- This topic has 1 ответ, 2 участника, and was last updated 16 years, 2 months назад by
.
-
Сообщения
-
помогите удалить порно информер, пожайлуста
ComboFix 08-11-21.04 — Владелец 2008-11-22 11:31:19.5 — NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1251.1.1049.18.233 [GMT 3:00]
Running from: C:ComboFix.exe
* Created a new restore pointWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.c:documents and settingsВладелецLocal SettingsTemporary Internet Files0EB9F12C_6E6B_4c03_AEBA_8C04CFA98AA4.gif
c:documents and settingsВладелецLocal SettingsTemporary Internet Files15913497_F86C_4218_8817_F50940D1E1B2.gif
c:documents and settingsВладелецLocal SettingsTemporary Internet Files29887DDE_00B9_4011_9CF7_59511F1ECC1B.gif
c:documents and settingsВладелецLocal SettingsTemporary Internet Files2A665EDD_5758_480c_8366_66DFC5F23877.gif
c:documents and settingsВладелецLocal SettingsTemporary Internet Files35B7DFFA_884F_4fbc_8E60_DA601BDC7BF7.gif
c:documents and settingsВладелецLocal SettingsTemporary Internet Files362FD6E8_8CDA_4c2a_A8AA-BDA22B321711.jpg
c:documents and settingsВладелецLocal SettingsTemporary Internet Files3DF04940_9866_4241_A998_0CDDFAFD147A.gif
c:documents and settingsВладелецLocal SettingsTemporary Internet Files426500D7_0FF3_426c_828D_065DBAEA0581.gif
c:documents and settingsВладелецLocal SettingsTemporary Internet Files478BD4AE_2691_438d_BDCA_3485DC022700.gif
c:documents and settingsВладелецLocal SettingsTemporary Internet Files5C6C645F_BAA8_4149_BFEB_2031230FF0FD.gif
c:documents and settingsВладелецLocal SettingsTemporary Internet Files61EA7D69_19D4_421a_A899_0DF4D58CD119.jpg
c:documents and settingsВладелецLocal SettingsTemporary Internet Files777FDAFB_83CF_4960_AA71_4E5D7BCD8E57.gif
c:documents and settingsВладелецLocal SettingsTemporary Internet Files8DA878D5_E80B_4721_B75A_17EFFAF1A700.gif
c:documents and settingsВладелецLocal SettingsTemporary Internet Files98F6DF79_7171_452d_9C26_C0193E12DBDF.gif
c:documents and settingsВладелецLocal SettingsTemporary Internet FilesA2B240D6_0386_419e_91C5_3F7D90437CD0.jpg
c:documents and settingsВладелецLocal SettingsTemporary Internet FilesC75CEF8D_5AF4_4563_8594_C45A45E14E63.gif
c:documents and settingsВладелецLocal SettingsTemporary Internet FilesE21285C1_40E6_435c_A69F_3387E7BD89CB.gif
c:documents and settingsВладелецLocal SettingsTemporary Internet FilesE9A4D648_ED73_4ea7_88B2_18332DBA4F3E.jpg.
((((((((((((((((((((((((( Files Created from 2008-10-22 to 2008-11-22 )))))))))))))))))))))))))))))))
.2008-11-22 11:29 . 2008-11-22 11:29 3,051,669 -ra
C:ComboFix.exe
2008-11-20 09:28 . 2008-11-20 09:28 113 —a—-t- C:delete_sh.bat
2008-11-19 21:57 . 2008-11-19 21:57 313,344 —a
c:windowssystem32nzilib.dll
2008-11-19 21:56 . 2008-11-19 21:56 316,928 —a
c:windowssystem32vmelib.dll
2008-11-19 12:00 . 2003-06-19 01:31 17,920 —a
c:windowssystem32mdimon.dll
2008-11-19 11:57 . 2008-11-19 11:58d
c:windowsSHELLNEW
2008-11-19 11:57 . 2008-11-19 11:57d
c:program filesMicrosoft.NET
2008-11-10 20:37 . 2008-11-10 20:37d
c:documents and settingsAll UsersApplication DataAge of Empires 3
2008-11-06 13:03 . 2008-03-05 15:56 3,786,760 —a
c:windowssystem32D3DX9_37.dll.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-22 07:25 696,352 —sha-w c:windowssystem32driversfidbox2.dat
2008-11-22 07:25 4,508 —sha-w c:windowssystem32driversfidbox2.idx
2008-11-22 07:21
d
w c:documents and settingsAll UsersApplication DataKaspersky Lab
2008-11-21 12:10 7,214,624 —sha-w c:windowssystem32driversfidbox.dat
2008-11-21 12:10 58,492 —sha-w c:windowssystem32driversfidbox.idx
2008-11-19 19:05
d
w c:program filesReGetDx
2008-11-18 13:50
d
w c:program filesOpenOffice.org1.1.4
2008-11-05 16:15
d
w c:program filesMagic Vines
2008-10-26 07:46
d
w c:program filesdirectx
2008-10-23 05:24
d—h—w c:program filesInstallShield Installation Information
2008-10-23 05:16
d
w c:program filesEA GAMES
2008-10-10 09:24 413,696
w c:windowssystem32wrap_oal.dll
2008-10-10 09:24 110,592
w c:windowssystem32OpenAL32.dll
2008-10-10 09:16
d
w c:program files1C
2008-10-09 08:18 96,976 —-a-w c:windowssystem32driversklin.dat
2008-10-09 08:18 87,855 —-a-w c:windowssystem32driversklick.dat
2008-10-09 08:03
d
w c:program filesKaspersky Lab
2008-10-09 08:01
d
w c:documents and settingsAll UsersApplication DataKaspersky Lab Setup Files
2008-10-03 06:19
d
w c:program filesCommon FilesWise Installation Wizard
2008-10-03 06:19
d
w c:program filesAGEIA Technologies
2008-10-02 17:21
d
w c:program filesMTX Mototrax
2008-10-01 15:38
d
w c:program filesFord Racing 3
2008-06-09 16:23 56,800 —-a-w c:documents and settingsВладелецApplication DataGDIPFONTCACHEV1.DAT
2006-09-28 19:37 1,680,792 —-a-w c:program filesdaemon406-x64.exe
2006-09-28 19:37 1,530,776 —-a-w c:program filesdaemon406-x86.exe
2006-03-25 17:40 5,571 —-a-w c:program filesPatchWise.log
.((((((((((((((((((((((((((((( snapshot@2008-11-21_15.05.29.25 )))))))))))))))))))))))))))))))))))))))))
.
— 2008-11-21 11:53:55 62,286 —-a-w c:windowssystem32perfc009.dat
+ 2008-11-21 12:16:13 62,286 —-a-w c:windowssystem32perfc009.dat
— 2008-11-21 11:53:56 74,560 —-a-w c:windowssystem32perfc019.dat
+ 2008-11-21 12:16:13 74,560 —-a-w c:windowssystem32perfc019.dat
— 2008-11-21 11:53:56 400,624 —-a-w c:windowssystem32perfh009.dat
+ 2008-11-21 12:16:13 400,624 —-a-w c:windowssystem32perfh009.dat
— 2008-11-21 11:53:56 441,244 —-a-w c:windowssystem32perfh019.dat
+ 2008-11-21 12:16:13 441,244 —-a-w c:windowssystem32perfh019.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_LOCAL_MACHINE~Browser Helper Objects{02A503CA-A3DC-4279-BE85-5A4669022448}]
2008-11-19 21:57 313344 —a
c:windowssystem32nzilib.dll[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2008-10-02 1561864][HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2008-10-02 1561864][HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar][HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2004-08-18 15360]
«Yupdate!»=»c:program filesCommon FilesYandexYupdateyupdate.exe» [2008-09-01 479496][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«wcmdmgr»=»c:windowswtupdaterwcmdmgrl.exe» [2002-09-27 20480]
«QuickTime Task»=»c:program filesQuickTimeqttask.exe» [2005-11-20 98304]
«Picasa Media Detector»=»c:program filesPicasa2PicasaMediaDetector.exe» [2007-05-02 366400]
«StartCCC»=»c:program filesATI TechnologiesATI.ACECore-StaticCLIStart.exe» [2006-11-10 90112]
«PinnacleDriverCheck»=»c:windowssystem32PSDrvCheck.exe» [2004-03-10 406016]
«StatusClient 2.6″=»c:program filesHewlett-PackardToolboxStatusClientStatusClient.exe» [2003-10-03 61440]
«TomcatStartup 2.5″=»c:program filesHewlett-PackardToolboxhpbpsttp.exe» [2004-04-09 184320]
«OrderReminder»=»c:program filesHewlett-PackardOrderReminderOrderReminder.exe» [2008-03-19 98304]
«HP Software Update»=»c:program filesHewlett-PackardHP Software UpdateHPWuSchd2.exe» [2003-12-05 49152]
«AVP»=»c:program filesKaspersky LabKaspersky Anti-Virus 2009avp.exe» [2008-04-25 201992]
«SoundMan»=»SOUNDMAN.EXE» [2005-01-20 c:windowsSOUNDMAN.EXE]
«BluetoothAuthenticationAgent»=»bthprops.cpl» [2004-08-18 c:windowssystem32bthprops.cpl][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2004-08-18 15360]c:documents and settings‚« ¤Ґ«Ґжѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
PowerReg Scheduler.exe [2007-12-26 256000]c:documents and settingsAll Usersѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
“бЄ®аҐл© § ЇгбЄ Adobe Reader.lnk — c:program filesAdobeAcrobat 7.0Readerreader_sl.exe [2005-09-24 29696][HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]
«vidc.SMP4″= mcs_vfw.dll
«VIDC.I420″= vdrcodec.dll
«VIDC.MJPG»= Pvmjpg21.dll
«VIDC.PIM1″= pclepim1.dll[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregBMExtreme]
—a
2005-12-01 04:34 169472 c:program filesBMExtremeBMExtreme.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregDAEMON Tools]
—a
2005-12-10 17:57 133016 c:program filesDAEMON Toolsdaemon.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregEDLauncher]
—a
2004-07-09 12:04 73728 c:program filesPRMT6PRMTEDEDLauncher.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregHomeAlarm]
—a
2005-10-05 14:38 864768 c:program filesChameleon ClockChamClock.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregMSMSGS]
—a
2004-10-13 19:24 1694208 c:program filesMessengermsmsgs.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNBJ]
—a
2005-04-08 18:43 1953792 c:program filesAheadNero BackItUpNBJ.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNeroFilterCheck]
—a
2001-07-09 11:50 155648 c:windowssystem32NeroCheck.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregQuickTime Task]
—a
2005-11-20 12:51 98304 c:program filesQuickTimeqttask.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregRemoteControl]
—a
2004-11-02 20:24 32768 c:program filesCyberLinkPowerDVDPDVDServ.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSecurityToolkit]
—a
2005-11-15 20:19 3289088 c:program filesQuantum Digital SecuritySecurity ToolkitSecurityToolkit.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSkype]
—a
2006-10-13 17:20 20058152 c:program filesSkypePhoneSkype.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSTYLEXP]
—a
2005-05-10 23:02 1310720 c:program filesTGTSoftStyleXPStyleXP.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregswg]
—a
2006-10-30 18:17 163576 c:program filesGoogleGoogleToolbarNotifier1.2.908.5008GoogleToolbarNotifier.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregWheelMouse]
—a
2004-08-25 17:31 147456 c:progra~1A4TechMouseAmoumain.exe[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«AntiVirusDisableNotify»=dword:00000001
«UpdatesDisableNotify»=dword:00000001
«AntiVirusOverride»=dword:00000001[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringKasperskyAntiVirus]
«DisableMonitoring»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\1C\Adrenalin\ADRENALIN.EXE»=
«c:\Program Files\Skype\Phone\Skype.exe»=
«c:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe»=
«c:\Program Files\Firefly Studios\Stronghold 2\Stronghold2.exe»=R0 klbg;Kaspersky Lab Boot Guard Driver;c:windowssystem32driversklbg.sys [2008-01-29 32784]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:windowssystem32DRIVERSklim5.sys [2008-03-25 24592]
S3 Amps2prt;A4Tech PS/2 Port Mouse Driver;c:windowssystem32DRIVERSAmps2prt.sys [2004-10-19 9984]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;??e:everest ultimate editionEVEREST Ultimate Editionkerneld.wnt []
S3 ids0005c;ids0005c;??c:documents and settingsAll UsersApplication DataKaspersky Anti-Virus Personal5.0basesids0005c.sys []
S3 ids00118;ids00118;??c:documents and settingsAll UsersApplication DataKaspersky Anti-Virus Personal5.0basesids00118.sys []
S3 SOCKFILT.DLL;Outpost Firewall PlugIn (SOCKFILT.DLL);??c:program filesAgnitumOutpost FirewallkernelSOCKFILT.DLL []
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);c:windowssystem32DRIVERSss_bus.sys [2007-09-03 58320]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;c:windowssystem32DRIVERSss_mdfl.sys [2007-09-03 8304]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;c:windowssystem32DRIVERSss_mdm.sys [2007-09-03 94000][HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{657ebd69-5b88-11d9-976e-806d6172696f}]
ShellAutoRuncommand — D:Setup.EXE[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{bd672607-59aa-11da-8cea-00115bf661ad}]
ShellAutoRuncommand — G:start.exe
.**************************************************************************
catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-22 11:35:23
Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
Completion time: 2008-11-22 11:36:37
ComboFix-quarantined-files.txt 2008-11-22 08:36:33
ComboFix2.txt 2008-11-21 12:40:41
ComboFix3.txt 2008-11-21 12:19:41
ComboFix4.txt 2008-11-21 12:08:05Pre-Run: 5 316 177 920 байт свободно
Post-Run: 5,299,195,904 байт свободно196
Здравствуйте, добро пожаловать на Spyware-ru форум.
Откройте блокнот и вставьте в него следующий текст:
Registry::
[-HKEY_LOCAL_MACHINE~Browser Helper Objects{02A503CA-A3DC-4279-BE85-5A4669022448}]
File::
c:windowssystem32nzilib.dll
c:windowssystem32vmelib.dllЗапишите получившийся файл на ваш рабочий стол под именем CFScript
Далее перетащите получившийся файл на иконку Combofix, как показано на картинке ниже.
Сombofix запуститься и выполнит процедуры описанные в созданном нами файле.
По результатам работы Combofix будет создан новый лог, его и вставьте в свой следующий ответ.
И конечно-же проверьте InternetExplorer в работе.
- Для ответа в этой теме необходимо авторизоваться.
