Созданные ответы форума
-
Сообщения
-
на сегодняшний день dr.web cureit еще нашел и удалил какие-то addstoper и PKey.exe,но опять ничего не изменилось((((((((((((((
вот так написал)):
ComboFix 10-11-15.05 — AnUTA 16.11.2010 11:04:43.1.1 — x86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.1023.689 [GMT 2:00]
Running from: c:documents and settingsAnUTAРабочий столComboFix.exe
.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr0.dat
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr1.dat
c:windowsInstall
c:windowsInstalldelay.exe
c:windowsInstalldocs.rtf
c:windowsInstallIconLib.dll
c:windowsInstalllicense.rtf
c:windowsInstalllicense2.rtf
c:windowsInstallNews.txt
c:windowsInstallPresetup.exe
c:windowsInstallPRESETUP.INI
c:windowsInstallPRESETUP.INI.bak
c:windowsInstallreadme.rtf
c:windowsInstallShowCmdParam.exe
c:windowsInstallSkinACTIVATE.WAV
c:windowsInstallSkinBACKSND_.MID
c:windowsInstallSkinBREAK.WAV
c:windowsInstallSkinBULB_PICT.BMP
c:windowsInstallSkinBULB_PICT_.BMP
c:windowsInstallSkinCHECKALL_BT.BMP
c:windowsInstallSkinCHECKNONE_BT.BMP
c:windowsInstallSkinCHECKTG_BT.BMP
c:windowsInstallSkinCLICK.WAV
c:windowsInstallSkinCLOSE_BT.BMP
c:windowsInstallSkinCOLLAPSE_BT.BMP
c:windowsInstallSkinDEFAULT_BT.BMP
c:windowsInstallSkinDONE.WAV
c:windowsInstallSkinEXPAND_BT.BMP
c:windowsInstallSkinFINISH_BT.BMP
c:windowsInstallSkinGROUP_BIG.BMP
c:windowsInstallSkinGROUP_SMALL.BMP
c:windowsInstallSkinHELP_BT.BMP
c:windowsInstallSkinINFO_BT.BMP
c:windowsInstallSkinLEFT_BT.BMP
c:windowsInstallSkinLEFTWIZ_LOGO.JPG
c:windowsInstallSkinPRCHECK_PICT.BMP
c:windowsInstallSkinRIGHT_BT.BMP
c:windowsInstallSkinSKIN.INI
c:windowsInstallSkinThumbs.db
c:windowsInstallSkinTOPWIZ_LOGO.JPG
c:windowsInstallSkinTRAY_BT.BMP
c:windowsInstallSkinTREESELECTOR_BIG.BMP
c:windowsInstallSkinTREESELECTOR_SMALL.BMP
c:windowsInstallSkinWALLPAPERS.bmp
c:windowssystem32Config.cfg
c:windowssystem32Install.cmd
c:windowssystem32sm.exe
BITS: Possible infected sites
hxxp://soft.export.yandex.ru
hxxp://download.yandex.ru
.
((((((((((((((((((((((((( Files Created from 2010-10-16 to 2010-11-16 )))))))))))))))))))))))))))))))
.2010-11-15 22:41 . 2010-11-15 22:41
d
w- c:documents and settingsAnUTALocal SettingsApplication DataMail.Ru
2010-11-15 01:01 . 2010-11-15 01:01
d
w- c:program filestrend micro
2010-11-15 01:01 . 2010-11-15 01:03
d
w- C:rsit.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-16 08:50 . 2009-12-24 17:16 1148928
w- c:windowssystem32SYSDM.CPL
.
Sigcheck
[-] 2009-12-24 . C86630DD18E28A24328DA7C7CEFF9106 . 616448 . . [5.1.2600.5512] . . c:windowssystem32winlogon.exe[-] 2009-12-24 . 37BC12A29EA1B91BDC7983D9CB636A4D . 648192 . . [5.82] . . c:windowssystem32comctl32.dll
[-] 2009-12-24 . A9A5E519D683C7567CC06BE600D623F9 . 929280 . . [6.0] . . c:windowsWinSxSx86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70acomctl32.dll
[-] 2009-12-24 . 692EDC2E300B033170ABF567E771A42D . 1061888 . . [6.0] . . c:windowsWinSxSx86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83comctl32.dll[-] 2009-12-24 . 1070FCFA307CAA8C1F66E178185DB82A . 6057984 . . [8.00.6001.22945] . . c:windowssystem32mshtml.dll
[-] 2009-12-24 . 1070FCFA307CAA8C1F66E178185DB82A . 6057984 . . [8.00.6001.22945] . . c:windowssystem32dllcachemshtml.dll[-] 2001-12-31 . 1829DF4C0A7A1CBFB08CAE1541443B4C . 2346752 . . [5.1.2600.5857] . . c:windowssystem32ntoskrnl.exe
[-] 2009-12-24 . 09ECBA39AFFB03F5736192DA6EDF204F . 257024 . . [5.1.2600.5512] . . c:windowssystem32tapisrv.dll
[-] 2009-12-24 . 67DE055C51D6E6EDE491CE4A0B3E5D29 . 634368 . . [5.1.2600.5512] . . c:windowssystem32user32.dll
[-] 2009-12-24 . 34F7A7D8CBEACFAC1A6A4B47557B663A . 942080 . . [8.00.6001.22945] . . c:windowssystem32wininet.dll
[-] 2009-12-24 . F46EE9333D2693F4961F83D385000AA3 . 1574400 . . [6.00.2900.5512] . . c:windowsexplorer.exe
[-] 2009-12-24 . 8BECA967DF13B3AF856438C268C9599A . 1290752 . . [5.1.2600.5512] . . c:windowssystem32ole32.dll
[-] 2009-12-24 . D0625984FE39B6D5BE94744500162CB9 . 1571840 . . [5.1.2600.5512] . . c:windowssystem32sfcfiles.dll
[-] 2009-12-24 . 9DBC37BEA098E23488B2B60CC0D4935B . 30208 . . [5.1.2600.5512] . . c:windowssystem32ctfmon.exe
[-] 2009-12-24 . 4E905F8D5DD204EF0C4E0616DC91DDF5 . 135680 . . [6.00.2900.5853] . . c:windowssystem32shsvcs.dll
[-] 2001-12-31 . 0B7D08A72F915CAA49F07671DEB9A0A9 . 2223616 . . [5.1.2600.5857] . . c:windowssystem32ntkrnlpa.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2010-05-18 10335560][HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar][HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2010-05-18 10335560][HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar][HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«Aml Maple»=»c:program filesAmlMapleAmlMaple.exe» [2007-12-18 74240]
«LClock»=»c:program filesLClockLClock.exe» [2007-12-19 135168]
«AdobeUpdater»=»c:program filesCommon FilesAdobeUpdaterAdobeUpdater.exe» [2005-03-16 970752][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«SoundMAXPnP»=»c:program filesAnalog DevicesCoresmax4pnp.exe» [2007-03-16 868352]
«WinStyleMON»=»c:windowssystem32WinstyleMonitor.exe» [2009-10-19 123904]
«Sidebar»=»c:program filesWindows SidebarStartup.exe» [2009-07-02 351109]
«Adobe Reader Speed Launcher»=»c:program filesAdobeReader 9.0ReaderReader_sl.exe» [2008-06-11 34672]
«USB Antivirus»=»c:program filesUSBDiskSecurityUSBGuard.exe» [2008-10-09 798720]
«Ulead AutoDetector»=»c:program filesUlead SystemsUlead Photo Explorer 8.0 SE BasicMonitor.exe» [2003-11-18 45056]
«Guard.Mail.ru.gui»=»c:program filesMail.RuGuardGuardMailRu.exe» [2001-12-31 975040][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2009-12-24 30208]
«Aml Maple»=»c:program filesAmlMapleAmlMaple.exe» [2007-12-18 74240]
«LClock»=»c:program filesLClockLClock.exe» [2007-12-19 135168][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE8_01″=»shell32» [X]
«IE8_02″=»advpack.dll» [2009-12-24 128512]c:documents and settingsAnUTAѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
Adobe Gamma.lnk — c:program filesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe [2005-3-16 113664][HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«ForceClassicControlPanel»= 1 (0x1)[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«AntiVirusOverride»=dword:00000001
«FirewallOverride»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)
«DisableUnicastResponsesToMulticastBroadcast»= 0 (0x0)[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=S2 Guard.Mail.ru;Guard.Mail.ru;c:program filesMail.RuGuardGuardMailRu.exe [01.01.2002 0:37 975040]
.
.
Supplementary Scan
.
uStart Page = hxxp://www.mail.ru/cnt/7227
TCP: {D907CC02-CC7A-4A8C-82B9-34CEEBB7427B} = 195.226.220.30,195.226.220.31
.
— — — — ORPHANS REMOVED — — — —Toolbar-ITBar7Position — (no file)
Notify-WgaLogon — (no file)
AddRemove-Камень судьбы — d:игрыКамень судьбыКамень судьбыUninstall.exe**************************************************************************
catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-16 11:07
Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(632)
c:windowssystem32SETUPAPI.dll
c:windowssystem32Ati2evxx.dll
c:windowssystem32cscui.dll
c:windowssystem32NTMARTA.DLL
c:windowssystem32COMRes.dll— — — — — — — > ‘lsass.exe'(688)
c:windowssystem32SETUPAPI.dll
c:windowssystem32psbase.dll
.
Completion time: 2010-11-16 11:08:29
ComboFix-quarantined-files.txt 2010-11-16 09:08Pre-Run: 7 258 054 656 байт свободно
Post-Run: 7 688 650 752 байт свободноWindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)WINDOWS
[operating systems]
c:cmdconsBOOTSECT.DAT=»Microsoft Windows Recovery Console» /cmdcons
UnsupportedDebug=»do not select this» /debug
multi(0)disk(0)rdisk(0)partition(1)WINDOWS=»Microsoft Windows XP Professional RU» /noexecute=optin /fastdetect— — End Of File — — 3506C30F6E401F117A30EFC13BE6E005
