Не заходит на сайты антивирусов

[Ssserrega]

Лог Combofix:

ComboFix 10-04-19.05 — Admin 21.04.2010 23:06:50.17.2 — x86
Microsoft Windows XP Professional 5.1.2600.3.1251.380.1049.18.2047.1582 [GMT 3:00]
Running from: c:documents and settingsAdminРабочий столComboFix.exe
Command switches used :: c:documents and settingsAdminРабочий столCFScript.txt
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: AGAVA Firewall *disabled* {A1B3B6D5-4E09-45D3-BC0D-5A1AC0DE29AC}
* Resident AV is active

FILE ::
«c:windowssystem32zouloovenou.exe»
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:windowssystem32zouloovenou.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

---

Legacy_BJXQBTBQ

---

Legacy_BZAAU5CZEU6EY0I

---

Legacy_XYVHSWKY

---

Service_bjxqbtbq

---

Service_bzaau5czeu6ey0i

---

Service_xyvhswky

((((((((((((((((((((((((( Files Created from 2010-03-21 to 2010-04-21 )))))))))))))))))))))))))))))))
.

2010-04-20 05:22 . 2010-04-20 05:22 921632 —-a-w- C:PA7302.DAT
2010-04-14 08:03 . 2010-04-14 08:03

---

d-sh—w- c:documents and settingsAll UsersApplication DataSecuROM
2010-04-14 07:49 . 2010-04-14 08:00

---

d

---

w- c:program filesCommon FilesBioWare
2010-04-14 07:29 . 2010-04-14 15:33

---

d

---

w- c:program filesDAEMON Tools Lite
2010-04-14 06:19 . 2008-04-14 16:10 15360 -c—a-w- c:windowssystem32dllcachectfmon.exe
2010-04-14 06:19 . 2008-04-14 16:10 15360 —-a-w- c:windowssystem32ctfmon.exe
2010-04-13 17:36 . 2010-04-13 17:36 300544 —-a-w- c:windowssystem32fidepil.exe
2010-04-13 12:25 . 2010-04-16 13:57

---

d

---

w- C:Photo
2010-04-11 18:31 . 2010-04-11 18:30 300544 —-a-w- c:windowssystem32gooquumywou.exe
2010-04-11 18:30 . 2010-04-11 18:30 129024 —sh—r- c:documents and settingsAdminApplication Datawyzlo.exe
2010-04-10 17:27 . 2010-04-10 17:27

---

d

---

w- c:documents and settingsAdminApplication Datateamspeak2
2010-04-06 11:57 . 2010-04-06 11:57

---

d

---

w- c:documents and settingsAdminApplication DataAssassin’s Creed II
2010-04-06 11:57 . 2010-04-06 11:39 1193739 —-a-w- c:documents and settingsAdminApplication DataAssassin’s Creed IIUninstallunins000.exe
2010-04-02 17:12 . 2010-04-16 22:51

---

d

---

w- C:Movavi files
2010-04-02 14:19 . 2010-04-02 14:20

---

d

---

w- c:program filesMovavi Video Converter 9
2010-03-31 17:11 . 2010-03-31 17:11 5918776 —-a-w- c:documents and settingsAll UsersApplication DataMalwarebytesMalwarebytes’ Anti-Malwarembam-setup.exe
2010-03-28 11:05 . 2009-05-29 21:37 205824 —-a-w- c:windowssystem32xvidvfw.dll
2010-03-28 11:05 . 2009-05-29 21:31 881664 —-a-w- c:windowssystem32xvidcore.dll
2010-03-28 11:05 . 2010-03-14 18:00 85504 —-a-w- c:windowssystem32ff_vfw.dll
2010-03-28 11:04 . 2010-03-28 11:05

---

d

---

w- c:program filesK-Lite Codec Pack
2010-03-28 10:13 . 2010-03-28 10:13 64000 -c—a-w- c:windowssystem32dllcachewmplayer.exe
2010-03-27 18:22 . 2010-03-27 18:22

---

d

---

w- c:program filesuTorrent
2010-03-27 18:21 . 2010-04-19 11:19

---

d

---

w- c:documents and settingsAdminApplication DatauTorrent
2010-03-25 17:50 . 2010-04-01 16:56

---

d

---

w- c:documents and settingsAdminApplication DatamIRC
2010-03-25 17:50 . 2010-04-01 16:54

---

d

---

w- c:program filesmIRC

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-21 13:18 . 2009-10-04 16:09

---

d

---

w- c:program filesABBYY FineReader 9.0
2010-04-20 13:42 . 2008-01-11 17:50 215160 —-a-w- c:windowssystem32PnkBstrB.exe
2010-04-20 13:41 . 2008-01-11 17:50 138544 —-a-w- c:windowssystem32driversPnkBstrK.sys
2010-04-19 18:01 . 2009-09-25 13:13

---

d

---

w- c:documents and settingsAdminApplication DataICQ
2010-04-18 17:02 . 2009-12-26 10:02

---

d

---

w- c:documents and settingsAdminApplication DataSkype
2010-04-18 17:02 . 2009-11-12 22:27

---

d

---

w- c:documents and settingsAdminApplication DataskypePM
2010-04-15 16:04 . 2007-12-26 14:40

---

d

---

w- c:program filesOpera
2010-04-14 22:23 . 2007-12-26 14:40

---

d

---

w- c:program filesHfs
2010-04-14 15:33 . 2007-12-26 14:40

---

d

---

w- c:program filesUnlocker
2010-04-14 07:29 . 2007-12-26 14:34 691696 —-a-w- c:windowssystem32driverssptd.sys
2010-04-12 16:50 . 2010-01-27 20:35

---

d

---

w- c:program filesSteam
2010-04-06 12:00 . 2008-03-22 08:48

---

d

---

w- c:documents and settingsAdminApplication DataUbisoft
2010-04-06 12:00 . 2008-01-23 12:47

---

d

---

w- c:documents and settingsAll UsersApplication DataUbisoft
2010-04-02 14:37 . 2010-03-13 14:01

---

d

---

w- c:program filesXilisoft
2010-03-31 17:12 . 2010-02-25 16:32

---

d

---

w- c:program filesMalwarebytes’ Anti-Malware
2010-03-29 21:46 . 2010-02-25 16:32 38224 —-a-w- c:windowssystem32driversmbamswissarmy.sys
2010-03-29 21:45 . 2010-02-25 16:32 20824 —-a-w- c:windowssystem32driversmbam.sys
2010-03-28 09:50 . 2004-08-18 12:00 84934 —-a-w- c:windowssystem32perfc019.dat
2010-03-28 09:50 . 2004-08-18 12:00 487386 —-a-w- c:windowssystem32perfh019.dat
2010-03-27 18:44 . 2007-12-26 14:41

---

d

---

w- c:program filesDownload Master
2010-03-20 06:38 . 2010-03-20 06:38 0 —ha-w- c:windowssystem32driversMsft_Kernel_LUsbFilt_01005.Wdf
2010-03-18 15:54 . 2010-02-23 14:53

---

d

---

w- c:program filesSpybot — Search & Destroy
2010-03-18 15:53 . 2010-02-23 14:53

---

d

---

w- c:documents and settingsAll UsersApplication DataSpybot — Search & Destroy
2010-03-13 14:02 . 2010-03-13 14:02

---

d

---

w- c:documents and settingsAdminApplication DataXilisoft Corporation
2010-03-13 00:15 . 2010-03-13 00:08

---

d

---

w- c:program filesExtra Video Converter Pro
2010-03-12 23:40 . 2010-03-12 23:40

---

d

---

w- c:documents and settingsAdminApplication DataMOVAVI
2010-03-07 13:28 . 2009-01-25 16:30

---

d

---

w- c:program filesNokia
2010-03-05 16:08 . 2008-12-06 07:28 1316168 —-a-w- c:documents and settingsLocalServiceLocal SettingsApplication DataFontCache3.0.0.0.dat
2010-03-04 20:02 . 2010-02-25 19:16

---

d

---

w- c:program filesCommon FilesScanner
2010-03-04 08:01 . 2010-03-04 08:01

---

d

---

w- c:documents and settingsNetworkServiceApplication DataYahoo!
2010-02-27 11:32 . 2010-02-27 11:32

---

d

---

w- c:documents and settingsAdminApplication DataLogitech
2010-02-27 11:32 . 2010-02-26 16:48

---

d

---

w- c:program filesCommon FilesLogishrd
2010-02-27 11:32 . 2010-02-25 19:13

---

d

---

w- c:documents and settingsAll UsersApplication DataLogiShrd
2010-02-27 11:31 . 2010-02-27 11:31 0 —ha-w- c:windowssystem32driversMsft_Kernel_LMouFilt_01005.Wdf
2010-02-27 11:31 . 2010-02-27 11:31 0 —ha-w- c:windowssystem32driversMsft_Kernel_LHidFilt_01005.Wdf
2010-02-27 11:31 . 2010-02-27 11:31 0 —ha-w- c:windowssystem32driversMsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2010-02-27 11:30 . 2007-12-26 14:39

---

d—h—w- c:program filesInstallShield Installation Information
2010-02-27 11:30 . 2010-02-27 11:30

---

d

---

w- c:program filesLogitech
2010-02-26 16:45 . 2010-02-25 19:14

---

d

---

w- c:program filesCommon FilesLogitech
2010-02-25 19:17 . 2010-02-25 19:17

---

d

---

w- c:documents and settingsAdminApplication DataYahoo!
2010-02-25 19:14 . 2010-02-25 19:14

---

d

---

w- c:documents and settingsAll UsersApplication DataLogitech
2010-02-25 17:31 . 2008-04-07 07:33

---

d

---

w- c:documents and settingsAll UsersApplication DataMicrosoft Help
2010-02-25 16:32 . 2010-02-25 16:32

---

d

---

w- c:documents and settingsAdminApplication DataMalwarebytes
2010-02-25 16:32 . 2010-02-25 16:32

---

d

---

w- c:documents and settingsAll UsersApplication DataMalwarebytes
2010-02-23 12:03 . 2009-11-26 13:35

---

d

---

w- c:program filestrend micro
2010-02-21 21:07 . 2010-02-21 21:07 11264 —-a-w- c:windowssystem32driversuzg4njgz.sys
2010-02-21 20:51 . 2007-12-26 14:40

---

d

---

w- c:program filesCcleaner
2010-02-21 16:56 . 2009-12-11 21:54

---

d

---

w- c:program filesBRS
2010-02-21 16:55 . 2007-12-26 14:40

---

d

---

w- c:program filesSMSDV
2010-02-21 16:47 . 2009-05-17 10:50

---

d

---

w- c:program filesQIP.Online
2010-02-21 16:23 . 2009-06-13 19:22

---

d

---

w- c:documents and settingsAdminApplication DataUniblue
2010-02-21 15:19 . 2007-12-26 14:29

---

d

---

w- c:program filesVistaDriveIcon
2010-02-10 17:13 . 2007-12-26 14:41 165376 —-a-w- c:windowssystem32unrar.dll
2010-02-08 14:31 . 2010-02-08 14:31 10134 —-a-r- c:documents and settingsAdminApplication DataMicrosoftInstaller{71CFE572-6C01-96C4-F90E-36C147C98123}ARPPRODUCTICON.exe
2010-02-08 14:26 . 2008-01-08 17:49 1324 —-a-w- c:windowssystem32d3d9caps.dat
2010-01-27 20:35 . 2010-01-27 20:35 15872 —-a-r- c:documents and settingsAdminApplication DataMicrosoftInstaller{048298C9-A4D3-490B-9FF9-AB023A9238F3}Icon048298C9.exe
.

c:program filesAdobePhotoshop Album Starter Edition3.2Appsapdproxy .exe

c:program filesAMDDual-Core Optimizeramd_dc_opt .exe

c:program filesATI TechnologiesATI.ACECore-Staticclistart .exe

c:program filesDAEMON Tools Litedtlite .exe

c:program filesESETESET NOD32 Antivirusegui .exe

c:program filesSony EricssonMobile2Application Launcherapplication launcher .exe

c:program filesSpybot - Search & Destroyteatimer .exe

c:program filesUnlockerunlockerassistant    .exe

c:program filesUnlockerunlockerassistant   .exe

c:program filesUnlockerunlockerassistant .exe

c:program filesVistaDriveIconvistadrv .exe

c:program filesVolumeControlvolume .exe

c:windowsPixArtPac7302monitor .exe




Sigcheck




[7] 2008-04-14 . 4379CA978CB35BB2458156B2B6CB35DF . 1571840 . . [5.1.2600.5512] . . c:windowsERDNTcachesfcfiles.dll

[7] 2008-04-14 . 4379CA978CB35BB2458156B2B6CB35DF . 1571840 . . [5.1.2600.5512] . . c:windowsServicePackFilesi386sfcfiles.dll

[-] 2007-12-26 . 867C8A991BF369B3FAFC3B64ADC6FC5C . 1548288 . . [5.1.2600.2180] . . c:windows$NtServicePackUninstall$sfcfiles.dll

[-] 2004-01-23 . E8728E3C12F7870BC74224201A830F70 . 1145856 . . [5.1.2600.1106] . . c:windowssystem32sfcfiles.dll

.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]

«Kernel and Hardware Abstraction Layer»=»KHALMNPR.EXE» [2009-06-17 55824]

«Sony Ericsson PC Suite»=»c:program filesSony EricssonMobile2Application LauncherApplication Launcher.exe» [2007-06-13 528384]

«PAC7302_Monitor»=»c:windowsPixArtPAC7302Monitor.exe» [2006-11-03 319488]

«UnlockerAssistant»=»c:program filesunlockerunlockerassistant  .exe» [N/A]
[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]

«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [N/A]

«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-14 15360]
[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]

«IE7_011″=»shell32» [X]

«ZZZZ2_FirstLogonSetting»=»advpack.dll» [2008-10-16 124928]

«IE7_012″=»advpack.dll» [2008-10-16 124928]
c:documents and settingsAll Usersѓ« ў­®Ґ ¬Ґ­оЏа®Ја ¬¬лЂўв®§ Јаг§Є 

Logitech SetPoint.lnk — c:program filesLogitechSetPointSetPoint.exe [2010-2-27 813584]
[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]

«NoThumbnailCache»= 1 (0x1)

«NoSMConfigurePrograms»= 1 (0x1)
[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]

«NoThumbnailCache»= 1 (0x1)

«NoSMConfigurePrograms»= 1 (0x1)
[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotifyLBTWlgn]

2009-07-20 10:28	72208	—-a-w-	c:program filesCommon FilesLogishrdBluetoothLBTWLgn.dll
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalWdfLoadGroup]

@=»»
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAlcmtr]

2008-06-08 11:22	69632	—-a-r-	c:windowsAlcmtr.exe
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregASUSGamerOSD]

c:program filesASUSGamerOSDGamerOSD.exe [N/A]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregKillCopy]

2008-06-08 11:22	1185792	—-a-w-	c:windowssystem32killcopy.exe
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregLClock]

2008-06-08 11:21	86016	—-a-w-	c:program filesLClockLClock.exe
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNBJ]

2008-06-08 11:18	2048000	—-a-w-	c:program filesAheadNero BackItUpNBJ.exe
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNeroFilterCheck]

2008-06-08 11:29	155648	—-a-w-	c:windowssystem32nerocheck.exe
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregRTHDCPL]

RTHDCPL.EXE [N/A]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSidebar]

2007-02-26 20:50	1254912	—-a-w-	c:program filesWindows Sidebarsidebar.exe
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSkyTel]

2008-06-08 11:22	2879488	—-a-r-	c:windowsSkyTel.exe
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregStartCCC]

c:program filesATI TechnologiesATI.ACECore-StaticCLIStart.exe [N/A]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregUnlockerAssistant]

c:program filesUnlockerUnlockerAssistant.exe [N/A]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]

«UpdatesOverride»=dword:00000001
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]

«%windir%\system32\sessmgr.exe»=

«%windir%\Network Diagnostic\xpnetdiag.exe»=

«c:\Program Files\uTorrent\utorrent.exe»=

«c:\WINDOWS\system32\dpnsvr.exe»=

«c:\Program Files\Bonjour\mDNSResponder.exe»=

«c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE»=

«e:\Games\Counter\hl.exe»=

«c:\WINDOWS\system32\PnkBstrA.exe»=

«c:\WINDOWS\system32\PnkBstrB.exe»=

«e:\Games\TDU\exe\TestDriveUnlimited.exe»=

«e:\Games\CALL\iw3mp.exe»=

«e:\Games\Need For Speed Underground\nfsuclient_alkar.exe»=

«e:\Games\Need For Speed Underground\speed.exe»=

«e:\Icq\ICQ6.5\ICQ.exe»=

«c:\Program Files\SopCast\SopCast.exe»=

«e:\Games\Counter\hltv.exe»=

«c:\Program Files\Opera\Opera.exe»=

«c:\Documents and Settings\Admin\Application Data\SopCast\adv\SopAdver.exe»=

«e:\Games\DIRT 2\dirt2_game.exe»=

«c:\Program Files\Skype\Plugin Manager\skypePM.exe»=

«e:\Games\Mass Effect 2\Binaries\MassEffect2.exe»=

«e:\Games\Mass Effect 2\MassEffect2Launcher.exe»=

«c:\Program Files\Skype\Phone\Skype.exe»=
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]

«9923:TCP»= 9923:TCP:bsbno

«3389:TCP»= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

«8103:TCP»= 8103:TCP
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:windowssystem32driverssfsync03.sys [13.10.2005 16:46 35328]

R0 sptd;sptd;c:windowssystem32driverssptd.sys [26.12.2007 17:34 691696]

R1 ehdrv;ehdrv;c:windowssystem32driversehdrv.sys [06.02.2009 15:23 106208]

R1 epfwtdir;epfwtdir;c:windowssystem32driversepfwtdir.sys [06.02.2009 15:24 93336]

R1 uzg4njgz;AVZ-RK Kernel Driver;c:windowssystem32driversuzg4njgz.sys [22.02.2010 0:07 11264]

R2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service;c:program filesCommon FilesABBYYFineReader9.00LicensingPENetworkLicenseServer.exe [27.10.2008 21:03 759072]

R2 ekrn;ESET Service;c:program filesESETESET NOD32 Antivirusekrn.exe [06.02.2009 15:23 727720]

R2 ICQ Service;ICQ Service;c:program filesICQ6ToolbarICQ Service.exe [22.07.2009 22:16 222968]

R2 LBeepKE;LBeepKE;c:windowssystem32driversLBeepKE.sys [27.02.2010 14:32 10384]

S3 s816bus;Sony Ericsson Device 816 driver (WDM);c:windowssystem32driverss816bus.sys [21.09.2009 21:22 81832]

S3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;c:windowssystem32driverss816mdfl.sys [21.09.2009 21:25 13864]

S3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;c:windowssystem32driverss816mdm.sys [21.09.2009 21:25 107304]

S3 s816mgmt;Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM);c:windowssystem32driverss816mgmt.sys [21.09.2009 21:35 99112]

S3 s816nd5;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS);c:windowssystem32driverss816nd5.sys [21.09.2009 21:36 21928]

S3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;c:windowssystem32driverss816obex.sys [21.09.2009 21:35 97320]

S3 s816unic;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM);c:windowssystem32driverss816unic.sys [21.09.2009 21:35 97704]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled componentsWindows Sidebar]

c:windowssystem32hidec [N/A]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled components{34A19196-274E-4D75-9D30-D7A45A0A4178}]

2004-08-04 02:07	11776	—-a-w-	c:program filesWindows Sidebarregsvr32.exe
[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled components{6B9228DA-9C15-419e-856C-19E768A13BDC}]

2004-08-04 02:07	11776	—-a-w-	c:program filesWindows Sidebarregsvr32.exe
[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled components{BADA65A0-86B7-462B-B720-CE66655C73F5}]

c:program filesWindows SidebarVAIO.vshellext.dll [N/A]

.

.

Supplementary Scan


.

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = Root: HKCU; Subkey: SoftwareMicrosoftInternet ExplorerSearchUrl; ValueType: string; ValueName: ‘; ValueData: ‘; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip

TCP: {DB1A5B64-2A47-45DB-8229-94171839A0A8} = 195.248.191.67,195.248.191.72

Handler: tbr — {4D25FB7A-8902-4291-960E-9ADA051CFBBF} — c:progra~1CrawlerToolbarctbr.dll

.

**************************************************************************
catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-04-21 23:13

Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully

hidden files: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully

user: MBR read successfully

called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll sfsync03.sys sfsync02.sys atapi.sys spbv.sys >>UNKNOWN [0x8A97B938]<<

kernel: MBR read successfully

detected MBR rootkit hooks:

DriverDisk -> CLASSPNP.SYS @ 0xba0fcf28

DriverACPI -> ACPI.sys @ 0xb9e74cb8

Driveratapi -> sfsync03.sys @ 0xba0c995c

IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8

ParseProcedure -> ntkrnlpa.exe @ 0x805827e8

DeviceHarddisk0DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8

ParseProcedure -> ntkrnlpa.exe @ 0x805827e8

NDIS: NVIDIA nForce Networking Controller -> SendCompleteHandler -> NDIS.sys @ 0xb9cffbb0

PacketIndicateHandler -> NDIS.sys @ 0xb9d0ca21

SendHandler -> NDIS.sys @ 0xb9cea87b

user & kernel MBR OK
**************************************************************************

.

DLLs Loaded Under Running Processes




— — — — — — — > ‘winlogon.exe'(744)

c:windowssystem32Ati2evxx.dll

c:program filescommon fileslogishrdbluetoothLBTWlgn.dll

c:program filescommon fileslogishrdbluetoothLBTServ.dll

— — — — — — — > ‘explorer.exe'(4052)

c:program filesLogitechSetPointGameHook.dll

c:program filesLogitechSetPointlgscroll.dll

c:windowssystem32WPDShServiceObj.dll

c:windowssystem32PortableDeviceTypes.dll

c:windowssystem32PortableDeviceApi.dll

.

Other Running Processes


.

c:windowssystem32Ati2evxx.exe

c:windowssystem32Ati2evxx.exe

c:program filesBonjourmDNSResponder.exe

c:matlab6p5webserverbinwin32matlabserver.exe

c:windowssystem32PnkBstrA.exe

c:windowssystem32PnkBstrB.exe

c:matlab6p5binwin32matlab.exe

c:windowssystem32wscntfy.exe

c:program filesCommon FilesLogishrdKHAL2KHALMNPR.EXE

c:program filesCommon FilesTeleca SharedGeneric.exe

c:program filesSony EricssonMobile2Mobile Phone Monitorepmworker.exe

.

**************************************************************************

.

Completion time: 2010-04-21  23:16:16 — machine was rebooted

ComboFix-quarantined-files.txt  2010-04-21 20:16

ComboFix2.txt  2010-04-20 13:06

Pre-Run: 11 059 466 240 байт свободно

Post-Run: 11 027 714 048 байт свободно
— — End Of File — — BC0377FDC95F254313CD120DF93218C1

		
	

[Автор]

Сообщения