- This topic has 3 ответа, 2 участника, and was last updated 16 years, 1 month назад by
.
-
Сообщения
-
Красная полоска внизу с free porno video достала просто!
ComboFix 08-12-02.02 — Admin 2008-12-04 23:27:36.8 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1251.1.1049.18.1638 [GMT 3:00]
Running from: c:documents and settingsAdminРабочий столComboFix.exe
* Resident AV is activeWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.c:documents and settingsAdminLocal SettingsTemporary Internet Files0EB9F12C_6E6B_4c03_AEBA_8C04CFA98AA4.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files15913497_F86C_4218_8817_F50940D1E1B2.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files29887DDE_00B9_4011_9CF7_59511F1ECC1B.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files2A665EDD_5758_480c_8366_66DFC5F23877.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files35B7DFFA_884F_4fbc_8E60_DA601BDC7BF7.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files362FD6E8_8CDA_4c2a_A8AA-BDA22B321711.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet Files3DF04940_9866_4241_A998_0CDDFAFD147A.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files426500D7_0FF3_426c_828D_065DBAEA0581.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files478BD4AE_2691_438d_BDCA_3485DC022700.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files5C6C645F_BAA8_4149_BFEB_2031230FF0FD.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files61EA7D69_19D4_421a_A899_0DF4D58CD119.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet Files777FDAFB_83CF_4960_AA71_4E5D7BCD8E57.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files8DA878D5_E80B_4721_B75A_17EFFAF1A700.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files98F6DF79_7171_452d_9C26_C0193E12DBDF.gif
c:documents and settingsAdminLocal SettingsTemporary Internet FilesA2B240D6_0386_419e_91C5_3F7D90437CD0.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet FilesC75CEF8D_5AF4_4563_8594_C45A45E14E63.gif
c:documents and settingsAdminLocal SettingsTemporary Internet FilesE21285C1_40E6_435c_A69F_3387E7BD89CB.gif
c:documents and settingsAdminLocal SettingsTemporary Internet FilesE9A4D648_ED73_4ea7_88B2_18332DBA4F3E.jpg.
((((((((((((((((((((((((( Files Created from 2008-11-04 to 2008-12-04 )))))))))))))))))))))))))))))))
.2008-12-04 23:17 . 2008-12-04 23:17
d
c:program filesTrend Micro
2008-11-27 17:46 . 2008-11-27 17:46 317,952 —a
c:windowssystem32evllib.dll.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-04 19:22
d
w c:program filesESET
2008-11-27 21:16
d
w c:documents and settingsAdminApplication DatauTorrent
2008-11-07 15:16
d
w c:program filesQIP
2008-11-01 16:33
d
w c:program filesuTorrent
2008-11-01 12:21
d
w c:program filesGoogle
2008-10-11 12:46
d
w c:program filesPCFriendly
2008-03-05 19:12 16,384 —sha-w c:windowssystem32configsystemprofileCookiesindex.dat
2008-03-05 19:12 16,384 —sha-w c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5index.dat
2008-03-05 19:12 32,768 —sha-w c:windowssystem32configsystemprofileLocal SettingsTemporary Internet FilesContent.IE5index.dat
.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_LOCAL_MACHINE~Browser Helper Objects{6564C5E9-9D1D-4703-9EED-186DF5998AC6}]
2008-11-27 17:46 317952 —a
c:windowssystem32evllib.dll[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2008-02-16 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2007-11-14 201728]
«LClock»=»c:program filesLClockLClock.exe» [2007-12-14 86016]
«swg»=»c:program filesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe» [2008-11-20 68856][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2006-01-12 155648]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2007-12-05 8523776]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2007-12-05 81920]
«nod32kui»=»c:program filesEsetnod32kui.exe» [2008-03-05 949376]
«EPSON Stylus C65 Series»=»c:windowsSystem32spoolDRIVERSW32X863E_S4I3S2.EXE» [2003-11-27 99840]
«SkyTel»=»SkyTel.EXE» [2007-06-15 c:windowsSkyTel.exe]
«RTHDCPL»=»RTHDCPL.EXE» [2007-07-05 c:windowsRTHDCPL.exe]
«nwiz»=»nwiz.exe» [2007-12-05 c:windowssystem32nwiz.exe][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-02-16 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» [2008-02-16 c:windowssystem32advpack.dll]
«IE7_012″=»advpack.dll» [2008-02-16 c:windowssystem32advpack.dll]c:documents and settingsAdminѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
QuickTV.lnk — c:program filesAVerTVQuickTV.exe [2004-02-18 266240][HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]
«VIDC.ACDV»= ACDV.dll[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesDisableNotify»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusDisableNotify»=dword:00000001
«AntiVirusOverride»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«c:\Program Files\Bonjour\mDNSResponder.exe»=R1 nod32drv;nod32drv;c:windowssystem32driversnod32drv.sys [2008-03-05 15424]
R1 VD_FileDisk;VD_FileDisk;c:windowssystem32driversVD_FileDisk.sys [2008-03-05 15872]
R3 Cap7134;Cap7134 Capture;c:windowssystem32DRIVERSCap7134.sys [2008-03-07 345056]
R3 PhTVTune;Cap7134 TVTuner;c:windowssystem32DRIVERSPhTVTune.sys [2008-03-07 35008][HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{94bba79e-eaeb-11dc-945d-001e90087485}]
ShellAutoRuncommand — G:minstall.exe
.
.
Supplementary Scan
.
FireFox -: Profile — c:documents and settingsAdminApplication DataMozillaFirefoxProfilesfn21hvd6.default
.**************************************************************************
catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-04 23:28:46
Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(756)
c:windowssystem32SETUPAPI.dll
c:windowssystem32cscui.dll— — — — — — — > ‘lsass.exe'(812)
c:windowssystem32setupapi.dll
c:windowssystem32imon.dll
c:program filesEsetpr_imon.dll
.
Completion time: 2008-12-04 23:29:11
ComboFix-quarantined-files.txt 2008-12-04 20:29:01
ComboFix2.txt 2008-12-04 20:05:21Pre-Run: 17 335 435 264 байт свободно
Post-Run: 17,324,097,536 байт свободно130
Здравствуйте, добро пожаловать на Spyware-ru форум.
Откройте блокнот и вставьте в него следующий текст:
Registry::
[-HKEY_LOCAL_MACHINE~Browser Helper Objects{6564C5E9-9D1D-4703-9EED-186DF5998AC6}]
File::
c:windowssystem32evllib.dllЗапишите получившийся файл на ваш рабочий стол под именем CFScript
Далее перетащите получившийся файл на иконку Combofix, как показано на картинке ниже.
Сombofix запуститься и выполнит процедуры описанные в созданном нами файле.
По результатам работы Combofix будет создан новый лог, его и вставьте в свой следующий ответ.Спасибо!!!Всё исчезло, комп пашет как часы. Вот лог
ComboFix 08-12-02.02 — Admin 2008-12-07 20:57:56.9 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1251.1.1049.18.1638 [GMT 3:00]
Running from: c:documents and settingsAdminРабочий столComboFix.exe
Command switches used :: c:documents and settingsAdminРабочий столCFScript.txt
* Created a new restore point
* Resident AV is activeWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
c:windowssystem32evllib.dll
.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.c:documents and settingsAdminLocal SettingsTemporary Internet Files0EB9F12C_6E6B_4c03_AEBA_8C04CFA98AA4.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files15913497_F86C_4218_8817_F50940D1E1B2.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files29887DDE_00B9_4011_9CF7_59511F1ECC1B.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files2A665EDD_5758_480c_8366_66DFC5F23877.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files35B7DFFA_884F_4fbc_8E60_DA601BDC7BF7.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files362FD6E8_8CDA_4c2a_A8AA-BDA22B321711.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet Files3DF04940_9866_4241_A998_0CDDFAFD147A.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files426500D7_0FF3_426c_828D_065DBAEA0581.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files478BD4AE_2691_438d_BDCA_3485DC022700.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files5C6C645F_BAA8_4149_BFEB_2031230FF0FD.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files61EA7D69_19D4_421a_A899_0DF4D58CD119.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet Files777FDAFB_83CF_4960_AA71_4E5D7BCD8E57.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files8DA878D5_E80B_4721_B75A_17EFFAF1A700.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files98F6DF79_7171_452d_9C26_C0193E12DBDF.gif
c:documents and settingsAdminLocal SettingsTemporary Internet FilesA2B240D6_0386_419e_91C5_3F7D90437CD0.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet FilesC75CEF8D_5AF4_4563_8594_C45A45E14E63.gif
c:documents and settingsAdminLocal SettingsTemporary Internet FilesE21285C1_40E6_435c_A69F_3387E7BD89CB.gif
c:documents and settingsAdminLocal SettingsTemporary Internet FilesE9A4D648_ED73_4ea7_88B2_18332DBA4F3E.jpg
c:windowssystem32evllib.dll.
((((((((((((((((((((((((( Files Created from 2008-11-07 to 2008-12-07 )))))))))))))))))))))))))))))))
.2008-12-05 18:31 . 2008-12-05 18:31 1,172 —a
c:windowsmozver.dat
2008-12-04 23:17 . 2008-12-04 23:17d
c:program filesTrend Micro.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-07 13:55
d
w c:documents and settingsAdminApplication DatauTorrent
2008-12-04 19:22
d
w c:program filesESET
2008-11-07 15:16
d
w c:program filesQIP
2008-11-01 16:33
d
w c:program filesuTorrent
2008-11-01 12:21
d
w c:program filesGoogle
2008-10-11 12:46
d
w c:program filesPCFriendly
2008-03-05 19:12 16,384 —sha-w c:windowssystem32configsystemprofileCookiesindex.dat
2008-03-05 19:12 16,384 —sha-w c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5index.dat
2008-03-05 19:12 32,768 —sha-w c:windowssystem32configsystemprofileLocal SettingsTemporary Internet FilesContent.IE5index.dat
.((((((((((((((((((((((((((((( snapshot@2008-12-04_23.28.50,56 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-10-04 17:24:00 3,695,008 —-a-w c:windowssystem32MacromedFlashNPSWF32.dll
+ 2008-10-04 17:24:00 235,936 —-a-w c:windowssystem32MacromedFlashNPSWF32_FlashUtil.exe
— 2008-12-04 20:11:20 64,372 —-a-w c:windowssystem32perfc009.dat
+ 2008-12-07 16:53:03 64,372 —-a-w c:windowssystem32perfc009.dat
— 2008-12-04 20:11:20 77,534 —-a-w c:windowssystem32perfc019.dat
+ 2008-12-07 16:53:03 77,534 —-a-w c:windowssystem32perfc019.dat
— 2008-12-04 20:11:20 409,232 —-a-w c:windowssystem32perfh009.dat
+ 2008-12-07 16:53:03 409,232 —-a-w c:windowssystem32perfh009.dat
— 2008-12-04 20:11:20 451,468 —-a-w c:windowssystem32perfh019.dat
+ 2008-12-07 16:53:03 451,468 —-a-w c:windowssystem32perfh019.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2008-02-16 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2007-11-14 201728]
«LClock»=»c:program filesLClockLClock.exe» [2007-12-14 86016]
«swg»=»c:program filesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe» [2008-11-20 68856][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2006-01-12 155648]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2007-12-05 8523776]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2007-12-05 81920]
«nod32kui»=»c:program filesEsetnod32kui.exe» [2008-03-05 949376]
«EPSON Stylus C65 Series»=»c:windowsSystem32spoolDRIVERSW32X863E_S4I3S2.EXE» [2003-11-27 99840]
«SkyTel»=»SkyTel.EXE» [2007-06-15 c:windowsSkyTel.exe]
«RTHDCPL»=»RTHDCPL.EXE» [2007-07-05 c:windowsRTHDCPL.exe]
«nwiz»=»nwiz.exe» [2007-12-05 c:windowssystem32nwiz.exe][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-02-16 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» [2008-02-16 c:windowssystem32advpack.dll]
«IE7_012″=»advpack.dll» [2008-02-16 c:windowssystem32advpack.dll]c:documents and settingsAdminѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
QuickTV.lnk — c:program filesAVerTVQuickTV.exe [2004-02-18 266240][HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]
«VIDC.ACDV»= ACDV.dll[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesDisableNotify»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusDisableNotify»=dword:00000001
«AntiVirusOverride»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«c:\Program Files\Bonjour\mDNSResponder.exe»=
«c:\Program Files\uTorrent\utorrent.exe»=R1 nod32drv;nod32drv;c:windowssystem32driversnod32drv.sys [2008-03-05 15424]
R1 VD_FileDisk;VD_FileDisk;c:windowssystem32driversVD_FileDisk.sys [2008-03-05 15872]
R3 Cap7134;Cap7134 Capture;c:windowssystem32DRIVERSCap7134.sys [2008-03-07 345056]
R3 PhTVTune;Cap7134 TVTuner;c:windowssystem32DRIVERSPhTVTune.sys [2008-03-07 35008][HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{94bba79e-eaeb-11dc-945d-001e90087485}]
ShellAutoRuncommand — G:minstall.exe
.**************************************************************************
catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-07 20:59:20
Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(760)
c:windowssystem32SETUPAPI.dll
c:windowssystem32cscui.dll— — — — — — — > ‘lsass.exe'(816)
c:windowssystem32setupapi.dll
c:windowssystem32imon.dll
c:program filesEsetpr_imon.dll
.
Completion time: 2008-12-07 20:59:44
ComboFix-quarantined-files.txt 2008-12-07 17:59:33
ComboFix2.txt 2008-12-04 20:29:11
ComboFix3.txt 2008-12-04 20:05:21Pre-Run: 17 185 959 936 байт свободно
Post-Run: 17,186,357,248 байт свободно143
- Для ответа в этой теме необходимо авторизоваться.
