• Инструкции
    • Как использовать
      • Программы
    • Как удалить
      • Шпионское и рекламное ПО (adware и spyware)
      • Поддельное антиспайваре
      • Руткиты
      • Трояны
      • Кейлоггеры
  • Скачать программы
  • Вопросы и Ответы
  • Форумы

SPYWARE-RU.COM
Меню
  • Инструкции
    • Как использовать
      • Программы
    • Как удалить
      • Шпионское и рекламное ПО (adware и spyware)
      • Поддельное антиспайваре
      • Руткиты
      • Трояны
      • Кейлоггеры
  • Скачать программы
  • Вопросы и Ответы
  • Форумы
В начало
Adguard
 

QERIBAN

  • Профиль
  • Начатые темы
  • Созданные ответы
  • Engagements
  • Избранное

Созданные ответы форума

Просмотр 15 сообщений - с 1 по 15 (из 33 всего)
1 2 3 →
  • Автор
    Сообщения
  • 2 сентября, 2011 в 6:22 пп в ответ на: Подозрение на инфекцию. #32218
    QERIBAN
    Participant
    • Темы:6
    • Сообщений:39
    • ☆

    Logfile of random’s system information tool 1.06 (written by random/random)
    Run by 123 at 2011-09-03 00:02:22
    Microsoft Windows XP Professional Service Pack 2
    System drive C: has 4 GB (18%) free of 20 GB
    Total RAM: 1015 MB (57% free)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 0:03:00, on 03.09.2011
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:WINDOWSSystem32smss.exe
    C:WINDOWSsystem32winlogon.exe
    C:WINDOWSsystem32services.exe
    C:WINDOWSsystem32lsass.exe
    C:WINDOWSsystem32svchost.exe
    C:WINDOWSSystem32svchost.exe
    C:WINDOWSsystem32svchost.exe
    C:WINDOWSsystem32spoolsv.exe
    C:Documents and SettingsAll UsersApplication DataDatacardServiceDCService.exe
    C:Program FilesMail.RuGuardGuardMailRu.exe
    C:WINDOWSTEMPGuardGuard.exe
    C:Program FilesCyberLinkShared FilesRichVideo.exe
    C:WINDOWSsystem32svchost.exe
    C:WINDOWSExplorer.EXE
    C:Program FilesAthanAthan.exe
    C:Program FilesMail.RuGuardGuardMailRu.exe
    C:Program FilesCyberLinkPowerDVDPDVDServ.exe
    C:WINDOWSsystem32ctfmon.exe
    C:Program FilesMail.RuAgentmagent.exe
    C:Program FilesInternet Exploreriexplore.exe
    C:Program FilesMail.RuSputnikSputnikHelper.exe
    C:Program FilesMail.RuSputnikSputnikFlashPlayer.exe
    C:Program FilesInternet Exploreriexplore.exe
    C:Program FilesInternet Exploreriexplore.exe
    C:Documents and Settings123Рабочий столRSIT.exe
    C:Program Filestrend micro123.exe

    R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://webalta.ru
    R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://webalta.ru/poisk
    R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://webalta.ru/poisk
    R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://webalta.ru/poisk
    R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.rambler.ru/
    R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://webalta.ru
    R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://webalta.ru/poisk
    R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://webalta.ru/poisk
    R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://webalta.ru/poisk
    R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://webalta.ru
    R1 — HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://webalta.ru/poisk
    R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://webalta.ru/poisk
    R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
    R3 — URLSearchHook: Rambler-Ассистент — {468CD8A9-7C25-45FA-969E-3D925C689DC4} — C:Program FilesRambler AssistantramblertoolbarU5950.dll
    R3 — URLSearchHook: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
    O2 — BHO: Adobe PDF Link Helper — {18DF081C-E8AD-4283-A596-FA578C2EBDC3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelperShim.dll
    O2 — BHO: MailRuBHO Class — {8984B388-A5BB-4DF7-B274-77B879E179DB} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
    O2 — BHO: IE 4.x-6.x BHO for Download Master — {9961627E-4059-41B4-8E0E-A7D6B3854ADF} — C:PROGRA~1DOWNLO~1dmiehlp.dll
    O3 — Toolbar: Rambler-Ассистент — {468CD8A9-7C25-45FA-969E-3D925C689DC4} — C:Program FilesRambler AssistantramblertoolbarU5950.dll
    O3 — Toolbar: DM Bar — {0E1230F8-EA50-42A9-983C-D22ABC2EED3C} — C:Program FilesDownload Masterdmbar.dll
    O3 — Toolbar: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
    O3 — Toolbar: Яндекс.Бар — {91397D20-1446-11D4-8AF4-0040CA1127B6} — C:Program FilesYandexYandexBarIEyndbar.dll
    O4 — HKLM..Run: [MAgent] C:Program FilesMail.RuAgentMAgent.exe -LM
    O4 — HKLM..Run: [Athan] C:Program FilesAthanAthan.exe
    O4 — HKLM..Run: [Guard.Mail.ru.gui] «C:Program FilesMail.RuGuardGuardMailRu.exe» /gui
    O4 — HKLM..Run: [RemoteControl] «C:Program FilesCyberLinkPowerDVDPDVDServ.exe»
    O4 — HKLM..Run: [Adobe ARM] «C:Program FilesCommon FilesAdobeARM1.0AdobeARM.exe»
    O4 — HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
    O4 — HKCU..Run: [VPetsPlayer] C:Program FilesVPetsVPets.exe
    O4 — HKCU..Run: [ETraffic] C:Program FilesETraffic 2.8.4.0ETraffic.exe
    O4 — HKCU..Run: [QQIntl] «C:Program FilesTencentQQIntlBinQQ.exe» /background
    O4 — HKCU..Run: [Skype] «C:Program FilesSkypePhoneSkype.exe» /nosplash /minimized
    O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
    O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
    O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
    O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
    O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
    O8 — Extra context menu item: Google ВикиКомментарии… — res://C:Program FilesGoogleGoogle ToolbarComponentGoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
    O8 — Extra context menu item: Добавить в Rambler-Закладки — res://C:Program FilesRambler AssistantramblertoolbarU5950.dll/zakladki.htm
    O8 — Extra context menu item: Закачать ВСЕ при помощи Download Master — C:Program FilesDownload Masterdmieall.htm
    O8 — Extra context menu item: Закачать при помощи Download Master — C:Program FilesDownload Masterdmie.htm
    O8 — Extra context menu item: Найти с помощью Рамблера — res://C:Program FilesRambler AssistantramblertoolbarU5950.dll/search.htm
    O8 — Extra context menu item: Перевести с помощью словарей Рамблера — res://C:Program FilesRambler AssistantramblertoolbarU5950.dll/dic.htm
    O8 — Extra context menu item: Передать на удаленную закачку DM — C:Program FilesDownload Masterremdown.htm
    O9 — Extra button: PalTalk — {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} — C:Program FilesPaltalk MessengerPaltalk.exe (file missing)
    O9 — Extra button: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
    O9 — Extra ‘Tools’ menuitem: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
    O9 — Extra button: Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
    O9 — Extra ‘Tools’ menuitem: &Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
    O9 — Extra button: Справочные материалы — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
    O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
    O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
    O10 — Unknown file in Winsock LSP: c:windowssystem32nwprovau.dll
    O15 — Trusted Zone: http://www.otaq.net
    O16 — DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} — http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O23 — Service: DCService.exe — Unknown owner — C:Documents and SettingsAll UsersApplication DataDatacardServiceDCService.exe
    O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
    O23 — Service: Guard.Mail.ru — Unknown owner — C:Program FilesMail.RuGuardGuardMailRu.exe
    O23 — Service: Служба Google Update (gupdate) (gupdate) — Google Inc. — C:Program FilesGoogleUpdateGoogleUpdate.exe
    O23 — Service: Служба Google Update (gupdatem) (gupdatem) — Google Inc. — C:Program FilesGoogleUpdateGoogleUpdate.exe
    O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
    O23 — Service: NetMeeting Remote Desktop Sharing (mnmsrvc) — Корпорация Майкрософт — C:WINDOWSsystem32mnmsrvc.exe
    O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
    O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
    O23 — Service: Cyberlink RichVideo Service(CRVS) (RichVideo) — Unknown owner — C:Program FilesCyberLinkShared FilesRichVideo.exe
    O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
    O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
    O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
    O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe

    —
    End of file — 8742 bytes

    ======Scheduled tasks folder======

    C:WINDOWStasksGoogleUpdateTaskMachineCore.job
    C:WINDOWStasksGoogleUpdateTaskMachineUA.job

    ======Registry dump======

    [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
    Adobe PDF Link Helper — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelperShim.dll [2011-06-06 63912]

    [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{8984B388-A5BB-4DF7-B274-77B879E179DB}]
    MailRuBHO Class — C:Program FilesMail.RuSputnikMailRuSputnik.dll [2011-06-19 1546960]

    [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9961627E-4059-41B4-8E0E-A7D6B3854ADF}]
    IE 4.x-6.x BHO for Download Master — C:PROGRA~1DOWNLO~1dmiehlp.dll [2011-08-04 165440]

    [HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
    {468CD8A9-7C25-45FA-969E-3D925C689DC4} — Rambler-Ассистент — C:Program FilesRambler AssistantramblertoolbarU5950.dll [2008-12-09 845296]
    {0E1230F8-EA50-42A9-983C-D22ABC2EED3C} — DM Bar — C:Program FilesDownload Masterdmbar.dll [2010-06-03 185664]
    {09900DE8-1DCA-443F-9243-26FF581438AF} — Спутник@Mail.Ru — C:Program FilesMail.RuSputnikMailRuSputnik.dll [2011-06-19 1546960]
    {91397D20-1446-11D4-8AF4-0040CA1127B6} — Яндекс.Бар — C:Program FilesYandexYandexBarIEyndbar.dll [2010-06-01 10336584]

    [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
    «MAgent»=C:Program FilesMail.RuAgentMAgent.exe [2010-10-06 12270784]
    «Athan»=C:Program FilesAthanAthan.exe [2010-03-27 1122304]
    «Guard.Mail.ru.gui»=C:Program FilesMail.RuGuardGuardMailRu.exe [2011-06-19 1472720]
    «RemoteControl»=C:Program FilesCyberLinkPowerDVDPDVDServ.exe [2006-11-23 56928]
    «Adobe ARM»=C:Program FilesCommon FilesAdobeARM1.0AdobeARM.exe [2011-06-06 937920]

    [HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
    «ctfmon.exe»=C:WINDOWSsystem32ctfmon.exe [2004-08-17 15360]
    «VPetsPlayer»=C:Program FilesVPetsVPets.exe []
    «ETraffic»=C:Program FilesETraffic 2.8.4.0ETraffic.exe [2011-04-02 616448]
    «QQIntl»=C:Program FilesTencentQQIntlBinQQ.exe [2011-06-15 144760]
    «Skype»=C:Program FilesSkypePhoneSkype.exe [2011-06-15 15141768]

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAnti Trojan Elite]
    C:Program FilesAnti Trojan EliteTJEnder.exe :NO []

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregCTFMON.EXE]
    C:WINDOWSsystem32ctfmon.exe [2004-08-17 15360]

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregFree Download Manager]
    C:Program FilesFree Download Managerfdm.exe -autorun []

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregHotKeysCmds]
    C:WINDOWSsystem32hkcmd.exe [2008-02-14 159744]

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIgfxTray]
    C:WINDOWSsystem32igfxtray.exe [2008-02-14 135168]

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregKernelFaultCheck]
    C:WINDOWSsystem32dumprep 0 -k []

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPersistence]
    C:WINDOWSsystem32igfxpers.exe [2008-02-14 131072]

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSoftware Informer]
    C:Program FilesSoftware Informersoftinfo.exe -autorun []

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupfolderC:^Documents and Settings^123^Главное меню^Программы^Автозагрузка^_uninst_setup_9.0.0.722_06.10.2010_16-33.exe.lnk]
    C:Documents and Settings123Local SettingsTemp_uninst_setup_9.0.0.722_06.10.2010_16-33.exe.bat []

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigservices]
    «avast! Web Scanner»=3
    «avast! Mail Scanner»=3
    «avast! Antivirus»=2
    «lanmanworkstation»=2
    «lanmanserver»=2

    [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyigfxcui]
    C:WINDOWSsystem32igfxdev.dll [2008-02-14 208896]

    [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
    WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32WPDShServiceObj.dll [2006-10-18 133632]

    [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlLsa]
    «authentication packages»=msv1_0
    nwprovau

    [HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
    «DisableTaskMgr»=1

    [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
    «dontdisplaylastusername»=0
    «legalnoticecaption»=
    «legalnoticetext»=
    «shutdownwithoutlogon»=1
    «undockwithoutlogon»=1

    [HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
    «NoDriveTypeAutoRun»=145

    [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
    «HonorAutoRunSetting»=

    [HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
    «%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
    «C:Program FilesSkypePhoneSkype.exe»=»C:Program FilesSkypePhoneSkype.exe:*:Enabled:Skype «
    «C:Documents and Settings123Рабочий столfg706pFreeU18.exe»=»C:Documents and Settings123Рабочий столfg706pFreeU18.exe:*:Enabled:Fast and Secure Gateway to Internet Freedom»
    «C:Program FilesMail.RuAgentmagent.exe»=»C:Program FilesMail.RuAgentmagent.exe:*:Enabled:Mail.Ru Агент»
    «C:Program FilesTencentQQIntlBinQQ.exe»=»C:Program FilesTencentQQIntlBinQQ.exe:*:Enabled:QQ International»
    «C:Program FilesTencentQQPlayerQQDeskUpdate.exe»=»C:Program FilesTencentQQPlayerQQDeskUpdate.exe:*:Enabled:QQPlayerUpdate»
    «C:Program FilesTencentQQPlayerQQPlayer.exe»=»C:Program FilesTencentQQPlayerQQPlayer.exe:*:Enabled:QQPlayer»
    «C:Program FilesTencentQQPlayerQPUp.exe»=»C:Program FilesTencentQQPlayerQPUp.exe:*:Enabled:QPUpdate»
    «C:Program FilesCommon FilesTencentQQDownload104Tencentdl.exe»=»C:Program FilesCommon FilesTencentQQDownload104Tencentdl.exe:*:Enabled:МЪС¶ІъЖ·ПВФШЧйјю»
    «C:Documents and Settings123Рабочий столfg706pFreeU17.exe»=»C:Documents and Settings123Рабочий столfg706pFreeU17.exe:*:Enabled:Fast and Secure Gateway to Internet Freedom»

    [HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
    «%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»

    [HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{3fdfb9bf-03d6-11e0-b742-00ff7e4e6c91}]
    shellAutoRuncommand — G:autorun.exe

    [HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{97b730c1-d12f-11df-93d5-ac6d2a1ac6b6}]
    shellAutoRuncommand — G:setup.exe

    [HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{bf83ca6a-6bd5-11e0-8719-00ff4bddae35}]
    shellAutoRuncommand — G:autorun.exe

    [HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{c21bae2d-03d5-11e0-ad5b-001cbf8ca5a5}]
    shellAutoRuncommand — G:autorun.exe

    [HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{e04340d3-6bc8-11e0-8715-00ff4bddae35}]
    shellAutoRuncommand — G:autorun.exe

    ======File associations======

    .ini — open — C:WINDOWSSystem32NOTEPAD.EXE %1
    .txt — open — C:WINDOWSnotepad.exe %1

    ======List of files/folders created in the last 1 months======

    2011-09-03 00:02:22 —-D—- C:rsit
    2011-08-21 00:25:08 —-D—- C:Program FilesYandex
    2011-08-21 00:25:08 —-D—- C:Documents and SettingsAll UsersApplication DataYandex

    ======List of files/folders modified in the last 1 months======

    2011-09-03 00:03:00 —-D—- C:Program FilesTrend Micro
    2011-09-03 00:02:28 —-D—- C:WINDOWSPrefetch
    2011-09-02 23:51:38 —-D—- C:Documents and Settings123Application DataSkype
    2011-09-02 23:31:11 —-D—- C:Program FilesConverter Amr-Wav
    2011-09-02 23:20:07 —-D—- C:WINDOWSsystem32CatRoot2
    2011-09-02 23:06:46 —-D—- C:WINDOWSTemp
    2011-09-02 23:04:54 —-A—- C:WINDOWSSchedLgU.Txt
    2011-08-31 01:04:59 —-A—- C:WINDOWSModemLog_HUAWEI Mobile Connect — 3G Modem.txt
    2011-08-31 00:40:06 —-D—- C:Documents and Settings123Application Datachinatelecom
    2011-08-31 00:00:27 —-A—- C:WINDOWSModemLog_HUAWEI Mobile Connect — 3G Modem #2.txt
    2011-08-27 01:07:38 —-A—- C:WINDOWSQQPlayer.INI
    2011-08-21 00:25:16 —-SHD—- C:WINDOWSInstaller
    2011-08-21 00:25:08 —-RD—- C:Program Files
    2011-08-21 00:25:08 —-D—- C:Documents and Settings123Application DataYandex
    2011-08-21 00:24:48 —-D—- C:Program FilesDownload Master
    2011-08-19 16:03:38 —-D—- C:Program FilesIslamic Encyclopedia
    2011-08-19 16:03:38 —-A—- C:WINDOWSMNTKHB_H.INI
    2011-08-19 14:45:23 —-D—- C:WINDOWSsystem32
    2011-08-07 15:55:45 —-D—- C:Program FilesAlawar
    2011-08-06 00:48:46 —-D—- C:WINDOWSHelp
    2011-08-05 11:58:36 —-D—- C:WINDOWS
    2011-08-05 00:48:37 —-A—- C:WINDOWSsystem.ini

    ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R1 eawdmfd;EAWDMFD; C:WINDOWSsystem32DRIVERSeawdmfd.sys [1999-10-29 24348]
    R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2004-08-17 40448]
    R1 kbdhid;Драйвер клавиатуры HID; C:WINDOWSsystem32DRIVERSkbdhid.sys [2004-08-17 14848]
    R1 WmiAcpi;Интерфейс управления для ACPI Microsoft Windows; C:WINDOWSsystem32DRIVERSwmiacpi.sys [2004-08-03 8832]
    R2 NwlnkIpx;NWLink IPX/SPX/NetBIOS-совместимый транспортный протокол; C:WINDOWSsystem32DRIVERSnwlnkipx.sys [2004-08-03 88448]
    R2 NwlnkNb;NWLink NetBIOS; C:WINDOWSsystem32DRIVERSnwlnknb.sys [2001-10-20 63232]
    R2 NwlnkSpx;Протокол NWLink SPX/SPXII; C:WINDOWSsystem32DRIVERSnwlnkspx.sys [2001-10-20 55936]
    R3 CmBatt;Драйвер батареи с ACPI-управлением (Майкрософт); C:WINDOWSsystem32DRIVERSCmBatt.sys [2004-08-03 14080]
    R3 E100B;Intel(R) PRO Network Connection Driver; C:WINDOWSsystem32DRIVERSe100b325.sys [2007-11-15 165496]
    R3 HBtnKey;HBtnKey; C:WINDOWSsystem32DRIVERScpqbttn.sys [2009-04-19 9344]
    R3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:WINDOWSsystem32driversCHDAud.sys [2007-02-13 625664]
    R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:WINDOWSsystem32DRIVERSHDAudBus.sys [2005-01-07 138752]
    R3 hidusb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2001-10-20 9600]
    R3 HpqKbFiltr;HpqKbFilter Driver; C:WINDOWSsystem32DRIVERSHpqKbFiltr.sys [2007-06-18 16768]
    R3 HSF_DPV;HSF_DPV; C:WINDOWSsystem32DRIVERSHSF_DP.sys [2009-08-23 985856]
    R3 HSFHWAZL;HSFHWAZL; C:WINDOWSsystem32DRIVERSHSF_HWAZL.sys [2009-08-23 210048]
    R3 ialm;ialm; C:WINDOWSsystem32DRIVERSigxpmp32.sys [2008-02-15 5854752]
    R3 mouhid;Драйвер мыши HID; C:WINDOWSsystem32DRIVERSmouhid.sys [2001-10-20 12160]
    R3 NWRDR;NetWare Rdr; C:WINDOWSsystem32DRIVERSnwrdr.sys [2004-08-03 163584]
    R3 rasuw;ChinaNet WLAN Adapter; C:WINDOWSsystem32DRIVERSrasuw.sys [2009-10-12 33280]
    R3 usbccgp;Драйвер универсального родительского устройства USB (Microsoft); C:WINDOWSsystem32DRIVERSusbccgp.sys [2004-08-03 31616]
    R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2004-08-03 26624]
    R3 usbhub;USB Root Hub (usbport); C:WINDOWSsystem32DRIVERSusbhub.sys [2004-08-03 57600]
    R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2004-08-03 20480]
    R3 usbvideo;USB-видеоустройство (WDM); C:WINDOWSSystem32Driversusbvideo.sys [2004-08-03 78464]
    R3 Wdf01000;Wdf01000; C:WINDOWSsystem32DRIVERSWdf01000.sys [2006-11-01 492000]
    R3 winachsf;winachsf; C:WINDOWSsystem32DRIVERSHSF_CNXT.sys [2009-08-23 731264]
    S1 12139221;12139221; C:WINDOWSsystem32DRIVERS12139221.sys []
    S2 ATE_PROCMON;ATE_PROCMON; ??C:Program FilesAnti Trojan EliteATEPMon.sys []
    S3 CCDECODE;Closed Caption декодер; C:WINDOWSsystem32DRIVERSCCDECODE.sys [2004-08-03 17024]
    S3 DKbFltr;Dritek Keyboard Filter Driver; C:WINDOWSsystem32DRIVERSDKbFltr.sys [2004-12-08 16896]
    S3 eaps2kbd;Compaq Easy Access PS2 Internet Keyboard (Win2K); C:WINDOWSsystem32DRIVERSeaps2kbd.sys [2001-12-28 24035]
    S3 ewusbnet;HUAWEI USB-NDIS miniport; C:WINDOWSsystem32DRIVERSewusbnet.sys [2009-12-08 114432]
    S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:WINDOWSsystem32DRIVERSewusbmdm.sys [2009-12-07 102912]
    S3 hwusbdev;Huawei DataCard USB PNP Device; C:WINDOWSsystem32DRIVERSewusbdev.sys [2009-10-12 100736]
    S3 MSTEE;Преобразователь потоков Tee/Sink-to-Sink Microsoft; C:WINDOWSsystem32driversMSTEE.sys [2004-08-03 5504]
    S3 NABTSFEC;NABTS/FEC VBI кодек; C:WINDOWSsystem32DRIVERSNABTSFEC.sys [2004-08-03 85376]
    S3 NdisIP;Microsoft видео или ТВ подключение; C:WINDOWSsystem32DRIVERSNdisIP.sys [2004-08-03 10880]
    S3 NETwLx32; Драйвер адаптера Intel(R) Wireless WiFi Link серии 5000 для Windows XP 32 Bit ; C:WINDOWSsystem32DRIVERSNETwLx32.sys [2010-07-04 6606208]
    S3 SLIP;BDA Slip De-Framer; C:WINDOWSsystem32DRIVERSSLIP.sys [2004-08-03 11136]
    S3 streamip;BDA IPSink; C:WINDOWSsystem32DRIVERSStreamIP.sys [2004-08-03 15360]
    S3 usbscan;Драйвер USB-сканера; C:WINDOWSsystem32DRIVERSusbscan.sys [2004-08-03 15104]
    S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2004-08-03 26496]
    S3 WpdUsb;WpdUsb; C:WINDOWSsystem32DRIVERSwpdusb.sys [2006-10-18 38528]
    S3 WSTCODEC;World Standard Teletext кодек; C:WINDOWSsystem32DRIVERSWSTCODEC.SYS [2004-08-03 19328]
    S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2006-09-28 82944]

    ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R2 DCService.exe;DCService.exe; C:Documents and SettingsAll UsersApplication DataDatacardServiceDCService.exe [2009-11-20 212992]
    R2 Guard.Mail.ru;Guard.Mail.ru; C:Program FilesMail.RuGuardGuardMailRu.exe [2011-06-19 1472720]
    R2 NWCWorkstation;Клиент для сетей NetWare; C:WINDOWSsystem32svchost.exe [2004-08-17 14336]
    R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:Program FilesCyberLinkShared FilesRichVideo.exe [2005-08-07 167936]
    R2 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2004-08-17 14336]
    S2 gupdate;Служба Google Update (gupdate); C:Program FilesGoogleUpdateGoogleUpdate.exe [2010-11-27 136176]
    S3 gupdatem;Служба Google Update (gupdatem); C:Program FilesGoogleUpdateGoogleUpdate.exe [2010-11-27 136176]
    S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2003-07-28 89136]

    EOF

    8 апреля, 2009 в 6:18 дп в ответ на: КОМП СТАЛ ОЧENЬ МEДЛENNO РАБОТАТЬ. #22635
    QERIBAN
    Participant
    • Темы:6
    • Сообщений:39
    • ☆

    второй RSIT лог

    8 апреля, 2009 в 6:15 дп в ответ на: КОМП СТАЛ ОЧENЬ МEДЛENNO РАБОТАТЬ. #22634
    QERIBAN
    Participant
    • Темы:6
    • Сообщений:39
    • ☆

    gmer loq

    8 апреля, 2009 в 6:10 дп в ответ на: КОМП СТАЛ ОЧENЬ МEДЛENNO РАБОТАТЬ. #22633
    QERIBAN
    Participant
    • Темы:6
    • Сообщений:39
    • ☆

    //////////////////////////////////////////
    Avenger Pre-Processor log
    //////////////////////////////////////////

    Platform: Windows XP (build 2600, Service Pack 3)
    Wed Apr 08 14:06:55 2009

    14:06:47: Error: Invalid registry syntax in command:
    «HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{A6C514F6-D7D8-F038-464A-0AAE17B106DE}»
    Only registry keys under the HKEY_LOCAL_MACHINE hive are accessible to this program.
    Skipping line. (Registry key deletion mode)

    //////////////////////////////////////////

    Logfile of The Avenger Version 2.0, (c) by Swandog46
    http://swandog46.geekstogo.com

    Platform: Windows XP

    *******************

    Script file opened successfully.
    Script file read successfully.

    Backups directory opened successfully at C:Avenger

    *******************

    Beginning to process script file:

    Rootkit scan active.
    No rootkits found!

    Completed script processing.

    *******************

    Finished! Terminate.

    8 апреля, 2009 в 6:04 дп в ответ на: КОМП СТАЛ ОЧENЬ МEДЛENNO РАБОТАТЬ. #22632
    QERIBAN
    Participant
    • Темы:6
    • Сообщений:39
    • ☆

    COMBOFIX LOQ Окозалось слишком большим

    4 апреля, 2009 в 6:50 пп в ответ на: КОМП СТАЛ ОЧENЬ МEДЛENNO РАБОТАТЬ. #22630
    QERIBAN
    Participant
    • Темы:6
    • Сообщений:39
    • ☆

    НЕ ЗНАЮ ЭТО ЛИ ВЫ ХОТИТЕ ОТ МЕНЯ?

    Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net

    device: opened successfully
    user: MBR read successfully
    kernel: MBR read successfully
    user & kernel MBR OK
    copy of MBR has been found in sector 62 !

    2 апреля, 2009 в 11:37 пп в ответ на: КОМП СТАЛ ОЧENЬ МEДЛENNO РАБОТАТЬ. #22628
    QERIBAN
    Participant
    • Темы:6
    • Сообщений:39
    • ☆

    GMER LOQ

    2 апреля, 2009 в 11:28 пп в ответ на: КОМП СТАЛ ОЧENЬ МEДЛENNO РАБОТАТЬ. #22627
    QERIBAN
    Participant
    • Темы:6
    • Сообщений:39
    • ☆

    ComboFix 09-04-01.01 — 123 2009-04-03 7:24:24.7 — FAT32x86
    Microsoft Windows XP Professional 5.1.2600.3.1251.1.1049.18.1015.600 [GMT 4:00]
    Running from: c:documents and settings123Рабочий столComboFix.exe
    Command switches used :: c:documents and settings123Рабочий столCFScript..txt
    AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((( Files Created from 2009-03-03 to 2009-04-03 )))))))))))))))))))))))))))))))
    .

    2009-04-02 17:19 . 2009-04-02 17:19 d—h

    C:$AVG8.VAULT$
    2009-04-02 16:53 . 2009-04-02 16:53 d—s—- c:documents and settings123UserData
    2009-04-02 16:46 . 2009-04-02 16:46 d

    c:windowssystem32driversAvg
    2009-04-02 16:46 . 2009-04-02 16:46 d

    c:program filesAVG
    2009-04-02 16:46 . 2009-04-02 16:46 d

    c:documents and settingsAll UsersApplication Dataavg8
    2009-04-02 16:46 . 2009-04-02 16:46 d

    c:documents and settings123Application DataAVGTOOLBAR
    2009-04-02 16:46 . 2009-04-02 16:46 325,640 —a

    c:windowssystem32driversavgldx86.sys
    2009-04-02 16:46 . 2009-04-02 16:46 107,912 —a

    c:windowssystem32driversavgtdix.sys
    2009-04-02 16:46 . 2009-04-02 16:46 10,520 —a

    c:windowssystem32avgrsstx.dll
    2009-04-01 00:40 . 2009-04-01 00:40 d

    c:documents and settings123Application DataMail.Ru
    2009-03-30 18:14 . 2009-03-30 18:14 d

    c:program filesMSECache
    2009-03-27 16:30 . 2009-03-27 16:30 d

    c:program filesDownload Master
    2009-03-24 23:17 . 2009-03-24 23:17 d

    c:documents and settingsAll UsersApplication DataAvira
    2009-03-24 20:40 . 2009-03-24 20:44 4,496,273 —a

    c:program filesazan.exe
    2009-03-24 14:02 . 2009-03-24 14:02 d

    c:windowssystem32ru-ru
    2009-03-24 14:02 . 2009-03-24 14:02 d

    c:windowssystem32ru
    2009-03-24 14:02 . 2009-03-24 14:02 d

    c:windowssystem32bits
    2009-03-24 14:02 . 2009-03-24 14:02 d

    c:windowsl2schemas
    2009-03-24 13:59 . 2009-03-24 13:59 d

    c:windowsServicePackFiles
    2009-03-23 20:03 . 2009-03-23 20:03 d

    c:program filesYandex
    2009-03-23 20:03 . 2009-03-23 20:03 d

    c:documents and settings123Application DataYandex
    2009-03-23 03:00 . 2009-03-23 03:00 d

    c:program filesMSXML 4.0
    2009-03-22 20:01 . 2008-10-16 14:08 27,672 —a

    c:windowssystem32wuapi.dll.mui
    2009-03-21 23:07 . 2009-03-21 23:07 d

    c:documents and settingsAll UsersApplication DataESET
    2009-03-19 01:24 . 2009-03-19 01:25 4,114 —a

    c:windowssystem32secushr.dat
    2009-03-19 01:24 . 2009-03-19 01:24 248 —a

    c:windowssystem32secustat.dat
    2009-03-19 01:23 . 2009-03-19 01:23 d

    c:documents and settings123Application DataFlashgetSetup
    2009-03-19 01:18 . 2009-03-19 01:18 d

    c:documents and settings123Application DataMedia Player Classic

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-03-28 14:26 737,280 —-a-w c:windowsiun6002.exe
    2009-03-23 16:17 2,516 —sha-w c:windowssystem32KGyGaAvL.sys
    2009-02-11 06:19 38,496 —-a-w c:windowssystem32driversmbamswissarmy.sys
    2009-02-11 06:19 15,504 —-a-w c:windowssystem32driversmbam.sys
    2009-02-09 13:07 1,846,912 —-a-w c:windowssystem32win32k.sys
    2009-02-09 13:07 1,846,912

    w c:windowssystem32dllcachewin32k.sys
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]
    «{ecdee021-0d17-467f-a1ff-c7a115230949}»= «c:program filesfree-downloads.nettbfree.dll» [2007-12-10 1510424]

    [HKEY_CLASSES_ROOTclsid{ecdee021-0d17-467f-a1ff-c7a115230949}]

    [HKEY_LOCAL_MACHINE~Browser Helper Objects{ecdee021-0d17-467f-a1ff-c7a115230949}]
    2007-12-10 13:46 1510424 —a

    c:program filesfree-downloads.nettbfree.dll

    [HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
    «{ecdee021-0d17-467f-a1ff-c7a115230949}»= «c:program filesfree-downloads.nettbfree.dll» [2007-12-10 1510424]

    [HKEY_CLASSES_ROOTclsid{ecdee021-0d17-467f-a1ff-c7a115230949}]

    [HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
    «{ECDEE021-0D17-467F-A1FF-C7A115230949}»= «c:program filesfree-downloads.nettbfree.dll» [2007-12-10 1510424]

    [HKEY_CLASSES_ROOTclsid{ecdee021-0d17-467f-a1ff-c7a115230949}]

    [HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
    «CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2008-04-14 15360]
    «AlcoholAutomount»=»d:alcohol 120% 1.9.7.6022Alcohol 120axcmd.exe» [2007-12-22 222080]

    [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
    «IgfxTray»=»c:windowssystem32igfxtray.exe» [2007-09-18 141848]
    «HotKeysCmds»=»c:windowssystem32hkcmd.exe» [2007-09-18 166424]
    «Persistence»=»c:windowssystem32igfxpers.exe» [2007-09-18 137752]
    «V0330Mon.exe»=»c:windowsV0330Mon.exe» [2007-04-30 32768]
    «ISUSPM Startup»=»c:program filesCommon FilesInstallShieldUpdateServiceisuspm.exe» [2005-08-11 249856]
    «ISUSScheduler»=»c:program filesCommon FilesInstallShieldUpdateServiceissch.exe» [2005-08-11 81920]
    «MAgent»=»c:program filesMail.RuAgentMAgent.exe» [2009-01-13 5598392]
    «Athan»=»c:program filesAthanAthan.exe» [2005-10-09 954368]
    «AVG8_TRAY»=»c:progra~1AVGAVG8avgtray.exe» [2009-04-02 1932568]

    [HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
    «CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-14 15360]

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotifyavgrsstarter]
    2009-04-02 16:46 10520 c:windowssystem32avgrsstx.dll

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe Reader Speed Launcher]
    —a

    2008-06-12 02:38 34672 c:program filesAdobeReader 9.0Readerreader_sl.exe

    [HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
    «%windir%\system32\sessmgr.exe»=
    «c:\Program Files\Messenger\msmsgs.exe»=
    «d:\uTorrent.exe»=
    «c:\Program Files\Windows Live\Messenger\msnmsgr.exe»=
    «c:\Program Files\Windows Live\Messenger\livecall.exe»=
    «%windir%\Network Diagnostic\xpnetdiag.exe»=
    «d:\SKYPE\Phone\Skype.exe»=
    «d:\ICQ6.5\ICQ.exe»=
    «$INSTDIR\FlvDetector.exe»= c:\Program Files\FlashGet Network\FlashGet 3\FlvDetector.exe
    «c:\Program Files\AVG\AVG8\avgupd.exe»=
    «c:\Program Files\AVG\AVG8\avgnsx.exe»=

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:windowssystem32driversavgldx86.sys [2009-04-02 325640]
    R1 AvgTdiX;AVG Free8 Network Redirector;c:windowssystem32driversavgtdix.sys [2009-04-02 107912]
    R2 avg8wd;AVG Free8 WatchDog;c:progra~1AVGAVG8avgwdsvc.exe [2009-04-02 298264]
    R3 V0330VID;WebCam Vista/Live! Cam Chat;c:windowssystem32driversV0330Vid.sys [2008-10-15 157696]
    S2 ccosm;Contrl Center of Storm Media;c:program filesStormIIstormliv.exe /asservice —> c:program filesStormIIstormliv.exe [?]

    — Other Services/Drivers In Memory —

    *NewlyCreated* — MBR
    *Deregistered* — mbr
    .
    .

    Supplementary Scan

    .
    uStart Page = hxxp://www.google.ru/ig?hl=ru
    mStart Page = hxxp://www.yahoo.com/
    mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
    uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
    IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
    IE: Добавить в Rambler-Закладки — d:rambler assistantramblertoolbarU5950.dll/zakladki.htm
    IE: Закачать ВСЕ при помощи Download Master — c:program filesDownload Masterdmieall.htm
    IE: Закачать все при помощи FlashGet — c:program filesFlashGetjc_all.htm
    IE: Закачать при помощи Download Master — c:program filesDownload Masterdmie.htm
    IE: Закачать при помощи FlashGet — c:program filesFlashGetjc_link.htm
    IE: Найти с помощью Рамблера — d:rambler assistantramblertoolbarU5950.dll/search.htm
    IE: Опубликовать в Дневнике — d:rambler assistantramblertoolbarU5950.dll/planet.htm
    IE: Перевести с помощью словарей Рамблера — d:rambler assistantramblertoolbarU5950.dll/dic.htm
    IE: Поиск@Mail.Ru — c:program filesMail.RuSputnikMailRuSputnik.dll/282
    IE: Словари@Mail.Ru — c:program filesMail.RuSputnikMailRuSputnik.dll/283
    IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:program filesMail.RuAgentmagent.exe
    IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe
    FF — ProfilePath — c:documents and settings123Application DataMozillaFirefoxProfileslb4yf04o.default
    FF — prefs.js: browser.search.defaulturl — hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
    FF — prefs.js: browser.search.selectedEngine — Википедия (ru)
    FF — prefs.js: browser.startup.homepage — hxxp://www.yahoo.com/
    FF — prefs.js: keyword.URL — hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
    FF — component: c:program filesMozilla Firefoxextensions{DB9127A2-3381-41ec-82B3-1B6ED4C6F29A}componentsFlashgetXpi.dll
    FF — plugin: d:real alternativebrowserpluginsnppl3260.dll
    FF — plugin: d:real alternativebrowserpluginsnprpjplug.dll
    .

    **************************************************************************

    catchme 0.3.1375 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-04-03 07:25:25
    Windows 5.1.2600 Service Pack 3 FAT NTAPI

    scanning hidden processes …

    scanning hidden autostart entries …

    scanning hidden files …

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2009-04-03 7:26:07
    ComboFix2.txt 2009-03-29 20:05:04
    ComboFix-quarantined-files.txt 2009-04-03 03:26:06

    Pre-Run: 5 925 978 112 байт свободно
    Post-Run: 6,020,988,928 байт свободно

    149 — E O F — 2009-03-31 18:56:42

    31 марта, 2009 в 9:24 дп в ответ на: КОМП СТАЛ ОЧENЬ МEДЛENNO РАБОТАТЬ. #22625
    QERIBAN
    Participant
    • Темы:6
    • Сообщений:39
    • ☆

    GMER 1.0.15.14944 — http://www.gmer.net
    Rootkit scan 2009-03-31 17:19:04
    Windows 5.1.2600 Service Pack 3

    —- System — GMER 1.0.15 —-

    SSDT spah.sys ZwCreateKey [0xF730A0E0]
    SSDT spah.sys ZwEnumerateKey [0xF7327CA2]
    SSDT spah.sys ZwEnumerateValueKey [0xF7328030]
    SSDT spah.sys ZwOpenKey [0xF730A0C0]
    SSDT spah.sys ZwQueryKey [0xF7328108]
    SSDT spah.sys ZwQueryValueKey [0xF7327F88]
    SSDT spah.sys ZwSetValueKey [0xF732819A]

    INT 0x62 ? 86D68BF8
    INT 0x82 ? 86D68BF8
    INT 0xB4 ? 869A3F00
    INT 0xB4 ? 869A3F00

    —- Kernel code sections — GMER 1.0.15 —-

    ? spah.sys Íå óäàåòñÿ íàéòè óêàçàííûé ôàéë. !
    .text USBPORT.SYS!DllUnload F65F08AC 5 Bytes JMP 869A34E0
    .text ahn6uhib.SYS F64FF384 1 Byte [20]
    .text ahn6uhib.SYS F64FF384 37 Bytes [20, 00, 00, 68, 00, 00, 00, …]
    .text ahn6uhib.SYS F64FF3AA 24 Bytes [00, 00, 20, 00, 00, E0, 00, …]
    .text ahn6uhib.SYS F64FF3C4 3 Bytes [00, 00, 00]
    .text ahn6uhib.SYS F64FF3C9 1 Byte [00]
    .text …

    —- Kernel IAT/EAT — GMER 1.0.15 —-

    IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F730B040] spah.sys
    IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F730B13C] spah.sys
    IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F730B0BE] spah.sys
    IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F730B7FC] spah.sys
    IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F730B6D2] spah.sys
    IAT SystemRootSystem32Driversahn6uhib.SYS[HAL.dll!KfAcquireSpinLock] 00000034
    IAT SystemRootSystem32Driversahn6uhib.SYS[HAL.dll!READ_PORT_UCHAR] 0000008E
    IAT SystemRootSystem32Driversahn6uhib.SYS[HAL.dll!KeGetCurrentIrql] 00000043
    IAT SystemRootSystem32Driversahn6uhib.SYS[HAL.dll!KfRaiseIrql] 00000044
    IAT SystemRootSystem32Driversahn6uhib.SYS[HAL.dll!KfLowerIrql] 000000C4
    IAT SystemRootSystem32Driversahn6uhib.SYS[HAL.dll!HalGetInterruptVector] 000000DE
    IAT SystemRootSystem32Driversahn6uhib.SYS[HAL.dll!HalTranslateBusAddress] 000000E9
    IAT SystemRootSystem32Driversahn6uhib.SYS[HAL.dll!KeStallExecutionProcessor] 000000CB
    IAT SystemRootSystem32Driversahn6uhib.SYS[HAL.dll!KfReleaseSpinLock] 00000054
    IAT SystemRootSystem32Driversahn6uhib.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] 0000007B
    IAT SystemRootSystem32Driversahn6uhib.SYS[HAL.dll!READ_PORT_USHORT] 00000094
    IAT SystemRootSystem32Driversahn6uhib.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] 00000032
    IAT SystemRootSystem32Driversahn6uhib.SYS[HAL.dll!WRITE_PORT_UCHAR] 000000A6
    IAT SystemRootSystem32Driversahn6uhib.SYS[WMILIB.SYS!WmiSystemControl] 00000023
    IAT SystemRootSystem32Driversahn6uhib.SYS[WMILIB.SYS!WmiCompleteRequest] 0000003D

    —- Devices — GMER 1.0.15 —-

    Device FileSystemFastfat FatCdrom 86D671F8
    Device Driverusbuhci DeviceUSBPDO-0 86A76500
    Device Driverdmio DeviceDmControlDmIoDaemon 86DD91F8
    Device Driverdmio DeviceDmControlDmConfig 86DD91F8
    Device Driverdmio DeviceDmControlDmPnP 86DD91F8
    Device Driverdmio DeviceDmControlDmInfo 86DD91F8
    Device Driverusbehci DeviceUSBPDO-1 86B141F8
    Device DriverFtdisk DeviceHarddiskVolume1 86D691F8
    Device DriverFtdisk DeviceHarddiskVolume2 86D691F8
    Device DriverCdrom DeviceCdRom0 86A561F8
    Device DriverFtdisk DeviceHarddiskVolume3 86D691F8
    Device DriverCdrom DeviceCdRom1 86A561F8
    Device DriverNetBT DeviceNetBT_Tcpip_{11BD6EB6-C0DE-41CD-8455-DEE482CA4083} 86914500
    Device DriverNetBT DeviceNetBt_Wins_Export 86914500
    Device Driversptd Device3905048580 spah.sys
    Device DriverNetBT DeviceNetbiosSmb 86914500
    Device DriverPCI_PNP3580 Device000004f spah.sys
    Device Driverusbuhci DeviceUSBFDO-0 86A76500
    Device Driverusbehci DeviceUSBFDO-1 86B141F8
    Device FileSystemMRxSmb DeviceLanmanDatagramReceiver 86978500
    Device FileSystemMRxSmb DeviceLanmanRedirector 86978500
    Device DriverNetBT DeviceNetBT_Tcpip_{8CF33562-65EC-43D1-9720-278EE0D512A5} 86914500
    Device DriverFtdisk DeviceFtControl 86D691F8
    Device Driverahn6uhib DeviceScsiahn6uhib1Port2Path0Target0Lun0 86904500
    Device Driverahn6uhib DeviceScsiahn6uhib1 86904500
    Device FileSystemFastfat Fat 86D671F8
    Device FileSystemCdfs Cdfs 868F8500

    —- Registry — GMER 1.0.15 —-

    Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (L002TP) 1?
    Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPTP) 1?
    Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPPoE) 1?
    Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@374@4O4494 ?0404@0404;4;0454;4L4=4K494 ?4>4@4B4 1?
    Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (IP) 1?
    Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 ?4;0404=484@4>0424I484:0404 ?0404:0454B4>0424 1?2?3?
    Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@s1 771343423
    Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@s2 285507792
    Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@h0 1
    Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04
    Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04@p0 D:Alcohol 120% 1.9.7.6022Alcohol 120
    Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04@h0 0
    Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04@ujdew 0x95 0xD7 0x59 0x93 …
    Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001
    Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001@a0 0x20 0x01 0x00 0x00 …
    Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001@ujdew 0xCE 0xA4 0x35 0xAE …
    Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40
    Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40@ujdew 0xF7 0x2F 0xE0 0xF0 …
    Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04
    Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04@p0 D:Alcohol 120% 1.9.7.6022Alcohol 120
    Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04@h0 0
    Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04@ujdew 0x95 0xD7 0x59 0x93 …
    Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001
    Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@a0 0x20 0x01 0x00 0x00 …
    Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@ujdew 0xCE 0xA4 0x35 0xAE …
    Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40
    Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40@ujdew 0xF7 0x2F 0xE0 0xF0 …
    Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (L002TP) 1?
    Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPTP) 1?
    Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPPoE) 1?
    Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@374@4O4494 ?0404@0404;4;0454;4L4=4K494 ?4>4@4B4 1?
    Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (IP) 1?
    Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 ?4;0404=484@4>0424I484:0404 ?0404:0454B4>0424 1?2?3?
    Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D04
    Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D04@p0 D:Alcohol 120% 1.9.7.6022Alcohol 120
    Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D04@h0 0
    Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D04@ujdew 0x95 0xD7 0x59 0x93 …
    Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001
    Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@a0 0x20 0x01 0x00 0x00 …
    Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@ujdew 0xCE 0xA4 0x35 0xAE …
    Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40
    Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40@ujdew 0xF7 0x2F 0xE0 0xF0 …
    Reg HKCUSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{A6C514F6-D7D8-F038-464A-0AAE17B106DE}
    Reg HKCUSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{A6C514F6-D7D8-F038-464A-0AAE17B106DE}@japeajgiohefniblbipd 0x6B 0x61 0x64 0x67 …
    Reg HKCUSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{A6C514F6-D7D8-F038-464A-0AAE17B106DE}@iafaghhpjphbpdcief 0x6B 0x61 0x64 0x67 …

    —- Disk sectors — GMER 1.0.15 —-

    Disk DeviceHarddisk0DR0 sector 62: copy of MBR

    —- EOF — GMER 1.0.15 —-

    29 марта, 2009 в 4:09 пп в ответ на: КОМП СТАЛ ОЧENЬ МEДЛENNO РАБОТАТЬ. #22623
    QERIBAN
    Participant
    • Темы:6
    • Сообщений:39
    • ☆

    ComboFix 09-03-28.06 — 123 2009-03-30 0:02:58.6 — FAT32x86
    Microsoft Windows XP Professional 5.1.2600.3.1251.1.1049.18.1015.626 [GMT 4:00]
    Running from: c:documents and settings123Рабочий столComboFix.exe
    Command switches used :: c:documents and settings123Рабочий столCFScript.txt
    AV: Avira Premium Security Suite *On-access scanning disabled* (Updated)
    FW: Avira Firewall *disabled*
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:123.exe
    c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr0.dat
    c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr1.dat
    c:program filesStormII
    c:program filesStormIIcodec264be.dll
    c:program filesStormIIcodec264dmmx.dll
    c:program filesStormIIcodec264dsse.dll
    c:program filesStormIIcodec264dsse2.dll
    c:program filesStormIIcodec264dsse3.dll
    c:program filesStormIIcodecaasc32.dll
    c:program filesStormIIcodecac3filter.ax
    c:program filesStormIIcodecacelpdec.ax
    c:program filesStormIIcodecasusasv1.dll
    c:program filesStormIIcodecasusasv2.dll
    c:program filesStormIIcodecativcr2.dll
    c:program filesStormIIcodecavcodec.dll
    c:program filesStormIIcodecavformat.dll
    c:program filesStormIIcodecavidavicodec.dll
    c:program filesStormIIcodecAviSplitter.ax
    c:program filesStormIIcodecavutil.dll
    c:program filesStormIIcodecbass.dll
    c:program filesStormIIcodecbass_aac.dll
    c:program filesStormIIcodecbass_alac.dll
    c:program filesStormIIcodecbass_ape.dll
    c:program filesStormIIcodecbass_flac.dll
    c:program filesStormIIcodecbass_mpc.dll
    c:program filesStormIIcodecbass_tta.dll
    c:program filesStormIIcodecbass_wv.dll
    c:program filesStormIIcodecbinkw32.dll
    c:program filesStormIIcodecBSPVDEC.dll
    c:program filesStormIIcodecbw10.dll
    c:program filesStormIIcodeccddareader.ax
    c:program filesStormIIcodeccdxareader.ax
    c:program filesStormIIcodecChpSrcFilter.ax
    c:program filesStormIIcodecCinemasterAudio.DLL
    c:program filesStormIIcodeccl264dec.ax
    c:program filesStormIIcodecCLNavX.ax
    c:program filesStormIIcodecCLRVIDDC.DLL
    c:program filesStormIIcodecclrviddd.dll
    c:program filesStormIIcodecCLVc1Dec.ax
    c:program filesStormIIcodecCLVSD.ax
    c:program filesStormIIcodecclvsdx.ax
    c:program filesStormIIcodeccoreavc.ax
    c:program filesStormIIcodecCUVCcodc.dll
    c:program filesStormIIcodecDCBassSource.ax
    c:program filesStormIIcodecDECVW_32.DLL
    c:program filesStormIIcodecdivxdec.ax
    c:program filesStormIIcodecDmoDec.dll
    c:program filesStormIIcodecDSMSplitter.ax
    c:program filesStormIIcodecempgdmx.ax
    c:program filesStormIIcodecff_kernelDeint.dll
    c:program filesStormIIcodecff_liba52.dll
    c:program filesStormIIcodecff_libavcodec.dll
    c:program filesStormIIcodecff_libdts.dll
    c:program filesStormIIcodecff_libfaad2.dll
    c:program filesStormIIcodecff_libmad.dll
    c:program filesStormIIcodecff_libmpeg2.dll
    c:program filesStormIIcodecff_libmplayer.dll
    c:program filesStormIIcodecff_realaac.dll
    c:program filesStormIIcodecff_samplerate.dll
    c:program filesStormIIcodecff_theora.dll
    c:program filesStormIIcodecff_TomsMoComp.dll
    c:program filesStormIIcodecff_tremor.dll
    c:program filesStormIIcodecff_unrar.dll
    c:program filesStormIIcodecff_wmv9.dll
    c:program filesStormIIcodecff_xvidcore.dll
    c:program filesStormIIcodecffdshow.ax
    c:program filesStormIIcodecffdshow.ax.manifest
    c:program filesStormIIcodecffmpeg.dll
    c:program filesStormIIcodecffsource.ax
    c:program filesStormIIcodecFlash.ocx
    c:program filesStormIIcodecFLT_ffdshow.dll
    c:program filesStormIIcodecFLVSplitter.ax
    c:program filesStormIIcodecfrapsvid.dll
    c:program filesStormIIcodecG722ADEC.dll
    c:program filesStormIIcodecGeoCodec.dll
    c:program filesStormIIcodecH264VDEC.dll
    c:program filesStormIIcodecHikAudioDec.ax
    c:program filesStormIIcodecHikFileSource.ax
    c:program filesStormIIcodecHikFileSplitter.ax
    c:program filesStormIIcodecHIKM4DEC.dll
    c:program filesStormIIcodecHikVideoDec.ax
    c:program filesStormIIcodeci263_32.drv
    c:program filesStormIIcodecicmw_32.dll
    c:program filesStormIIcodeciconv.dll
    c:program filesStormIIcodeckdh4.dll
    c:program filesStormIIcodeckdm4.dll
    c:program filesStormIIcodeckeys.dat
    c:program filesStormIIcodecl3codecx.ax
    c:program filesStormIIcodecLCodcCMP.dll
    c:program filesStormIIcodeclibavcodec.dll
    c:program filesStormIIcodeclibmpeg2_ff.dll
    c:program filesStormIIcodeclibmplayer.dll
    c:program filesStormIIcodecLMVRGBxf.dll
    c:program filesStormIIcodecLMVYUVxf.dll
    c:program filesStormIIcodeclsvxdec.dll
    c:program filesStormIIcodecmfplat.dll
    c:program filesStormIIcodecmkunicode.dll
    c:program filesStormIIcodecmkx.dll
    c:program filesStormIIcodecmkzlib.dll
    c:program filesStormIIcodecmmamrdmx.ax
    c:program filesStormIIcodecMp3Decdll.dll
    c:program filesStormIIcodecMP3DMOD.DLL
    c:program filesStormIIcodecmp4.dll
    c:program filesStormIIcodecmp43dmod.dll
    c:program filesStormIIcodecmp4sdmod.dll
    c:program filesStormIIcodecMP4Splitter.ax
    c:program filesStormIIcodecMpaDecFilter.ax
    c:program filesStormIIcodecMpaSplitter.ax
    c:program filesStormIIcodecmpcvideodec.ax
    c:program filesStormIIcodecMpeg2DecFilter.ax
    c:program filesStormIIcodecmpeg2dmx.ax
    c:program filesStormIIcodecMpegSplitter.ax
    c:program filesStormIIcodecmpg2splt.ax
    c:program filesStormIIcodecmpg4dmod.dll
    c:program filesStormIIcodecmsdmo.dll
    c:program filesStormIIcodecmsms001.vwp
    c:program filesStormIIcodecmsvcp71.dll
    c:program filesStormIIcodecmsvcr71.dll
    c:program filesStormIIcodecMZP4_DEC.DLL
    c:program filesStormIIcodecNDParser.ax
    c:program filesStormIIcodecNeMP4Splitter.ax
    c:program filesStormIIcodecnvviddec.ax
    c:program filesStormIIcodecOggSplitter.ax
    c:program filesStormIIcodecPluginsnppl3260.dll
    c:program filesStormIIcodecPluginsnppl3260.xpt
    c:program filesStormIIcodecPluginsnpqtplugin.dll
    c:program filesStormIIcodecPluginsnprpjplug.dll
    c:program filesStormIIcodecPluginsnsIQTScriptablePlugin.xpt
    c:program filesStormIIcodecPluginsnsJSRealPlayerPlugin.xpt
    c:program filesStormIIcodecPluginsQuickTimePlugin.class
    c:program filesStormIIcodecPmpSplt.ax
    c:program filesStormIIcodecpncrt.dll
    c:program filesStormIIcodecpndx5016.dll
    c:program filesStormIIcodecpndx5032.dll
    c:program filesStormIIcodecpthreadVC2.dll
    c:program filesStormIIcodecpvmjpg21.dll
    c:program filesStormIIcodecPVWV220.DLL
    c:program filesStormIIcodecqasf.dll
    c:program filesStormIIcodecQTSystemCFCharacterSetBitmaps.bitmap
    c:program filesStormIIcodecQTSystemCoreVideo.qtx
    c:program filesStormIIcodecQTSystemCoreVideo.ResourcesCoreVideo.qtr
    c:program filesStormIIcodecQTSystemCoreVideo.Resourcesen.lprojCoreVideoLocalized.qtr
    c:program filesStormIIcodecQTSystemQuickTime.qts
    c:program filesStormIIcodecQTSystemQuickTime.Resourcesen.lprojQuickTimeLocalized.dll
    c:program filesStormIIcodecQTSystemQuickTime.Resourcesen.lprojQuickTimeLocalized.qtr
    c:program filesStormIIcodecQTSystemQuickTime.ResourcesQuickTime.dll
    c:program filesStormIIcodecQTSystemQuickTime.ResourcesQuickTime.qtr
    c:program filesStormIIcodecQTSystemQuickTime.ResourcesQuickTime.qtxs
    c:program filesStormIIcodecQTSystemQuickTime3GPP.qtx
    c:program filesStormIIcodecQTSystemQuickTime3GPP.Resourcesen.lprojQuickTime3GPPLocalized.qtr
    c:program filesStormIIcodecQTSystemQuickTime3GPP.ResourcesQuickTime3GPP.qtr
    c:program filesStormIIcodecQTSystemQuickTimeAudioSupport.qtx
    c:program filesStormIIcodecQTSystemQuickTimeAudioSupport.Resourcesen.lprojQuickTimeAudioSupportLocalized.dll
    c:program filesStormIIcodecQTSystemQuickTimeAudioSupport.Resourcesen.lprojQuickTimeAudioSupportLocalized.qtr
    c:program filesStormIIcodecQTSystemQuickTimeAudioSupport.ResourcesQuickTimeAudioSupport.qtr
    c:program filesStormIIcodecQTSystemQuickTimeEssentials.qtx
    c:program filesStormIIcodecQTSystemQuickTimeEssentials.Resourcesen.lprojQuickTimeEssentialsLocalized.qtr
    c:program filesStormIIcodecQTSystemQuickTimeEssentials.ResourcesQuickTimeEssentials.qtr
    c:program filesStormIIcodecQTSystemQuickTimeH264.qtx
    c:program filesStormIIcodecQTSystemQuickTimeH264.Resourcesen.lprojQuickTimeH264Localized.qtr
    c:program filesStormIIcodecQTSystemQuickTimeH264.ResourcesQuickTimeH264.qtr
    c:program filesStormIIcodecQTSystemQuickTimeInternetExtras.qtx
    c:program filesStormIIcodecQTSystemQuickTimeInternetExtras.Resourcesen.lprojQuickTimeInternetExtrasLocalized.qtr
    c:program filesStormIIcodecQTSystemQuickTimeInternetExtras.ResourcesQuickTimeInternetExtras.qtr
    c:program filesStormIIcodecQTSystemQuickTimeMPEG4.qtx
    c:program filesStormIIcodecQTSystemQuickTimeMPEG4.Resourcesen.lprojQuickTimeMPEG4Localized.qtr
    c:program filesStormIIcodecQTSystemQuickTimeMPEG4.ResourcesQuickTimeMPEG4.qtr
    c:program filesStormIIcodecQTSystemQuickTimeMusic.qtx
    c:program filesStormIIcodecQTSystemQuickTimeMusic.Resourcesen.lprojQuickTimeMusicLocalized.qtr
    c:program filesStormIIcodecQTSystemQuickTimeMusic.ResourcesQuickTimeMusic.qtr
    c:program filesStormIIcodecQTSystemQuickTimeStreaming.qtx
    c:program filesStormIIcodecQTSystemQuickTimeStreaming.Resourcesen.lprojQuickTimeStreamingLocalized.dll
    c:program filesStormIIcodecQTSystemQuickTimeStreaming.Resourcesen.lprojQuickTimeStreamingLocalized.qtr
    c:program filesStormIIcodecQTSystemQuickTimeStreaming.ResourcesQuickTimeStreaming.qtr
    c:program filesStormIIcodecQTSystemQuickTimeStreamingExtras.qtx
    c:program filesStormIIcodecQTSystemQuickTimeStreamingExtras.Resourcesen.lprojQuickTimeStreamingExtrasLocalized.qtr
    c:program filesStormIIcodecQTSystemQuickTimeStreamingExtras.ResourcesQuickTimeStreamingExtras.qtr
    c:program filesStormIIcodecQTSystemQuickTimeVR.qtx
    c:program filesStormIIcodecQTSystemQuickTimeVR.Resourcesen.lprojQuickTimeVRLocalized.qtr
    c:program filesStormIIcodecQTSystemQuickTimeVR.ResourcesQuickTimeVR.qtr
    c:program filesStormIIcodecQuickTime.qts
    c:program filesStormIIcodecQuickTimeVR.qtx
    c:program filesStormIIcodecRadGtSplitter.ax
    c:program filesStormIIcodecRealCodecs14_43260.dll
    c:program filesStormIIcodecRealCodecs28_83260.dll
    c:program filesStormIIcodecRealCodecsatrc.dll
    c:program filesStormIIcodecRealCodecscook.dll
    c:program filesStormIIcodecRealCodecsddnt3260.dll
    c:program filesStormIIcodecRealCodecsdnet3260.dll
    c:program filesStormIIcodecRealCodecsdrv1.dll
    c:program filesStormIIcodecRealCodecsdrv2.dll
    c:program filesStormIIcodecRealCodecsdrvc.dll
    c:program filesStormIIcodecRealCodecshxltcolor.dll
    c:program filesStormIIcodecRealCodecsraac.dll
    c:program filesStormIIcodecRealCodecsralf.dll
    c:program filesStormIIcodecRealCodecsrv10.dll
    c:program filesStormIIcodecRealCodecsrv20.dll
    c:program filesStormIIcodecRealCodecsrv30.dll
    c:program filesStormIIcodecRealCodecsrv40.dll
    c:program filesStormIIcodecRealCodecssipr.dll
    c:program filesStormIIcodecRealCommonobjb3201.dll
    c:program filesStormIIcodecRealCommonpnen3260.dll
    c:program filesStormIIcodecRealCommonpngu3267.dll
    c:program filesStormIIcodecRealCommonpnrs3260.dll
    c:program filesStormIIcodecRealCommonrppr3260.dll
    c:program filesStormIIcodecRealCommonsecurity.dll
    c:program filesStormIIcodecRealPluginsaudplin.dll
    c:program filesStormIIcodecRealPluginsauthmgr.dll
    c:program filesStormIIcodecRealPluginsclbascauth.dll
    c:program filesStormIIcodecRealPluginsclntxres.dll
    c:program filesStormIIcodecRealPluginsExtResourcescoreres.xrs
    c:program filesStormIIcodecRealPluginsfpsechnd.dll
    c:program filesStormIIcodecRealPluginshttpfsys.dll
    c:program filesStormIIcodecRealPluginshxsdp.dll
    c:program filesStormIIcodecRealPluginshxxml.dll
    c:program filesStormIIcodecRealPluginsimgrender.dll
    c:program filesStormIIcodecRealPluginsmemfsys.dll
    c:program filesStormIIcodecRealPluginsmp3fformat.dll
    c:program filesStormIIcodecRealPluginsmp3render.dll
    c:program filesStormIIcodecRealPluginsmp4arender.dll
    c:program filesStormIIcodecRealPluginsntlmauth.dll
    c:program filesStormIIcodecRealPluginsoggfformat.dll
    c:program filesStormIIcodecRealPluginspacplin.dll
    c:program filesStormIIcodecRealPluginsplusplin.dll
    c:program filesStormIIcodecRealPluginspxcb3210.dll
    c:program filesStormIIcodecRealPluginsramfformat.dll
    c:program filesStormIIcodecRealPluginsramrender.dll
    c:program filesStormIIcodecRealPluginsrarender.dll
    c:program filesStormIIcodecRealPluginsrmfformat.dll
    c:program filesStormIIcodecRealPluginsrmxfpln.dll
    c:program filesStormIIcodecRealPluginsrmxrend.dll
    c:program filesStormIIcodecRealPluginsrn5auth.dll
    c:program filesStormIIcodecRealPluginsrtfformat.dll
    c:program filesStormIIcodecRealPluginsrtrender.dll
    c:program filesStormIIcodecRealPluginsrvrender.dll
    c:program filesStormIIcodecRealPluginssdpplin.dll
    c:program filesStormIIcodecRealPluginssecurity.dll
    c:program filesStormIIcodecRealPluginssmlfformat.dll
    c:program filesStormIIcodecRealPluginssmlrender.dll
    c:program filesStormIIcodecRealPluginssmmrender.dll
    c:program filesStormIIcodecRealPluginssmplfsys.dll
    c:program filesStormIIcodecRealPluginsstubdrm.dll
    c:program filesStormIIcodecRealPluginstfilesys.dll
    c:program filesStormIIcodecRealPluginsvidplin.dll
    c:program filesStormIIcodecRealPluginsvidsite.dll
    c:program filesStormIIcodecRealPluginsvorbisrend.dll
    c:program filesStormIIcodecRealPluginsvsrlocal.dll
    c:program filesStormIIcodecRealrppluginscnembed_cn.dll
    c:program filesStormIIcodecRealrppluginscnrpclsvc_cn.dll
    c:program filesStormIIcodecRealrppluginsembd3260.dll
    c:program filesStormIIcodecRealrppluginsrpcl3260.dll
    c:program filesStormIIcodecRealrppluginsrput3260.dll
    c:program filesStormIIcodecRLMPCDec.ax
    c:program filesStormIIcodecrmoc3260.dll
    c:program filesStormIIcodecRMSplt.ax
    c:program filesStormIIcodecSc726dec.ax
    c:program filesStormIIcodecscmpack.dll
    c:program filesStormIIcodecscsource.ax
    c:program filesStormIIcodecsmackw32.dll
    c:program filesStormIIcodecSonicLicenseManager9.dll
    c:program filesStormIIcodecsplitter.ax
    c:program filesStormIIcodecTomsMoComp_ff.dll
    c:program filesStormIIcodects.dll
    c:program filesStormIIcodectsccvid.dll
    c:program filesStormIIcodecTTL2Dec.dll
    c:program filesStormIIcodecv2k2_dec.dll
    c:program filesStormIIcodecv2kdspde.dll
    c:program filesStormIIcodecvc1dc.dll
    c:program filesStormIIcodecvc1dmmx.dll
    c:program filesStormIIcodecvc1dsse.dll
    c:program filesStormIIcodecvc1dsse2.dll
    c:program filesStormIIcodecvc1wp.ax
    c:program filesStormIIcodecVDODEC32.dll
    c:program filesStormIIcodecvdowave.drv
    c:program filesStormIIcodecVgmAudio.ax
    c:program filesStormIIcodecvgmbgr.ax
    c:program filesStormIIcodecVgmSplt.ax
    c:program filesStormIIcodecvgmv2k2.ax
    c:program filesStormIIcodecVid1Dec.dll
    c:program filesStormIIcodecvmnc.dll
    c:program filesStormIIcodecvoxmsdec.ax
    c:program filesStormIIcodecvp6vfw.dll
    c:program filesStormIIcodecvp7vfw.dll
    c:program filesStormIIcodecvssver2.scc
    c:program filesStormIIcodecWMADMOD.dll
    c:program filesStormIIcodecwmpasf.dll
    c:program filesStormIIcodecwmsdmod.dll
    c:program filesStormIIcodecWMVDECOD.dll
    c:program filesStormIIcodecwmvdmod.dll
    c:program filesStormIIcodecxvid.ax
    c:program filesStormIIcodecxvidcore.dll
    c:program filesStormIIcurrent.ecs
    c:program filesStormIIjscript.dll
    c:program filesStormIIkeys.dat
    c:program filesStormIImediadefdef.flv
    c:program filesStormIImediadefdef.ini
    c:program filesStormIImediaempty.swf
    c:program filesStormIImediamedia4in1.swf
    c:program filesStormIImediamediabp.swf
    c:program filesStormIImediaothers.xml
    c:program filesStormIImediaothers.xml.ini
    c:program filesStormIImediastcon.ini
    c:program filesStormIImediatoff.ini
    c:program filesStormIImediavideo_material_list.xml
    c:program filesStormIImediavideo_material_list.xml.ini
    c:program filesStormIImediavideo_style_list.xml
    c:program filesStormIImediavideo_style_list.xml.ini
    c:program filesStormIIMedia2.dll
    c:program filesStormIImee.db
    c:program filesStormIIMovieInfo.dll
    c:program filesStormIImps.dll
    c:program filesStormIImsscript.ocx
    c:program filesStormIImsvcp60.dll
    c:program filesStormIIrndrmgr.dll
    c:program filesStormIIscore.dll
    c:program filesStormIIsexpert.dll
    c:program filesStormIISkinјыБъР¶јЧ.zip
    c:program filesStormIISkin±©·з1ѕ­µд.zip
    c:program filesStormIISkin±©·з2ѕ­µд.zip
    c:program filesStormIIspfa.dll
    c:program filesStormIIsplayers.dll
    c:program filesStormIIsprobe.dll
    c:program filesStormIIStorm.exe
    c:program filesStormIIstormliv.exe
    c:program filesStormIIstormply.exe
    c:program filesStormIIStormRes.dll
    c:program filesStormIIsubdecoder.dll
    c:program filesStormIIuninst.exe

    BITS: Possible infected sites


    hxxp://soft.export.yandex.ru
    .
    ((((((((((((((((((((((((( Files Created from 2009-02-28 to 2009-03-29 )))))))))))))))))))))))))))))))
    .

    2009-03-27 16:30 . 2009-03-27 16:30 d

    c:program filesDownload Master
    2009-03-25 00:59 . 2009-03-25 00:59 d

    c:documents and settings123Application DataAvira
    2009-03-24 23:17 . 2009-03-24 23:17 d

    c:program filesAvira
    2009-03-24 23:17 . 2009-03-24 23:17 d

    c:documents and settingsAll UsersApplication DataAvira
    2009-03-24 23:17 . 2008-05-07 13:20 71,592 —a

    c:windowssystem32driversavfwot.sys
    2009-03-24 23:17 . 2008-05-07 09:51 71,464 —a

    c:windowssystem32driversavfwim.sys
    2009-03-24 20:40 . 2009-03-24 20:44 4,496,273 —a

    c:program filesazan.exe
    2009-03-24 14:02 . 2009-03-24 14:02 d

    c:windowssystem32ru-ru
    2009-03-24 14:02 . 2009-03-24 14:02 d

    c:windowssystem32ru
    2009-03-24 14:02 . 2009-03-24 14:02 d

    c:windowssystem32bits
    2009-03-24 14:02 . 2009-03-24 14:02 d

    c:windowsl2schemas
    2009-03-24 13:59 . 2009-03-24 13:59 d

    c:windowsServicePackFiles
    2009-03-23 20:03 . 2009-03-23 20:03 d

    c:program filesYandex
    2009-03-23 20:03 . 2009-03-23 20:03 d

    c:documents and settings123Application DataYandex
    2009-03-23 03:00 . 2009-03-23 03:00 d

    c:program filesMSXML 4.0
    2009-03-22 20:01 . 2008-10-16 14:08 27,672 —a

    c:windowssystem32wuapi.dll.mui
    2009-03-21 23:07 . 2009-03-21 23:07 d

    c:documents and settingsAll UsersApplication DataESET
    2009-03-19 01:24 . 2009-03-19 01:25 4,114 —a

    c:windowssystem32secushr.dat
    2009-03-19 01:24 . 2009-03-19 01:24 248 —a

    c:windowssystem32secustat.dat
    2009-03-19 01:23 . 2009-03-19 01:23 d

    c:documents and settings123Application DataFlashgetSetup
    2009-03-19 01:18 . 2009-03-19 01:18 d

    c:documents and settings123Application DataMedia Player Classic

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-03-28 14:26 737,280 —-a-w c:windowsiun6002.exe
    2009-03-23 16:17 2,516 —sha-w c:windowssystem32KGyGaAvL.sys
    2009-02-11 06:19 38,496 —-a-w c:windowssystem32driversmbamswissarmy.sys
    2009-02-11 06:19 15,504 —-a-w c:windowssystem32driversmbam.sys
    2009-02-09 13:07 1,846,912 —-a-w c:windowssystem32win32k.sys
    2009-02-09 13:07 1,846,912

    w c:windowssystem32dllcachewin32k.sys
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]
    «{ecdee021-0d17-467f-a1ff-c7a115230949}»= «c:program filesfree-downloads.nettbfree.dll» [2007-12-10 1510424]

    [HKEY_CLASSES_ROOTclsid{ecdee021-0d17-467f-a1ff-c7a115230949}]

    [HKEY_LOCAL_MACHINE~Browser Helper Objects{ecdee021-0d17-467f-a1ff-c7a115230949}]
    2007-12-10 13:46 1510424 —a

    c:program filesfree-downloads.nettbfree.dll

    [HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
    «{ecdee021-0d17-467f-a1ff-c7a115230949}»= «c:program filesfree-downloads.nettbfree.dll» [2007-12-10 1510424]

    [HKEY_CLASSES_ROOTclsid{ecdee021-0d17-467f-a1ff-c7a115230949}]

    [HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
    «{ECDEE021-0D17-467F-A1FF-C7A115230949}»= «c:program filesfree-downloads.nettbfree.dll» [2007-12-10 1510424]

    [HKEY_CLASSES_ROOTclsid{ecdee021-0d17-467f-a1ff-c7a115230949}]

    [HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
    «CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2008-04-14 15360]
    «AlcoholAutomount»=»d:alcohol 120% 1.9.7.6022Alcohol 120axcmd.exe» [2007-12-22 222080]

    [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
    «IgfxTray»=»c:windowssystem32igfxtray.exe» [2007-09-18 141848]
    «HotKeysCmds»=»c:windowssystem32hkcmd.exe» [2007-09-18 166424]
    «Persistence»=»c:windowssystem32igfxpers.exe» [2007-09-18 137752]
    «V0330Mon.exe»=»c:windowsV0330Mon.exe» [2007-04-30 32768]
    «ISUSPM Startup»=»c:program filesCommon FilesInstallShieldUpdateServiceisuspm.exe» [2005-08-11 249856]
    «ISUSScheduler»=»c:program filesCommon FilesInstallShieldUpdateServiceissch.exe» [2005-08-11 81920]
    «MAgent»=»c:program filesMail.RuAgentMAgent.exe» [2009-01-13 5598392]
    «Athan»=»c:program filesAthanAthan.exe» [2005-10-09 954368]
    «avgnt»=»c:program filesAviraAvira Premium Security Suiteavgnt.exe» [2008-06-12 266497]

    [HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
    «CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-14 15360]

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe Reader Speed Launcher]
    —a

    2008-06-12 02:38 34672 c:program filesAdobeReader 9.0Readerreader_sl.exe

    [HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
    «EnableFirewall»= 0 (0x0)

    [HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
    «%windir%\system32\sessmgr.exe»=
    «c:\Program Files\Messenger\msmsgs.exe»=
    «d:\uTorrent.exe»=
    «c:\Program Files\Windows Live\Messenger\msnmsgr.exe»=
    «c:\Program Files\Windows Live\Messenger\livecall.exe»=
    «%windir%\Network Diagnostic\xpnetdiag.exe»=
    «d:\SKYPE\Phone\Skype.exe»=
    «d:\ICQ6.5\ICQ.exe»=
    «$INSTDIR\FlvDetector.exe»= c:\Program Files\FlashGet Network\FlashGet 3\FlvDetector.exe

    R1 avfwot;avfwot;c:windowssystem32driversavfwot.sys [2009-03-24 71592]
    R2 AntiVirFirewallService;Avira Premium Security Suite Firewall;c:program filesAviraAvira Premium Security Suiteavfwsvc.exe [2009-03-24 344321]
    R2 AntiVirMailService;Avira Premium Security Suite MailGuard;c:program filesAviraAvira Premium Security Suiteavmailc.exe [2009-03-24 164097]
    R2 antivirwebservice;Avira Premium Security Suite WebGuard;c:program filesAviraAvira Premium Security Suiteavwebgrd.exe [2009-03-24 258305]
    R2 AVEService;Вспомогательная служба Avira Premium Security Suite MailGuard (Защита почты).;c:program filesAviraAvira Premium Security Suiteavesvc.exe [2009-03-24 41217]
    R3 avfwim;AvFw Packet Filter Miniport;c:windowssystem32driversavfwim.sys [2009-03-24 71464]
    R3 V0330VID;WebCam Vista/Live! Cam Chat;c:windowssystem32driversV0330Vid.sys [2008-10-15 157696]
    S2 ccosm;Contrl Center of Storm Media;c:program filesStormIIstormliv.exe /asservice —> c:program filesStormIIstormliv.exe [?]
    .
    .

    Supplementary Scan

    .
    uStart Page = hxxp://www.google.ru/ig?hl=ru
    mStart Page = hxxp://www.yahoo.com/
    mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
    uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
    IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
    IE: Добавить в Rambler-Закладки — d:rambler assistantramblertoolbarU5950.dll/zakladki.htm
    IE: Закачать ВСЕ при помощи Download Master — c:program filesDownload Masterdmieall.htm
    IE: Закачать все при помощи FlashGet — c:program filesFlashGetjc_all.htm
    IE: Закачать при помощи Download Master — c:program filesDownload Masterdmie.htm
    IE: Закачать при помощи FlashGet — c:program filesFlashGetjc_link.htm
    IE: Найти с помощью Рамблера — d:rambler assistantramblertoolbarU5950.dll/search.htm
    IE: Опубликовать в Дневнике — d:rambler assistantramblertoolbarU5950.dll/planet.htm
    IE: Перевести с помощью словарей Рамблера — d:rambler assistantramblertoolbarU5950.dll/dic.htm
    IE: Поиск@Mail.Ru — c:program filesMail.RuSputnikMailRuSputnik.dll/282
    IE: Словари@Mail.Ru — c:program filesMail.RuSputnikMailRuSputnik.dll/283
    IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} — c:program filesMail.RuAgentmagent.exe
    IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe
    LSP: avsda.dll
    FF — ProfilePath — c:documents and settings123Application DataMozillaFirefoxProfileslb4yf04o.default
    FF — prefs.js: browser.search.defaulturl — hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
    FF — prefs.js: browser.search.selectedEngine — Википедия (ru)
    FF — prefs.js: browser.startup.homepage — hxxp://www.yahoo.com/
    FF — prefs.js: keyword.URL — hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
    FF — component: c:program filesMozilla Firefoxextensions{DB9127A2-3381-41ec-82B3-1B6ED4C6F29A}componentsFlashgetXpi.dll
    FF — plugin: d:real alternativebrowserpluginsnppl3260.dll
    FF — plugin: d:real alternativebrowserpluginsnprpjplug.dll
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-03-30 00:04:23
    Windows 5.1.2600 Service Pack 3 FAT NTAPI

    scanning hidden processes …

    scanning hidden autostart entries …

    scanning hidden files …

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .

    DLLs Loaded Under Running Processes


    — — — — — — — > ‘lsass.exe'(1348)
    c:windowssystem32avsda.dll
    .
    Completion time: 2009-03-30 0:05:01
    ComboFix-quarantined-files.txt 2009-03-29 20:05:00

    Pre-Run: 7 529 594 880 байт свободно
    Post-Run: 8,216,150,016 байт свободно

    479 — E O F — 2009-03-24 18:09:06

    27 марта, 2009 в 4:19 дп в ответ на: КОМП СТАЛ ОЧENЬ МEДЛENNO РАБОТАТЬ. #22621
    QERIBAN
    Participant
    • Темы:6
    • Сообщений:39
    • ☆

    GMER 1.0.15.14944 — http://www.gmer.net
    Rootkit scan 2009-03-27 12:16:04
    Windows 5.1.2600 Service Pack 3

    —- System — GMER 1.0.15 —-

    SSDT spcs.sys ZwCreateKey [0xF730A0E0]
    SSDT F7C48844 ZwCreateThread
    SSDT spcs.sys ZwEnumerateKey [0xF7327CA2]
    SSDT spcs.sys ZwEnumerateValueKey [0xF7328030]
    SSDT spcs.sys ZwOpenKey [0xF730A0C0]
    SSDT F7C48830 ZwOpenProcess
    SSDT F7C48835 ZwOpenThread
    SSDT spcs.sys ZwQueryKey [0xF7328108]
    SSDT spcs.sys ZwQueryValueKey [0xF7327F88]
    SSDT spcs.sys ZwSetValueKey [0xF732819A]
    SSDT F7C4883F ZwTerminateProcess
    SSDT F7C4883A ZwWriteVirtualMemory

    INT 0x62 ? 86D68BF8
    INT 0x82 ? 86D68BF8
    INT 0xB4 ? 86AE2BF8
    INT 0xB4 ? 86AE2BF8

    —- Kernel code sections — GMER 1.0.15 —-

    ? spcs.sys Íå óäàåòñÿ íàéòè óêàçàííûé ôàéë. !
    .text USBPORT.SYS!DllUnload F683C8AC 5 Bytes JMP 86AE21D8
    .text a0h3kmdv.SYS F674B384 1 Byte [20]
    .text a0h3kmdv.SYS F674B384 37 Bytes [20, 00, 00, 68, 00, 00, 00, …]
    .text a0h3kmdv.SYS F674B3AA 24 Bytes [00, 00, 20, 00, 00, E0, 00, …]
    .text a0h3kmdv.SYS F674B3C4 3 Bytes [00, 00, 00]
    .text a0h3kmdv.SYS F674B3C9 1 Byte [00]
    .text …

    —- Kernel IAT/EAT — GMER 1.0.15 —-

    IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F730B040] spcs.sys
    IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F730B13C] spcs.sys
    IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F730B0BE] spcs.sys
    IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F730B7FC] spcs.sys
    IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F730B6D2] spcs.sys
    IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!KfAcquireSpinLock] 00000034
    IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!READ_PORT_UCHAR] 0000008E
    IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!KeGetCurrentIrql] 00000043
    IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!KfRaiseIrql] 00000044
    IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!KfLowerIrql] 000000C4
    IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!HalGetInterruptVector] 000000DE
    IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!HalTranslateBusAddress] 000000E9
    IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!KeStallExecutionProcessor] 000000CB
    IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!KfReleaseSpinLock] 00000054
    IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] 0000007B
    IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!READ_PORT_USHORT] 00000094
    IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] 00000032
    IAT SystemRootSystem32Driversa0h3kmdv.SYS[HAL.dll!WRITE_PORT_UCHAR] 000000A6
    IAT SystemRootSystem32Driversa0h3kmdv.SYS[WMILIB.SYS!WmiSystemControl] 00000023
    IAT SystemRootSystem32Driversa0h3kmdv.SYS[WMILIB.SYS!WmiCompleteRequest] 0000003D

    —- Devices — GMER 1.0.15 —-

    Device FileSystemFastfat FatCdrom 86D671F8

    AttachedDevice DriverTcpip DeviceIp avfwot.sys (TDI filtering kernel driver/Avira GmbH)

    Device Driverusbuhci DeviceUSBPDO-0 86B591F8
    Device Driverusbehci DeviceUSBPDO-1 86A311F8
    Device Driverdmio DeviceDmControlDmIoDaemon 86DD81F8
    Device Driverdmio DeviceDmControlDmConfig 86DD81F8
    Device Driverdmio DeviceDmControlDmPnP 86DD81F8
    Device Driverdmio DeviceDmControlDmInfo 86DD81F8
    Device DriverPCI_PNP7718 Device0000055 spcs.sys

    AttachedDevice DriverTcpip DeviceTcp avfwot.sys (TDI filtering kernel driver/Avira GmbH)

    Device DriverFtdisk DeviceHarddiskVolume1 86D691F8
    Device DriverFtdisk DeviceHarddiskVolume2 86D691F8
    Device DriverCdrom DeviceCdRom0 86A88500
    Device DriverFtdisk DeviceHarddiskVolume3 86D691F8
    Device DriverCdrom DeviceCdRom1 86A88500
    Device DriverNetBT DeviceNetBT_Tcpip_{11BD6EB6-C0DE-41CD-8455-DEE482CA4083} 86947500
    Device DriverNetBT DeviceNetBt_Wins_Export 86947500
    Device DriverNetBT DeviceNetbiosSmb 86947500

    AttachedDevice DriverTcpip DeviceUdp avfwot.sys (TDI filtering kernel driver/Avira GmbH)
    AttachedDevice DriverTcpip DeviceRawIp avfwot.sys (TDI filtering kernel driver/Avira GmbH)

    Device Driversptd Device2507090218 spcs.sys
    Device Driverusbuhci DeviceUSBFDO-0 86B591F8
    Device Driverusbehci DeviceUSBFDO-1 86A311F8
    Device FileSystemMRxSmb DeviceLanmanDatagramReceiver 86B671F8
    Device FileSystemMRxSmb DeviceLanmanRedirector 86B671F8
    Device DriverNetBT DeviceNetBT_Tcpip_{8CF33562-65EC-43D1-9720-278EE0D512A5} 86947500
    Device DriverFtdisk DeviceFtControl 86D691F8
    Device Drivera0h3kmdv DeviceScsia0h3kmdv1 86951500
    Device Drivera0h3kmdv DeviceScsia0h3kmdv1Port2Path0Target0Lun0 86951500
    Device FileSystemFastfat Fat 86D671F8

    AttachedDevice FileSystemFastfat Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

    Device FileSystemCdfs Cdfs 8686B1F8

    —- Registry — GMER 1.0.15 —-

    Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (L002TP) 1?
    Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPTP) 1?
    Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPPoE) 1?
    Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@374@4O4494 ?0404@0404;4;0454;4L4=4K494 ?4>4@4B4 1?
    Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (IP) 1?
    Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 ?4;0404=484@4>0424I484:0404 ?0404:0454B4>0424 1?2?3?
    Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@s1 771343423
    Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@s2 285507792
    Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@h0 1
    Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04
    Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04@p0 D:Alcohol 120% 1.9.7.6022Alcohol 120
    Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04@h0 0
    Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04@ujdew 0x95 0xD7 0x59 0x93 …
    Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001
    Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001@a0 0x20 0x01 0x00 0x00 …
    Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001@ujdew 0xCE 0xA4 0x35 0xAE …
    Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40
    Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40@ujdew 0xF7 0x2F 0xE0 0xF0 …
    Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04
    Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04@p0 D:Alcohol 120% 1.9.7.6022Alcohol 120
    Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04@h0 0
    Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04@ujdew 0x95 0xD7 0x59 0x93 …
    Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001
    Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@a0 0x20 0x01 0x00 0x00 …
    Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@ujdew 0xCE 0xA4 0x35 0xAE …
    Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40
    Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40@ujdew 0xF7 0x2F 0xE0 0xF0 …
    Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (L002TP) 1?
    Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPTP) 1?
    Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPPoE) 1?
    Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@374@4O4494 ?0404@0404;4;0454;4L4=4K494 ?4>4@4B4 1?
    Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (IP) 1?
    Reg HKLMSYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 ?4;0404=484@4>0424I484:0404 ?0404:0454B4>0424 1?2?3?
    Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D04
    Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D04@p0 D:Alcohol 120% 1.9.7.6022Alcohol 120
    Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D04@h0 0
    Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D04@ujdew 0x95 0xD7 0x59 0x93 …
    Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001
    Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@a0 0x20 0x01 0x00 0x00 …
    Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@ujdew 0xCE 0xA4 0x35 0xAE …
    Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40
    Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40@ujdew 0xF7 0x2F 0xE0 0xF0 …
    Reg HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows@DeviceNotSelectedTimeout 15
    Reg HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows@GDIProcessHandleQuota 10000
    Reg HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows@Spooler yes
    Reg HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows@swapdisk
    Reg HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows@TransmissionRetryTimeout 90
    Reg HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows@USERProcessHandleQuota 10000
    Reg HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows@appinit_dlls
    Reg HKCUSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{A6C514F6-D7D8-F038-464A-0AAE17B106DE}
    Reg HKCUSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{A6C514F6-D7D8-F038-464A-0AAE17B106DE}@japeajgiohefniblbipd 0x6B 0x61 0x64 0x67 …
    Reg HKCUSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{A6C514F6-D7D8-F038-464A-0AAE17B106DE}@iafaghhpjphbpdcief 0x6B 0x61 0x64 0x67 …

    —- Disk sectors — GMER 1.0.15 —-

    Disk DeviceHarddisk0DR0 sector 62: copy of MBR

    —- EOF — GMER 1.0.15 —-

    27 марта, 2009 в 4:04 дп в ответ на: БЕРМУДСКИЙ ТРЕУГОЛЬНИК #22780
    QERIBAN
    Participant
    • Темы:6
    • Сообщений:39
    • ☆

    OK

    23 марта, 2009 в 7:47 пп в ответ на: КОМП СТАЛ ОЧENЬ МEДЛENNO РАБОТАТЬ. #22619
    QERIBAN
    Participant
    • Темы:6
    • Сообщений:39
    • ☆

    GMER лог — ЧТО ЕТО?

    23 марта, 2009 в 7:41 пп в ответ на: БЕРМУДСКИЙ ТРЕУГОЛЬНИК #22778
    QERIBAN
    Participant
    • Темы:6
    • Сообщений:39
    • ☆

    ДА. ОНА САМАЯ. А ИНОГДА ЯРЛЫКИ НЕ МОГУТ НАЙТИ ФАЙЛ.И ЕЩО ИНОГДА ВДУГ КАССКАДОМ НАЧЕНАЮТ ОТКРЫВАТЬСА ОКНО. ПОКА Я НЕ ВЫКЛЮЧУ КОМП. ВОТ ТАКАЯ ЧЕРТОВШИНА.

    20 марта, 2009 в 3:23 пп в ответ на: БЕРМУДСКИЙ ТРЕУГОЛЬНИК #22776
    QERIBAN
    Participant
    • Темы:6
    • Сообщений:39
    • ☆

    А КАК ВСЕ ЕТО ПРОВЕРИТЬ?

  • Автор
    Сообщения
Просмотр 15 сообщений - с 1 по 15 (из 33 всего)
1 2 3 →

Добро пожаловать

На нашем сайте размещены инструкции и программы, которые помогут вам абсолютно бесплатно и самостоятельно удалить навязчивую рекламу, вирусы и трояны.

Поиск

Важные инструкции

Как удалить всплывающие окна
Как восстановить зашифрованные файлы (Инструкция)
Как удалить рекламный вирус в браузере (Chrome, Opera, Firefox, Internet Explorer, Edge)
Убрать рекламу в браузере (Chrome, Firefox, Opera, Yandex)
Как запустить компьютер в безопасном режиме (Safe Mode)

СПАЙВАРЕ РУ

  • О Спайваре Ру
  • Контакты
  • Реклама на сайте
  • Политика конфиденциальности
  • Правила использования

Нужна помощь?

Задайте свой вопрос прямо сейчас кликнув по следующей ссылке Задать вопрос.

Или обратитесь на наш форум, где команда Spyware-ru поможет вам. Узнайте, как попросить о помощи здесь.

Ссылки

  • Инструкции
  • Скачать программы
  • Помощь в удалении вирусов
  • Как вылечить компьютер
Copyright © 2008 - 2024 Spyware-RU.com (en)