Созданные ответы форума
-
Сообщения
-
Пропал информер внизу экрана и многие программы перестали зависать! Огромное Вам спасибо!!!
Да, диск F — это флэшка и др. устройства.
ComboFix 08-11-26.05 — Admin 2008-11-29 0:58:05.4 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.1.1049.18.597 [GMT 3:00]
Running from: c:downloadsПрограммыComboFix.exe
Command switches used :: c:documents and settingsAdminРабочий столCFScript.txt
* Created a new restore pointWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.((((((((((((((((((((((((( Files Created from 2008-10-28 to 2008-11-28 )))))))))))))))))))))))))))))))
.2008-11-28 11:22 . 2008-11-28 11:22
d
c:program filesAKVIS
2008-11-27 23:44 . 2008-11-27 23:47d
c:program filesTotal Video Converter
2008-11-27 16:43 . 2008-11-27 16:43d
c:program filesLuxand
2008-11-27 16:23 . 2008-11-27 16:23d
c:program filesSimitex lab
2008-11-27 10:09 . 2008-11-27 10:09d
c:documents and settingsAdminApplication DataApple Computer
2008-11-27 10:09 . 2008-11-28 12:41 54,156 —ah
c:windowsQTFont.qfn
2008-11-27 10:09 . 2008-11-27 10:09 1,409 —a
c:windowsQTFont.for
2008-11-26 13:41 . 2008-11-26 13:41d
C:rsit
2008-11-26 13:24 . 2008-11-26 13:24d
c:program filesTrend Micro
2008-11-25 22:58 . 2008-11-25 22:59d
c:program filesTrojan Remover
2008-11-25 22:58 . 2008-11-25 22:58d
c:documents and settingsAll UsersApplication DataSimply Super Software
2008-11-25 22:58 . 2008-11-25 22:58d
c:documents and settingsAdminApplication DataSimply Super Software
2008-11-25 22:58 . 2006-05-25 15:52 162,304 —a
c:windowssystem32ztvunrar36.dll
2008-11-25 22:58 . 2003-02-02 20:06 153,088 —a
c:windowssystem32UNRAR3.dll
2008-11-25 22:58 . 2005-08-26 01:50 77,312 —a
c:windowssystem32ztvunace26.dll
2008-11-25 22:58 . 2002-03-06 01:00 75,264 —a
c:windowssystem32unacev2.dll
2008-11-25 22:58 . 2006-06-19 13:01 69,632 —a
c:windowssystem32ztvcabinet.dll
2008-11-25 22:21 . 2008-11-25 22:21 237 —a
c:windowssystem32$$$$$$$$.bat
2008-11-25 21:42 . 2008-11-25 21:51 0 —ah
c:windowssystem32BITD6.tmp
2008-11-25 10:59 . 2008-11-26 02:13d
c:program filesКнига Солнца
2008-11-23 19:31 . 2008-11-23 19:31d
c:documents and settingsAdminApplication Datavlc
2008-11-23 11:16 . 2008-11-23 11:19d
c:program filesVinegret
2008-11-22 14:11 . 2008-11-22 14:11d
c:documents and settingsAdminApplication DataArtogon
2008-11-22 14:06 . 2008-11-22 14:06d
c:program filesTreasure_Seekers
2008-11-22 00:45 . 2008-11-22 00:45 80,384 —a
c:windowswinnt32_modul.dll
2008-11-21 22:28 . 2008-11-21 22:28 29 —a
c:windowssystem32sqdiwauf.tmp
2008-11-21 15:56 . 2008-11-21 15:56 327,680 —a
c:windowssystem32fbilib.dll
2008-11-21 13:40 . 2008-11-21 13:40 23,552 —a
c:windowssystem32msvcrt57.dll
2008-11-20 18:03 . 2008-11-20 18:04d
c:program filesIEPopUpControl
2008-11-20 18:02 . 2008-11-20 18:02d
c:program filesMyCentria
2008-11-20 17:37 . 2008-11-20 17:37d
c:documents and settingsAdminApplication DataCyberLink
2008-11-20 16:55 . 2008-11-28 19:51d
c:program filesSMS from IE
2008-11-20 13:53 . 2008-11-20 13:53d
c:program filesReadon Technology
2008-11-19 10:46 . 2008-11-19 11:06d
c:program filesЭлитрил. Сокровище эльфов
2008-11-18 13:26 . 2008-11-18 13:27d
C:Hopeland
2008-11-18 11:46 . 2008-11-18 11:46d
c:program filesFashionista
2008-11-13 12:54 . 2008-11-13 12:54d—hs—- c:windowsftpcache
2008-11-13 12:54 . 2008-11-13 12:54d
c:documents and settingsAll UsersApplication DataRedrum
2008-11-13 12:51 . 2008-11-13 12:51d
c:program filesRedrum — Dead Diary
2008-11-12 10:16 . 2008-11-12 12:37d
c:program filesЮвелир
2008-11-10 16:18 . 2008-11-10 16:18 3,612,461 —a
c:windowssystem32Caribbean Nights.scr
2008-11-10 15:54 . 2008-11-10 15:54d
c:windowssystem32Lang
2008-11-10 15:54 . 2008-11-10 15:54 940,794 —a
c:windowssystem32LoopyMusic.wav
2008-11-10 15:54 . 2008-11-10 15:54 146,650 —a
c:windowssystem32BuzzingBee.wav
2008-11-09 19:21 . 2008-11-09 19:21d
c:program filesNextUp-ScanSoft
2008-11-09 19:18 . 2008-11-28 19:51d
c:program filesTextAloud
2008-11-09 15:52 . 2008-11-09 15:52d
c:windowsTranscend JetFlash Recovery Tool
2008-11-09 15:52 . 2008-11-09 15:52d
c:program filesTranscend JetFlash Recovery Tool
2008-11-09 14:10 . 2008-11-09 14:10d
c:program filesMystic Inn
2008-11-09 11:48 . 2008-11-09 11:48d
c:documents and settingsAll UsersApplication DataPlayFirst
2008-11-09 11:48 . 2008-11-09 11:48d
c:documents and settingsAdminApplication DataPlayFirst
2008-11-09 11:15 . 2008-11-09 11:15d
c:program filesDream Chronicles
2008-11-09 10:29 . 2008-11-09 10:29d
c:program filesCommon FilesTeleca Shared
2008-11-09 10:29 . 2008-11-09 10:29d
c:documents and settingsAll UsersDocuments
2008-11-09 10:29 . 2008-11-09 10:29d
c:documents and settingsAll UsersApplication DataTeleca
2008-11-09 10:29 . 2008-11-09 10:29d
c:documents and settingsAll UsersApplication DataSony Ericsson
2008-11-08 22:09 . 2008-11-08 22:09d
c:documents and settingsAdminApplication DataLeadertech
2008-11-08 18:32 . 2008-11-08 18:32d
c:documents and settingsAdminApplication DataAshampoo
2008-11-08 18:31 . 2008-11-08 18:31d
c:program filesAshampoo
2008-11-08 18:31 . 2008-11-08 18:31d
c:documents and settingsAll UsersApplication Dataashampoo
2008-11-08 08:44 . 2008-11-08 08:44d
c:documents and settingsAll UsersApplication DataValusoft
2008-11-08 08:44 . 2008-11-08 08:44d
c:documents and settingsAdminApplication DataValusoft
2008-11-07 17:02 . 2008-11-07 17:02d
c:program filesHot_Dish
2008-11-07 15:49 . 2008-11-07 15:49d
c:program filesIlya-Muromets
2008-11-07 15:44 . 2008-11-07 15:44 4,096 —a
c:windowsd3dx.dat
2008-11-07 14:29 . 2008-11-07 14:30d
c:program filesKudos_Rock_Legend
2008-11-07 12:19 . 2008-11-07 12:20d
c:program filesЭнциклопедия пасьянсов
2008-11-07 11:41 . 2008-11-08 08:44d
c:program filesE2
2008-11-07 11:22 . 2008-11-07 11:22d
c:program files10 Talismans
2008-11-07 10:15 . 2008-11-07 10:15d
c:documents and settingsAll UsersApplication DataAlawar Stargaze
2008-11-07 10:14 . 2008-11-07 10:14d
c:program filesМодный сезон
2008-11-06 18:24 . 2008-11-06 18:24d
c:documents and settingsAdminApplication DataWebMoney
2008-11-05 09:36 . 2008-11-05 12:24d
c:program filesЭлектра
2008-11-05 09:30 . 2008-11-05 09:43d
c:program filesФото мания
2008-11-04 22:33 . 2008-11-04 22:34d
c:program filesNufsoft
2008-11-04 22:15 . 2008-11-04 22:19d
c:program filesФотоДЕКОР
2008-11-03 00:01 . 2008-11-03 00:02d
c:program filesMusaic Box
2008-11-02 21:52 . 2008-11-02 21:52d
c:program filesPixarra
2008-11-02 19:05 . 2008-11-02 19:11d
c:documents and settingsAdminApplication DataSecretIslandRus
2008-11-02 19:01 . 2008-11-02 19:03d
c:program filesTheTreasuresOfMysteryIsland_Rus
2008-11-02 14:02 . 2008-11-02 14:02d
c:program filesSimPE
2008-10-31 22:54 . 2008-11-23 19:16 10 —a
c:windowspopcinfo.dat
2008-10-31 22:17 . 2008-11-04 20:57d
c:documents and settingsAdminApplication DataAdobeUM
2008-10-31 22:17 . 2008-10-31 22:17d
c:documents and settingsAdminApplication DataAdobeAUM
2008-10-31 18:24 . 2008-11-01 07:50d
c:program filesSims2Pack Clean Installer
2008-10-31 18:24 . 2008-11-03 19:18d
c:program filesSims 2 Categorizer
2008-10-31 18:24 . 2008-10-31 18:24 249,856
c:windowsSetup1.exe
2008-10-31 18:24 . 2008-10-31 18:24 73,216 —a
c:windowsST6UNST.EXE
2008-10-31 18:12 . 2008-10-31 18:12 631,305 —a
c:windowsunins000.exe
2008-10-31 18:12 . 2008-10-31 18:12 2,615 —a
c:windowsunins000.dat
2008-10-31 14:01 . 2008-10-31 19:08d
c:program filesZuma Deluxe
2008-10-29 23:27 . 2008-10-29 23:27d
c:program filesDisc2Phone
2008-10-29 23:25 . 2008-10-29 23:27d
c:program filesQuickTime
2008-10-29 23:25 . 2008-10-29 23:25d
c:documents and settingsAll UsersApplication DataApple Computer
2008-10-29 23:23 . 2008-11-09 13:24d
c:documents and settingsAdminApplication DataTeleca
2008-10-29 23:23 . 2008-10-29 23:23d
c:documents and settingsAdminApplication DataSony Ericsson
2008-10-29 23:23 . 2006-08-18 12:10 97,056 -ra
c:windowssystem32driversK320mdm.sys
2008-10-29 23:23 . 2006-08-18 12:10 9,328 -ra
c:windowssystem32driversK320mdfl.sys
2008-10-29 23:22 . 2006-08-18 11:10 88,560 -ra
c:windowssystem32driversK320mgmt.sys
2008-10-29 23:22 . 2006-08-18 11:10 86,368 -ra
c:windowssystem32driversK320obex.sys
2008-10-29 23:22 . 2006-08-18 11:10 61,504 -ra
c:windowssystem32driversK320bus.sys
2008-10-29 23:22 . 2006-08-18 12:10 6,208 -ra
c:windowssystem32driversK320cmnt.sys
2008-10-29 23:22 . 2006-08-18 12:10 6,208 -ra
c:windowssystem32driversK320cm.sys
2008-10-29 23:22 . 2006-08-18 11:10 5,840 -ra
c:windowssystem32driversK320whnt.sys
2008-10-29 23:22 . 2006-08-18 11:10 5,840 -ra
c:windowssystem32driversK320wh.sys
2008-10-29 23:21 . 2008-10-29 23:22d—-c— c:windowssystem32DRVSTORE
2008-10-29 23:20 . 2008-10-29 23:20d
c:program filesSony Ericsson
2008-10-29 23:19 . 2008-10-29 23:19d
c:windowsDownloaded Installations
2008-10-29 10:51 . 2008-10-29 10:51d
c:documents and settingsAdminApplication Datacr3
2008-10-29 10:28 . 2008-10-29 10:28d
c:program filesBookReader
2008-10-29 08:32 . 2008-11-01 19:20 20,568 —a
c:documents and settingsAdminApplication DataGDIPFONTCACHEV1.DAT
2008-10-29 00:36 . 2008-10-29 00:36d
c:program filesEA GAMES
2008-10-28 20:06 . 2008-10-28 20:06d
c:documents and settingsAdminApplication DataGames
2008-10-28 19:18 . 2008-10-28 19:18d
c:program filesSherlock_Holmes_The_Mystery_Of_The_Persian_Carpet
2008-10-28 15:12 . 2008-10-28 15:12d
c:windowsSun
2008-10-28 14:48 . 2008-10-28 14:48d
c:program filesWinDjView
2008-10-28 14:21 . 2008-10-28 14:21d
C:8332eebaf65650fc7b9a3e49
2008-10-28 14:13 . 2008-10-28 14:13d
C:b75caa556faf7701dac7fac5933ecc4a
2008-10-28 14:13 . 2008-10-28 14:13dr-h
C:AHCache
2008-10-28 14:04 . 2008-10-28 14:04d
c:program filesWebMoney Agent
2008-10-28 14:04 . 2008-10-28 14:04d
c:program filesWebMoney Advisor
2008-10-28 14:04 . 2008-11-28 18:25d-a
c:documents and settingsAll UsersApplication DataTEMP
2008-10-28 14:03 . 2008-10-28 14:04d
c:program filesWebMoney
2008-10-28 13:50 . 2008-10-28 15:17 65,536 —a
C:0xf9.exe
2008-10-28 13:09 . 2008-10-28 13:09d
c:program filesQIP.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-28 21:32
d
w c:program filesDrWeb
2008-11-19 08:06
d
w c:program filesЭлитрил. Сокровище эльфов
2008-11-07 09:20
d
w c:program filesЭнциклопедия пасьянсов
2008-11-05 09:24
d
w c:program filesЭлектра
2008-11-04 17:56
d—h—w c:program filesInstallShield Installation Information
2008-11-04 17:56
d
w c:program filesCommon FilesInstallShield
2008-11-04 14:05
d
w c:program filesCommon FilesAdobe
2008-10-28 05:20
d
w c:program filesSamsung
2008-10-27 15:10
d
w c:documents and settingsAdminApplication DataAhead
2008-10-27 14:44
d
w c:program filesCommon FilesAhead
2008-10-27 14:43
d
w c:program filesNero
2008-10-27 14:43
d
w c:documents and settingsAll UsersApplication DataNero
2008-10-27 14:35 73,728 —-atw c:windowssystem32DRWEBSP.DLL
2008-10-27 14:35
d
w c:documents and settingsAdminApplication DataInstallShield
2008-10-27 14:34
d
w c:documents and settingsAll UsersApplication DataCyberLink
2008-10-27 14:33
d
w c:program filesCyberLink
2008-10-27 14:32
d
w c:program filesK-Lite Codec Pack
2008-10-27 10:06 717,296 —-a-w c:windowssystem32driverssptd.sys
2008-10-27 10:06
d
w c:program filesVistaDriveIcon
2008-10-27 10:06
d
w c:program filesJava
2008-10-27 10:06
d
w c:program filesCommon FilesJava
2008-10-27 09:59
d
w c:program filesWindows Media Connect 2
2008-10-27 09:59
d
w c:program filesPaint.NET
.((((((((((((((((((((((((((((( snapshot@2008-11-26_17.11.58.45 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-11-27 13:23:55 9,662 —-a-r c:windowsInstaller{3F5E6A00-EC7C-43D5-BBCE-FE953584EAB2}_21F3885A18D238E15AAE81.exe
+ 2008-11-27 13:23:55 9,662 —-a-r c:windowsInstaller{3F5E6A00-EC7C-43D5-BBCE-FE953584EAB2}_2BAE0D390DF4564BF4B244.exe
+ 2008-11-27 13:23:55 33,982 —-a-r c:windowsInstaller{3F5E6A00-EC7C-43D5-BBCE-FE953584EAB2}_6010506297426748D27598.exe
+ 2008-11-27 13:23:55 56,390 —-a-r c:windowsInstaller{3F5E6A00-EC7C-43D5-BBCE-FE953584EAB2}_6FEFF9B68218417F98F549.exe
+ 2008-11-27 13:23:55 9,662 —-a-r c:windowsInstaller{3F5E6A00-EC7C-43D5-BBCE-FE953584EAB2}_8B335AD6E4F7E1F1BBEA03.exe
+ 2008-11-27 13:23:55 10,134 —-a-r c:windowsInstaller{3F5E6A00-EC7C-43D5-BBCE-FE953584EAB2}_9D03ECF900B4EB88D83390.exe
+ 2008-11-27 13:23:55 10,134 —-a-r c:windowsInstaller{3F5E6A00-EC7C-43D5-BBCE-FE953584EAB2}_DB3D6AFA617990A524DEE6.exe
+ 2008-11-27 13:23:55 10,134 —-a-r c:windowsInstaller{3F5E6A00-EC7C-43D5-BBCE-FE953584EAB2}_F2388FC26BBCF4085BCFD4.exe
+ 2008-11-27 13:23:55 33,982 —-a-r c:windowsInstaller{3F5E6A00-EC7C-43D5-BBCE-FE953584EAB2}_FF6114B25DE787F337FBE6.exe
— 2008-11-26 14:08:38 49,152 —sha-w c:windowssystem32configsystemprofileCookiesindex.dat
+ 2008-11-28 21:31:57 49,152 —sha-w c:windowssystem32configsystemprofileCookiesindex.dat
— 2008-11-26 14:08:38 311,296 —sha-w c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5index.dat
+ 2008-11-28 21:31:57 311,296 —sha-w c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5index.dat
— 2008-11-26 08:10:02 49,152 —sha-w c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5MSHist012008112620081127index.dat
+ 2008-11-26 14:46:38 49,152 —sha-w c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5MSHist012008112620081127index.dat
+ 2008-11-27 19:38:39 32,768 —sha-w c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5MSHist012008112720081128index.dat
— 2008-11-26 14:08:38 1,359,872 —sha-w c:windowssystem32configsystemprofileLocal SettingsTemporary Internet FilesContent.IE5index.dat
+ 2008-11-28 21:31:57 1,359,872 —sha-w c:windowssystem32configsystemprofileLocal SettingsTemporary Internet FilesContent.IE5index.dat
+ 2008-06-21 08:28:10 83,072 —-a-w c:windowssystem32driverswdmaud.sys
+ 2008-04-15 12:00:00 4,352 —-a-w c:windowssystem32driverswmilib.sys
+ 2008-03-02 11:45:40 38,528 —-a-w c:windowssystem32driverswpdusb.sys
+ 2008-04-15 12:00:00 12,032 —-a-w c:windowssystem32driversws2ifsl.sys
+ 2008-03-02 11:45:40 77,568 —-a-w c:windowssystem32driverswudfpf.sys
+ 2008-03-02 11:45:40 82,944 —-a-w c:windowssystem32driverswudfrd.sys
— 2008-10-30 05:42:26 121,336 —-a-w c:windowssystem32FNTCACHE.DAT
+ 2008-11-28 07:08:32 122,136 —-a-w c:windowssystem32FNTCACHE.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_LOCAL_MACHINE~Browser Helper Objects{B4806C1A-FE8A-4008-9DA3-8CEDB6E82C10}]
2008-09-05 15:42 2409472 —a
c:program filesWebMoney Advisorwmadvisor.dll[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2008-10-16 1578248]
«{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}»= «c:program filesWebMoney Advisorwmadvisor.dll» [2008-09-05 2409472][HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2008-10-16 1578248]
«{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}»= «c:program filesWebMoney Advisorwmadvisor.dll» [2008-09-05 2409472][HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar][HKEY_CLASSES_ROOTclsid{3affd7f7-fd3d-4c9d-8f83-03296a1a8840}]
[HKEY_CLASSES_ROOTTBSB03223.TBSB03223.3]
[HKEY_CLASSES_ROOTTypeLib{77AA25E8-6083-4949-A831-9CB11861DC10}]
[HKEY_CLASSES_ROOTTBSB03223.TBSB03223][HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2008-06-21 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
«BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=»c:program filesCommon FilesAheadLibNMBgMonitor.exe» [2007-01-15 147456]
«Yupdate!»=»c:program filesCommon FilesYandexYupdateyupdate.exe» [2008-09-01 479496]
«Download Master»=»c:program filesDownload Masterdmaster.exe» [2008-09-17 3294720]
«QIP2005″=»c:program filesQIPqip.exe» [2008-07-01 3256320][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«RemoteControl»=»c:program filesCyberLinkPowerDVDPDVDServ.exe» [2007-03-14 71216]
«LanguageShortcut»=»c:program filesCyberLinkPowerDVDLanguageLanguage.exe» [2007-03-14 54832]
«SpIDerNT»=»c:progra~1DrWebspiderui.exe» [2007-09-19 214552]
«SpIDerMail»=»c:program filesDrWebspiderml.exe» [2007-09-19 361712]
«NeroFilterCheck»=»c:program filesCommon FilesAheadLibNeroCheck.exe» [2006-01-12 155648]
«SMSTray»=»c:program filesSamsungSamsung Media Studio 5SMSTray.exe» [2007-09-20 132624]
«MAAgent»=»c:program filesMarkAnyContentSaferMAAgent.exe» [2007-01-30 57344]
«MAgent»=»c:program filesMail.RuAgentMAgent.exe» [2008-10-28 4412920]
«wmagent.exe»=»c:program filesWebMoney Agentwmagent.exe» [2008-10-01 209376]
«QuickTime Task»=»c:program filesQuickTimeqttask.exe» [2008-10-29 155648]
«Adobe Photo Downloader»=»c:program filesAdobePhotoshop Album Starter Edition3.0Appsapdproxy.exe» [2005-06-06 57344]
«Adobe Reader Speed Launcher»=»c:program filesAdobeReader 8.0ReaderReader_sl.exe» [2008-01-11 39792]
«Sony Ericsson PC Suite»=»c:program filesSony EricssonMobile2Application LauncherApplication Launcher.exe» [2005-10-26 159744]
«TrojanScanner»=»c:program filesTrojan RemoverTrjscan.exe» [2008-09-20 922192]
«SoundMan»=»SOUNDMAN.EXE» [2007-04-16 c:windowsSOUNDMAN.EXE][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-06-21 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» [2008-06-21 c:windowssystem32advpack.dll]
«IE7_012″=»advpack.dll» [2008-06-21 c:windowssystem32advpack.dll][HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)[hkey_local_machinesoftwaremicrosoftwindowscurrentversionexplorerShellExecuteHooks]
«{88485281-8b4b-4f8d-9ede-82e29a064277}»= «c:progra~1MarkAnyCONTEN~1MACSMA~1.DLL» [2004-11-23 192512][HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]
«msacm.ac3filter»= ac3filter.acm[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesDisableNotify»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusDisableNotify»=dword:00000001
«AntiVirusOverride»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«%windir%\system32\lsass.exe»=[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«110:TCP»= 110:TCP:svchostR0 nvcchflt;NVIDIA Disk Cache Filter Driver;c:windowssystem32DRIVERSnvcchflt.sys [2008-10-27 16640]
R0 nvrd32;NVIDIA nForce RAID Driver;c:windowssystem32DRIVERSnvrd32.sys [2008-10-27 116736]
R2 {95808DC4-FA4A-4C74-92FE-5B863F82066B};{95808DC4-FA4A-4C74-92FE-5B863F82066B};??c:program filesCyberLinkPowerDVD000.fcl [2007-09-19 21:37:48 41456]
R2 SPIDER;SpIDer Guard File System Monitor;??c:progra~1DrWebspider.sys [2008-10-27 317624]
R2 SPIDERNT;SpIDer Guard for Windows;c:progra~1DrWebspidernt.exe [2008-10-27 218648]
S3 K320bus;Sony Ericsson K320 driver (WDM);c:windowssystem32DRIVERSK320bus.sys [2008-10-29 61504]
S3 K320mdfl;Sony Ericsson K320 USB WMC Modem Filter;c:windowssystem32DRIVERSK320mdfl.sys [2008-10-29 9328]
S3 K320mdm;Sony Ericsson K320 USB WMC Modem Driver;c:windowssystem32DRIVERSK320mdm.sys [2008-10-29 97056]
S3 K320mgmt;Sony Ericsson K320 USB WMC Device Management Drivers (WDM);c:windowssystem32DRIVERSK320mgmt.sys [2008-10-29 88560]
S3 K320obex;Sony Ericsson K320 USB WMC OBEX Interface;c:windowssystem32DRIVERSK320obex.sys [2008-10-29 86368]
.**************************************************************************
catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-29 01:00:43
Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
[HKEY_LOCAL_MACHINEsystemControlSet001Services{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
«ImagePath»=»??c:program filesCyberLinkPowerDVD000.fcl»
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(692)
c:windowssystem32SETUPAPI.dll
c:windowssystem32WININET.dll
c:windowssystem32DRWEBSP.DLL
c:windowssystem32Ati2evxx.dll
c:windowssystem32cscui.dll
c:windowssystem32COMRes.dll— — — — — — — > ‘lsass.exe'(748)
c:windowssystem32SETUPAPI.dll
c:windowssystem32DRWEBSP.DLL
.
Completion time: 2008-11-29 1:02:15
ComboFix-quarantined-files.txt 2008-11-28 22:02:13
ComboFix2.txt 2008-11-27 19:52:43
ComboFix3.txt 2008-11-27 07:30:33
ComboFix4.txt 2008-11-26 14:12:55Pre-Run: 81 483 194 368 байт свободно
Post-Run: 81,501,265,920 байт свободно306
ComboFix 08-11-26.05 — Admin 2008-11-27 22:45:03.3 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.1.1049.18.529 [GMT 3:00]
Running from: c:downloadsПрограммыComboFix.exe
Command switches used :: c:documents and settingsAdminРабочий столCFScript.txtWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
c:windowssystem32csrss7.dll
c:windowssystem32driversati5pwxx.sys.vir
c:windowssystem32driversati7hnxx.sys
c:windowssystem32driverssfc.sys
c:windowssystem32ntos.exe.vir
c:windowssystem32qyklib.dll
c:windowssystem32reset5c.dll
c:windowssystem32sbin.exe
c:windowssystem32tprlib.dll
c:windowswinnt32_video.dll
.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.c:program filesMicrosoft Common
c:program filesMicrosoft Commonsvchost.exe
c:windowssystem32csrss7.dll
c:windowssystem32driversati5pwxx.sys.vir
c:windowssystem32driversati7hnxx.sys
c:windowssystem32ntos.exe.vir
c:windowssystem32qyklib.dll
c:windowssystem32reset5c.dll
c:windowssystem32sbin.exe
c:windowssystem32tprlib.dll
c:windowswinnt32_video.dll.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
Legacy_ATI5PWXX
Legacy_ATI7HNXX
Service_ati5pwxx
Service_ati7hnxx((((((((((((((((((((((((( Files Created from 2008-10-27 to 2008-11-27 )))))))))))))))))))))))))))))))
.2008-11-27 16:43 . 2008-11-27 16:43
d
c:program filesLuxand
2008-11-27 16:23 . 2008-11-27 16:23d
c:program filesSimitex lab
2008-11-27 10:09 . 2008-11-27 10:09d
c:documents and settingsAdminApplication DataApple Computer
2008-11-27 10:09 . 2008-11-27 10:09 54,156 —ah
c:windowsQTFont.qfn
2008-11-27 10:09 . 2008-11-27 10:09 1,409 —a
c:windowsQTFont.for
2008-11-26 13:41 . 2008-11-26 13:41d
C:rsit
2008-11-26 13:24 . 2008-11-26 13:24d
c:program filesTrend Micro
2008-11-25 22:58 . 2008-11-25 22:59d
c:program filesTrojan Remover
2008-11-25 22:58 . 2008-11-25 22:58d
c:documents and settingsAll UsersApplication DataSimply Super Software
2008-11-25 22:58 . 2008-11-25 22:58d
c:documents and settingsAdminApplication DataSimply Super Software
2008-11-25 22:58 . 2006-05-25 15:52 162,304 —a
c:windowssystem32ztvunrar36.dll
2008-11-25 22:58 . 2003-02-02 20:06 153,088 —a
c:windowssystem32UNRAR3.dll
2008-11-25 22:58 . 2005-08-26 01:50 77,312 —a
c:windowssystem32ztvunace26.dll
2008-11-25 22:58 . 2002-03-06 01:00 75,264 —a
c:windowssystem32unacev2.dll
2008-11-25 22:58 . 2006-06-19 13:01 69,632 —a
c:windowssystem32ztvcabinet.dll
2008-11-25 22:21 . 2008-11-25 22:21 237 —a
c:windowssystem32$$$$$$$$.bat
2008-11-25 21:42 . 2008-11-25 21:51 0 —ah
c:windowssystem32BITD6.tmp
2008-11-25 10:59 . 2008-11-26 02:13d
c:program filesКнига Солнца
2008-11-23 19:31 . 2008-11-23 19:31d
c:documents and settingsAdminApplication Datavlc
2008-11-23 11:16 . 2008-11-23 11:19d
c:program filesVinegret
2008-11-22 14:11 . 2008-11-22 14:11d
c:documents and settingsAdminApplication DataArtogon
2008-11-22 14:06 . 2008-11-22 14:06d
c:program filesTreasure_Seekers
2008-11-22 00:45 . 2008-11-22 00:45 80,384 —a
c:windowswinnt32_modul.dll
2008-11-21 22:28 . 2008-11-21 22:28 29 —a
c:windowssystem32sqdiwauf.tmp
2008-11-21 15:56 . 2008-11-21 15:56 327,680 —a
c:windowssystem32fbilib.dll
2008-11-21 13:40 . 2008-11-21 13:40 23,552 —a
c:windowssystem32msvcrt57.dll
2008-11-20 18:03 . 2008-11-20 18:04d
c:program filesIEPopUpControl
2008-11-20 18:02 . 2008-11-20 18:02d
c:program filesMyCentria
2008-11-20 17:37 . 2008-11-20 17:37d
c:documents and settingsAdminApplication DataCyberLink
2008-11-20 16:55 . 2008-11-20 16:57d
c:program filesSMS from IE
2008-11-20 13:53 . 2008-11-20 13:53d
c:program filesReadon Technology
2008-11-19 10:46 . 2008-11-19 11:06d
c:program filesЭлитрил. Сокровище эльфов
2008-11-18 13:26 . 2008-11-18 13:27d
C:Hopeland
2008-11-18 11:46 . 2008-11-18 11:46d
c:program filesFashionista
2008-11-13 12:54 . 2008-11-13 12:54d—hs—- c:windowsftpcache
2008-11-13 12:54 . 2008-11-13 12:54d
c:documents and settingsAll UsersApplication DataRedrum
2008-11-13 12:51 . 2008-11-13 12:51d
c:program filesRedrum — Dead Diary
2008-11-12 10:16 . 2008-11-12 12:37d
c:program filesЮвелир
2008-11-10 16:18 . 2008-11-10 16:18 3,612,461 —a
c:windowssystem32Caribbean Nights.scr
2008-11-10 15:54 . 2008-11-10 15:54d
c:windowssystem32Lang
2008-11-10 15:54 . 2008-11-10 15:54 940,794 —a
c:windowssystem32LoopyMusic.wav
2008-11-10 15:54 . 2008-11-10 15:54 146,650 —a
c:windowssystem32BuzzingBee.wav
2008-11-09 19:21 . 2008-11-09 19:21d
c:program filesNextUp-ScanSoft
2008-11-09 19:18 . 2008-11-20 16:56d
c:program filesTextAloud
2008-11-09 15:52 . 2008-11-09 15:52d
c:windowsTranscend JetFlash Recovery Tool
2008-11-09 15:52 . 2008-11-09 15:52d
c:program filesTranscend JetFlash Recovery Tool
2008-11-09 14:10 . 2008-11-09 14:10d
c:program filesMystic Inn
2008-11-09 11:48 . 2008-11-09 11:48d
c:documents and settingsAll UsersApplication DataPlayFirst
2008-11-09 11:48 . 2008-11-09 11:48d
c:documents and settingsAdminApplication DataPlayFirst
2008-11-09 11:15 . 2008-11-09 11:15d
c:program filesDream Chronicles
2008-11-09 10:29 . 2008-11-09 10:29d
c:program filesCommon FilesTeleca Shared
2008-11-09 10:29 . 2008-11-09 10:29d
c:documents and settingsAll UsersDocuments
2008-11-09 10:29 . 2008-11-09 10:29d
c:documents and settingsAll UsersApplication DataTeleca
2008-11-09 10:29 . 2008-11-09 10:29d
c:documents and settingsAll UsersApplication DataSony Ericsson
2008-11-08 22:09 . 2008-11-08 22:09d
c:documents and settingsAdminApplication DataLeadertech
2008-11-08 18:32 . 2008-11-08 18:32d
c:documents and settingsAdminApplication DataAshampoo
2008-11-08 18:31 . 2008-11-08 18:31d
c:program filesAshampoo
2008-11-08 18:31 . 2008-11-08 18:31d
c:documents and settingsAll UsersApplication Dataashampoo
2008-11-08 08:44 . 2008-11-08 08:44d
c:documents and settingsAll UsersApplication DataValusoft
2008-11-08 08:44 . 2008-11-08 08:44d
c:documents and settingsAdminApplication DataValusoft
2008-11-07 17:02 . 2008-11-07 17:02d
c:program filesHot_Dish
2008-11-07 15:49 . 2008-11-07 15:49d
c:program filesIlya-Muromets
2008-11-07 15:44 . 2008-11-07 15:44 4,096 —a
c:windowsd3dx.dat
2008-11-07 14:29 . 2008-11-07 14:30d
c:program filesKudos_Rock_Legend
2008-11-07 12:19 . 2008-11-07 12:20d
c:program filesЭнциклопедия пасьянсов
2008-11-07 11:41 . 2008-11-08 08:44d
c:program filesE2
2008-11-07 11:22 . 2008-11-07 11:22d
c:program files10 Talismans
2008-11-07 10:15 . 2008-11-07 10:15d
c:documents and settingsAll UsersApplication DataAlawar Stargaze
2008-11-07 10:14 . 2008-11-07 10:14d
c:program filesМодный сезон
2008-11-06 18:24 . 2008-11-06 18:24d
c:documents and settingsAdminApplication DataWebMoney
2008-11-05 09:36 . 2008-11-05 12:24d
c:program filesЭлектра
2008-11-05 09:30 . 2008-11-05 09:43d
c:program filesФото мания
2008-11-04 22:33 . 2008-11-04 22:34d
c:program filesNufsoft
2008-11-04 22:15 . 2008-11-04 22:19d
c:program filesФотоДЕКОР
2008-11-03 00:01 . 2008-11-03 00:02d
c:program filesMusaic Box
2008-11-02 21:52 . 2008-11-02 21:52d
c:program filesPixarra
2008-11-02 19:05 . 2008-11-02 19:11d
c:documents and settingsAdminApplication DataSecretIslandRus
2008-11-02 19:01 . 2008-11-02 19:03d
c:program filesTheTreasuresOfMysteryIsland_Rus
2008-11-02 14:02 . 2008-11-02 14:02d
c:program filesSimPE
2008-10-31 22:54 . 2008-11-23 19:16 10 —a
c:windowspopcinfo.dat
2008-10-31 22:17 . 2008-11-04 20:57d
c:documents and settingsAdminApplication DataAdobeUM
2008-10-31 22:17 . 2008-10-31 22:17d
c:documents and settingsAdminApplication DataAdobeAUM
2008-10-31 18:24 . 2008-11-01 07:50d
c:program filesSims2Pack Clean Installer
2008-10-31 18:24 . 2008-11-03 19:18d
c:program filesSims 2 Categorizer
2008-10-31 18:24 . 2008-10-31 18:24 249,856
c:windowsSetup1.exe
2008-10-31 18:24 . 2008-10-31 18:24 73,216 —a
c:windowsST6UNST.EXE
2008-10-31 18:12 . 2008-10-31 18:12 631,305 —a
c:windowsunins000.exe
2008-10-31 18:12 . 2008-10-31 18:12 2,615 —a
c:windowsunins000.dat
2008-10-31 14:01 . 2008-10-31 19:08d
c:program filesZuma Deluxe
2008-10-29 23:27 . 2008-10-29 23:27d
c:program filesDisc2Phone
2008-10-29 23:25 . 2008-10-29 23:27d
c:program filesQuickTime
2008-10-29 23:25 . 2008-10-29 23:25d
c:documents and settingsAll UsersApplication DataApple Computer
2008-10-29 23:23 . 2008-11-09 13:24d
c:documents and settingsAdminApplication DataTeleca
2008-10-29 23:23 . 2008-10-29 23:23d
c:documents and settingsAdminApplication DataSony Ericsson
2008-10-29 23:23 . 2006-08-18 12:10 97,056 -ra
c:windowssystem32driversK320mdm.sys
2008-10-29 23:23 . 2006-08-18 12:10 9,328 -ra
c:windowssystem32driversK320mdfl.sys
2008-10-29 23:22 . 2006-08-18 11:10 88,560 -ra
c:windowssystem32driversK320mgmt.sys
2008-10-29 23:22 . 2006-08-18 11:10 86,368 -ra
c:windowssystem32driversK320obex.sys
2008-10-29 23:22 . 2006-08-18 11:10 61,504 -ra
c:windowssystem32driversK320bus.sys
2008-10-29 23:22 . 2006-08-18 12:10 6,208 -ra
c:windowssystem32driversK320cmnt.sys
2008-10-29 23:22 . 2006-08-18 12:10 6,208 -ra
c:windowssystem32driversK320cm.sys
2008-10-29 23:22 . 2006-08-18 11:10 5,840 -ra
c:windowssystem32driversK320whnt.sys
2008-10-29 23:22 . 2006-08-18 11:10 5,840 -ra
c:windowssystem32driversK320wh.sys
2008-10-29 23:21 . 2008-10-29 23:22d—-c— c:windowssystem32DRVSTORE
2008-10-29 23:20 . 2008-10-29 23:20d
c:program filesSony Ericsson
2008-10-29 23:19 . 2008-10-29 23:19d
c:windowsDownloaded Installations
2008-10-29 10:51 . 2008-10-29 10:51d
c:documents and settingsAdminApplication Datacr3
2008-10-29 10:28 . 2008-10-29 10:28d
c:program filesBookReader
2008-10-29 08:32 . 2008-11-01 19:20 20,568 —a
c:documents and settingsAdminApplication DataGDIPFONTCACHEV1.DAT
2008-10-29 00:36 . 2008-10-29 00:36d
c:program filesEA GAMES
2008-10-28 20:06 . 2008-10-28 20:06d
c:documents and settingsAdminApplication DataGames
2008-10-28 19:18 . 2008-10-28 19:18d
c:program filesSherlock_Holmes_The_Mystery_Of_The_Persian_Carpet
2008-10-28 15:12 . 2008-10-28 15:12d
c:windowsSun
2008-10-28 14:48 . 2008-10-28 14:48d
c:program filesWinDjView
2008-10-28 14:21 . 2008-10-28 14:21d
C:8332eebaf65650fc7b9a3e49
2008-10-28 14:13 . 2008-10-28 14:13d
C:b75caa556faf7701dac7fac5933ecc4a
2008-10-28 14:13 . 2008-10-28 14:13dr-h
C:AHCache
2008-10-28 14:04 . 2008-10-28 14:04d
c:program filesWebMoney Agent
2008-10-28 14:04 . 2008-10-28 14:04d
c:program filesWebMoney Advisor
2008-10-28 14:04 . 2008-11-25 23:13d-a
c:documents and settingsAll UsersApplication DataTEMP
2008-10-28 14:03 . 2008-10-28 14:04d
c:program filesWebMoney
2008-10-28 13:50 . 2008-10-28 15:17 65,536 —a
C:0xf9.exe
2008-10-28 13:09 . 2008-10-28 13:09d
c:program filesQIP
2008-10-28 12:58 . 2008-10-28 12:58d
c:program filesMail.Ru
2008-10-28 12:58 . 2008-10-28 12:59d
c:documents and settingsAdminApplication DataMra.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-19 08:06
d
w c:program filesЭлитрил. Сокровище эльфов
2008-11-07 09:20
d
w c:program filesЭнциклопедия пасьянсов
2008-11-05 09:24
d
w c:program filesЭлектра
2008-10-27 10:06 717,296 —-a-w c:windowssystem32driverssptd.sys
2008-10-27 10:06
d
w c:program filesVistaDriveIcon
2008-10-27 10:06
d
w c:program filesJava
2008-10-27 10:06
d
w c:program filesCommon FilesJava
2008-10-27 09:59
d
w c:program filesWindows Media Connect 2
2008-10-27 09:59
d
w c:program filesPaint.NET
.((((((((((((((((((((((((((((( snapshot@2008-11-26_17.11.58.45 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-11-27 13:23:55 9,662 —-a-r c:windowsInstaller{3F5E6A00-EC7C-43D5-BBCE-FE953584EAB2}_21F3885A18D238E15AAE81.exe
+ 2008-11-27 13:23:55 9,662 —-a-r c:windowsInstaller{3F5E6A00-EC7C-43D5-BBCE-FE953584EAB2}_2BAE0D390DF4564BF4B244.exe
+ 2008-11-27 13:23:55 33,982 —-a-r c:windowsInstaller{3F5E6A00-EC7C-43D5-BBCE-FE953584EAB2}_6010506297426748D27598.exe
+ 2008-11-27 13:23:55 56,390 —-a-r c:windowsInstaller{3F5E6A00-EC7C-43D5-BBCE-FE953584EAB2}_6FEFF9B68218417F98F549.exe
+ 2008-11-27 13:23:55 9,662 —-a-r c:windowsInstaller{3F5E6A00-EC7C-43D5-BBCE-FE953584EAB2}_8B335AD6E4F7E1F1BBEA03.exe
+ 2008-11-27 13:23:55 10,134 —-a-r c:windowsInstaller{3F5E6A00-EC7C-43D5-BBCE-FE953584EAB2}_9D03ECF900B4EB88D83390.exe
+ 2008-11-27 13:23:55 10,134 —-a-r c:windowsInstaller{3F5E6A00-EC7C-43D5-BBCE-FE953584EAB2}_DB3D6AFA617990A524DEE6.exe
+ 2008-11-27 13:23:55 10,134 —-a-r c:windowsInstaller{3F5E6A00-EC7C-43D5-BBCE-FE953584EAB2}_F2388FC26BBCF4085BCFD4.exe
+ 2008-11-27 13:23:55 33,982 —-a-r c:windowsInstaller{3F5E6A00-EC7C-43D5-BBCE-FE953584EAB2}_FF6114B25DE787F337FBE6.exe
— 2008-11-26 14:08:38 49,152 —sha-w c:windowssystem32configsystemprofileCookiesindex.dat
+ 2008-11-27 19:48:33 49,152 —sha-w c:windowssystem32configsystemprofileCookiesindex.dat
— 2008-11-26 14:08:38 311,296 —sha-w c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5index.dat
+ 2008-11-27 19:48:33 311,296 —sha-w c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5index.dat
— 2008-11-26 08:10:02 49,152 —sha-w c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5MSHist012008112620081127index.dat
+ 2008-11-26 14:46:38 49,152 —sha-w c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5MSHist012008112620081127index.dat
+ 2008-11-27 19:38:39 32,768 —sha-w c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5MSHist012008112720081128index.dat
— 2008-11-26 14:08:38 1,359,872 —sha-w c:windowssystem32configsystemprofileLocal SettingsTemporary Internet FilesContent.IE5index.dat
+ 2008-11-27 19:48:33 1,359,872 —sha-w c:windowssystem32configsystemprofileLocal SettingsTemporary Internet FilesContent.IE5index.dat
+ 2008-06-21 08:28:10 83,072 —-a-w c:windowssystem32driverswdmaud.sys
+ 2008-04-15 12:00:00 4,352 —-a-w c:windowssystem32driverswmilib.sys
+ 2008-03-02 11:45:40 38,528 —-a-w c:windowssystem32driverswpdusb.sys
+ 2008-04-15 12:00:00 12,032 —-a-w c:windowssystem32driversws2ifsl.sys
+ 2008-03-02 11:45:40 77,568 —-a-w c:windowssystem32driverswudfpf.sys
+ 2008-03-02 11:45:40 82,944 —-a-w c:windowssystem32driverswudfrd.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]
«{83821C2B-32A8-4DD7-B6D4-44309A78E668}»= «c:program filesMail.RuAgentMradllnewmrasearch.dll» [2008-10-28 79352][HKEY_CLASSES_ROOTclsid{83821c2b-32a8-4dd7-b6d4-44309a78e668}]
[HKEY_LOCAL_MACHINE~Browser Helper Objects{B4806C1A-FE8A-4008-9DA3-8CEDB6E82C10}]
2008-09-05 15:42 2409472 —a
c:program filesWebMoney Advisorwmadvisor.dll[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2008-10-16 1578248]
«{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}»= «c:program filesWebMoney Advisorwmadvisor.dll» [2008-09-05 2409472][HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2008-10-16 1578248]
«{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}»= «c:program filesWebMoney Advisorwmadvisor.dll» [2008-09-05 2409472][HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar][HKEY_CLASSES_ROOTclsid{3affd7f7-fd3d-4c9d-8f83-03296a1a8840}]
[HKEY_CLASSES_ROOTTBSB03223.TBSB03223.3]
[HKEY_CLASSES_ROOTTypeLib{77AA25E8-6083-4949-A831-9CB11861DC10}]
[HKEY_CLASSES_ROOTTBSB03223.TBSB03223][HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2008-06-21 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
«BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=»c:program filesCommon FilesAheadLibNMBgMonitor.exe» [2007-01-15 147456]
«Yupdate!»=»c:program filesCommon FilesYandexYupdateyupdate.exe» [2008-09-01 479496]
«Download Master»=»c:program filesDownload Masterdmaster.exe» [2008-09-17 3294720]
«QIP2005″=»c:program filesQIPqip.exe» [2008-07-01 3256320][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«RemoteControl»=»c:program filesCyberLinkPowerDVDPDVDServ.exe» [2007-03-14 71216]
«LanguageShortcut»=»c:program filesCyberLinkPowerDVDLanguageLanguage.exe» [2007-03-14 54832]
«SpIDerNT»=»c:progra~1DrWebspiderui.exe» [2007-09-19 214552]
«SpIDerMail»=»c:program filesDrWebspiderml.exe» [2007-09-19 361712]
«NeroFilterCheck»=»c:program filesCommon FilesAheadLibNeroCheck.exe» [2006-01-12 155648]
«SMSTray»=»c:program filesSamsungSamsung Media Studio 5SMSTray.exe» [2007-09-20 132624]
«MAAgent»=»c:program filesMarkAnyContentSaferMAAgent.exe» [2007-01-30 57344]
«MAgent»=»c:program filesMail.RuAgentMAgent.exe» [2008-10-28 4412920]
«wmagent.exe»=»c:program filesWebMoney Agentwmagent.exe» [2008-10-01 209376]
«QuickTime Task»=»c:program filesQuickTimeqttask.exe» [2008-10-29 155648]
«Adobe Photo Downloader»=»c:program filesAdobePhotoshop Album Starter Edition3.0Appsapdproxy.exe» [2005-06-06 57344]
«Adobe Reader Speed Launcher»=»c:program filesAdobeReader 8.0ReaderReader_sl.exe» [2008-01-11 39792]
«Sony Ericsson PC Suite»=»c:program filesSony EricssonMobile2Application LauncherApplication Launcher.exe» [2005-10-26 159744]
«TrojanScanner»=»c:program filesTrojan RemoverTrjscan.exe» [2008-09-20 922192]
«SoundMan»=»SOUNDMAN.EXE» [2007-04-16 c:windowsSOUNDMAN.EXE][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-06-21 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» [2008-06-21 c:windowssystem32advpack.dll]
«IE7_012″=»advpack.dll» [2008-06-21 c:windowssystem32advpack.dll]c:documents and settingsAll Usersѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
Microsoft Office.lnk — c:program filesMicrosoft OfficeOffice10OSA.EXE [2001-02-13 83360][HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)[hkey_local_machinesoftwaremicrosoftwindowscurrentversionexplorerShellExecuteHooks]
«{88485281-8b4b-4f8d-9ede-82e29a064277}»= «c:progra~1MarkAnyCONTEN~1MACSMA~1.DLL» [2004-11-23 192512][HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]
«msacm.ac3filter»= ac3filter.acm[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesDisableNotify»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusDisableNotify»=dword:00000001
«AntiVirusOverride»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«%windir%\system32\lsass.exe»=[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«110:TCP»= 110:TCP:svchostR0 nvcchflt;NVIDIA Disk Cache Filter Driver;c:windowssystem32DRIVERSnvcchflt.sys [2008-10-27 16640]
R0 nvrd32;NVIDIA nForce RAID Driver;c:windowssystem32DRIVERSnvrd32.sys [2008-10-27 116736]
R2 {95808DC4-FA4A-4C74-92FE-5B863F82066B};{95808DC4-FA4A-4C74-92FE-5B863F82066B};??c:program filesCyberLinkPowerDVD000.fcl [2007-09-19 21:37:48 41456]
R2 SPIDER;SpIDer Guard File System Monitor;??c:progra~1DrWebspider.sys [2008-10-27 317624]
R2 SPIDERNT;SpIDer Guard for Windows;c:progra~1DrWebspidernt.exe [2008-10-27 218648]
S3 K320bus;Sony Ericsson K320 driver (WDM);c:windowssystem32DRIVERSK320bus.sys [2008-10-29 61504]
S3 K320mdfl;Sony Ericsson K320 USB WMC Modem Filter;c:windowssystem32DRIVERSK320mdfl.sys [2008-10-29 9328]
S3 K320mdm;Sony Ericsson K320 USB WMC Modem Driver;c:windowssystem32DRIVERSK320mdm.sys [2008-10-29 97056]
S3 K320mgmt;Sony Ericsson K320 USB WMC Device Management Drivers (WDM);c:windowssystem32DRIVERSK320mgmt.sys [2008-10-29 88560]
S3 K320obex;Sony Ericsson K320 USB WMC OBEX Interface;c:windowssystem32DRIVERSK320obex.sys [2008-10-29 86368][HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{67aef12d-a438-11dd-8a4e-000fea0bc92c}]
ShellAutoRuncommand — c:windowssystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL system.exe
ShellExplorecommand — F:system.exe
ShellOpencommand — F:system.exe
.**************************************************************************
catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-27 22:48:57
Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
[HKEY_LOCAL_MACHINESystemControlSet001Services{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
«ImagePath»=»??c:program filesCyberLinkPowerDVD000.fcl»
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(688)
c:windowssystem32SETUPAPI.dll
c:windowssystem32WININET.dll
c:windowssystem32DRWEBSP.DLL
c:windowssystem32Ati2evxx.dll
c:windowssystem32cscui.dll
c:windowssystem32COMRes.dll— — — — — — — > ‘lsass.exe'(744)
c:windowssystem32setupapi.dll
c:windowssystem32DRWEBSP.DLL
.
Other Running Processes
.
c:windowssystem32ati2evxx.exe
c:windowssystem32ati2evxx.exe
c:program filesCommon FilesMicrosoft SharedVS7Debugmdm.exe
c:program filesCyberLinkShared filesRichVideo.exe
c:program filesCommon FilesTeleca SharedCapabilityManager.exe
c:program filesCommon FilesAheadLibNMIndexStoreSvr.exe
c:program filesCommon FilesAheadLibNMIndexingService.exe
c:program filesCommon FilesTeleca SharedGeneric.exe
c:program filesSony EricssonMobile2Mobile Phone Monitorepmworker.exe
.
**************************************************************************
.
Completion time: 2008-11-27 22:52:41 — machine was rebooted
ComboFix-quarantined-files.txt 2008-11-27 19:52:34
ComboFix2.txt 2008-11-27 07:30:33
ComboFix3.txt 2008-11-26 14:12:55Pre-Run: 81 626 132 480 байт свободно
Post-Run: 81,639,186,432 байт свободно342
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:31:52, on 27.11.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20815)
Boot mode: NormalRunning processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesCommon FilesMicrosoft SharedVS7Debugmdm.exe
C:Program FilesCyberLinkShared filesRichVideo.exe
C:PROGRA~1DrWebspidernt.exe
C:WINDOWSSOUNDMAN.EXE
C:Program FilesCyberLinkPowerDVDPDVDServ.exe
C:PROGRA~1DrWebspiderui.exe
C:Program FilesDrWebspiderml.exe
C:Program FilesSamsungSamsung Media Studio 5SMSTray.exe
C:Program FilesMarkAnyContentSaferMAAgent.exe
C:Program FilesMail.RuAgentMAgent.exe
C:Program FilesWebMoney Agentwmagent.exe
C:Program FilesQuickTimeqttask.exe
C:Program FilesAdobePhotoshop Album Starter Edition3.0Appsapdproxy.exe
C:Program FilesAdobeReader 8.0ReaderReader_sl.exe
C:Program FilesSony EricssonMobile2Application LauncherApplication Launcher.exe
C:WINDOWSsystem32ctfmon.exe
C:WINDOWSsystem32wuauclt.exe
C:Program FilesVistaDriveIconVistaDrv.exe
C:Program FilesCommon FilesAheadLibNMBgMonitor.exe
C:Program FilesCommon FilesYandexYupdateyupdate.exe
C:Program FilesDownload Masterdmaster.exe
C:Program FilesCommon FilesTeleca SharedCapabilityManager.exe
C:Program FilesQIPqip.exe
C:Program FilesCommon FilesAheadLibNMIndexStoreSvr.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesCommon FilesAheadLibNMIndexingService.exe
C:Program FilesCommon FilesTeleca SharedGeneric.exe
C:Program FilesSony EricssonMobile2Mobile Phone Monitorepmworker.exe
C:WINDOWSexplorer.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesTrend MicroHijackThisHijackThis.exeR0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.yandex.ru/?clid=40316
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKCUSoftwareMicrosoftInternet Connection Wizard,ShellNext = http://www.yandex.ru/
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O2 — BHO: (no name) — {33D2056E-E8D5-444B-ADC5-2169139B74F9} — C:PROGRA~1IEPOPU~1IEPOPU~1.DLL
O2 — BHO: SSVHelper Class — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — C:Program FilesJavajre1.6.0_06binssv.dll
O2 — BHO: Спутник@Mail.Ru — {8984B388-A5BB-4DF7-B274-77B879E179DB} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O2 — BHO: IE 4.x-6.x BHO for Download Master — {9961627E-4059-41B4-8E0E-A7D6B3854ADF} — C:PROGRA~1DOWNLO~1dmiehlp.dll
O2 — BHO: TBSB03223 — {B4806C1A-FE8A-4008-9DA3-8CEDB6E82C10} — C:Program FilesWebMoney Advisorwmadvisor.dll
O3 — Toolbar: Яндекс.Бар — {91397D20-1446-11D4-8AF4-0040CA1127B6} — C:Program FilesYandexYandexBarIEyndbar.dll
O3 — Toolbar: DM Bar — {0E1230F8-EA50-42A9-983C-D22ABC2EED3C} — C:Program FilesDownload Masterdmbar.dll
O3 — Toolbar: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O3 — Toolbar: WebMoney Advisor — {3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — C:Program FilesWebMoney Advisorwmadvisor.dll
O3 — Toolbar: TextAloud — {F053C368-5458-45B2-9B4D-D8914BDDDBFF} — C:PROGRA~1TEXTAL~1TAForIE.dll
O3 — Toolbar: IEPopUpControl — {0D1C019E-129F-4466-A176-CEA7F86A1FE8} — C:PROGRA~1IEPOPU~1IEPOPU~1.DLL
O4 — HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 — HKLM..Run: [RemoteControl] «C:Program FilesCyberLinkPowerDVDPDVDServ.exe»
O4 — HKLM..Run: [LanguageShortcut] «C:Program FilesCyberLinkPowerDVDLanguageLanguage.exe»
O4 — HKLM..Run: [SpIDerNT] C:PROGRA~1DrWebspiderui.exe /agent
O4 — HKLM..Run: [SpIDerMail] «C:Program FilesDrWebspiderml.exe»
O4 — HKLM..Run: [NeroFilterCheck] C:Program FilesCommon FilesAheadLibNeroCheck.exe
O4 — HKLM..Run: [SMSTray] C:Program FilesSamsungSamsung Media Studio 5SMSTray.exe
O4 — HKLM..Run: [MAAgent] C:Program FilesMarkAnyContentSaferMAAgent.exe
O4 — HKLM..Run: [MAgent] C:Program FilesMail.RuAgentMAgent.exe -LM
O4 — HKLM..Run: [wmagent.exe] «C:Program FilesWebMoney Agentwmagent.exe»
O4 — HKLM..Run: [QuickTime Task] «C:Program FilesQuickTimeqttask.exe» -atboottime
O4 — HKLM..Run: [Adobe Photo Downloader] «C:Program FilesAdobePhotoshop Album Starter Edition3.0Appsapdproxy.exe»
O4 — HKLM..Run: [Adobe Reader Speed Launcher] «C:Program FilesAdobeReader 8.0ReaderReader_sl.exe»
O4 — HKLM..Run: [Sony Ericsson PC Suite] «C:Program FilesSony EricssonMobile2Application LauncherApplication Launcher.exe» /startoptions
O4 — HKLM..Run: [TrojanScanner] C:Program FilesTrojan RemoverTrjscan.exe /boot
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe
O4 — HKCU..Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] «C:Program FilesCommon FilesAheadLibNMBgMonitor.exe»
O4 — HKCU..Run: [Yupdate!] «C:Program FilesCommon FilesYandexYupdateyupdate.exe»
O4 — HKCU..Run: [Download Master] C:Program FilesDownload Masterdmaster.exe -autorun
O4 — HKCU..Run: [QIP2005] C:Program FilesQIPqip.exe
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,NewUserFirstLogonInstall,0 (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — HKUS.DEFAULT..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,NewUserFirstLogonInstall,0 (User ‘Default user’)
O4 — Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOffice10OSA.EXE
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~1Office10EXCEL.EXE/3000
O8 — Extra context menu item: Закачать ВСЕ при помощи Download Master — C:Program FilesDownload Masterdmieall.htm
O8 — Extra context menu item: Закачать при помощи Download Master — C:Program FilesDownload Masterdmie.htm
O8 — Extra context menu item: Найти в интернете — res://C:Program FilesMail.RuSputnikMailRuSputnik.dll/282
O8 — Extra context menu item: Найти в словарях — res://C:Program FilesMail.RuSputnikMailRuSputnik.dll/283
O9 — Extra button: (no name) — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_06binssv.dll
O9 — Extra ‘Tools’ menuitem: Sun Java Console — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_06binssv.dll
O9 — Extra button: WebMoney Advisor — {3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — C:Program FilesWebMoney Advisorwmadvisor.dll
O9 — Extra ‘Tools’ menuitem: WebMoney Advisor — {3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — C:Program FilesWebMoney Advisorwmadvisor.dll
O9 — Extra button: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra ‘Tools’ menuitem: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra button: Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
O9 — Extra ‘Tools’ menuitem: &Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
O9 — Extra button: Отправить SMS — {9787C789-65F9-4291-A2DE-BE288D933EE3} — http://sms.start-page.ru/smsfromie.html (file missing)
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O17 — HKLMSystemCCSServicesTcpip..{DB7ECE15-A764-4177-9E2D-9CB42EC4B80A}: NameServer = 88.147.128.17 88.147.129.15
O20 — Winlogon Notify: reset5c — C:WINDOWSSYSTEM32reset5c.dll
O23 — Service: Ati HotKey Poller — ATI Technologies Inc. — C:WINDOWSsystem32Ati2evxx.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: InstallDriver Table Manager (IDriverT) — Macrovision Corporation — C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: NBService — Nero AG — C:Program FilesNeroNero 7Nero BackItUpNBService.exe
O23 — Service: NMIndexingService — Nero AG — C:Program FilesCommon FilesAheadLibNMIndexingService.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Cyberlink RichVideo Service(CRVS) (RichVideo) — Unknown owner — C:Program FilesCyberLinkShared filesRichVideo.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: SpIDer Guard for Windows (SPIDERNT) — Doctor Web, Ltd. — C:PROGRA~1DrWebspidernt.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe—
End of file — 10587 bytesСпасибо большое! Информер пропал! 😀
ComboFix 08-11-26.05 — Admin 2008-11-27 10:22:27.2 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.1.1049.18.531 [GMT 3:00]
Running from: c:downloadsПрограммыComboFix.exe
* Created a new restore pointWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.c:documents and settingsAdminLocal SettingsTemporary Internet Files0EB9F12C_6E6B_4c03_AEBA_8C04CFA98AA4.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files15913497_F86C_4218_8817_F50940D1E1B2.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files29887DDE_00B9_4011_9CF7_59511F1ECC1B.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files2A665EDD_5758_480c_8366_66DFC5F23877.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files35B7DFFA_884F_4fbc_8E60_DA601BDC7BF7.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files362FD6E8_8CDA_4c2a_A8AA-BDA22B321711.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet Files3DF04940_9866_4241_A998_0CDDFAFD147A.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files426500D7_0FF3_426c_828D_065DBAEA0581.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files478BD4AE_2691_438d_BDCA_3485DC022700.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files5C6C645F_BAA8_4149_BFEB_2031230FF0FD.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files61EA7D69_19D4_421a_A899_0DF4D58CD119.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet Files777FDAFB_83CF_4960_AA71_4E5D7BCD8E57.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files8DA878D5_E80B_4721_B75A_17EFFAF1A700.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files98F6DF79_7171_452d_9C26_C0193E12DBDF.gif
c:documents and settingsAdminLocal SettingsTemporary Internet FilesA2B240D6_0386_419e_91C5_3F7D90437CD0.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet FilesC75CEF8D_5AF4_4563_8594_C45A45E14E63.gif
c:documents and settingsAdminLocal SettingsTemporary Internet FilesE21285C1_40E6_435c_A69F_3387E7BD89CB.gif
c:documents and settingsAdminLocal SettingsTemporary Internet FilesE9A4D648_ED73_4ea7_88B2_18332DBA4F3E.jpg
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr0.dat
c:documents and settingsAll UsersApplication DataMicrosoftNetworkDownloaderqmgr1.dat
c:windowssystem32configsystemprofileLocal SettingsTemporary Internet Files0EB9F12C_6E6B_4c03_AEBA_8C04CFA98AA4.gif
c:windowssystem32configsystemprofileLocal SettingsTemporary Internet Files15913497_F86C_4218_8817_F50940D1E1B2.gif
c:windowssystem32configsystemprofileLocal SettingsTemporary Internet Files29887DDE_00B9_4011_9CF7_59511F1ECC1B.gif
c:windowssystem32configsystemprofileLocal SettingsTemporary Internet Files2A665EDD_5758_480c_8366_66DFC5F23877.gif
c:windowssystem32configsystemprofileLocal SettingsTemporary Internet Files35B7DFFA_884F_4fbc_8E60_DA601BDC7BF7.gif
c:windowssystem32configsystemprofileLocal SettingsTemporary Internet Files362FD6E8_8CDA_4c2a_A8AA-BDA22B321711.jpg
c:windowssystem32configsystemprofileLocal SettingsTemporary Internet Files3DF04940_9866_4241_A998_0CDDFAFD147A.gif
c:windowssystem32configsystemprofileLocal SettingsTemporary Internet Files426500D7_0FF3_426c_828D_065DBAEA0581.gif
c:windowssystem32configsystemprofileLocal SettingsTemporary Internet Files478BD4AE_2691_438d_BDCA_3485DC022700.gif
c:windowssystem32configsystemprofileLocal SettingsTemporary Internet Files5C6C645F_BAA8_4149_BFEB_2031230FF0FD.gif
c:windowssystem32configsystemprofileLocal SettingsTemporary Internet Files61EA7D69_19D4_421a_A899_0DF4D58CD119.jpg
c:windowssystem32configsystemprofileLocal SettingsTemporary Internet Files777FDAFB_83CF_4960_AA71_4E5D7BCD8E57.gif
c:windowssystem32configsystemprofileLocal SettingsTemporary Internet Files8DA878D5_E80B_4721_B75A_17EFFAF1A700.gif
c:windowssystem32configsystemprofileLocal SettingsTemporary Internet Files98F6DF79_7171_452d_9C26_C0193E12DBDF.gif
c:windowssystem32configsystemprofileLocal SettingsTemporary Internet FilesA2B240D6_0386_419e_91C5_3F7D90437CD0.jpg
c:windowssystem32configsystemprofileLocal SettingsTemporary Internet FilesC75CEF8D_5AF4_4563_8594_C45A45E14E63.gif
c:windowssystem32configsystemprofileLocal SettingsTemporary Internet FilesE21285C1_40E6_435c_A69F_3387E7BD89CB.gif
c:windowssystem32configsystemprofileLocal SettingsTemporary Internet FilesE9A4D648_ED73_4ea7_88B2_18332DBA4F3E.jpg
c:windowssystem32driverszfrnrvrv.sys
BITS: Possible infected sites
hxxp://www.telexexchange.net
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
Legacy_ZFRNRVRV
Service_zfrnrvrv((((((((((((((((((((((((( Files Created from 2008-10-27 to 2008-11-27 )))))))))))))))))))))))))))))))
.2008-11-27 10:26 . 8,672 c:windowssystem32driverssfc.sys
2008-11-27 10:09 . 2008-11-27 10:09d
c:documents and settingsAdminApplication DataApple Computer
2008-11-27 10:09 . 2008-11-27 10:09 54,156 —ah
c:windowsQTFont.qfn
2008-11-27 10:09 . 2008-11-27 10:09 1,409 —a
c:windowsQTFont.for
2008-11-26 13:41 . 2008-11-26 13:41d
C:rsit
2008-11-26 13:24 . 2008-11-26 13:24d
c:program filesTrend Micro
2008-11-26 00:00 . 2008-11-26 00:00 70,144 —a
c:windowssystem32sbin.exe
2008-11-25 23:41 . 2008-11-27 10:14 32,768 —a
c:windowssystem32driversati7hnxx.sys
2008-11-25 23:08 . 2008-11-25 23:08 448,000 —a
c:windowssystem32ntos.exe.vir
2008-11-25 23:08 . 2008-11-25 23:08 32,768 —a
c:windowssystem32driversati5pwxx.sys.vir
2008-11-25 22:58 . 2008-11-25 22:59d
c:program filesTrojan Remover
2008-11-25 22:58 . 2008-11-25 22:58d
c:documents and settingsAll UsersApplication DataSimply Super Software
2008-11-25 22:58 . 2008-11-25 22:58d
c:documents and settingsAdminApplication DataSimply Super Software
2008-11-25 22:58 . 2006-05-25 15:52 162,304 —a
c:windowssystem32ztvunrar36.dll
2008-11-25 22:58 . 2003-02-02 20:06 153,088 —a
c:windowssystem32UNRAR3.dll
2008-11-25 22:58 . 2005-08-26 01:50 77,312 —a
c:windowssystem32ztvunace26.dll
2008-11-25 22:58 . 2002-03-06 01:00 75,264 —a
c:windowssystem32unacev2.dll
2008-11-25 22:58 . 2006-06-19 13:01 69,632 —a
c:windowssystem32ztvcabinet.dll
2008-11-25 22:21 . 2008-11-25 22:21 237 —a
c:windowssystem32$$$$$$$$.bat
2008-11-25 21:42 . 2008-11-25 21:51 0 —ah
c:windowssystem32BITD6.tmp
2008-11-25 10:59 . 2008-11-26 02:13d
c:program filesКнига Солнца
2008-11-23 19:31 . 2008-11-23 19:31d
c:documents and settingsAdminApplication Datavlc
2008-11-23 11:16 . 2008-11-23 11:19d
c:program filesVinegret
2008-11-22 14:11 . 2008-11-22 14:11d
c:documents and settingsAdminApplication DataArtogon
2008-11-22 14:06 . 2008-11-22 14:06d
c:program filesTreasure_Seekers
2008-11-22 00:45 . 2008-11-22 00:45 80,384 —a
c:windowswinnt32_modul.dll
2008-11-21 22:28 . 2008-11-21 22:28 29 —a
c:windowssystem32sqdiwauf.tmp
2008-11-21 15:56 . 2008-11-21 15:56 327,680 —a
c:windowssystem32fbilib.dll
2008-11-21 13:40 . 2008-11-21 13:40 23,552 —a
c:windowssystem32msvcrt57.dll
2008-11-20 18:03 . 2008-11-20 18:04d
c:program filesIEPopUpControl
2008-11-20 18:02 . 2008-11-20 18:02d
c:program filesMyCentria
2008-11-20 17:37 . 2008-11-20 17:37d
c:documents and settingsAdminApplication DataCyberLink
2008-11-20 16:55 . 2008-11-20 16:57d
c:program filesSMS from IE
2008-11-20 13:53 . 2008-11-20 13:53d
c:program filesReadon Technology
2008-11-20 09:36 . 2008-11-20 09:36 80,384 —a
c:windowswinnt32_video.dll
2008-11-19 19:18 . 2008-11-19 19:18 330,240 —a
c:windowssystem32qyklib.dll
2008-11-19 14:26 . 2008-11-19 14:26 328,704 —a
c:windowssystem32tprlib.dll
2008-11-19 10:46 . 2008-11-19 11:06d
c:program filesЭлитрил. Сокровище эльфов
2008-11-18 13:26 . 2008-11-18 13:27d
C:Hopeland
2008-11-18 11:46 . 2008-11-18 11:46d
c:program filesFashionista
2008-11-13 20:16 . 2008-11-13 20:16 60,416 —a
c:windowssystem32csrss7.dll
2008-11-13 12:54 . 2008-11-13 12:54d—hs—- c:windowsftpcache
2008-11-13 12:54 . 2008-11-13 12:54d
c:documents and settingsAll UsersApplication DataRedrum
2008-11-13 12:51 . 2008-11-13 12:51d
c:program filesRedrum — Dead Diary
2008-11-12 10:16 . 2008-11-12 12:37d
c:program filesЮвелир
2008-11-10 16:18 . 2008-11-10 16:18 3,612,461 —a
c:windowssystem32Caribbean Nights.scr
2008-11-10 15:54 . 2008-11-10 15:54d
c:windowssystem32Lang
2008-11-10 15:54 . 2008-11-10 15:54 940,794 —a
c:windowssystem32LoopyMusic.wav
2008-11-10 15:54 . 2008-11-10 15:54 146,650 —a
c:windowssystem32BuzzingBee.wav
2008-11-09 19:21 . 2008-11-09 19:21d
c:program filesNextUp-ScanSoft
2008-11-09 19:18 . 2008-11-20 16:56d
c:program filesTextAloud
2008-11-09 15:52 . 2008-11-09 15:52d
c:windowsTranscend JetFlash Recovery Tool
2008-11-09 15:52 . 2008-11-09 15:52d
c:program filesTranscend JetFlash Recovery Tool
2008-11-09 14:10 . 2008-11-09 14:10d
c:program filesMystic Inn
2008-11-09 11:48 . 2008-11-09 11:48d
c:documents and settingsAll UsersApplication DataPlayFirst
2008-11-09 11:48 . 2008-11-09 11:48d
c:documents and settingsAdminApplication DataPlayFirst
2008-11-09 11:15 . 2008-11-09 11:15d
c:program filesDream Chronicles
2008-11-09 10:29 . 2008-11-09 10:29d
c:program filesCommon FilesTeleca Shared
2008-11-09 10:29 . 2008-11-09 10:29d
c:documents and settingsAll UsersDocuments
2008-11-09 10:29 . 2008-11-09 10:29d
c:documents and settingsAll UsersApplication DataTeleca
2008-11-09 10:29 . 2008-11-09 10:29d
c:documents and settingsAll UsersApplication DataSony Ericsson
2008-11-08 22:09 . 2008-11-08 22:09d
c:documents and settingsAdminApplication DataLeadertech
2008-11-08 18:32 . 2008-11-08 18:32d
c:documents and settingsAdminApplication DataAshampoo
2008-11-08 18:31 . 2008-11-08 18:31d
c:program filesAshampoo
2008-11-08 18:31 . 2008-11-08 18:31d
c:documents and settingsAll UsersApplication Dataashampoo
2008-11-08 08:44 . 2008-11-08 08:44d
c:documents and settingsAll UsersApplication DataValusoft
2008-11-08 08:44 . 2008-11-08 08:44d
c:documents and settingsAdminApplication DataValusoft
2008-11-07 17:02 . 2008-11-07 17:02d
c:program filesHot_Dish
2008-11-07 15:49 . 2008-11-07 15:49d
c:program filesIlya-Muromets
2008-11-07 15:44 . 2008-11-07 15:44 4,096 —a
c:windowsd3dx.dat
2008-11-07 14:29 . 2008-11-07 14:30d
c:program filesKudos_Rock_Legend
2008-11-07 12:19 . 2008-11-07 12:20d
c:program filesЭнциклопедия пасьянсов
2008-11-07 11:41 . 2008-11-08 08:44d
c:program filesE2
2008-11-07 11:22 . 2008-11-07 11:22d
c:program files10 Talismans
2008-11-07 10:15 . 2008-11-07 10:15d
c:documents and settingsAll UsersApplication DataAlawar Stargaze
2008-11-07 10:14 . 2008-11-07 10:14d
c:program filesМодный сезон
2008-11-06 18:24 . 2008-11-06 18:24d
c:documents and settingsAdminApplication DataWebMoney
2008-11-05 09:36 . 2008-11-05 12:24d
c:program filesЭлектра
2008-11-05 09:30 . 2008-11-05 09:43d
c:program filesФото мания
2008-11-04 22:33 . 2008-11-04 22:34d
c:program filesNufsoft
2008-11-04 22:15 . 2008-11-04 22:19d
c:program filesФотоДЕКОР
2008-11-03 00:01 . 2008-11-03 00:02d
c:program filesMusaic Box
2008-11-02 21:52 . 2008-11-02 21:52d
c:program filesPixarra
2008-11-02 19:05 . 2008-11-02 19:11d
c:documents and settingsAdminApplication DataSecretIslandRus
2008-11-02 19:01 . 2008-11-02 19:03d
c:program filesTheTreasuresOfMysteryIsland_Rus
2008-11-02 14:02 . 2008-11-02 14:02d
c:program filesSimPE
2008-10-31 22:54 . 2008-11-23 19:16 10 —a
c:windowspopcinfo.dat
2008-10-31 22:17 . 2008-11-04 20:57d
c:documents and settingsAdminApplication DataAdobeUM
2008-10-31 22:17 . 2008-10-31 22:17d
c:documents and settingsAdminApplication DataAdobeAUM
2008-10-31 18:24 . 2008-11-01 07:50d
c:program filesSims2Pack Clean Installer
2008-10-31 18:24 . 2008-11-03 19:18d
c:program filesSims 2 Categorizer
2008-10-31 18:24 . 2008-10-31 18:24 249,856
c:windowsSetup1.exe
2008-10-31 18:24 . 2008-10-31 18:24 73,216 —a
c:windowsST6UNST.EXE
2008-10-31 18:12 . 2008-10-31 18:12 631,305 —a
c:windowsunins000.exe
2008-10-31 18:12 . 2008-10-31 18:12 2,615 —a
c:windowsunins000.dat
2008-10-31 14:01 . 2008-10-31 19:08d
c:program filesZuma Deluxe
2008-10-29 23:27 . 2008-10-29 23:27d
c:program filesDisc2Phone
2008-10-29 23:25 . 2008-10-29 23:27d
c:program filesQuickTime
2008-10-29 23:25 . 2008-10-29 23:25d
c:documents and settingsAll UsersApplication DataApple Computer
2008-10-29 23:23 . 2008-11-09 13:24d
c:documents and settingsAdminApplication DataTeleca
2008-10-29 23:23 . 2008-10-29 23:23d
c:documents and settingsAdminApplication DataSony Ericsson
2008-10-29 23:23 . 2006-08-18 12:10 97,056 -ra
c:windowssystem32driversK320mdm.sys
2008-10-29 23:23 . 2006-08-18 12:10 9,328 -ra
c:windowssystem32driversK320mdfl.sys
2008-10-29 23:22 . 2006-08-18 11:10 88,560 -ra
c:windowssystem32driversK320mgmt.sys
2008-10-29 23:22 . 2006-08-18 11:10 86,368 -ra
c:windowssystem32driversK320obex.sys
2008-10-29 23:22 . 2006-08-18 11:10 61,504 -ra
c:windowssystem32driversK320bus.sys
2008-10-29 23:22 . 2006-08-18 12:10 6,208 -ra
c:windowssystem32driversK320cmnt.sys
2008-10-29 23:22 . 2006-08-18 12:10 6,208 -ra
c:windowssystem32driversK320cm.sys
2008-10-29 23:22 . 2006-08-18 11:10 5,840 -ra
c:windowssystem32driversK320whnt.sys
2008-10-29 23:22 . 2006-08-18 11:10 5,840 -ra
c:windowssystem32driversK320wh.sys
2008-10-29 23:21 . 2008-10-29 23:22d—-c— c:windowssystem32DRVSTORE
2008-10-29 23:20 . 2008-10-29 23:20d
c:program filesSony Ericsson
2008-10-29 23:19 . 2008-10-29 23:19d
c:windowsDownloaded Installations
2008-10-29 10:51 . 2008-10-29 10:51d
c:documents and settingsAdminApplication Datacr3
2008-10-29 10:28 . 2008-10-29 10:28d
c:program filesBookReader
2008-10-29 08:32 . 2008-11-01 19:20 20,568 —a
c:documents and settingsAdminApplication DataGDIPFONTCACHEV1.DAT
2008-10-29 07:30 . 2008-04-15 15:00 8,704 —a
c:windowssystem32reset5c.dll
2008-10-29 00:36 . 2008-10-29 00:36d
c:program filesEA GAMES
2008-10-28 20:06 . 2008-10-28 20:06d
c:documents and settingsAdminApplication DataGames
2008-10-28 19:18 . 2008-10-28 19:18d
c:program filesSherlock_Holmes_The_Mystery_Of_The_Persian_Carpet
2008-10-28 15:12 . 2008-10-28 15:12d
c:windowsSun
2008-10-28 14:48 . 2008-10-28 14:48d
c:program filesWinDjView
2008-10-28 14:21 . 2008-10-28 14:21d
C:8332eebaf65650fc7b9a3e49
2008-10-28 14:13 . 2008-10-28 14:13d
C:b75caa556faf7701dac7fac5933ecc4a
2008-10-28 14:13 . 2008-10-28 14:13dr-h
C:AHCache.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-19 08:06
d
w c:program filesЭлитрил. Сокровище эльфов
2008-11-07 09:20
d
w c:program filesЭнциклопедия пасьянсов
2008-11-05 09:24
d
w c:program filesЭлектра
2008-10-27 10:06 717,296 —-a-w c:windowssystem32driverssptd.sys
2008-10-27 10:06
d
w c:program filesVistaDriveIcon
2008-10-27 10:06
d
w c:program filesJava
2008-10-27 10:06
d
w c:program filesCommon FilesJava
2008-10-27 09:59
d
w c:program filesWindows Media Connect 2
2008-10-27 09:59
d
w c:program filesPaint.NET
.
Sigcheck
2008-06-21 07:49 579072 23b7d3f3f5ec8feea75ec381c71cbd5e c:windowssystem32user32.dll2008-06-21 07:49 952320 61504a92b0fde8bf5ec7356ed104d78e c:windowssystem32wininet.dll
2008-06-21 07:45 361344 030dc4d48cc2b894fee2f390d8e66ad5 c:windowssystem32driverstcpip.sys
2008-06-21 07:47 1721344 dbe9bb4018832ed71bc288b2a38f225b c:windowsexplorer.exe
2008-06-21 07:47 30208 53db04aa692f9e906e46127ab7e83252 c:windowssystem32ctfmon.exe
2008-06-21 07:49 80728 d1e6ff38ad08a56d55a422d3d08df22d c:windowssystem32wuauclt.exe
.
((((((((((((((((((((((((((((( snapshot@2008-11-26_17.11.58.45 )))))))))))))))))))))))))))))))))))))))))
.
— 2008-11-26 14:08:38 49,152 —sha-w c:windowssystem32configsystemprofileCookiesindex.dat
+ 2008-11-27 07:26:06 49,152 —sha-w c:windowssystem32configsystemprofileCookiesindex.dat
— 2008-11-26 14:08:38 311,296 —sha-w c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5index.dat
+ 2008-11-27 07:26:06 311,296 —sha-w c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5index.dat
— 2008-11-26 08:10:02 49,152 —sha-w c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5MSHist012008112620081127index.dat
+ 2008-11-26 14:46:38 49,152 —sha-w c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5MSHist012008112620081127index.dat
+ 2008-11-27 07:21:30 32,768 —sha-w c:windowssystem32configsystemprofileLocal SettingsHistoryHistory.IE5MSHist012008112720081128index.dat
— 2008-11-26 14:08:38 1,359,872 —sha-w c:windowssystem32configsystemprofileLocal SettingsTemporary Internet FilesContent.IE5index.dat
+ 2008-11-27 07:26:06 1,359,872 —sha-w c:windowssystem32configsystemprofileLocal SettingsTemporary Internet FilesContent.IE5index.dat
+ 2008-06-21 08:28:10 83,072 —-a-w c:windowssystem32driverswdmaud.sys
+ 2008-04-15 12:00:00 4,352 —-a-w c:windowssystem32driverswmilib.sys
+ 2008-03-02 11:45:40 38,528 —-a-w c:windowssystem32driverswpdusb.sys
+ 2008-04-15 12:00:00 12,032 —-a-w c:windowssystem32driversws2ifsl.sys
+ 2008-03-02 11:45:40 77,568 —-a-w c:windowssystem32driverswudfpf.sys
+ 2008-03-02 11:45:40 82,944 —-a-w c:windowssystem32driverswudfrd.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]
«{83821C2B-32A8-4DD7-B6D4-44309A78E668}»= «c:program filesMail.RuAgentMradllnewmrasearch.dll» [2008-10-28 79352][HKEY_CLASSES_ROOTclsid{83821c2b-32a8-4dd7-b6d4-44309a78e668}]
[HKEY_LOCAL_MACHINE~Browser Helper Objects{B4806C1A-FE8A-4008-9DA3-8CEDB6E82C10}]
2008-09-05 15:42 2409472 —a
c:program filesWebMoney Advisorwmadvisor.dll[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2008-10-16 1578248]
«{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}»= «c:program filesWebMoney Advisorwmadvisor.dll» [2008-09-05 2409472][HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
«{91397D20-1446-11D4-8AF4-0040CA1127B6}»= «c:program filesYandexYandexBarIEyndbar.dll» [2008-10-16 1578248]
«{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}»= «c:program filesWebMoney Advisorwmadvisor.dll» [2008-09-05 2409472][HKEY_CLASSES_ROOTclsid{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOTYandex.Toolbar.1]
[HKEY_CLASSES_ROOTTypeLib{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOTYandex.Toolbar][HKEY_CLASSES_ROOTclsid{3affd7f7-fd3d-4c9d-8f83-03296a1a8840}]
[HKEY_CLASSES_ROOTTBSB03223.TBSB03223.3]
[HKEY_CLASSES_ROOTTypeLib{77AA25E8-6083-4949-A831-9CB11861DC10}]
[HKEY_CLASSES_ROOTTBSB03223.TBSB03223][HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2008-06-21 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
«BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=»c:program filesCommon FilesAheadLibNMBgMonitor.exe» [2007-01-15 147456]
«Yupdate!»=»c:program filesCommon FilesYandexYupdateyupdate.exe» [2008-09-01 479496]
«Download Master»=»c:program filesDownload Masterdmaster.exe» [2008-09-17 3294720]
«QIP2005″=»c:program filesQIPqip.exe» [2008-07-01 3256320][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«RemoteControl»=»c:program filesCyberLinkPowerDVDPDVDServ.exe» [2007-03-14 71216]
«LanguageShortcut»=»c:program filesCyberLinkPowerDVDLanguageLanguage.exe» [2007-03-14 54832]
«SpIDerNT»=»c:progra~1DrWebspiderui.exe» [2007-09-19 214552]
«SpIDerMail»=»c:program filesDrWebspiderml.exe» [2007-09-19 361712]
«NeroFilterCheck»=»c:program filesCommon FilesAheadLibNeroCheck.exe» [2006-01-12 155648]
«SMSTray»=»c:program filesSamsungSamsung Media Studio 5SMSTray.exe» [2007-09-20 132624]
«MAAgent»=»c:program filesMarkAnyContentSaferMAAgent.exe» [2007-01-30 57344]
«MAgent»=»c:program filesMail.RuAgentMAgent.exe» [2008-10-28 4412920]
«wmagent.exe»=»c:program filesWebMoney Agentwmagent.exe» [2008-10-01 209376]
«QuickTime Task»=»c:program filesQuickTimeqttask.exe» [2008-10-29 155648]
«Adobe Photo Downloader»=»c:program filesAdobePhotoshop Album Starter Edition3.0Appsapdproxy.exe» [2005-06-06 57344]
«Adobe Reader Speed Launcher»=»c:program filesAdobeReader 8.0ReaderReader_sl.exe» [2008-01-11 39792]
«Sony Ericsson PC Suite»=»c:program filesSony EricssonMobile2Application LauncherApplication Launcher.exe» [2005-10-26 159744]
«TrojanScanner»=»c:program filesTrojan RemoverTrjscan.exe» [2008-09-20 922192]
«SoundMan»=»SOUNDMAN.EXE» [2007-04-16 c:windowsSOUNDMAN.EXE][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-06-21 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» [2008-06-21 c:windowssystem32advpack.dll]
«IE7_012″=»advpack.dll» [2008-06-21 c:windowssystem32advpack.dll]c:documents and settingsAll Usersѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
Microsoft Office.lnk — c:program filesMicrosoft OfficeOffice10OSA.EXE [2001-02-13 83360][HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)[hkey_local_machinesoftwaremicrosoftwindowscurrentversionexplorerShellExecuteHooks]
«{88485281-8b4b-4f8d-9ede-82e29a064277}»= «c:progra~1MarkAnyCONTEN~1MACSMA~1.DLL» [2004-11-23 192512][HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotifyreset5c]
2008-04-15 15:00 8704 c:windowssystem32reset5c.dll[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]
«msacm.ac3filter»= ac3filter.acm[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalati7hnxx.sys]
@=»Driver»[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesDisableNotify»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusDisableNotify»=dword:00000001
«AntiVirusOverride»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«%windir%\system32\lsass.exe»=[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«110:TCP»= 110:TCP:svchostR0 ati7hnxx;ati7hnxx;c:windowssystem32Driversati7hnxx.sys [2008-11-25 32768]
R0 nvcchflt;NVIDIA Disk Cache Filter Driver;c:windowssystem32DRIVERSnvcchflt.sys [2008-10-27 16640]
R0 nvrd32;NVIDIA nForce RAID Driver;c:windowssystem32DRIVERSnvrd32.sys [2008-10-27 116736]
R2 {95808DC4-FA4A-4C74-92FE-5B863F82066B};{95808DC4-FA4A-4C74-92FE-5B863F82066B};??c:program filesCyberLinkPowerDVD000.fcl [2007-09-19 21:37:48 41456]
R2 SPIDER;SpIDer Guard File System Monitor;??c:progra~1DrWebspider.sys [2008-10-27 317624]
R2 SPIDERNT;SpIDer Guard for Windows;c:progra~1DrWebspidernt.exe [2008-10-27 218648]
S0 ati5pwxx;ati5pwxx; []
S3 K320bus;Sony Ericsson K320 driver (WDM);c:windowssystem32DRIVERSK320bus.sys [2008-10-29 61504]
S3 K320mdfl;Sony Ericsson K320 USB WMC Modem Filter;c:windowssystem32DRIVERSK320mdfl.sys [2008-10-29 9328]
S3 K320mdm;Sony Ericsson K320 USB WMC Modem Driver;c:windowssystem32DRIVERSK320mdm.sys [2008-10-29 97056]
S3 K320mgmt;Sony Ericsson K320 USB WMC Device Management Drivers (WDM);c:windowssystem32DRIVERSK320mgmt.sys [2008-10-29 88560]
S3 K320obex;Sony Ericsson K320 USB WMC OBEX Interface;c:windowssystem32DRIVERSK320obex.sys [2008-10-29 86368][HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{6ce6a8cc-ad63-11dd-8a67-000fea0bc92c}]
ShellAutoRuncommand — c:windowssystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL system.exe
ShellExplorecommand — F:system.exe
ShellOpencommand — F:system.exe
.**************************************************************************
catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-27 10:26:24
Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
[HKEY_LOCAL_MACHINESystemControlSet001Services{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
«ImagePath»=»??c:program filesCyberLinkPowerDVD000.fcl»
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(700)
c:windowssystem32SETUPAPI.dll
c:windowssystem32WININET.dll
c:windowssystem32DRWEBSP.DLL
c:windowssystem32Ati2evxx.dll
c:windowssystem32cscui.dll
c:windowssystem32reset5c.dll
c:windowssystem32COMRes.dll— — — — — — — > ‘lsass.exe'(760)
c:windowssystem32SETUPAPI.dll
c:windowssystem32reset5c.dll
c:windowssystem32DRWEBSP.DLL
.
Other Running Processes
.
c:windowssystem32ati2evxx.exe
c:windowssystem32ati2evxx.exe
c:program filesCommon FilesMicrosoft SharedVS7Debugmdm.exe
c:program filesCyberLinkShared filesRichVideo.exe
c:program filesCommon FilesTeleca SharedCapabilityManager.exe
c:program filesCommon FilesAheadLibNMIndexStoreSvr.exe
c:program filesCommon FilesAheadLibNMIndexingService.exe
c:program filesCommon FilesTeleca SharedGeneric.exe
c:program filesSony EricssonMobile2Mobile Phone Monitorepmworker.exe
c:windowssystem32verclsid.exe
.
**************************************************************************
.
Completion time: 2008-11-27 10:30:31 — machine was rebooted
ComboFix-quarantined-files.txt 2008-11-27 07:30:25
ComboFix2.txt 2008-11-26 14:12:55Pre-Run: 81 777 278 976 байт свободно
Post-Run: 81,765,027,840 байт свободно366
