[catanddog06]

Я не смогла найти файл n1deiect.com. на диске С. В скрытых папках я тоже смотрела. Как же его найти? И поисковик не находит. Может, его нет?

[catanddog06]

Все сделала, вот какой Лог получился:

ComboFix 08-12-14.01 — 1 2008-12-22 22:38:47.7 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1251.1.1049.18.511.201 [GMT 4:00]
Running from: c:documents and settings1Рабочий столComboFix.exe
Command switches used :: c:documents and settings1Рабочий столCFScript.txt
* Created a new restore point
* Resident AV is active

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
— REDUCED FUNCTIONALITY MODE —
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:windowssystem32amvo.exe
c:windowssystem32amvo0.dll

.
((((((((((((((((((((((((( Files Created from 2008-11-22 to 2008-12-22 )))))))))))))))))))))))))))))))
.

2008-12-18 14:35 . 2007-12-11 15:12 123,551 -r-hs—- C:n1deiect.com
2008-12-10 19:21 . 2008-12-10 19:21 796 —a

---

C:top100.cnt
2008-12-09 22:15 . 2008-12-09 22:15 d

---

c:program filesICQ6Toolbar
2008-12-09 22:15 . 2008-12-09 22:15 d

---

c:documents and settingsAll UsersApplication DataICQ
2008-12-09 22:12 . 2008-12-09 22:23 d

---

c:program filesICQ6.5
2008-12-09 22:12 . 2008-12-13 19:12 d

---

c:documents and settings1Application DataICQ
2008-12-08 00:28 . 2008-12-08 22:22 d

---

c:documents and settingsЂ¤¬Ё­Ёбва в®аLocal Settings
2008-12-08 00:28 . 2008-12-08 00:28 d

---

c:documents and settingsЂ¤¬Ё­Ёбва в®а
2008-12-07 23:08 . 2008-12-07 23:08 d

---

c:program filesParagon Software
2008-12-07 23:08 . 2008-12-07 23:08 d

---

c:program filesCommon FilesParagon Software
2008-12-07 21:31 . 2008-12-07 21:36 d

---

c:program filesTranslateIt! 6.5
2008-12-07 21:31 . 2008-12-07 21:31 d

---

c:documents and settings1Application DataTranslateIt6.5
2008-12-05 21:35 . 2008-12-05 23:01 d

---

c:program filesГДЗометр 2.1
2008-12-03 22:40 . 2008-12-03 22:40 d

---

c:program filesVerseQ
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesUltraISO
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesSmart Install Maker
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesLouderIt
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesDAEMON Tools
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesCommon FilesEZB Systems
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesAudiograbber
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program files7-Zip
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:documents and settings1Application DataDAEMON Tools
2008-11-28 23:35 . 2001-08-17 14:53 62,976 —a

---

c:windowssystem32CABARC.EXE
2008-11-28 23:35 . 2007-10-31 20:42 8,636 —a

---

c:windowssystem32MODIFYPE.EXE
2008-11-28 23:35 . 2007-11-08 15:44 2,130 —a

---

c:windowssystem32CABTOOLS.VBS
2008-11-28 23:35 . 2004-09-28 20:26 1,701 —a

---

c:windowssystem32CABIN.VBS
2008-11-28 23:35 . 2004-09-27 20:57 1,281 —a

---

c:windowssystem32CABOUT.VBS
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesRestorator 2007
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesNeoSmart Technologies
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesFSImgViewer
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesEverest
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesEasy Gif Animator
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesDriver-soft
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesCPU-Z
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:documents and settings1Application DataFastStone
2008-11-28 23:34 . 2007-03-11 21:29 116,736 —a

---

c:windowssystem32RestoratorContextMenu.dll
2008-11-28 23:33 . 2008-11-28 23:33 d

---

c:program filesCorel
2008-11-28 23:33 . 2008-11-28 23:33 d

---

c:program filesCommon FilesCorel
2008-11-28 23:30 . 2008-11-28 23:30 d

---

c:program filesTechSmith
2008-11-28 23:30 . 2008-11-28 23:30 d

---

c:documents and settingsAll UsersApplication DataTechSmith
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesXPTweaker
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesUninstall Tool
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesRegshot
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesReal Alternative
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesNo1 DVD Ripper
2008-11-28 23:29 . 2007-07-09 17:40 d

---

c:program filesKristanix
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesK-Lite Codec Pack
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesCommon FilesWise Installation Wizard
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesCcleaner
2008-11-28 23:28 . 2008-11-28 23:28 d

---

c:program filesVLC
2008-11-28 23:28 . 2008-11-28 23:28 d

---

c:program filesThe KMPlayer
2008-11-28 23:28 . 2008-11-28 23:28 d

---

c:program filesMSECache
2008-11-28 23:27 . 2008-11-28 23:27 d

---

c:program filesCommon FilesMacromedia
2008-11-28 23:27 . 2008-11-28 23:48 d

---

c:program filesCommon FilesArsenal Shared
2008-11-28 23:27 . 2008-11-28 23:28 d

---

c:program filesArsenal Company
2008-11-28 23:25 . 2008-11-28 23:25 d

---

c:program filesMacromedia
2008-11-28 23:17 . 2008-11-28 23:24 d

---

c:windowsSHELLNEW
2008-11-28 23:15 . 2008-11-28 23:15 d

---

c:program filesMicrosoft Works
2008-11-28 23:13 . 2008-11-28 23:25 d

---

c:documents and settingsAll UsersApplication DataMicrosoft Help
2008-11-28 23:12 . 2008-11-28 23:12 dr-h

---

C:MSOCache
2008-11-28 23:11 . 2008-11-28 23:11 d

---

c:program filesWinDjView
2008-11-28 23:11 . 2008-11-28 23:42 d

---

c:program filesPunto Switcher
2008-11-28 23:11 . 2008-11-28 23:11 d

---

c:program filesFoxit Reader
2008-11-27 21:48 . 2008-11-27 23:36 d

---

c:windowssystem32CatRoot_bak
2008-11-27 21:25 . 2008-11-27 21:25 d

---

c:program filesMicrosoft Silverlight
2008-11-27 20:20 . 2004-12-22 13:06 17,584,128 -ra

---

c:windowssystem32ALSNDMGR.CPL
2008-11-27 20:20 . 2004-12-22 13:13 9,524,224 -ra

---

c:windowssystem32RTLCPL.EXE
2008-11-27 20:20 . 2004-12-22 13:07 2,304,320 -ra

---

c:windowssystem32driversALCXWDM.SYS
2008-11-27 20:20 . 2004-09-07 10:23 156,672 -ra

---

c:windowssystem32RTLCPAPI.dll
2008-11-27 20:20 . 2002-02-05 09:54 141,016 -ra

---

c:windowssystem32ALSNDMGR.WAV
2008-11-27 20:20 . 2004-12-22 13:09 77,824 -ra

---

c:windowsSOUNDMAN.EXE
2008-11-27 20:09 . 2008-11-27 20:09 d

---

c:documents and settingsAll UsersApplication DataNetwork Associates
2008-11-27 20:08 . 2008-11-27 20:09 d

---

c:program filesNetwork Associates
2008-11-27 20:08 . 2008-11-27 20:08 d

---

c:program filesCommon FilesNetwork Associates
2008-11-27 19:47 . 2008-11-27 19:48 d

---

c:program filesWinamp
2008-11-27 19:17 . 2008-11-27 19:30 d

---

c:windowsSxsCaPendDel
2008-11-27 19:11 . 2008-11-29 13:28 d

---

c:program filesMario Forever
2008-11-27 17:24 . 2008-11-27 17:24 4,444 —a

---

c:windowssystem32pid.PNF

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-09 18:15

---

d—h—w c:program filesInstallShield Installation Information
2008-12-09 17:43

---

d

---

w c:program filesQIP
2008-11-28 19:31

---

d

---

w c:program filesCommon FilesAdobe
2008-11-27 15:47

---

d

---

w c:program filesDownload Master
2008-11-27 15:36

---

d

---

w c:program filesNokia
2008-11-27 15:31

---

d

---

w c:program filesMail.Ru
2008-11-27 15:30 96,256 —-a-w c:windowssystem32driverssptd5581.sys
2008-11-27 15:28

---

d

---

w c:program filescitysvyaz
2008-11-27 15:27

---

d

---

w c:program filesPPPWorld
2008-11-27 15:27

---

d

---

w c:program filesDivX
2008-11-27 15:26

---

d

---

w c:program filesXtra
2008-11-27 15:19

---

d

---

w c:program filesOpera
2008-11-27 15:05

---

d

---

w c:program filesInterActual
2008-11-27 15:04

---

d

---

w c:program filesInterVideo
2008-11-27 15:04

---

d

---

w c:program filesCommon FilesInterVideo
2008-11-27 15:01

---

d

---

w c:program filesASUSTek
2008-11-14 20:35

---

d

---

w c:documents and settingsAll UsersApplication DataAlawarWrapper
2008-11-14 13:54

---

d

---

w c:program filesAlawar.ru
2008-11-14 13:25

---

d

---

w c:documents and settings1Application DataEleFun Games
2006-02-23 20:00 4,400,769 —-a-w c:program files3gp-video-converter.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2004-08-17 15360]
«NBJ»=»c:program filesaheadNero BackItUpNBJ.exe» [2004-09-07 1871872]
«MSMSGS»=»c:program filesMessengermsmsgs.exe» [2004-10-13 1694208]
«Download Master»=»c:program filesDownload Masterdmaster.exe» [2007-09-12 3253248]
«PcSync»=»c:program filesNokiaNokia PC Suite 6PcSync2.exe» [2006-06-27 1449984]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2007-11-14 201728]
«louderit.exe»=»c:program fileslouderitLouderIt.exe» [2008-02-19 41472]
«SlovoEd 6″=»c:program filesParagon SoftwareSlovoEd 6run.exe» [2007-03-26 610304]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2001-07-09 155648]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2005-06-15 6803456]
«PCSuiteTrayApplication»=»c:progra~1NokiaNOKIAP~1LAUNCH~1.EXE» [2006-06-15 229376]
«WinampAgent»=»c:program filesWinampwinampa.exe» [2006-02-23 35328]
«ShStatEXE»=»c:program filesNetwork AssociatesVirusScanSHSTAT.EXE» [2003-09-29 81990]
«McAfeeUpdaterUI»=»c:program filesNetwork AssociatesCommon FrameworkUpdaterUI.exe» [2003-09-10 135251]
«nwiz»=»nwiz.exe» [2005-06-15 c:windowssystem32nwiz.exe]
«SoundMan»=»SOUNDMAN.EXE» [2004-12-22 c:windowsSOUNDMAN.EXE]

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\QIP\qip.exe»=
«c:\Program Files\ICQ6.5\ICQ.exe»=

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2F]
ShellAutoRuncommand — F:laucher.exe
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.yandex.ru/?clid=40488
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~4Office12EXCEL.EXE/3000
IE: Закачать ВСЕ при помощи Download Master — c:program filesDownload Masterdmieall.htm
IE: Закачать при помощи Download Master — c:program filesDownload Masterdmie.htm
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe —
FF — ProfilePath — c:documents and settings1Application DataMozillaFirefoxProfilesh3beukur.default
FF — prefs.js: browser.search.selectedEngine — ICQ Search
FF — prefs.js: browser.startup.homepage — hxxp://www.yandex.ru/?clid=40488
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnppl3260.dll
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnprpjplug.dll
FF — plugin: c:program filesMicrosoft Silverlight2.0.31005.0npctrl.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-22 22:41:11
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

Other Running Processes

---

.
c:windowssystem32WgaTray.exe
c:progra~1COMMON~1NokiaMPAPIMPAPI3s.exe
c:program filesICQ6ToolbarICQ Service.exe
c:program filesNetwork AssociatesCommon FrameworkFrameworkService.exe
c:program filesNetwork AssociatesVirusScanMcshield.exe
c:progra~1NETWOR~1COMMON~1naPrdMgr.exe
c:program filesNetwork AssociatesVirusScanVsTskMgr.exe
c:program filesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
c:windowssystem32nvsvc32.exe
c:windowssystem32PnkBstrA.exe
c:windowssystem32wscntfy.exe
c:program filesCommon FilesPCSuiteServicesServiceLayer.exe
.
**************************************************************************
.
Completion time: 2008-12-22 22:42:51 — machine was rebooted
ComboFix-quarantined-files.txt 2008-12-22 18:42:06
ComboFix2.txt 2008-12-14 17:53:55
ComboFix3.txt 2008-12-09 19:30:50
ComboFix4.txt 2008-12-08 18:22:57
ComboFix5.txt 2008-12-22 18:38:11

Pre-Run: 14 920 974 336 байт свободно
Post-Run: 14,958,624,768 байт свободно

201 — E O F — 2008-10-24 18:01:10

[catanddog06]

Я все сделала, как Вы написали.Порнореклама пропала!!!Спасибо огромное!Не знаю, надо Вам теперь лог отправлять или нет, но на всякий случай отправляю.Дальше надо что-нибудь делать?

ComboFix 08-12-14.01 — 1 2008-12-14 21:50:23.6 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1251.1.1049.18.511.151 [GMT 4:00]
Running from: c:documents and settings1Рабочий столComboFix.exe
Command switches used :: c:documents and settings1Рабочий столCFScript.txt
* Created a new restore point
* Resident AV is active

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:windowssystem32ovylib.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:documents and settings1Local SettingsTemporary Internet Files0EB9F12C_6E6B_4c03_AEBA_8C04CFA98AA4.gif
c:documents and settings1Local SettingsTemporary Internet Files15913497_F86C_4218_8817_F50940D1E1B2.gif
c:documents and settings1Local SettingsTemporary Internet Files29887DDE_00B9_4011_9CF7_59511F1ECC1B.gif
c:documents and settings1Local SettingsTemporary Internet Files2A665EDD_5758_480c_8366_66DFC5F23877.gif
c:documents and settings1Local SettingsTemporary Internet Files35B7DFFA_884F_4fbc_8E60_DA601BDC7BF7.gif
c:documents and settings1Local SettingsTemporary Internet Files362FD6E8_8CDA_4c2a_A8AA-BDA22B321711.jpg
c:documents and settings1Local SettingsTemporary Internet Files3DF04940_9866_4241_A998_0CDDFAFD147A.gif
c:documents and settings1Local SettingsTemporary Internet Files426500D7_0FF3_426c_828D_065DBAEA0581.gif
c:documents and settings1Local SettingsTemporary Internet Files478BD4AE_2691_438d_BDCA_3485DC022700.gif
c:documents and settings1Local SettingsTemporary Internet Files5C6C645F_BAA8_4149_BFEB_2031230FF0FD.gif
c:documents and settings1Local SettingsTemporary Internet Files61EA7D69_19D4_421a_A899_0DF4D58CD119.jpg
c:documents and settings1Local SettingsTemporary Internet Files777FDAFB_83CF_4960_AA71_4E5D7BCD8E57.gif
c:documents and settings1Local SettingsTemporary Internet Files8DA878D5_E80B_4721_B75A_17EFFAF1A700.gif
c:documents and settings1Local SettingsTemporary Internet Files98F6DF79_7171_452d_9C26_C0193E12DBDF.gif
c:documents and settings1Local SettingsTemporary Internet FilesA2B240D6_0386_419e_91C5_3F7D90437CD0.jpg
c:documents and settings1Local SettingsTemporary Internet FilesC75CEF8D_5AF4_4563_8594_C45A45E14E63.gif
c:documents and settings1Local SettingsTemporary Internet FilesE21285C1_40E6_435c_A69F_3387E7BD89CB.gif
c:documents and settings1Local SettingsTemporary Internet FilesE9A4D648_ED73_4ea7_88B2_18332DBA4F3E.jpg
c:program filesMyCentria
c:program filesMyCentriaFirefoxadcentria.uid
c:program filesMyCentriaFirefoxadcentria.xml
c:program filesMyCentriaFirefoxInstallerFF.exe
c:program filesMyCentriaInfoBarMyCentriaInfoBar.dll
c:program filesMyCentriaMyCentriaUninstall.exe
c:windowssystem32ovylib.dll

.
((((((((((((((((((((((((( Files Created from 2008-11-14 to 2008-12-14 )))))))))))))))))))))))))))))))
.

2008-12-10 19:21 . 2008-12-10 19:21 796 —a

---

C:top100.cnt
2008-12-09 22:15 . 2008-12-09 22:15 d

---

c:program filesICQ6Toolbar
2008-12-09 22:15 . 2008-12-09 22:15 d

---

c:documents and settingsAll UsersApplication DataICQ
2008-12-09 22:12 . 2008-12-09 22:23 d

---

c:program filesICQ6.5
2008-12-09 22:12 . 2008-12-13 19:12 d

---

c:documents and settings1Application DataICQ
2008-12-08 00:28 . 2008-12-08 22:22 d

---

c:documents and settingsЂ¤¬Ё­Ёбва в®аLocal Settings
2008-12-08 00:28 . 2008-12-08 00:28 d

---

c:documents and settingsЂ¤¬Ё­Ёбва в®а
2008-12-07 23:08 . 2008-12-07 23:08 d

---

c:program filesParagon Software
2008-12-07 23:08 . 2008-12-07 23:08 d

---

c:program filesCommon FilesParagon Software
2008-12-07 21:31 . 2008-12-07 21:36 d

---

c:program filesTranslateIt! 6.5
2008-12-07 21:31 . 2008-12-07 21:31 d

---

c:documents and settings1Application DataTranslateIt6.5
2008-12-05 21:35 . 2008-12-05 23:01 d

---

c:program filesГДЗометр 2.1
2008-12-03 22:40 . 2008-12-03 22:40 d

---

c:program filesVerseQ
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesUltraISO
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesSmart Install Maker
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesLouderIt
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesDAEMON Tools
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesCommon FilesEZB Systems
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesAudiograbber
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program files7-Zip
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:documents and settings1Application DataDAEMON Tools
2008-11-28 23:35 . 2001-08-17 14:53 62,976 —a

---

c:windowssystem32CABARC.EXE
2008-11-28 23:35 . 2007-10-31 20:42 8,636 —a

---

c:windowssystem32MODIFYPE.EXE
2008-11-28 23:35 . 2007-11-08 15:44 2,130 —a

---

c:windowssystem32CABTOOLS.VBS
2008-11-28 23:35 . 2004-09-28 20:26 1,701 —a

---

c:windowssystem32CABIN.VBS
2008-11-28 23:35 . 2004-09-27 20:57 1,281 —a

---

c:windowssystem32CABOUT.VBS
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesRestorator 2007
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesNeoSmart Technologies
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesFSImgViewer
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesEverest
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesEasy Gif Animator
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesDriver-soft
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesCPU-Z
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:documents and settings1Application DataFastStone
2008-11-28 23:34 . 2007-03-11 21:29 116,736 —a

---

c:windowssystem32RestoratorContextMenu.dll
2008-11-28 23:33 . 2008-11-28 23:33 d

---

c:program filesCorel
2008-11-28 23:33 . 2008-11-28 23:33 d

---

c:program filesCommon FilesCorel
2008-11-28 23:30 . 2008-11-28 23:30 d

---

c:program filesTechSmith
2008-11-28 23:30 . 2008-11-28 23:30 d

---

c:documents and settingsAll UsersApplication DataTechSmith
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesXPTweaker
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesUninstall Tool
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesRegshot
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesReal Alternative
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesNo1 DVD Ripper
2008-11-28 23:29 . 2007-07-09 17:40 d

---

c:program filesKristanix
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesK-Lite Codec Pack
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesCommon FilesWise Installation Wizard
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesCcleaner
2008-11-28 23:28 . 2008-11-28 23:28 d

---

c:program filesVLC
2008-11-28 23:28 . 2008-11-28 23:28 d

---

c:program filesThe KMPlayer
2008-11-28 23:28 . 2008-11-28 23:28 d

---

c:program filesMSECache
2008-11-28 23:27 . 2008-11-28 23:27 d

---

c:program filesCommon FilesMacromedia
2008-11-28 23:27 . 2008-11-28 23:48 d

---

c:program filesCommon FilesArsenal Shared
2008-11-28 23:27 . 2008-11-28 23:28 d

---

c:program filesArsenal Company
2008-11-28 23:25 . 2008-11-28 23:25 d

---

c:program filesMacromedia
2008-11-28 23:17 . 2008-11-28 23:24 d

---

c:windowsSHELLNEW
2008-11-28 23:15 . 2008-11-28 23:15 d

---

c:program filesMicrosoft Works
2008-11-28 23:13 . 2008-11-28 23:25 d

---

c:documents and settingsAll UsersApplication DataMicrosoft Help
2008-11-28 23:12 . 2008-11-28 23:12 dr-h

---

C:MSOCache
2008-11-28 23:11 . 2008-11-28 23:11 d

---

c:program filesWinDjView
2008-11-28 23:11 . 2008-11-28 23:42 d

---

c:program filesPunto Switcher
2008-11-28 23:11 . 2008-11-28 23:11 d

---

c:program filesFoxit Reader
2008-11-27 21:48 . 2008-11-27 23:36 d

---

c:windowssystem32CatRoot_bak
2008-11-27 21:25 . 2008-11-27 21:25 d

---

c:program filesMicrosoft Silverlight
2008-11-27 20:20 . 2004-12-22 13:06 17,584,128 -ra

---

c:windowssystem32ALSNDMGR.CPL
2008-11-27 20:20 . 2004-12-22 13:13 9,524,224 -ra

---

c:windowssystem32RTLCPL.EXE
2008-11-27 20:20 . 2004-12-22 13:07 2,304,320 -ra

---

c:windowssystem32driversALCXWDM.SYS
2008-11-27 20:20 . 2004-09-07 10:23 156,672 -ra

---

c:windowssystem32RTLCPAPI.dll
2008-11-27 20:20 . 2002-02-05 09:54 141,016 -ra

---

c:windowssystem32ALSNDMGR.WAV
2008-11-27 20:20 . 2004-12-22 13:09 77,824 -ra

---

c:windowsSOUNDMAN.EXE
2008-11-27 20:09 . 2008-11-27 20:09 d

---

c:documents and settingsAll UsersApplication DataNetwork Associates
2008-11-27 20:08 . 2008-11-27 20:09 d

---

c:program filesNetwork Associates
2008-11-27 20:08 . 2008-11-27 20:08 d

---

c:program filesCommon FilesNetwork Associates
2008-11-27 19:47 . 2008-11-27 19:48 d

---

c:program filesWinamp
2008-11-27 19:17 . 2008-11-27 19:30 d

---

c:windowsSxsCaPendDel
2008-11-27 19:11 . 2008-11-29 13:28 d

---

c:program filesMario Forever
2008-11-27 17:24 . 2008-11-27 17:24 4,444 —a

---

c:windowssystem32pid.PNF
2008-11-16 19:25 . 2008-10-16 14:06 268,648 —a

---

c:windowssystem32mucltui.dll
2008-11-16 19:25 . 2008-10-16 14:06 208,744 —a

---

c:windowssystem32muweb.dll
2008-11-16 19:25 . 2008-10-16 14:06 27,496 —a

---

c:windowssystem32mucltui.dll.mui
2008-11-14 17:25 . 2008-11-14 17:54 d

---

c:program filesAlawar.ru
2008-11-14 17:25 . 2008-11-15 00:35 d

---

c:documents and settingsAll UsersApplication DataAlawarWrapper
2008-11-14 17:25 . 2008-11-14 17:25 d

---

c:documents and settings1Application DataEleFun Games

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-09 18:15

---

d—h—w c:program filesInstallShield Installation Information
2008-12-09 17:43

---

d

---

w c:program filesQIP
2008-11-28 19:31

---

d

---

w c:program filesCommon FilesAdobe
2008-11-27 15:47

---

d

---

w c:program filesDownload Master
2008-11-27 15:36

---

d

---

w c:program filesNokia
2008-11-27 15:31

---

d

---

w c:program filesMail.Ru
2008-11-27 15:30 96,256 —-a-w c:windowssystem32driverssptd5581.sys
2008-11-27 15:28

---

d

---

w c:program filescitysvyaz
2008-11-27 15:27

---

d

---

w c:program filesPPPWorld
2008-11-27 15:27

---

d

---

w c:program filesDivX
2008-11-27 15:26

---

d

---

w c:program filesXtra
2008-11-27 15:19

---

d

---

w c:program filesOpera
2008-11-27 15:05

---

d

---

w c:program filesInterActual
2008-11-27 15:04

---

d

---

w c:program filesInterVideo
2008-11-27 15:04

---

d

---

w c:program filesCommon FilesInterVideo
2008-11-27 15:01

---

d

---

w c:program filesASUSTek
2008-10-16 10:13 202,776 —-a-w c:windowssystem32wuweb.dll
2008-10-16 10:13 1,809,944 —-a-w c:windowssystem32wuaueng.dll
2008-10-16 10:12 561,688 —-a-w c:windowssystem32wuapi.dll
2008-10-16 10:12 323,608 —-a-w c:windowssystem32wucltui.dll
2008-10-16 10:09 92,696 —-a-w c:windowssystem32cdm.dll
2008-10-16 10:09 51,224 —-a-w c:windowssystem32wuauclt.exe
2008-10-16 10:09 43,544 —-a-w c:windowssystem32wups2.dll
2008-10-16 10:08 34,328 —-a-w c:windowssystem32wups.dll
2008-10-15 17:00 332,800 —-a-w c:windowssystem32dllcachenetapi32.dll
2008-09-30 12:43 1,286,152 —-a-w c:windowssystem32msxml4.dll
2008-09-15 15:40 1,846,144 —-a-w c:windowssystem32win32k.sys
2008-09-15 15:40 1,846,144 —-a-w c:windowssystem32dllcachewin32k.sys
2006-02-23 20:00 4,400,769 —-a-w c:program files3gp-video-converter.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2004-08-17 15360]
«NBJ»=»c:program filesaheadNero BackItUpNBJ.exe» [2004-09-07 1871872]
«MSMSGS»=»c:program filesMessengermsmsgs.exe» [2004-10-13 1694208]
«Download Master»=»c:program filesDownload Masterdmaster.exe» [2007-09-12 3253248]
«PcSync»=»c:program filesNokiaNokia PC Suite 6PcSync2.exe» [2006-06-27 1449984]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2007-11-14 201728]
«louderit.exe»=»c:program fileslouderitLouderIt.exe» [2008-02-19 41472]
«SlovoEd 6″=»c:program filesParagon SoftwareSlovoEd 6run.exe» [2007-03-26 610304]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2001-07-09 155648]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2005-06-15 6803456]
«PCSuiteTrayApplication»=»c:progra~1NokiaNOKIAP~1LAUNCH~1.EXE» [2006-06-15 229376]
«WinampAgent»=»c:program filesWinampwinampa.exe» [2006-02-23 35328]
«ShStatEXE»=»c:program filesNetwork AssociatesVirusScanSHSTAT.EXE» [2003-09-29 81990]
«McAfeeUpdaterUI»=»c:program filesNetwork AssociatesCommon FrameworkUpdaterUI.exe» [2003-09-10 135251]
«nwiz»=»nwiz.exe» [2005-06-15 c:windowssystem32nwiz.exe]
«SoundMan»=»SOUNDMAN.EXE» [2004-12-22 c:windowsSOUNDMAN.EXE]

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\QIP\qip.exe»=
«c:\Program Files\ICQ6.5\ICQ.exe»=

R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:windowssystem32driverssfsync03.sys [2005-12-06 35328]
R0 tffsport;M-Systems DiskOnChip 2000;c:windowssystem32DRIVERStffsport.sys [2008-10-28 149376]
R2 ICQ Service;ICQ Service;c:program filesICQ6ToolbarICQ Service.exe [2008-12-09 222456]
S3 ASPI;Advanced SCSI Programming Interface Driver;??c:windowsSystem32DRIVERSASPI32.sys [2008-02-04 16512]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2F]
ShellAutoRuncommand — F:laucher.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{37756303-b63a-11dd-b83d-001485192de9}]
ShellAutoRuncommand — H:rqq2v.bat
ShellexploreCommand — H:rqq2v.bat
ShellopenCommand — H:rqq2v.bat
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.yandex.ru/?clid=40488
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~4Office12EXCEL.EXE/3000
IE: Закачать ВСЕ при помощи Download Master — c:program filesDownload Masterdmieall.htm
IE: Закачать при помощи Download Master — c:program filesDownload Masterdmie.htm
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe —
TCP: {ECABB36C-1AA3-40EC-AE20-2881C213519F} = 85.113.62.225 85.113.63.225
FF — ProfilePath — c:documents and settings1Application DataMozillaFirefoxProfilesh3beukur.default
FF — prefs.js: browser.search.selectedEngine — ICQ Search
FF — prefs.js: browser.startup.homepage — hxxp://www.yandex.ru/?clid=40488
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnppl3260.dll
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnprpjplug.dll
FF — plugin: c:program filesMicrosoft Silverlight2.0.31005.0npctrl.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-14 21:52:42
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-12-14 21:53:53
ComboFix-quarantined-files.txt 2008-12-14 17:53:20
ComboFix2.txt 2008-12-09 19:30:50
ComboFix3.txt 2008-12-08 18:22:57
ComboFix4.txt 2008-12-08 13:03:41
ComboFix5.txt 2008-12-14 17:49:32

Pre-Run: 19 125 231 616 байт свободно
Post-Run: 19,358,703,616 байт свободно

230 — E O F — 2008-10-24 18:01:10

[Автор]

Сообщения