-
Junior Member
- Вес репутации
- 50
Combofix стер учетные записи The Bat
После работы комбофикс почтовик предлагает настроиться с нуля.
Вот лог. В чем дело?? Как восстановить??
лог:
Код:
ComboFix 10-08-07.02 - Мызникова 08.08.2010 16:25:23.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1251.7.1049.18.247.121 [GMT 4:00]
Running from: c:\documents and settings\Мызникова\Рабочий стол\combo-fix.exe
AV: Антивирус Касперского *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Антивирус Касперского *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Мызникова\Application Data\.#
c:\documents and settings\Мызникова\Application Data\.#\MBX@99C@3437A8.###
c:\documents and settings\Мызникова\Application Data\.#\MBX@99C@343838.###
c:\documents and settings\Мызникова\Application Data\.#\MBX@99C@343848.###
c:\documents and settings\Мызникова\Application Data\.#\MBX@99C@343858.###
c:\documents and settings\Мызникова\Application Data\.#\MBX@99C@343868.###
c:\documents and settings\All Users\IEXPLORE.EXE
.
((((((((((((((((((((((((( Files Created from 2010-07-08 to 2010-08-08 )))))))))))))))))))))))))))))))
.
2010-08-07 10:57 . 2010-08-07 10:57 11264 ----a-w- c:\windows\system32\drivers\uze3mjk3.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-08 13:25 . 2008-10-13 08:58 33281056 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-08-08 13:23 . 2008-10-13 08:58 288812 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-08-08 13:23 . 2008-10-13 08:58 2762016 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-08-08 13:23 . 2008-10-13 08:58 479024 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-08-08 09:12 . 2008-10-13 08:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2010-07-30 10:04 . 2008-10-13 09:00 113933 ----a-w- c:\windows\system32\drivers\klin.dat
2010-07-30 10:04 . 2008-10-13 09:00 97549 ----a-w- c:\windows\system32\drivers\klick.dat
2010-06-21 09:43 . 2009-01-26 09:58 -------- d-----w- c:\program files\Hewlett-Packard
2010-06-21 09:27 . 2008-10-13 07:38 50232 ----a-w- c:\documents and settings\Мызникова\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-07-01 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-07-01 118784]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-10 40048]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-13 148888]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe" [2008-10-13 231952]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-08-17 12:17 1667584 ------w- c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 07:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OrderReminder]
2005-03-18 11:18 98304 ----a-r- c:\program files\Hewlett-Packard\OrderReminder\OrderReminder.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\rserver30\\rserver3.exe"=
R3 RServer3;Radmin Server V3;c:\windows\system32\rserver30\RServer3.exe [2009-10-09 1242504]
S1 raddrvv3;raddrvv3;c:\windows\system32\rserver30\raddrvv3.sys [2009-10-09 46304]
S1 uze3mjk3;AVZ-RK Kernel Driver;c:\windows\system32\Drivers\uze3mjk3.sys [2010-08-07 11264]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2007-05-30 24344]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.mail.ru/
IE: &Экспорт в Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.
- - - - ORPHANS REMOVED - - - -
MSConfigStartUp-plugin - c:\program files\plugin.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-08 17:26
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1993962763-1202660629-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*!6*1*7*\OpenWithList]
@Class="Shell"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(824)
c:\windows\system32\klogon.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-08-08 17:34:06 - machine was rebooted
ComboFix-quarantined-files.txt 2010-08-08 13:33
Pre-Run: 80*298*483*712 байт свободно
Post-Run: 81*383*514*112 байт свободно
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional RU" /noexecute=optin /fastdetect
- - End Of File - - 71122D1E64FB80B8AFE4533B912E8E79
-
Будь в курсе!
Будь в курсе!
Надоело быть жертвой? Стань профи по информационной безопасности, получай самую свежую информацию об угрозах и средствах защиты от ведущего российского аналитического центра Anti-Malware.ru:
-
-
-
А зачем Вы запускали combo fix?
-