
НА СЧЕТ ДВУХ БУКВ АЛФОВИТА (T,Y) КОТОРЫЕ ПЕРЕСТАЛИ РОБОТАТЬ ВЫ НЕ УТОЧНИЛИ

Я лично сталкивался с проблемой, когда переставали работать клавиши (сгорела микросхема), попробуйте просто подключить к ноуту внешнюю клавиатуру.

И ещё, приложите к вашему ответу свежий GMER лог.

[QERIBAN]

GMER лог — ЧТО ЕТО?

[Admin]

GMER лог — это лог, который получается в результате использования программы GMER. В этой теме мы уже использовали эту программу, найдите моё сообщение, прочитайте и снова выполните инструкцию.

[QERIBAN]

GMER 1.0.15.14944 — http://www.gmer.net
Rootkit scan 2009-03-27 12:16:04
Windows 5.1.2600 Service Pack 3

—- System — GMER 1.0.15 —-

SSDT spcs.sys ZwCreateKey [0xF730A0E0]
SSDT F7C48844 ZwCreateThread
SSDT spcs.sys ZwEnumerateKey [0xF7327CA2]
SSDT spcs.sys ZwEnumerateValueKey [0xF7328030]
SSDT spcs.sys ZwOpenKey [0xF730A0C0]
SSDT F7C48830 ZwOpenProcess
SSDT F7C48835 ZwOpenThread
SSDT spcs.sys ZwQueryKey [0xF7328108]
SSDT spcs.sys ZwQueryValueKey [0xF7327F88]
SSDT spcs.sys ZwSetValueKey [0xF732819A]
SSDT F7C4883F ZwTerminateProcess
SSDT F7C4883A ZwWriteVirtualMemory

INT 0x62 ? 86D68BF8
INT 0x82 ? 86D68BF8
INT 0xB4 ? 86AE2BF8
INT 0xB4 ? 86AE2BF8

—- Kernel code sections — GMER 1.0.15 —-

? spcs.sys Íå óäàåòñÿ íàéòè óêàçàííûé ôàéë. !
.text USBPORT.SYS!DllUnload F683C8AC 5 Bytes JMP 86AE21D8
.text a0h3kmdv.SYS F674B384 1 Byte [20]
.text a0h3kmdv.SYS F674B384 37 Bytes [20, 00, 00, 68, 00, 00, 00, …]
.text a0h3kmdv.SYS F674B3AA 24 Bytes [00, 00, 20, 00, 00, E0, 00, …]
.text a0h3kmdv.SYS F674B3C4 3 Bytes [00, 00, 00]
.text a0h3kmdv.SYS F674B3C9 1 Byte [00]
.text …

—- Kernel IAT/EAT — GMER 1.0.15 —-

IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F730B040] spcs.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F730B13C] spcs.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F730B0BE] spcs.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F730B7FC] spcs.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F730B6D2] spcs.sys
IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!KfAcquireSpinLock] 00000034
IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!READ_PORT_UCHAR] 0000008E
IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!KeGetCurrentIrql] 00000043
IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!KfRaiseIrql] 00000044
IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!KfLowerIrql] 000000C4
IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!HalGetInterruptVector] 000000DE
IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!HalTranslateBusAddress] 000000E9
IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!KeStallExecutionProcessor] 000000CB
IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!KfReleaseSpinLock] 00000054
IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] 0000007B
IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!READ_PORT_USHORT] 00000094
IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] 00000032
IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!WRITE_PORT_UCHAR] 000000A6
IAT SystemRootSystem32Driversa0h3kmdv.SYS[WMILIB.SYS!WmiSystemControl] 00000023
IAT SystemRootSystem32Driversa0h3kmdv.SYS[WMILIB.SYS!WmiCompleteRequest] 0000003D

—- Devices — GMER 1.0.15 —-

Device FileSystemFastfat FatCdrom 86D671F8

AttachedDevice DriverTcpip DeviceIp avfwot.sys (TDI filtering kernel driver/Avira GmbH)

Device Driverusbuhci DeviceUSBPDO-0 86B591F8
Device Driverusbehci DeviceUSBPDO-1 86A311F8
Device Driverdmio DeviceDmControlDmIoDaemon 86DD81F8
Device Driverdmio DeviceDmControlDmConfig 86DD81F8
Device Driverdmio DeviceDmControlDmPnP 86DD81F8
Device Driverdmio DeviceDmControlDmInfo 86DD81F8
Device DriverPCI_PNP7718 Device0000055 spcs.sys

AttachedDevice DriverTcpip DeviceTcp avfwot.sys (TDI filtering kernel driver/Avira GmbH)

Device DriverFtdisk DeviceHarddiskVolume1 86D691F8
Device DriverFtdisk DeviceHarddiskVolume2 86D691F8
Device DriverCdrom DeviceCdRom0 86A88500
Device DriverFtdisk DeviceHarddiskVolume3 86D691F8
Device DriverCdrom DeviceCdRom1 86A88500
Device DriverNetBT DeviceNetBT_Tcpip_{11BD6EB6-C0DE-41CD-8455-DEE482CA4083} 86947500
Device DriverNetBT DeviceNetBt_Wins_Export 86947500
Device DriverNetBT DeviceNetbiosSmb 86947500

AttachedDevice DriverTcpip DeviceUdp avfwot.sys (TDI filtering kernel driver/Avira GmbH)
AttachedDevice DriverTcpip DeviceRawIp avfwot.sys (TDI filtering kernel driver/Avira GmbH)

Device Driversptd Device2507090218 spcs.sys
Device Driverusbuhci DeviceUSBFDO-0 86B591F8
Device Driverusbehci DeviceUSBFDO-1 86A311F8
Device FileSystemMRxSmb DeviceLanmanDatagramReceiver 86B671F8
Device FileSystemMRxSmb DeviceLanmanRedirector 86B671F8
Device DriverNetBT DeviceNetBT_Tcpip_{8CF33562-65EC-43D1-9720-278EE0D512A5} 86947500
Device DriverFtdisk DeviceFtControl 86D691F8
Device Drivera0h3kmdv DeviceScsia0h3kmdv1 86951500
Device Drivera0h3kmdv DeviceScsia0h3kmdv1Port2Path0Target0Lun0 86951500
Device FileSystemFastfat Fat 86D671F8

AttachedDevice FileSystemFastfat Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device FileSystemCdfs Cdfs 8686B1F8

—- Registry — GMER 1.0.15 —-

Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (L002TP) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPTP) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPPoE) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@374@4O4494 ?0404@0404;4;0454;4L4=4K494 ?4>4@4B4 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (IP) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 ?4;0404=484@4>0424I484:0404 ?0404:0454B4>0424 1?2?3?
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@s1 771343423
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@s2 285507792
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@h0 1
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04@p0 D:Alcohol 120% 1.9.7.6022Alcohol 120
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04@h0 0
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04@ujdew 0x95 0xD7 0x59 0x93 …
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001@ujdew 0xCE 0xA4 0x35 0xAE …
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40@ujdew 0xF7 0x2F 0xE0 0xF0 …
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04@p0 D:Alcohol 120% 1.9.7.6022Alcohol 120
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04@h0 0
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04@ujdew 0x95 0xD7 0x59 0x93 …
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@ujdew 0xCE 0xA4 0x35 0xAE …
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40@ujdew 0xF7 0x2F 0xE0 0xF0 …
Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (L002TP) 1?
Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPTP) 1?
Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPPoE) 1?
Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@374@4O4494 ?0404@0404;4;0454;4L4=4K494 ?4>4@4B4 1?
Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (IP) 1?
Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 ?4;0404=484@4>0424I484:0404 ?0404:0454B4>0424 1?2?3?
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D04
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D04@p0 D:Alcohol 120% 1.9.7.6022Alcohol 120
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D04@h0 0
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D04@ujdew 0x95 0xD7 0x59 0x93 …
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@ujdew 0xCE 0xA4 0x35 0xAE …
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40@ujdew 0xF7 0x2F 0xE0 0xF0 …
Reg HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows@DeviceNotSelectedTimeout 15
Reg HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows@GDIProcessHandleQuota 10000
Reg HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows@Spooler yes
Reg HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows@swapdisk
Reg HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows@TransmissionRetryTimeout 90
Reg HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows@USERProcessHandleQuota 10000
Reg HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows@appinit_dlls
Reg HKCUSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{A6C514F6-D7D8-F038-464A-0AAE17B106DE}
Reg HKCUSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{A6C514F6-D7D8-F038-464A-0AAE17B106DE}@japeajgiohefniblbipd 0x6B 0x61 0x64 0x67 …
Reg HKCUSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{A6C514F6-D7D8-F038-464A-0AAE17B106DE}@iafaghhpjphbpdcief 0x6B 0x61 0x64 0x67 …

—- Disk sectors — GMER 1.0.15 —-

Disk DeviceHarddisk0DR0 sector 62: copy of MBR

—- EOF — GMER 1.0.15 —-

[Admin]

Откройте блокнот (Кликните Пуск, Выполнить, в строке ввода введите notepad и нажмите Enter) и вставьте в него следующий текст:

reglockdel::

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{A6C514F6-D7D8-F038-464A-0AAE17B106DE}]

Запишите получившийся файл на ваш рабочий стол под именем CFScript
Далее перетащите получившийся файл на иконку Combofix, как показано на картинке ниже.

Сombofix запуститься и выполнит процедуры описанные в созданном нами файле.
По результатам работы Combofix будет создан новый лог, его и вставьте в свой следующий ответ.

[QERIBAN]

ComboFix 09-03-28.06 — 123 2009-03-30 0:02:58.6 — FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1251.1.1049.18.1015.626 [GMT 4:00]
Running from: c:documents and settings123Рабочий столComboFix.exe
Command switches used :: c:documents and settings123Рабочий столCFScript.txt
AV: Avira Premium Security Suite *On-access scanning disabled* (Updated)
FW: Avira Firewall *disabled*
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:123.exe
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr0.dat
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr1.dat
c:program filesStormII
c:program filesStormIIcodec264be.dll
c:program filesStormIIcodec264dmmx.dll
c:program filesStormIIcodec264dsse.dll
c:program filesStormIIcodec264dsse2.dll
c:program filesStormIIcodec264dsse3.dll
c:program filesStormIIcodecaasc32.dll
c:program filesStormIIcodecac3filter.ax
c:program filesStormIIcodecacelpdec.ax
c:program filesStormIIcodecasusasv1.dll
c:program filesStormIIcodecasusasv2.dll
c:program filesStormIIcodecativcr2.dll
c:program filesStormIIcodecavcodec.dll
c:program filesStormIIcodecavformat.dll
c:program filesStormIIcodecavidavicodec.dll
c:program filesStormIIcodecAviSplitter.ax
c:program filesStormIIcodecavutil.dll
c:program filesStormIIcodecbass.dll
c:program filesStormIIcodecbass_aac.dll
c:program filesStormIIcodecbass_alac.dll
c:program filesStormIIcodecbass_ape.dll
c:program filesStormIIcodecbass_flac.dll
c:program filesStormIIcodecbass_mpc.dll
c:program filesStormIIcodecbass_tta.dll
c:program filesStormIIcodecbass_wv.dll
c:program filesStormIIcodecbinkw32.dll
c:program filesStormIIcodecBSPVDEC.dll
c:program filesStormIIcodecbw10.dll
c:program filesStormIIcodeccddareader.ax
c:program filesStormIIcodeccdxareader.ax
c:program filesStormIIcodecChpSrcFilter.ax
c:program filesStormIIcodecCinemasterAudio.DLL
c:program filesStormIIcodeccl264dec.ax
c:program filesStormIIcodecCLNavX.ax
c:program filesStormIIcodecCLRVIDDC.DLL
c:program filesStormIIcodecclrviddd.dll
c:program filesStormIIcodecCLVc1Dec.ax
c:program filesStormIIcodecCLVSD.ax
c:program filesStormIIcodecclvsdx.ax
c:program filesStormIIcodeccoreavc.ax
c:program filesStormIIcodecCUVCcodc.dll
c:program filesStormIIcodecDCBassSource.ax
c:program filesStormIIcodecDECVW_32.DLL
c:program filesStormIIcodecdivxdec.ax
c:program filesStormIIcodecDmoDec.dll
c:program filesStormIIcodecDSMSplitter.ax
c:program filesStormIIcodecempgdmx.ax
c:program filesStormIIcodecff_kernelDeint.dll
c:program filesStormIIcodecff_liba52.dll
c:program filesStormIIcodecff_libavcodec.dll
c:program filesStormIIcodecff_libdts.dll
c:program filesStormIIcodecff_libfaad2.dll
c:program filesStormIIcodecff_libmad.dll
c:program filesStormIIcodecff_libmpeg2.dll
c:program filesStormIIcodecff_libmplayer.dll
c:program filesStormIIcodecff_realaac.dll
c:program filesStormIIcodecff_samplerate.dll
c:program filesStormIIcodecff_theora.dll
c:program filesStormIIcodecff_TomsMoComp.dll
c:program filesStormIIcodecff_tremor.dll
c:program filesStormIIcodecff_unrar.dll
c:program filesStormIIcodecff_wmv9.dll
c:program filesStormIIcodecff_xvidcore.dll
c:program filesStormIIcodecffdshow.ax
c:program filesStormIIcodecffdshow.ax.manifest
c:program filesStormIIcodecffmpeg.dll
c:program filesStormIIcodecffsource.ax
c:program filesStormIIcodecFlash.ocx
c:program filesStormIIcodecFLT_ffdshow.dll
c:program filesStormIIcodecFLVSplitter.ax
c:program filesStormIIcodecfrapsvid.dll
c:program filesStormIIcodecG722ADEC.dll
c:program filesStormIIcodecGeoCodec.dll
c:program filesStormIIcodecH264VDEC.dll
c:program filesStormIIcodecHikAudioDec.ax
c:program filesStormIIcodecHikFileSource.ax
c:program filesStormIIcodecHikFileSplitter.ax
c:program filesStormIIcodecHIKM4DEC.dll
c:program filesStormIIcodecHikVideoDec.ax
c:program filesStormIIcodeci263_32.drv
c:program filesStormIIcodecicmw_32.dll
c:program filesStormIIcodeciconv.dll
c:program filesStormIIcodeckdh4.dll
c:program filesStormIIcodeckdm4.dll
c:program filesStormIIcodeckeys.dat
c:program filesStormIIcodecl3codecx.ax
c:program filesStormIIcodecLCodcCMP.dll
c:program filesStormIIcodeclibavcodec.dll
c:program filesStormIIcodeclibmpeg2_ff.dll
c:program filesStormIIcodeclibmplayer.dll
c:program filesStormIIcodecLMVRGBxf.dll
c:program filesStormIIcodecLMVYUVxf.dll
c:program filesStormIIcodeclsvxdec.dll
c:program filesStormIIcodecmfplat.dll
c:program filesStormIIcodecmkunicode.dll
c:program filesStormIIcodecmkx.dll
c:program filesStormIIcodecmkzlib.dll
c:program filesStormIIcodecmmamrdmx.ax
c:program filesStormIIcodecMp3Decdll.dll
c:program filesStormIIcodecMP3DMOD.DLL
c:program filesStormIIcodecmp4.dll
c:program filesStormIIcodecmp43dmod.dll
c:program filesStormIIcodecmp4sdmod.dll
c:program filesStormIIcodecMP4Splitter.ax
c:program filesStormIIcodecMpaDecFilter.ax
c:program filesStormIIcodecMpaSplitter.ax
c:program filesStormIIcodecmpcvideodec.ax
c:program filesStormIIcodecMpeg2DecFilter.ax
c:program filesStormIIcodecmpeg2dmx.ax
c:program filesStormIIcodecMpegSplitter.ax
c:program filesStormIIcodecmpg2splt.ax
c:program filesStormIIcodecmpg4dmod.dll
c:program filesStormIIcodecmsdmo.dll
c:program filesStormIIcodecmsms001.vwp
c:program filesStormIIcodecmsvcp71.dll
c:program filesStormIIcodecmsvcr71.dll
c:program filesStormIIcodecMZP4_DEC.DLL
c:program filesStormIIcodecNDParser.ax
c:program filesStormIIcodecNeMP4Splitter.ax
c:program filesStormIIcodecnvviddec.ax
c:program filesStormIIcodecOggSplitter.ax
c:program filesStormIIcodecPluginsnppl3260.dll
c:program filesStormIIcodecPluginsnppl3260.xpt
c:program filesStormIIcodecPluginsnpqtplugin.dll
c:program filesStormIIcodecPluginsnprpjplug.dll
c:program filesStormIIcodecPluginsnsIQTScriptablePlugin.xpt
c:program filesStormIIcodecPluginsnsJSRealPlayerPlugin.xpt
c:program filesStormIIcodecPluginsQuickTimePlugin.class
c:program filesStormIIcodecPmpSplt.ax
c:program filesStormIIcodecpncrt.dll
c:program filesStormIIcodecpndx5016.dll
c:program filesStormIIcodecpndx5032.dll
c:program filesStormIIcodecpthreadVC2.dll
c:program filesStormIIcodecpvmjpg21.dll
c:program filesStormIIcodecPVWV220.DLL
c:program filesStormIIcodecqasf.dll
c:program filesStormIIcodecQTSystemCFCharacterSetBitmaps.bitmap
c:program filesStormIIcodecQTSystemCoreVideo.qtx
c:program filesStormIIcodecQTSystemCoreVideo.ResourcesCoreVideo.qtr
c:program filesStormIIcodecQTSystemCoreVideo.Resourcesen.lprojCoreVideoLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTime.qts
c:program filesStormIIcodecQTSystemQuickTime.Resourcesen.lprojQuickTimeLocalized.dll
c:program filesStormIIcodecQTSystemQuickTime.Resourcesen.lprojQuickTimeLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTime.ResourcesQuickTime.dll
c:program filesStormIIcodecQTSystemQuickTime.ResourcesQuickTime.qtr
c:program filesStormIIcodecQTSystemQuickTime.ResourcesQuickTime.qtxs
c:program filesStormIIcodecQTSystemQuickTime3GPP.qtx
c:program filesStormIIcodecQTSystemQuickTime3GPP.Resourcesen.lprojQuickTime3GPPLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTime3GPP.ResourcesQuickTime3GPP.qtr
c:program filesStormIIcodecQTSystemQuickTimeAudioSupport.qtx
c:program filesStormIIcodecQTSystemQuickTimeAudioSupport.Resourcesen.lprojQuickTimeAudioSupportLocalized.dll
c:program filesStormIIcodecQTSystemQuickTimeAudioSupport.Resourcesen.lprojQuickTimeAudioSupportLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTimeAudioSupport.ResourcesQuickTimeAudioSupport.qtr
c:program filesStormIIcodecQTSystemQuickTimeEssentials.qtx
c:program filesStormIIcodecQTSystemQuickTimeEssentials.Resourcesen.lprojQuickTimeEssentialsLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTimeEssentials.ResourcesQuickTimeEssentials.qtr
c:program filesStormIIcodecQTSystemQuickTimeH264.qtx
c:program filesStormIIcodecQTSystemQuickTimeH264.Resourcesen.lprojQuickTimeH264Localized.qtr
c:program filesStormIIcodecQTSystemQuickTimeH264.ResourcesQuickTimeH264.qtr
c:program filesStormIIcodecQTSystemQuickTimeInternetExtras.qtx
c:program filesStormIIcodecQTSystemQuickTimeInternetExtras.Resourcesen.lprojQuickTimeInternetExtrasLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTimeInternetExtras.ResourcesQuickTimeInternetExtras.qtr
c:program filesStormIIcodecQTSystemQuickTimeMPEG4.qtx
c:program filesStormIIcodecQTSystemQuickTimeMPEG4.Resourcesen.lprojQuickTimeMPEG4Localized.qtr
c:program filesStormIIcodecQTSystemQuickTimeMPEG4.ResourcesQuickTimeMPEG4.qtr
c:program filesStormIIcodecQTSystemQuickTimeMusic.qtx
c:program filesStormIIcodecQTSystemQuickTimeMusic.Resourcesen.lprojQuickTimeMusicLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTimeMusic.ResourcesQuickTimeMusic.qtr
c:program filesStormIIcodecQTSystemQuickTimeStreaming.qtx
c:program filesStormIIcodecQTSystemQuickTimeStreaming.Resourcesen.lprojQuickTimeStreamingLocalized.dll
c:program filesStormIIcodecQTSystemQuickTimeStreaming.Resourcesen.lprojQuickTimeStreamingLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTimeStreaming.ResourcesQuickTimeStreaming.qtr
c:program filesStormIIcodecQTSystemQuickTimeStreamingExtras.qtx
c:program filesStormIIcodecQTSystemQuickTimeStreamingExtras.Resourcesen.lprojQuickTimeStreamingExtrasLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTimeStreamingExtras.ResourcesQuickTimeStreamingExtras.qtr
c:program filesStormIIcodecQTSystemQuickTimeVR.qtx
c:program filesStormIIcodecQTSystemQuickTimeVR.Resourcesen.lprojQuickTimeVRLocalized.qtr
c:program filesStormIIcodecQTSystemQuickTimeVR.ResourcesQuickTimeVR.qtr
c:program filesStormIIcodecQuickTime.qts
c:program filesStormIIcodecQuickTimeVR.qtx
c:program filesStormIIcodecRadGtSplitter.ax
c:program filesStormIIcodecRealCodecs14_43260.dll
c:program filesStormIIcodecRealCodecs28_83260.dll
c:program filesStormIIcodecRealCodecsatrc.dll
c:program filesStormIIcodecRealCodecscook.dll
c:program filesStormIIcodecRealCodecsddnt3260.dll
c:program filesStormIIcodecRealCodecsdnet3260.dll
c:program filesStormIIcodecRealCodecsdrv1.dll
c:program filesStormIIcodecRealCodecsdrv2.dll
c:program filesStormIIcodecRealCodecsdrvc.dll
c:program filesStormIIcodecRealCodecshxltcolor.dll
c:program filesStormIIcodecRealCodecsraac.dll
c:program filesStormIIcodecRealCodecsralf.dll
c:program filesStormIIcodecRealCodecsrv10.dll
c:program filesStormIIcodecRealCodecsrv20.dll
c:program filesStormIIcodecRealCodecsrv30.dll
c:program filesStormIIcodecRealCodecsrv40.dll
c:program filesStormIIcodecRealCodecssipr.dll
c:program filesStormIIcodecRealCommonobjb3201.dll
c:program filesStormIIcodecRealCommonpnen3260.dll
c:program filesStormIIcodecRealCommonpngu3267.dll
c:program filesStormIIcodecRealCommonpnrs3260.dll
c:program filesStormIIcodecRealCommonrppr3260.dll
c:program filesStormIIcodecRealCommonsecurity.dll
c:program filesStormIIcodecRealPluginsaudplin.dll
c:program filesStormIIcodecRealPluginsauthmgr.dll
c:program filesStormIIcodecRealPluginsclbascauth.dll
c:program filesStormIIcodecRealPluginsclntxres.dll
c:program filesStormIIcodecRealPluginsExtResourcescoreres.xrs
c:program filesStormIIcodecRealPluginsfpsechnd.dll
c:program filesStormIIcodecRealPluginshttpfsys.dll
c:program filesStormIIcodecRealPluginshxsdp.dll
c:program filesStormIIcodecRealPluginshxxml.dll
c:program filesStormIIcodecRealPluginsimgrender.dll
c:program filesStormIIcodecRealPluginsmemfsys.dll
c:program filesStormIIcodecRealPluginsmp3fformat.dll
c:program filesStormIIcodecRealPluginsmp3render.dll
c:program filesStormIIcodecRealPluginsmp4arender.dll
c:program filesStormIIcodecRealPluginsntlmauth.dll
c:program filesStormIIcodecRealPluginsoggfformat.dll
c:program filesStormIIcodecRealPluginspacplin.dll
c:program filesStormIIcodecRealPluginsplusplin.dll
c:program filesStormIIcodecRealPluginspxcb3210.dll
c:program filesStormIIcodecRealPluginsramfformat.dll
c:program filesStormIIcodecRealPluginsramrender.dll
c:program filesStormIIcodecRealPluginsrarender.dll
c:program filesStormIIcodecRealPluginsrmfformat.dll
c:program filesStormIIcodecRealPluginsrmxfpln.dll
c:program filesStormIIcodecRealPluginsrmxrend.dll
c:program filesStormIIcodecRealPluginsrn5auth.dll
c:program filesStormIIcodecRealPluginsrtfformat.dll
c:program filesStormIIcodecRealPluginsrtrender.dll
c:program filesStormIIcodecRealPluginsrvrender.dll
c:program filesStormIIcodecRealPluginssdpplin.dll
c:program filesStormIIcodecRealPluginssecurity.dll
c:program filesStormIIcodecRealPluginssmlfformat.dll
c:program filesStormIIcodecRealPluginssmlrender.dll
c:program filesStormIIcodecRealPluginssmmrender.dll
c:program filesStormIIcodecRealPluginssmplfsys.dll
c:program filesStormIIcodecRealPluginsstubdrm.dll
c:program filesStormIIcodecRealPluginstfilesys.dll
c:program filesStormIIcodecRealPluginsvidplin.dll
c:program filesStormIIcodecRealPluginsvidsite.dll
c:program filesStormIIcodecRealPluginsvorbisrend.dll
c:program filesStormIIcodecRealPluginsvsrlocal.dll
c:program filesStormIIcodecRealrppluginscnembed_cn.dll
c:program filesStormIIcodecRealrppluginscnrpclsvc_cn.dll
c:program filesStormIIcodecRealrppluginsembd3260.dll
c:program filesStormIIcodecRealrppluginsrpcl3260.dll
c:program filesStormIIcodecRealrppluginsrput3260.dll
c:program filesStormIIcodecRLMPCDec.ax
c:program filesStormIIcodecrmoc3260.dll
c:program filesStormIIcodecRMSplt.ax
c:program filesStormIIcodecSc726dec.ax
c:program filesStormIIcodecscmpack.dll
c:program filesStormIIcodecscsource.ax
c:program filesStormIIcodecsmackw32.dll
c:program filesStormIIcodecSonicLicenseManager9.dll
c:program filesStormIIcodecsplitter.ax
c:program filesStormIIcodecTomsMoComp_ff.dll
c:program filesStormIIcodects.dll
c:program filesStormIIcodectsccvid.dll
c:program filesStormIIcodecTTL2Dec.dll
c:program filesStormIIcodecv2k2_dec.dll
c:program filesStormIIcodecv2kdspde.dll
c:program filesStormIIcodecvc1dc.dll
c:program filesStormIIcodecvc1dmmx.dll
c:program filesStormIIcodecvc1dsse.dll
c:program filesStormIIcodecvc1dsse2.dll
c:program filesStormIIcodecvc1wp.ax
c:program filesStormIIcodecVDODEC32.dll
c:program filesStormIIcodecvdowave.drv
c:program filesStormIIcodecVgmAudio.ax
c:program filesStormIIcodecvgmbgr.ax
c:program filesStormIIcodecVgmSplt.ax
c:program filesStormIIcodecvgmv2k2.ax
c:program filesStormIIcodecVid1Dec.dll
c:program filesStormIIcodecvmnc.dll
c:program filesStormIIcodecvoxmsdec.ax
c:program filesStormIIcodecvp6vfw.dll
c:program filesStormIIcodecvp7vfw.dll
c:program filesStormIIcodecvssver2.scc
c:program filesStormIIcodecWMADMOD.dll
c:program filesStormIIcodecwmpasf.dll
c:program filesStormIIcodecwmsdmod.dll
c:program filesStormIIcodecWMVDECOD.dll
c:program filesStormIIcodecwmvdmod.dll
c:program filesStormIIcodecxvid.ax
c:program filesStormIIcodecxvidcore.dll
c:program filesStormIIcurrent.ecs
c:program filesStormIIjscript.dll
c:program filesStormIIkeys.dat
c:program filesStormIImediadefdef.flv
c:program filesStormIImediadefdef.ini
c:program filesStormIImediaempty.swf
c:program filesStormIImediamedia4in1.swf
c:program filesStormIImediamediabp.swf
c:program filesStormIImediaothers.xml
c:program filesStormIImediaothers.xml.ini
c:program filesStormIImediastcon.ini
c:program filesStormIImediatoff.ini
c:program filesStormIImediavideo_material_list.xml
c:program filesStormIImediavideo_material_list.xml.ini
c:program filesStormIImediavideo_style_list.xml
c:program filesStormIImediavideo_style_list.xml.ini
c:program filesStormIIMedia2.dll
c:program filesStormIImee.db
c:program filesStormIIMovieInfo.dll
c:program filesStormIImps.dll
c:program filesStormIImsscript.ocx
c:program filesStormIImsvcp60.dll
c:program filesStormIIrndrmgr.dll
c:program filesStormIIscore.dll
c:program filesStormIIsexpert.dll
c:program filesStormIISkinјыБъР¶јЧ.zip
c:program filesStormIISkin±©·з1ѕ­µд.zip
c:program filesStormIISkin±©·з2ѕ­µд.zip
c:program filesStormIIspfa.dll
c:program filesStormIIsplayers.dll
c:program filesStormIIsprobe.dll
c:program filesStormIIStorm.exe
c:program filesStormIIstormliv.exe
c:program filesStormIIstormply.exe
c:program filesStormIIStormRes.dll
c:program filesStormIIsubdecoder.dll
c:program filesStormIIuninst.exe

---

BITS: Possible infected sites

---

hxxp://soft.export.yandex.ru
.
((((((((((((((((((((((((( Files Created from 2009-02-28 to 2009-03-29 )))))))))))))))))))))))))))))))
.

2009-03-27 16:30 . 2009-03-27 16:30 d

---

c:program filesDownload Master
2009-03-25 00:59 . 2009-03-25 00:59 d

---

c:documents and settings123Application DataAvira
2009-03-24 23:17 . 2009-03-24 23:17 d

---

c:program filesAvira
2009-03-24 23:17 . 2009-03-24 23:17 d

---

c:documents and settingsAll UsersApplication DataAvira
2009-03-24 23:17 . 2008-05-07 13:20 71,592 —a

---

c:windowssystem32driversavfwot.sys
2009-03-24 23:17 . 2008-05-07 09:51 71,464 —a

---

c:windowssystem32driversavfwim.sys
2009-03-24 20:40 . 2009-03-24 20:44 4,496,273 —a

---

c:program filesazan.exe
2009-03-24 14:02 . 2009-03-24 14:02 d

---

c:windowssystem32ru-ru
2009-03-24 14:02 . 2009-03-24 14:02 d

---

c:windowssystem32ru
2009-03-24 14:02 . 2009-03-24 14:02 d

---

c:windowssystem32bits
2009-03-24 14:02 . 2009-03-24 14:02 d

---

c:windowsl2schemas
2009-03-24 13:59 . 2009-03-24 13:59 d

---

c:windowsServicePackFiles
2009-03-23 20:03 . 2009-03-23 20:03 d

---

c:program filesYandex
2009-03-23 20:03 . 2009-03-23 20:03 d

---

c:documents and settings123Application DataYandex
2009-03-23 03:00 . 2009-03-23 03:00 d

---

c:program filesMSXML 4.0
2009-03-22 20:01 . 2008-10-16 14:08 27,672 —a

---

c:windowssystem32wuapi.dll.mui
2009-03-21 23:07 . 2009-03-21 23:07 d

---

c:documents and settingsAll UsersApplication DataESET
2009-03-19 01:24 . 2009-03-19 01:25 4,114 —a

---

c:windowssystem32secushr.dat
2009-03-19 01:24 . 2009-03-19 01:24 248 —a

---

c:windowssystem32secustat.dat
2009-03-19 01:23 . 2009-03-19 01:23 d

---

c:documents and settings123Application DataFlashgetSetup
2009-03-19 01:18 . 2009-03-19 01:18 d

---

c:documents and settings123Application DataMedia Player Classic

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-28 14:26 737,280 —-a-w c:windowsiun6002.exe
2009-03-23 16:17 2,516 —sha-w c:windowssystem32KGyGaAvL.sys
2009-02-11 06:19 38,496 —-a-w c:windowssystem32driversmbamswissarmy.sys
2009-02-11 06:19 15,504 —-a-w c:windowssystem32driversmbam.sys
2009-02-09 13:07 1,846,912 —-a-w c:windowssystem32win32k.sys
2009-02-09 13:07 1,846,912

---

w c:windowssystem32dllcachewin32k.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]
«{ecdee021-0d17-467f-a1ff-c7a115230949}»= «c:program filesfree-downloads.nettbfree.dll» [2007-12-10 1510424]

[HKEY_CLASSES_ROOTclsid{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_LOCAL_MACHINE~Browser Helper Objects{ecdee021-0d17-467f-a1ff-c7a115230949}]
2007-12-10 13:46 1510424 —a

---

c:program filesfree-downloads.nettbfree.dll

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{ecdee021-0d17-467f-a1ff-c7a115230949}»= «c:program filesfree-downloads.nettbfree.dll» [2007-12-10 1510424]

[HKEY_CLASSES_ROOTclsid{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{ECDEE021-0D17-467F-A1FF-C7A115230949}»= «c:program filesfree-downloads.nettbfree.dll» [2007-12-10 1510424]

[HKEY_CLASSES_ROOTclsid{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2008-04-14 15360]
«AlcoholAutomount»=»d:alcohol 120% 1.9.7.6022Alcohol 120axcmd.exe» [2007-12-22 222080]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«IgfxTray»=»c:windowssystem32igfxtray.exe» [2007-09-18 141848]
«HotKeysCmds»=»c:windowssystem32hkcmd.exe» [2007-09-18 166424]
«Persistence»=»c:windowssystem32igfxpers.exe» [2007-09-18 137752]
«V0330Mon.exe»=»c:windowsV0330Mon.exe» [2007-04-30 32768]
«ISUSPM Startup»=»c:program filesCommon FilesInstallShieldUpdateServiceisuspm.exe» [2005-08-11 249856]
«ISUSScheduler»=»c:program filesCommon FilesInstallShieldUpdateServiceissch.exe» [2005-08-11 81920]
«MAgent»=»c:program filesMail.RuAgentMAgent.exe» [2009-01-13 5598392]
«Athan»=»c:program filesAthanAthan.exe» [2005-10-09 954368]
«avgnt»=»c:program filesAviraAvira Premium Security Suiteavgnt.exe» [2008-06-12 266497]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-14 15360]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe Reader Speed Launcher]
—a

---

2008-06-12 02:38 34672 c:program filesAdobeReader 9.0Readerreader_sl.exe

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\Messenger\msmsgs.exe»=
«d:\uTorrent.exe»=
«c:\Program Files\Windows Live\Messenger\msnmsgr.exe»=
«c:\Program Files\Windows Live\Messenger\livecall.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«d:\SKYPE\Phone\Skype.exe»=
«d:\ICQ6.5\ICQ.exe»=
«$INSTDIR\FlvDetector.exe»= c:\Program Files\FlashGet Network\FlashGet 3\FlvDetector.exe

R1 avfwot;avfwot;c:windowssystem32driversavfwot.sys [2009-03-24 71592]
R2 AntiVirFirewallService;Avira Premium Security Suite Firewall;c:program filesAviraAvira Premium Security Suiteavfwsvc.exe [2009-03-24 344321]
R2 AntiVirMailService;Avira Premium Security Suite MailGuard;c:program filesAviraAvira Premium Security Suiteavmailc.exe [2009-03-24 164097]
R2 antivirwebservice;Avira Premium Security Suite WebGuard;c:program filesAviraAvira Premium Security Suiteavwebgrd.exe [2009-03-24 258305]
R2 AVEService;Вспомогательная служба Avira Premium Security Suite MailGuard (Защита почты).;c:program filesAviraAvira Premium Security Suiteavesvc.exe [2009-03-24 41217]
R3 avfwim;AvFw Packet Filter Miniport;c:windowssystem32driversavfwim.sys [2009-03-24 71464]
R3 V0330VID;WebCam Vista/Live! Cam Chat;c:windowssystem32driversV0330Vid.sys [2008-10-15 157696]
S2 ccosm;Contrl Center of Storm Media;c:program filesStormIIstormliv.exe /asservice —> c:program filesStormIIstormliv.exe [?]
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.google.ru/ig?hl=ru
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
IE: Добавить в Rambler-Закладки — d:rambler assistantramblertoolbarU5950.dll/zakladki.htm
IE: Закачать ВСЕ при помощи Download Master — c:program filesDownload Masterdmieall.htm
IE: Закачать все при помощи FlashGet — c:program filesFlashGetjc_all.htm
IE: Закачать при помощи Download Master — c:program filesDownload Masterdmie.htm
IE: Закачать при помощи FlashGet — c:program filesFlashGetjc_link.htm
IE: Найти с помощью Рамблера — d:rambler assistantramblertoolbarU5950.dll/search.htm
IE: Опубликовать в Дневнике — d:rambler assistantramblertoolbarU5950.dll/planet.htm
IE: Перевести с помощью словарей Рамблера — d:rambler assistantramblertoolbarU5950.dll/dic.htm
IE: Поиск@Mail.Ru — c:program filesMail.RuSputnikMailRuSputnik.dll/282
IE: Словари@Mail.Ru — c:program filesMail.RuSputnikMailRuSputnik.dll/283
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:program filesMail.RuAgentmagent.exe
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe
LSP: avsda.dll
FF — ProfilePath — c:documents and settings123Application DataMozillaFirefoxProfileslb4yf04o.default
FF — prefs.js: browser.search.defaulturl — hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF — prefs.js: browser.search.selectedEngine — Википедия (ru)
FF — prefs.js: browser.startup.homepage — hxxp://www.yahoo.com/
FF — prefs.js: keyword.URL — hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF — component: c:program filesMozilla Firefoxextensions{DB9127A2-3381-41ec-82B3-1B6ED4C6F29A}componentsFlashgetXpi.dll
FF — plugin: d:real alternativebrowserpluginsnppl3260.dll
FF — plugin: d:real alternativebrowserpluginsnprpjplug.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-30 00:04:23
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘lsass.exe'(1348)
c:windowssystem32avsda.dll
.
Completion time: 2009-03-30 0:05:01
ComboFix-quarantined-files.txt 2009-03-29 20:05:00

Pre-Run: 7 529 594 880 байт свободно
Post-Run: 8,216,150,016 байт свободно

479 — E O F — 2009-03-24 18:09:06

[Автор]

Сообщения