Код:
ComboFix 10-10-16.04 - Admin 17.10.2010 19:48:54.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.2046.1647 [GMT 4:00]
Running from: c:\documents and settings\Admin\Рабочий стол\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\All Users\Application Data\Toolbar4
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\001a0a59473174c31c40007d7eec9744
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\00212e80e56aa9f5e9bf92c08e0bfacf
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\02a42f445a2980f30fcf7a2b7b0ca058
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\05f68ba8e78a892bbbcf23713976459d
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\098b2353f7950bfd8d35044f4b970c42
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\0b698c6db55fa249842de64c200c0e12
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\0c515ff72a6b73d020930ca1924a8541
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\132bb01bdb60b95f46fad4da47dc5b6e
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\141c12791b9bd455bac3a591653675c1
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\1946d09c9a458c7f66903739548f3661
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\1a3b264daf44fff3f6d1da52668032e1
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\1ac89e1b64ffd626ee7ace6fd9389d0e
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\1ef9ce091c3bae18a3df07507e414291
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\1fdf0c27d8d52a04ce6f3f756f59e6da
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\2004232e741bb7b6e11b1a89272548e3
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\20e984a52b9c80df9990b591c47a817a
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\26652e164d5672539bced3d4eabd0e0f
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\277cd95898f97fdb6dc7938bcc69afa8
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\27f08a3599914602d3ed71c68a23d398
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\297071523d240f3f7ec15736e0f4af2f
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\29d3d1cc38e71f054cf43126c6212895
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\2b658237acc53354c200631f3a55366b
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\2cb0ab3021e5227d4d32f2020f242926
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\2ceddc7fc61a890d23f76d474b4e99ae
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\2dc031e07800cc4d77c7532b4b8c5919
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\31864fada7f854befd32c2a232b11c12
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\3316d2eb0e880964bf8deedb5212ff17
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\348b7b10457cac2718565dd45cd7b78c
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\371e233b760cfadd8ada478f56f21f6c
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\388273f8f4b5fad1c47a22fc640878c0
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\3bee88953d615d308e221109ed703048
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\3d4a03ee687a5d895bc84069026e7968
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\427df20945c5abc5cd17c4df1f433132
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\436cbc825df34f535334d5d1a5aefb99
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\471284a4cac8e19cce370da973535b0e
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\4f504dca3e0672961ada79556436b75e
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\528f6446e72ad3fa7de9a811a9d77096
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\530943cf8e71d02e05843ffe0a750ed2
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\5784a657dcf8546d42ffd587f2460d86
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\61edf803fb107f8892f02af5403aed05
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\623c8d6b15eb38a135a0d91053c14378
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\64b4c7c498d2de6c0f9a5a7ab5f5cb62
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\65011545afd474b7993b3d45c9ec38b5
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\6696ecc73d69264cf4806b7dd76861bc
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\680ea01b67ce228a2913e3d3663fe455
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\68f8823b17e23aa03f01864cee4fe3d3
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\6ac2a3aa1e166e1af91c8a8a86295144
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\6c87e4ecd91db872ca5bb4273853dd72
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\6daea1001beefd8945902e2e64603469
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\7223fcc9a39d4d4043dae9ec6115e7ee
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\72bb407fa585fa61d6879a590be78021
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\757f3c7b28e8921642a5480d858015eb
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\7d69595e4a929215ed3bd539e086398b
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\7e8beba9db5b0bfd2416eb1a81427d13
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\82f968e4e67557da4d875b1c4a589a05
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\84877fdaf1e8a7d3b9cf3be5016aa6cc
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\900ce303884e352799f2c28ba4396e08
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\90ecd53f8366e64b70c63c717193ec45
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\92e5b4fa195dfc16dff7508efe5d20aa
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\93e77eb6d2ee50198b228dae08e3c119
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\94b9c3c4d8f8dd0402da6d024ec7fe7e
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\94d167a0b70df934a351ed7e3de793f3
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\993f7224f76bbc2a8eed02cb84b38bc1
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\a7c4581730a7396ca910c0f338ee40ae
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\a9e886762da9fdcecc5f3b19bbbcb277
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\ac047d90856c11405671aec41d34d56f
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\aca1f27a69cac68380c30e24c3e9e9cd
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\b0c596f149019eb616a4fa6c67b45cdf
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\b6bf221e5e9f433a044b0345c3064332
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\bb805747acc1583af063aea145bf7212
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\bc6b80ba13fda0d891e2ea677405902d
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\bfbd8068de19eee65cfb92d340c95879
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\bff36022412ad4830e1064d3b482157f
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\c045be02feb8c276b3fc282d19e7a0cc
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\c6238e110516a58e24fa3c57f17a9e46
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\cd9cd577a7dfea5bbef76ae4a7243838
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\ceeba1c6b2d94583141ed925375597fd
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\d153b78ae8826d7fe09b6b9b3b00a516
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\d4b55a8fd3b51cb27c138a54579b9747
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\d591687cd7a783777b600ac8578b1a9f
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\d5f5e208bebd53ecc562e61b3d8b6cb7
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\dad63ebfdaea31d439750b8af4f41364
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\dff0e0166555b820be487cd7969c7adc
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\eaf1f1bc471e40a7b3b1f263afc6c101
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\f0a643a7a844868dda7a126581af13e2
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\f0d693ba231d0aaafc139678a8050172
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\f424eae12af0c334838afc05b34ce9d8
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\f4f1e06d2d2fb8821f47162ff12614d4
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\f5cff6f8d2a64b1a25458ffd00f7f8d5
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\f8232d879a8985419633e5832ea2c49c
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\f8aa063f622ac73a72a02902307a78da
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\f9f310684ef3c2e506b68fa5ca3f53fd
c:\documents and settings\All Users\Application Data\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\include_files\fb3562721c8a5e7dee999478ab1e620d
c:\program files\WebMoney Advisor
c:\program files\WebMoney Advisor\16x16x32b.bmp
c:\program files\WebMoney Advisor\anim.gif
c:\program files\WebMoney Advisor\basis.xml
c:\program files\WebMoney Advisor\booble.html
c:\program files\WebMoney Advisor\favicon.ico
c:\program files\WebMoney Advisor\favicon.png
c:\program files\WebMoney Advisor\info.txt
c:\program files\WebMoney Advisor\SecurityHelper.exe
c:\program files\WebMoney Advisor\statusbar_pluginU.dll
c:\program files\WebMoney Advisor\tbcore3.dll
c:\program files\WebMoney Advisor\tbhelper.dll
c:\program files\WebMoney Advisor\tbs_include_script_statusbar.js
c:\program files\WebMoney Advisor\tbs_include_script_wmadvisor.js
c:\program files\WebMoney Advisor\uninstall.exe
c:\program files\WebMoney Advisor\update.exe
c:\program files\WebMoney Advisor\version.txt
c:\program files\WebMoney Advisor\wmadvisor.crc
c:\program files\WebMoney Advisor\wmadvisor.dll
c:\program files\WebMoney Advisor\WMPlugin.dll
c:\program files\WebMoney Advisor\WMStatusbarSync.exe
c:\windows\svchost.exe
c:\windows\system32\Пузыри.scr
----- BITS: Possible infected sites -----
hxxp://soft.export.yandex.ru
hxxp://download.yandex.ru
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_ABP470N5
-------\Legacy_POWERMANAGER
-------\Service_abp470n5
-------\Service_PowerManager
((((((((((((((((((((((((( Files Created from 2010-09-17 to 2010-10-17 )))))))))))))))))))))))))))))))
.
2010-10-09 11:37 . 2010-10-12 14:54 -------- d-----w- c:\documents and settings\Admin\Application Data\skypePM
2010-10-09 11:36 . 2010-10-12 15:19 -------- d-----w- c:\documents and settings\Admin\Application Data\Skype
2010-10-09 11:36 . 2010-10-09 11:36 -------- d-----r- c:\program files\Skype
2010-10-09 11:36 . 2010-10-09 11:36 -------- d-----w- c:\program files\Common Files\Skype
2010-10-09 11:36 . 2010-10-09 11:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2010-10-07 06:44 . 2010-10-07 06:44 -------- d-----w- c:\documents and settings\Admin\Local Settings\Application Data\Identities
2010-10-06 13:32 . 2010-10-06 13:32 -------- d-----w- c:\documents and settings\Admin\Local Settings\Application Data\Mail.Ru
2010-09-20 13:38 . 2010-09-20 13:38 -------- d-----w- c:\documents and settings\Admin\Application Data\Mail.Ru
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
------- Sigcheck -------
[-] 2009-09-13 . 6A104BA98D99D53AB0C91825CE659FC6 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
[-] 2009-09-13 . 85315C6F61092584BCD96A1EF8A02B4C . 78360 . . [7.2.6001.788] . . c:\windows\system32\wuauclt.exe
[-] 2009-09-13 . 23B7D3F3F5EC8FEEA75EC381C71CBD5E . 579072 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll
[-] 2009-09-13 . 7BF5762CE65A58B7C15B78673F3C3DD3 . 1040384 . . [8.00.6001.22896] . . c:\windows\system32\wininet.dll
[-] 2009-09-13 . B8D3A575A3C0E1A4B724E2BD05394E60 . 1721344 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2009-09-13 . AB778E794E8F39D0D387A440AD356944 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
[-] 2009-09-13 . 635A2C09FC5421444547C2392B43C44B . 99840 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{91397D20-1446-11D4-8AF4-0040CA1127B6}"= "c:\program files\Yandex\YandexBarIE\yndbar.dll" [2010-06-01 10336584]
"{1208AB5D-4748-49fe-A74A-484AE2FA5D34}"= "c:\program files\Yandex\YandexBarIE\bars\barietorrent\yndbar.dll" [2010-05-21 8892232]
[HKEY_CLASSES_ROOT\clsid\{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOT\Yandex.Toolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOT\Yandex.Toolbar]
[HKEY_CLASSES_ROOT\clsid\{1208ab5d-4748-49fe-a74a-484ae2fa5d34}]
[HKEY_CLASSES_ROOT\YandexTorrent.Toolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{50EBFBE3-CEAE-4567-884E-C58C12E91F4C}]
[HKEY_CLASSES_ROOT\YandexTorrent.Toolbar]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"UpdatesOverride"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\NeroCheck.exe"=
"c:\\Program Files\\Adobe\\Reader 9.0\\Reader\\Reader_sl.exe"=
"c:\\WINDOWS\\system32\\nwiz.exe"=
R0 pe3ajtsb;Stalker (Pro) Environment Driver (pe3ajtsb);c:\windows\system32\drivers\pe3ajtsb.sys [05.03.2007 18:58 65408]
R0 pe3ajtsc;Stalker (Pro) Environment Driver (pe3ajtsc);c:\windows\system32\drivers\pe3ajtsc.sys [15.08.2007 16:11 64640]
R0 ps6ajtsb;Stalker (Pro) Synchronization Driver (ps6ajtsb);c:\windows\system32\drivers\ps6ajtsb.sys [05.03.2007 18:57 52104]
R0 ps7ajtsc;Stalker (Pro) Synchronization Driver (ps7ajtsc);c:\windows\system32\drivers\ps7ajtsc.sys [15.08.2007 16:11 68744]
R2 Guard.Mail.ru;Guard.Mail.ru;c:\program files\Mail.Ru\Guard\GuardMailRu.exe [27.06.2010 21:57 973168]
S2 pr2ajtsb;Stalker (Pro) Drivers Auto Removal (pr2ajtsb);c:\windows\system32\pr2ajtsb.exe svc --> c:\windows\system32\pr2ajtsb.exe svc [?]
S2 pr2ajtsc;Stalker (Pro) Drivers Auto Removal (pr2ajtsc);c:\windows\system32\pr2ajtsc.exe svc --> c:\windows\system32\pr2ajtsc.exe svc [?]
S3 DrvAgent32;DrvAgent32;c:\windows\system32\drivers\DrvAgent32.sys [16.06.2010 20:00 23456]
S3 FoxAwdWINFLASH;FoxAwdWINFLASH;\??\c:\progra~1\FOXCONN\FOXLIV~1\FoxAwdWINFLASH.SYS --> c:\progra~1\FOXCONN\FOXLIV~1\FoxAwdWINFLASH.SYS [?]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [14.06.2010 19:56 722416]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - ABP470N5
*NewlyCreated* - POWERMANAGER
*NewlyCreated* - WUAUSERV
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.mail.ru/cnt/7829
uInternet Settings,ProxyOverride = *.local
IE: Закачать ВСЕ при помощи Download Master - c:\program files\Download Master\dmieall.htm
IE: Закачать при помощи Download Master - c:\program files\Download Master\dmie.htm
IE: {{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} - {3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} -
LSP: %SYSTEMROOT%\system32\nvLsp.dll
.
- - - - ORPHANS REMOVED - - - -
Toolbar-{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} - c:\program files\WebMoney Advisor\tbcore3.dll
Toolbar-ITBar7Position - (no file)
WebBrowser-{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} - c:\program files\WebMoney Advisor\tbcore3.dll
AddRemove-Microsoft .NET Framework 2.0 Language Pack - RUS - c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - RUS\install.exe
AddRemove-NVIDIA Display Control Panel - c:\program files\NVIDIA Corporation\Uninstall\nvuninst.exe
AddRemove-uTorrent - c:\program files\uTorrent\uTorrent.exe
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PowerManager]
"ImagePath"="c:\windows\svchost.exe"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-73586283-362288127-682003330-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,c9,89,9f,e5,a4,c5,c3,4a,a4,95,27,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,c9,89,9f,e5,a4,c5,c3,4a,a4,95,27,\
[HKEY_USERS\S-1-5-21-73586283-362288127-682003330-500\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(692)
c:\windows\system32\cscui.dll
- - - - - - - > 'lsass.exe'(748)
c:\windows\system32\nvLsp.dll
- - - - - - - > 'explorer.exe'(3764)
c:\windows\system32\SHDOCVW.dll
c:\windows\system32\WININET.dll
c:\windows\system32\COMRes.dll
c:\windows\System32\cscui.dll
c:\windows\system32\msi.dll
c:\program files\LClock\LC.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
c:\windows\system32\NETSHELL.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\Analog Devices\Core\smax4pnp.exe
c:\program files\XpertVision\TBPanel.exe
c:\program files\Winamp\winampa.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\WebMoney Agent\wmagent.exe
c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
c:\program files\VistaDriveIcon\VistaDrv.exe
c:\program files\LClock\LClock.exe
c:\program files\XPC Tools\Driver Updater Pro\DriverUpdaterPro.exe
c:\documents and settings\Admin\Local Settings\Application Data\Mail.Ru\GameDownloader\MailRuDownloader.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
c:\windows\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2010-10-17 19:59:49 - machine was rebooted
ComboFix-quarantined-files.txt 2010-10-17 15:59
Pre-Run: 4*604*809*216 байт свободно
Post-Run: 5*331*668*992 байт свободно
- - End Of File - - CE627897ADEA73173F4E239960CB1646
