Прокомментируйте пожалуйста лог-файл

[Аноним]

Проблемы с компьютером вроде бы устранены.
Но все же…

ComboFix 11-03-29.06 — ячсми 30.03.2011 19:30:52.1.2 — x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1251.7.1049.18.3066.2010 [GMT 4:00]
Running from: c:usersячсмиDesktopComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:usersячсмиAppDataRoamingwinxrar
c:usersячсмиAppDataRoamingwinxrara.htm
c:usersячсмиAppDataRoamingwinxrarafter.png
c:usersячсмиAppDataRoamingwinxraraview
c:usersячсмиAppDataRoamingwinxrardir.png
c:usersячсмиAppDataRoamingwinxrardot.gif
c:usersячсмиAppDataRoamingwinxrarhtmlayout.dll
c:usersячсмиAppDataRoamingwinxrarkey
c:usersячсмиAppDataRoamingwinxrarlogo.png
c:usersячсмиAppDataRoamingwinxrarlogo_____.png
c:usersячсмиAppDataRoamingwinxrarlogo2.png
c:usersячсмиAppDataRoamingwinxrarMyriadWebPro-Condensed.ttf
c:usersячсмиAppDataRoamingwinxrarrules.css
c:usersячсмиAppDataRoamingwinxrarsb-h-scroll-next.png
c:usersячсмиAppDataRoamingwinxrarsb-h-scroll-prev.png
c:usersячсмиAppDataRoamingwinxrarsb-scroll-back.png
c:usersячсмиAppDataRoamingwinxrarsb-scroll-base.png
c:usersячсмиAppDataRoamingwinxrarsb-scroll-slider.png
c:usersячсмиAppDataRoamingwinxrarsb-v-scroll-next.png
c:usersячсмиAppDataRoamingwinxrarsb-v-scroll-prev.png
c:usersячсмиAppDataRoamingwinxrarscroll.css
c:windowssystem32dxxfmsf.dll
c:windowssystem32temp.005
.
.
((((((((((((((((((((((((( Files Created from 2011-02-28 to 2011-03-30 )))))))))))))))))))))))))))))))
.
.
2011-03-30 13:49 . 2011-03-30 13:49 11264 —-a-w- c:windowssystem32driversuziznze2.sys
2011-03-30 13:31 . 2011-03-30 13:49 7168 —-a-w- c:windowssystem32driversutiznze2.sys
2011-03-29 19:08 . 2011-03-29 19:08

---

d

---

w- c:program filesCCleaner
2011-03-29 18:49 . 2011-03-29 21:22

---

d—h—w- c:program filesCommon Filesinf
2011-03-29 18:43 . 2011-03-29 18:43 0 —-a-w- c:windowssystem3296E7.tmp
2011-03-27 21:30 . 2011-03-15 04:05 6792528 —-a-w- c:programdataMicrosoftWindows DefenderDefinition Updates{2A652079-A4F4-4462-8770-09A83EF7385F}mpengine.dll
2011-03-16 04:56 . 2011-03-16 04:56

---

d

---

w- c:windows1C4551A64743409391E41477CD655043.TMP
2011-03-16 04:34 . 2011-03-16 15:28

---

d

---

w- c:program filesDragon Age
2011-03-08 22:55 . 2011-03-08 22:55

---

d

---

w- c:program filesNVIDIA Corporation
2011-03-05 12:50 . 2011-03-05 12:50

---

d

---

w- c:usersячсмиAppDataRoamingPrince of Persia
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-02 14:11 . 2010-02-15 15:51 222080

---

w- c:windowssystem32MpSigStub.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«Picasa Media Detector»=»c:program filesPicasa2PicasaMediaDetector.exe» [2008-02-26 443968]
«swg»=»c:program filesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe» [2009-09-10 39408]
«ehTray.exe»=»c:windowsehomeehTray.exe» [2008-01-21 125952]
«DAEMON Tools Lite»=»c:program filesDAEMON Tools LiteDTLite.exe» [2009-10-30 369200]
«Skype»=»c:program filesSkypePhoneSkype.exe» [2010-10-11 14940040]
.
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«RtHDVCpl»=»RtHDVCpl.exe» [2008-05-13 6139904]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2008-06-09 13543968]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2008-06-09 92704]
«Adobe Reader Speed Launcher»=»c:program filesAdobeReader 8.0ReaderReader_sl.exe» [2008-01-11 39792]
«BDRegion»=»c:program filesCyberlinkShared Filesbrs.exe» [2007-11-16 91432]
«RemoteControl»=»c:program filesCyberLinkPowerDVDPDVDServ.exe» [2007-10-28 72736]
«LanguageShortcut»=»c:program filesCyberLinkPowerDVDLanguageLanguage.exe» [2007-10-11 62760]
«Google EULA Launcher»=»c:program filesGoogleGoogle EULAGoogleEULALauncher.exe» [2008-05-28 20480]
«OSD»=»c:program filesOEMOSD_1.16osd.exe» [2008-06-18 376832]
«avgnt»=»c:program filesAviraAntiVir Desktopavgnt.exe» [2009-03-02 209153]
«Guard.Mail.ru.gui»=»c:program filesMail.RuGuardGuardMailRu.exe» [2010-12-23 1041088]
.
[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«Picasa Media Detector»=»c:program filesPicasa2PicasaMediaDetector.exe» [2008-02-26 443968]
.
c:usersпзб¬ЁAppDataRoamingMicrosoftWindowsStart MenuProgramsStartup
Adobe Gamma.lnk — c:program filesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe [2005-3-16 113664]
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]
«EnableLUA»= 0 (0x0)
«EnableUIADesktopToggle»= 0 (0x0)
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]
«aux»=wdmaud.drv
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerSvcS-1-5-21-3708281081-187386317-2860240483-1000]
«EnableNotificationsRef»=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:windowsMicrosoft.NETFrameworkv4.0.30319mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Служба Google Update (gupdate);c:program filesGoogleUpdateGoogleUpdate.exe [2010-04-06 135664]
R3 DAUpdaterSvc;Dragon Age: Начало — Контентное обновление;c:program filesDragon Agebin_shipDAUpdaterSvc.Service.exe [2009-12-15 25832]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:windowssystem32DRIVERSewusbdev.sys [2009-06-22 100736]
R3 NETw5v32;Драйвер адаптера Intel(R) Wireless WiFi Link для Windows Vista 32 Bit ;c:windowssystem32DRIVERSNETw5v32.sys [2008-05-01 3660800]
R3 utiznze2;AVZ Kernel Driver;c:windowssystem32Driversutiznze2.sys [2011-03-30 7168]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:windowsMicrosoft.NETFrameworkv4.0.30319WPFWPFFontCache_v0400.exe [2010-03-18 753504]
R4 mchInjDrv;mchInjDrv;c:usersF6F2~1AppDataLocalTempmc28CB8.tmp [x]
S0 sptd;sptd;c:windowsSystem32Driverssptd.sys [2010-01-19 691696]
S1 uziznze2;AVZ-RK Kernel Driver;c:windowssystem32Driversuziznze2.sys [2011-03-30 11264]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:program filesAviraAntiVir Desktopsched.exe [2009-05-13 108289]
S2 Guard.Mail.ru;Guard.Mail.ru;c:program filesMail.RuGuardGuardMailRu.exe [2010-12-23 1041088]
S2 nlsX86cc;NLS Service;c:windowssystem32NLSSRV32.EXE [2010-10-20 67904]
S2 OsdService;OSD Service;c:program filesOEMOSD_1.16OsdService.exe [2008-02-22 94208]
S3 GpdDevDPort;GpdDevDPort;c:windowssystem32directport.sys [2008-06-17 7168]
S3 GpdKbFilter;GpdKbFilter;c:windowssystem32kbfiltr.sys [2008-03-31 8192]
S3 netr28;Ralink 802.11n Wireless Driver for Windows Vista;c:windowssystem32DRIVERSnetr28.sys [2008-01-30 338432]
.
.
Contents of the ‘Scheduled Tasks’ folder
.
2011-03-30 c:windowsTasksGoogleUpdateTaskMachineCore.job
— c:program filesGoogleUpdateGoogleUpdate.exe [2010-04-06 23:06]
.
2011-03-30 c:windowsTasksGoogleUpdateTaskMachineUA.job
— c:program filesGoogleUpdateGoogleUpdate.exe [2010-04-06 23:06]
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.mail.ru/cnt/7828
uDefault_Search_URL = hxxp://search.qip.ru
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
uInternet Settings,ProxyOverride = vkontakte.ru;www.vkontakte.ru;vk.com;www.vk.com
uSearchAssistant = hxxp://search.qip.ru/ie
uSearchURL,(Default) = Root: HKCU; Subkey: SoftwareMicrosoftInternet ExplorerSearchUrl; ValueType: string; ValueName: ‘; ValueData: ‘; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
IE: E&xport to Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
IE: Google ВикиКомментарии… — c:program filesGoogleGoogle ToolbarComponentGoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
Trusted Zone: samara.ruwww
Trusted Zone: yandex.ruwww
TCP: {168D9CB9-A3A5-4A58-A5AA-5BB382D89831} = 192.168.6.1
TCP: {77E57D1A-8CDC-4AF4-9E33-F667AE9827FF} = 91.222.128.18 91.222.128.18
FF — ProfilePath — c:usersячсмиAppDataRoamingMozillaFirefoxProfilesxl07np19.default
FF — prefs.js: browser.search.defaulturl — hxxp://go.mail.ru/search?fr=fftb&utf8in&q=
FF — prefs.js: browser.search.selectedEngine — mail.ru: РџРѕРёСЃРє РІ Интернете
FF — prefs.js: browser.startup.homepage — hxxp://google/
FF — prefs.js: keyword.URL — hxxp://go.mail.ru/search?utf8in=1&fr=fftbUFix&q=
FF — Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} — c:program filesMozilla Firefoxextensions{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF — Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} — c:program filesMozilla Firefoxextensions{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF — Ext: DAEMON Tools Toolbar: DTToolbar@toolbarnet.com — %profile%extensionsDTToolbar@toolbarnet.com
FF — Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} — %profile%extensions{20a82645-c095-46ed-80e3-08825760534b}
FF — Ext: Спутник @Mail.Ru: {37964A3C-4EE8-47b1-8321-34DE2C39BA4D} — %profile%extensions{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}
FF — Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} — c:windowsMicrosoft.NETFrameworkv3.5Windows Presentation FoundationDotNetAssistantExtension
.
— — — — ORPHANS REMOVED — — — —
.
HKU-Default-Run-fsc-reg — c:fsc-regfscreg.exe
.
.
.
**************************************************************************
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files:
.
**************************************************************************
.
[HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesmchInjDrv]
«ImagePath»=»??c:usersF6F2~1AppDataLocalTempmc28CB8.tmp»
.
[HKEY_LOCAL_MACHINESYSTEMControlSet001Services{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
«ImagePath»=»??c:program filesCyberLinkPowerDVD00.fcl»
.

---

LOCKED REGISTRY KEYS

---

.
[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}000AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
«BlindDial»=dword:00000000
.
[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}001AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
«BlindDial»=dword:00000000
.
[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}002AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
«BlindDial»=dword:00000000
.

---

Other Running Processes

---

.
c:windowssystem32nvvsvc.exe
c:windowssystem32rundll32.exe
c:windowssystem32conime.exe
c:program filesAviraAntiVir Desktopavguard.exe
c:program filesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
c:program filesNeroNero8Nero BackItUpNBService.exe
c:windowssystem32IoctlSvc.exe
c:program filesFujitsu Siemens ComputersSystemDiagnosticsOnlineDiagnosticTestManagerTestHandler.exe
c:windowssystem32WUDFHost.exe
c:windowsRtHDVCpl.exe
c:windowsSystem32rundll32.exe
c:windowsehomeehmsas.exe
c:program filesWindows Media Playerwmpnscfg.exe
c:program filesWindows Media Playerwmpnetwk.exe
c:windowssystem32wbemunsecapp.exe
c:\?c:windowssystem32wbemWMIADAP.EXE
c:windowsservicingTrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2011-03-30 19:46:34 — machine was rebooted
ComboFix-quarantined-files.txt 2011-03-30 15:46
.
Pre-Run: 20 685 770 752 байт свободно
Post-Run: 20 335 009 792 байт свободно
.
— — End Of File — — FB3D7CAA26F838BC49786E034568EDFF

[Автор]

Сообщения