[BaceK]

Новый ComboFix. Единственный вопрос: я после каждой такой операции три раза подряд перезагружал комп, потому что была не активна панель задач и меню пуск, опера и другие программы зависали, так продолжалось 5 минут, потом все отвисает и компьютер работает нормально, это так и должно быть?

[BaceK]

вышеприведенный сайт у меня не грузится, файл, который выдали.
<=

[BaceK]

Все что было по ссылке сделал, помогло, огромное вам спасибо!
в конце выдали
LOG.TXT
ComboFix 10-08-21.06 — Василий 22.08.2010 14:34:21.1.2 — x86
Microsoft Windows XP Professional 5.1.2600.2.1251.7.1049.18.511.293 [GMT 4:00]
Running from: c:documents and settingsВасилий.BA447EBB33F1482Рабочий столComboFix.exe
Command switches used :: c:documents and settingsВасилий.BA447EBB33F1482Рабочий столWindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:program filesInternet Explorersetupapi.dll
c:program filesMozilla Firefoxsetupapi.dll
c:program filesOperasetupapi.dll
c:program filesRelevantKnowledge
c:program filesRelevantKnowledgerlls.dll
c:program filesVKSaver
c:program filesVKSaveruninstall.exe
c:windowssystem32fjhdyfhsn.bat
c:windowssystem32vksaver.dll
E:autorun.inf

.
((((((((((((((((((((((((( Files Created from 2010-07-22 to 2010-08-22 )))))))))))))))))))))))))))))))
.

2010-08-22 09:40 . 2010-08-22 10:00

---

d

---

w- c:program filestrend micro
2010-08-22 09:40 . 2010-08-22 09:41

---

d

---

w- C:rsit
2010-08-21 19:11 . 2006-03-02 12:00 990208 —-a-w- c:windowssetupapi.dll
2010-08-21 19:07 . 2004-05-13 13:28 932864 —-a-w- c:windowssystemSETUPAPI.DLL
2010-08-21 14:28 . 2010-08-21 14:28 585504 —-a-w- c:windowssystem32driverssexar.sys
2010-08-21 14:27 . 2010-08-21 14:27

---

d-sh—w- c:windowssystem32configsystemprofileIETldCache
2010-08-21 14:27 . 2010-08-21 14:27 40960 —-a-w- c:windowssystem322fdcddbb.exe
2010-08-21 05:45 . 2006-03-02 12:00 221184 —-a-w- c:windowssystem32wmpns.dll
2010-08-21 05:45 . 2010-08-21 05:45

---

d

---

w- c:documents and settingsГлавный.BA447EBB33F1482
2010-08-18 05:41 . 2010-08-18 05:41

---

d

---

w- c:documents and settingsAll Users.WINDOWSApplication DataMcAfee Security Scan
2010-08-18 05:41 . 2010-08-18 05:41

---

d

---

w- c:documents and settingsAll Users.WINDOWSApplication DataMcAfee
2010-08-18 05:41 . 2010-08-18 05:41 1025992 —-a-w- c:documents and settingsAll Users.WINDOWSApplication DataNOSAdobe_DownloadsSecurityScan_Release.exe
2010-08-18 05:40 . 2010-08-18 11:59

---

d

---

w- c:documents and settingsAll Users.WINDOWSApplication DataNOS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-22 10:41 . 2008-11-26 14:12

---

d

---

w- c:program filesOpera
2010-08-21 14:28 . 2006-03-02 12:00 585504 —-a-w- c:windowssystem32driversasyncmac.sys
2010-08-21 14:27 . 2010-08-21 14:27 20 —-a-w- c:documents and settingsNetworkService.NT AUTHORITY.000Application Datagqlidy.dat
2010-08-21 06:35 . 2009-06-21 13:31

---

d

---

w- c:program filesMMetro
2010-08-20 12:43 . 2010-01-08 09:14

---

d

---

w- c:program filesuTorrent
2010-08-19 15:31 . 2010-07-04 05:47

---

d

---

w- c:documents and settingsAll Users.WINDOWSApplication DataTest Drive Unlimited
2010-08-18 19:00 . 2010-04-15 12:08 1200128 —-a-w- c:windowsSignSIS.EXE
2010-08-18 17:23 . 2010-06-09 10:26

---

d

---

w- c:program filesFull Tilt Poker
2010-08-12 17:03 . 2010-07-13 16:28

---

d

---

w- c:program filesICQ7.2
2010-07-13 16:29 . 2008-11-26 13:57

---

d—h—w- c:program filesInstallShield Installation Information
2010-07-13 16:28 . 2010-07-13 16:28

---

d

---

w- c:documents and settingsAll Users.WINDOWSApplication DataICQ
2010-07-13 16:19 . 2009-09-01 12:07

---

d

---

w- c:program filesQIP
2010-07-11 18:19 . 2009-03-18 13:37

---

d—a-w- c:documents and settingsAll Users.WINDOWSApplication DataTEMP
2010-07-11 16:53 . 2010-07-11 16:53 53248 —-a-w- c:windowssystem32apache.dll
2010-07-04 08:18 . 2009-08-24 06:33 137200 -c—a-w- c:windowssystem32driversPnkBstrK.sys
2010-07-04 08:18 . 2009-08-24 06:33 215152 —-a-w- c:windowssystem32PnkBstrB.exe
2010-07-04 05:25 . 2010-07-04 05:25 691696 —-a-w- c:windowssystem32driverssptd.sys
2010-07-04 05:25 . 2010-07-04 05:25

---

d

---

w- c:documents and settingsAll Users.WINDOWSApplication DataDAEMON Tools Lite
2010-06-28 16:18 . 2010-06-28 16:18

---

d

---

w- c:program filesWMV9_VCM
2010-06-02 18:33 . 2010-03-11 10:23 534784 -c—a-w- c:documents and settingsLocalService.NT AUTHORITY.000Local SettingsApplication DataFontCache3.0.0.0.dat
2009-06-23 09:59 . 2009-06-23 09:59 61 -csh—w- c:windowscnerolf.dat
.

---

Sigcheck

---

[-] 2010-08-21 14:28 . 0BB8CF97B010AD4CBF8D0C14EABC9509 . 585504 . . . . c:windowssystem32driversasyncmac.sys
[7] 2006-03-02 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:windowssystem32dllcacheasyncmac.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2010-01-11 110696]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2010-01-11 13666408]
«SoundMan»=»SOUNDMAN.EXE» [2007-04-16 577536]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2006-03-02 15360]

c:documents and settings‚ бЁ«Ё©.BA447EBB33F1482ѓ« ў­®Ґ ¬Ґ­оЏа®Ја ¬¬лЂўв®§ Јаг§Є 
monoca32.exe [2006-3-2 23611]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalWdf01000.sys]
@=»Driver»

[HKLM~startupfolderC:^Documents and Settings^Василий.BA447EBB33F1482^Главное меню^Программы^Автозагрузка^OpenOffice.org 3.2.lnk]
path=c:documents and settingsВасилий.BA447EBB33F1482Главное менюПрограммыАвтозагрузкаOpenOffice.org 3.2.lnk
backup=c:windowspssOpenOffice.org 3.2.lnkStartup

[HKLM~startupfolderC:^Documents and Settings^Василий.BA447EBB33F1482^Главное меню^Программы^Автозагрузка^Stardock ObjectDock.lnk]
path=c:documents and settingsВасилий.BA447EBB33F1482Главное менюПрограммыАвтозагрузкаStardock ObjectDock.lnk
backup=c:windowspssStardock ObjectDock.lnkStartup

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe ARM]
2010-06-09 08:06 976832 —-a-w- c:program filesCommon FilesAdobeARM1.0AdobeARM.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe Reader Speed Launcher]
2010-06-20 02:04 35760 —-a-w- c:program filesAdobeReader 9.0Readerreader_sl.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregGrooveMonitor]
2006-10-26 21:47 31016 -c—a-w- c:program filesMicrosoft OfficeOffice12GrooveMonitor.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPC Suite Tray]
2009-11-11 07:57 1451520 —-a-w- c:program filesNokiaNokia PC Suite 7PCSuite.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSunJavaUpdateSched]
2010-01-11 11:21 246504 -c—a-w- c:program filesCommon FilesJavaJava Updatejusched.exe

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\QIP\qip.exe»=
«c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE»=
«c:\Program Files\Microsoft Office\Office12\GROOVE.EXE»=
«c:\Program Files\Microsoft Office\Office12\ONENOTE.EXE»=
«e:\Игры\Pro Evolution Soccer 2009\pes2009.exe»=
«e:\Игры\Counter Strike 1.6\hl.exe»=
«c:\WINDOWS\system32\dpnsvr.exe»=
«c:\Program Files\uTorrent\utorrent.exe»=
«e:\Игры\Flight simulator\fs9.exe»=
«c:\Program Files\Bonjour\mDNSResponder.exe»=
«c:\Program Files\Roger Wilco\roger.exe»=
«e:\Игры\Pro Evolution Soccer 2009\GCP2009.exe»=
«f:\Program Files\FIFA2005\fifa2005.exe»=
«e:\Игры\Counter Strike 1.6\hlds.exe»=
«e:\Игры\Counter Strike 1.6\hltv.exe»=
«f:\Program Files\Pro Evolution Soccer 2010\pes2010.exe»=
«c:\Program Files\Opera\opera.exe»=
«c:\WINDOWS\system32\mmc.exe»=
«e:\Игры\Test Drive Unlimited GOLD\TestDriveUnlimited.exe»=
«c:\Program Files\ICQ7.2\ICQ.exe»=
«c:\Program Files\ICQ7.2\aolload.exe»=

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:windowssystem32driverssfdrv01a.sys [05.07.2006 16:46 63352]
R2 asyncr;asyncr;c:windowssystem32driversasyncr.sys [22.10.2009 12:10 30208]
R3 rxpvbus;Reality XP Avionics Bus Driver;c:windowssystem32driversrxpvbus.sys [28.08.2005 21:04 44032]
S2 gupdate;Служба Google Update (gupdate);»c:program filesGoogleUpdateGoogleUpdate.exe» /svc —> c:program filesGoogleUpdateGoogleUpdate.exe [?]
S2 ICQ Service;ICQ Service;c:program filesICQ6ToolbarICQ Service.exe —> c:program filesICQ6ToolbarICQ Service.exe [?]
S3 McComponentHostService;McAfee Security Scan Component Host Service;»c:program filesMcAfee Security Scan2.0.181McCHSvc.exe» —> c:program filesMcAfee Security Scan2.0.181McCHSvc.exe [?]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:windowssystem32driversnmwcdnsu.sys [18.03.2010 19:30 136704]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:windowssystem32driversnmwcdnsuc.sys [18.03.2010 19:30 8320]
S4 sptd;sptd;c:windowssystem32driverssptd.sys [04.07.2010 9:25 691696]
.
Contents of the ‘Scheduled Tasks’ folder

2010-08-22 c:windowsTasksUser_Feed_Synchronization-{E4A8E682-1A87-4695-870B-1A09C495ECBF}.job
— c:windowssystem32msfeedssync.exe [2009-03-08 01:31]
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://shkola.edu.ru/
uInternet Settings,ProxyOverride =
uSearchAssistant = hxxp://search.qip.ru/ie
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
Trusted Zone: citibank.ruwww
FF — ProfilePath — c:documents and settingsВасилий.BA447EBB33F1482Application DataMozillaFirefoxProfilesx6l7arp4.default
FF — prefs.js: browser.search.selectedEngine — QIP Search
FF — prefs.js: browser.startup.homepage — chrome://yasearch/content/ftab/ftab.xul
FF — prefs.js: keyword.URL — hxxp://search.qip.ru/search?from=FF&query=
FF — prefs.js: network.proxy.type — 2
FF — component: c:documents and settingsВасилий.BA447EBB33F1482Application DataMozillaFirefoxProfilesx6l7arp4.defaultextensions{32a1fd71-835e-4b11-8e54-886fda0b4c89}componentsqippipe.dll

—- FIREFOX POLICIES —-
c:program filesMozilla Firefoxgreprefsall.js — pref(«ui.use_native_colors», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.IDN.whitelist.lu», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.IDN.whitelist.nu», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.IDN.whitelist.nz», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.IDN.whitelist.xn--mgbaam7a8h», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.IDN.whitelist.xn--mgberp4a5d4ar», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.IDN.whitelist.xn--p1ai», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.IDN.whitelist.xn--mgbayh7gpa», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.IDN.whitelist.tel», true);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.auth.force-generic-ntlm», false);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.proxy.type», 5);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.buffer.cache.count», 24);
c:program filesMozilla Firefoxgreprefsall.js — pref(«network.buffer.cache.size», 4096);
c:program filesMozilla Firefoxgreprefsall.js — pref(«dom.ipc.plugins.timeoutSecs», 45);
c:program filesMozilla Firefoxgreprefsall.js — pref(«svg.smil.enabled», false);
c:program filesMozilla Firefoxgreprefsall.js — pref(«accelerometer.enabled», true);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js — pref(«security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref», true);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js — pref(«security.ssl.renego_unrestricted_hosts», «»);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js — pref(«security.ssl.treat_unsafe_negotiation_as_broken», false);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js — pref(«security.ssl.require_safe_negotiation», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name», «chrome://browser/locale/browser.properties»);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description», «chrome://browser/locale/browser.properties»);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«plugins.update.notifyUser», false);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«dom.ipc.plugins.enabled.nptest.dll», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«dom.ipc.plugins.enabled.npswf32.dll», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«dom.ipc.plugins.enabled.npctrl.dll», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«dom.ipc.plugins.enabled.npqtplugin.dll», true);
c:program filesMozilla Firefoxdefaultspreffirefox.js — pref(«dom.ipc.plugins.enabled», false);
.
— — — — ORPHANS REMOVED — — — —

Notify-AtiExtEvent — (no file)
MSConfigStartUp-avast! — c:progra~1ALWILS~1Avast4ashDisp.exe
MSConfigStartUp-nwiz — nwiz.exe
MSConfigStartUp-WinampAgent — c:program filesWinampwinampa.exe
AddRemove-A-one 3GP Video Converter_is1 — c:program filesA-one 3GP Video Converterunins000.exe
AddRemove-Agogo FLV to 3GP Converter Free_is1 — c:program filesAgogo FLV to 3GP Converterunins000.exe
AddRemove-Apollox Realistic Gameplay 1.0 — c:program filesEA SportsFIFA 09Uninstall Apollox Realistic Gameplay 1_0.exe
AddRemove-Apollox Realistic Gameplay v1.5.5 — e:игрыFIFA 09Uninstall Apollox Realistic Gameplay 1_5_5.exe
AddRemove-com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 — c:program filesCommon FilesAdobe AIRVersions1.0Adobe AIR Application Installer.exe
AddRemove-FIFA 09 Lightning Patch — f:program filesFIFA 09Uninstall Light Patch.exe
AddRemove-ICQToolbar — c:program filesICQ6ToolbarICQUnToolbar.exe
AddRemove-IL-2 Sturmovik Demo — e:игрыил-2Uninst.isu
AddRemove-ImTOO 3GP Video Converter — c:program filesImTOO3GP Video ConverterUninstall.exe
AddRemove-McAfee Security Scan — c:program filesMcAfee Security Scanuninstall.exe
AddRemove-Pes-World Patch 3.0 Final — e:игрыPro Evolution Soccer 2009PES 2009Uninstall.exe
AddRemove-Pro Evolution Soccer 5 — f:progra~1PROEVO~1UNWISE.EXE
AddRemove-Project IGI — e:игрыIGIUninst.isu
AddRemove-Samdim Design Antonov An-24RV — f:program filesMicrosoft GamesFlight Simulator 9UninstalAn24RV.exe
AddRemove-VKSaver — c:program filesVKSaveruninstall.exe
AddRemove-{32F66A20-7614-11D4-BD11-00104BD3F987} — c:program filesDesign ScienceMathPlayerSetup.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-22 14:44
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

c:documents and settingsВасилий.BA447EBB33F1482Главное менюПрограммыАвтозагрузкаmonoca32.exe 23611 bytes executable

scan completed successfully
hidden files: 1

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll prosync1.sys >>UNKNOWN [0x825C9160]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
DriverDisk -> CLASSPNP.SYS @ 0xf86a8fc3
DriverACPI -> ACPI.sys @ 0xf853bcb8
Driveratapi -> prosync1.sys @ 0xf8b6e6c1
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x8058236c
ParseProcedure -> ntkrnlpa.exe @ 0x8058146a
DeviceHarddisk0DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x8058236c
ParseProcedure -> ntkrnlpa.exe @ 0x8058146a
NDIS: Realtek RTL8139 Family PCI Fast Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0xf83b5bc3
PacketIndicateHandler -> NDIS.sys @ 0xf83a3a0b
SendHandler -> NDIS.sys @ 0xf83b7b31
user & kernel MBR OK

**************************************************************************
.

---

DLLs Loaded Under Running Processes

---

— — — — — — — > ‘explorer.exe'(2556)
c:windowssystem32ieframe.dll
c:windowssystem32webcheck.dll
c:windowssystem32WPDShServiceObj.dll
c:program filesNokiaNokia PC Suite 7PhoneBrowser.dll
c:program filesNokiaNokia PC Suite 7NGSCM.DLL
c:program filesNokiaNokia PC Suite 7LangPhoneBrowser_rus.nlr
c:program filesNokiaNokia PC Suite 7ResourcePhoneBrowser_Nokia.ngr
c:windowssystem32PortableDeviceTypes.dll
c:windowssystem32PortableDeviceApi.dll
.

---

Other Running Processes

---

.
c:windowssystem32nvsvc32.exe
c:program filesBonjourmDNSResponder.exe
c:program filesJavajre6binjqs.exe
e:altera91quartusbinjtagserver.exe
c:windowssystem32PnkBstrA.exe
c:windowssystem32wscntfy.exe
c:windowssystem32wbemwmiapsrv.exe
c:windowssystem32RUNDLL32.EXE
c:windowsSOUNDMAN.EXE
.
**************************************************************************
.
Completion time: 2010-08-22 14:47:43 — machine was rebooted
ComboFix-quarantined-files.txt 2010-08-22 10:47

Pre-Run: 2 537 435 136 байт свободно
Post-Run: 2 565 488 640 байт свободно

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)WINDOWS
[operating systems]
c:cmdconsBOOTSECT.DAT=»Microsoft Windows Recovery Console» /cmdcons
multi(0)disk(0)rdisk(0)partition(1)WINDOWS=»Microsoft Windows XP Professional RU» /noexecute=optin /fastdetect

— — End Of File — — 3A513C05D360B4E36DE3E6594F6B72AF

[Автор]

Сообщения