Код:
ComboFix 10-05-05.0D - Lana 07.05.2010 1:04.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.3583.3110 [GMT 4:00]
Running from: h:\documents and settings\Lana\Рабочий стол\ComboFix.exe
Command switches used :: h:\documents and settings\Lana\Рабочий стол\CFScript.txt
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FILE ::
"h:\windows\system32\drivers\klick.dat"
"h:\windows\system32\drivers\klin.dat"
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
h:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
h:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
h:\windows\system32\drivers\klick.dat
h:\windows\system32\drivers\klin.dat
----- BITS: Possible infected sites -----
hxxp://soft.export.yandex.ru
hxxp://download.yandex.ru
.
((((((((((((((((((((((((( Files Created from 2010-04-06 to 2010-05-06 )))))))))))))))))))))))))))))))
.
2010-05-06 21:08 . 2010-05-06 21:08 97549 ----a-w- h:\windows\system32\drivers\klick.dat
2010-05-06 21:08 . 2010-05-06 21:08 113933 ----a-w- h:\windows\system32\drivers\klin.dat
2010-05-04 19:04 . 2010-05-04 19:04 932368 ----a-w- h:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\profiles-1-6.dll
2010-05-04 19:04 . 2010-05-04 19:04 678416 ----a-w- h:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\content_interpreter-1-1.dll
2010-05-04 19:04 . 2010-05-04 19:04 604688 ----a-w- h:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\gsg-3-9.dll
2010-05-04 19:04 . 2010-05-04 19:04 522768 ----a-w- h:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\database-1-5.dll
2010-05-04 19:04 . 2010-05-04 19:04 1096208 ----a-w- h:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\filtration-4-6.dll
2010-05-04 19:03 . 2010-05-04 19:03 80400 ----a-w- h:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav9exec\9.0.0.736\fssync.dll
2010-05-04 19:03 . 2010-05-04 19:03 80400 ----a-w- h:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.736\fssync.dll
2010-05-04 18:57 . 2010-05-06 21:08 -------- d-----w- h:\documents and settings\All Users\Application Data\Kaspersky Lab
2010-05-04 18:57 . 2010-05-04 18:57 -------- d-----w- h:\program files\Kaspersky Lab
2010-05-04 18:56 . 2010-05-04 18:56 -------- d-----w- h:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2010-05-03 14:56 . 2010-05-03 14:56 -------- d-----w- h:\documents and settings\Lana\Application Data\Malwarebytes
2010-05-03 14:56 . 2010-04-29 11:39 38224 ----a-w- h:\windows\system32\drivers\mbamswissarmy.sys
2010-05-03 14:56 . 2010-05-03 14:56 -------- d-----w- h:\program files\Malwarebytes' Anti-Malware
2010-05-03 14:56 . 2010-05-03 14:56 -------- d-----w- h:\documents and settings\All Users\Application Data\Malwarebytes
2010-05-03 14:56 . 2010-04-29 11:39 20952 ----a-w- h:\windows\system32\drivers\mbam.sys
2010-05-01 20:06 . 2010-05-01 20:06 -------- d-----w- h:\documents and settings\Lana\Local Settings\Application Data\Opera
2010-05-01 20:06 . 2010-05-01 20:06 -------- d-----w- h:\program files\Opera
2010-05-01 18:03 . 2010-05-01 18:03 -------- d-----w- h:\windows\ERUNT
2010-05-01 17:59 . 2010-05-01 18:12 -------- d-----w- H:\SDFix
2010-04-30 09:02 . 2010-04-30 09:02 -------- d-----w- h:\documents and settings\Admin\DoctorWeb
2010-04-30 08:50 . 2010-04-30 08:50 -------- d-----w- h:\documents and settings\Admin\Application Data\ABIG
2010-04-29 16:46 . 2010-04-29 16:46 -------- d-----w- h:\program files\Yandex
2010-04-29 16:46 . 2010-04-29 16:46 -------- d-----w- h:\documents and settings\All Users\Application Data\Yandex
2010-04-26 16:42 . 2010-04-26 16:42 -------- d-----w- h:\program files\Common Files\Skype
2010-04-07 12:23 . 2010-04-07 12:23 -------- d-----w- H:\WTablet
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-06 21:08 . 2009-09-09 19:47 -------- d-----w- h:\documents and settings\Lana\Application Data\WTablet
2010-05-06 20:59 . 2009-10-15 20:13 -------- d-----w- h:\documents and settings\Lana\Application Data\Skype
2010-05-06 20:59 . 2009-09-09 17:44 -------- d-----w- h:\documents and settings\Lana\Application Data\uTorrent
2010-05-06 13:29 . 2009-10-15 20:22 -------- d-----w- h:\documents and settings\Lana\Application Data\skypePM
2010-04-29 19:32 . 2010-01-13 07:57 -------- d-----w- h:\documents and settings\All Users\Application Data\Lavasoft
2010-04-29 17:13 . 2009-09-09 21:35 -------- d-----w- h:\documents and settings\All Users\Application Data\Microsoft Help
2010-04-29 16:46 . 2010-01-13 08:25 -------- d-----w- h:\documents and settings\Lana\Application Data\Yandex
2010-04-29 16:43 . 2010-04-02 13:41 -------- d-----w- h:\documents and settings\Lana\Application Data\Aegisub
2010-04-29 13:29 . 2009-09-27 03:31 -------- d-----w- h:\program files\Common Files\Adobe
2010-04-25 09:21 . 2009-10-12 15:56 57 ----a-w- h:\documents and settings\All Users\Application Data\Brother\BrLog\BrCollectDir\BR_cat.bat
2010-04-25 09:18 . 2009-10-12 16:00 50 ----a-w- h:\windows\system32\bridf05a.dat
2010-04-05 12:01 . 2009-09-08 16:09 31416 ----a-w- h:\documents and settings\Lana\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-02 13:41 . 2010-04-02 13:41 -------- d-----w- h:\program files\Aegisub
2010-04-02 12:43 . 2010-04-02 11:58 -------- d-----w- h:\program files\MKVtoolnix
2010-04-02 12:02 . 2010-04-02 12:02 -------- d-----w- h:\program files\URUSoft
2010-03-31 12:43 . 2010-03-31 12:43 -------- d-----w- h:\program files\Haali
2010-03-28 03:58 . 2008-04-15 11:00 79748 ----a-w- h:\windows\system32\perfc019.dat
2010-03-28 03:58 . 2008-04-15 11:00 474826 ----a-w- h:\windows\system32\perfh019.dat
2010-03-26 14:55 . 2010-03-26 14:54 -------- d-----w- h:\program files\K-Lite Codec Pack
2010-03-26 06:17 . 2010-03-18 20:39 -------- d-----w- h:\program files\KMPlayer
2010-03-23 02:32 . 2009-09-09 20:05 -------- d-----w- h:\documents and settings\Lana\Application Data\Media Player Classic
2010-03-18 19:24 . 2009-12-02 13:58 -------- d-----w- h:\program files\The KMPlayer
2010-03-15 00:02 . 2009-09-09 17:51 -------- d-----w- h:\program files\uTorrent
2010-03-11 11:44 . 2009-03-14 07:51 841216 ----a-w- h:\windows\system32\wininet.dll
2010-03-11 11:44 . 2008-04-15 11:00 78336 ----a-w- h:\windows\system32\ieencode.dll
2010-03-11 11:44 . 2009-03-14 07:51 17408 ----a-w- h:\windows\system32\corpol.dll
2010-03-09 11:08 . 2009-03-14 07:51 430080 ----a-w- h:\windows\system32\vbscript.dll
2010-02-24 11:57 . 2009-03-14 07:50 457216 ----a-w- h:\windows\system32\drivers\mrxsmb.sys
2010-02-20 17:31 . 2010-02-20 17:30 38784 ----a-w- h:\documents and settings\Lana\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-02-20 17:31 . 2010-02-20 17:30 38784 ----a-w- h:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-02-16 19:01 . 2009-03-14 07:51 2148352 ----a-w- h:\windows\system32\ntoskrnl.exe
2010-02-16 19:01 . 2008-08-14 15:56 2026496 ----a-w- h:\windows\system32\ntkrnlpa.exe
2010-02-12 04:29 . 2008-04-15 11:00 100864 ----a-w- h:\windows\system32\6to4svc.dll
2010-02-11 11:36 . 2009-03-14 07:51 226880 ----a-w- h:\windows\system32\drivers\tcpip6.sys
2010-02-10 17:13 . 2009-09-09 20:11 165376 ----a-w- h:\windows\system32\unrar.dll
.
------- Sigcheck -------
[-] 2009-09-30 . 0940D662B2E96A46421BC7B46DE95905 . 361600 . . [5.1.2600.5625] . . h:\windows\system32\drivers\tcpip.sys
[-] 2009-03-14 . 5176457636696D5A535D297B26A4F7FE . 1571840 . . [5.1.2600.5512] . . h:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{7778AA60-698A-41D9-9BF0-7AB41045AA7F}"= "h:\program files\Yandex\YandexBarIE\bars\barieeset\yndbar.dll" [2010-03-24 8322888]
[HKEY_CLASSES_ROOT\clsid\{7778aa60-698a-41d9-9bf0-7ab41045aa7f}]
[HKEY_CLASSES_ROOT\YandexEset.Toolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{7775BF84-AB6A-44DE-8E7B-C32934180E03}]
[HKEY_CLASSES_ROOT\YandexEset.Toolbar]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{7778AA60-698A-41D9-9BF0-7AB41045AA7F}"= "h:\program files\Yandex\YandexBarIE\bars\barieeset\yndbar.dll" [2010-03-24 8322888]
[HKEY_CLASSES_ROOT\clsid\{7778aa60-698a-41d9-9bf0-7ab41045aa7f}]
[HKEY_CLASSES_ROOT\YandexEset.Toolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{7775BF84-AB6A-44DE-8E7B-C32934180E03}]
[HKEY_CLASSES_ROOT\YandexEset.Toolbar]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IconOverlay1EXL600]
@="{BF9B13E4-FE9B-4121-853F-866F4E9E2830}"
[HKEY_CLASSES_ROOT\CLSID\{BF9B13E4-FE9B-4121-853F-866F4E9E2830}]
2008-04-16 13:55 599552 ----a-w- h:\windows\system32\FPAP-EXL600\FileptcIconOverlay.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="h:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2009-10-20 340456]
"NvCplDaemon"="h:\windows\system32\NvCpl.dll" [2009-11-20 12669544]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="h:\windows\system32\CTFMON.EXE" [2008-04-15 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"IE7_011"="shell32" [X]
"IE7_012"="advpack.dll" [2010-03-11 124928]
[HKLM\~\startupfolder\H:^Documents and Settings^All Users^Главное меню^Программы^Автозагрузка^TrayMin210.exe.lnk]
backup=h:\windows\pss\TrayMin210.exe.lnkCommon Startup
[HKLM\~\startupfolder\H:^Documents and Settings^All Users^Главное меню^Программы^Автозагрузка^Монитор состояния.lnk]
backup=h:\windows\pss\Монитор состояния.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-01-11 18:16 39792 ----a-w- h:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
2008-08-14 03:58 611712 ----a-w- h:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter2.0]
2005-07-19 09:36 933888 ------w- h:\program files\Brother\ControlCenter2\brctrcen.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-15 11:00 15360 ----a-w- h:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Pro Agent]
2007-09-06 13:08 136136 ----a-w- h:\program files\DAEMON Tools Pro\DTProAgent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDAudDeck]
2008-08-15 03:13 30003200 ----a-r- h:\program files\VIA\VIAudioi\HDADeck\HDeck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
2005-08-25 16:59 40960 ----a-w- h:\program files\ScanSoft\PaperPort\IndexSearch.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2009-11-20 17:32 12669544 ----a-w- h:\windows\system32\nvcpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2009-11-20 17:32 110184 ----a-w- h:\windows\system32\nvmctray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe [BU]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
2005-08-25 16:50 57393 ----a-w- h:\program files\ScanSoft\PaperPort\pptd40nt.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 20:08 417792 ----a-w- h:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefPrt]
2005-01-26 14:02 49152 ------w- h:\program files\Brother\Brmfl05a\BrStDvPt.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-04-05 22:27 26102056 ----a-r- h:\program files\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2003-09-29 20:14 155648 ----a-r- h:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"h:\\Program Files\\uTorrent\\uTorrent.exe"=
"h:\\Program Files\\QIP\\qip.exe"=
"h:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"h:\\WINDOWS\\system32\\dpvsetup.exe"=
"h:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"h:\\Program Files\\Opera\\opera.exe"=
"h:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"1024:TCP"= 1024:TCP
R0 klbg;Kaspersky Lab Boot Guard Driver;h:\windows\system32\drivers\klbg.sys [14.10.2009 20:18 36880]
R0 sptd;sptd;h:\windows\system32\drivers\sptd.sys [10.09.2009 17:14 685816]
R2 TabletServicePen;TabletServicePen;h:\windows\system32\Pen_Tablet.exe [09.09.2009 23:47 2749736]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;h:\windows\system32\drivers\klim5.sys [14.09.2009 13:42 32272]
R3 klmouflt;Kaspersky Lab KLMOUFLT;h:\windows\system32\drivers\klmouflt.sys [02.10.2009 18:39 19472]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;h:\windows\system32\drivers\viahduaa.sys [08.09.2009 20:17 845184]
S3 wacmoumonitor;Wacom Mode Helper;h:\windows\system32\drivers\wacmoumonitor.sys [09.09.2009 23:47 15656]
.
Contents of the 'Scheduled Tasks' folder
2010-03-30 h:\windows\Tasks\AppleSoftwareUpdate.job
- h:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 08:34]
.
.
------- Supplementary Scan -------
.
uLocal Page = h:\windows\pchealth\helpctr\System\panels\blank.htm
uStart Page = hxxp://www.yandex.ru/?clid=131634
uDefault_Search_URL = hxxp://search.qip.ru
uSearchAssistant = hxxp://search.qip.ru/ie
uSearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
IE: &Экспорт в Microsoft Excel - h:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - h:\documents and settings\Lana\Application Data\Mozilla\Firefox\Profiles\2km8wqxi.default\
FF - component: h:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - component: h:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll
FF - plugin: h:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: h:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - h:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
h:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
h:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
h:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
h:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
h:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
h:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
h:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
h:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
h:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
h:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
h:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
h:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
h:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
h:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
h:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
h:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
h:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
h:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
h:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
h:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-07 01:10
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1036)
h:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
- - - - - - - > 'explorer.exe'(1936)
h:\windows\system32\WININET.dll
h:\windows\system32\FPAP-EXL600\FileptcIconOverlay.dll
h:\windows\system32\msi.dll
h:\windows\system32\WPDShServiceObj.dll
h:\windows\system32\PortableDeviceTypes.dll
h:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
h:\windows\system32\nvsvc32.exe
h:\windows\system32\brss01a.exe
h:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe
h:\windows\system32\UTSCSI.EXE
h:\windows\system32\WTablet\Pen_TabletUser.exe
h:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-05-07 01:12:01 - machine was rebooted
ComboFix-quarantined-files.txt 2010-05-06 21:11
ComboFix2.txt 2010-05-05 13:40
Pre-Run: 84*533*809*152 байт свободно
Post-Run: 84*527*882*240 байт свободно
- - End Of File - - 8A8D04D4900BFA1A08AF246D0A821779
всегда при использовании ComboFix появляется окошко : приложение PEV.cfxxe допустило ошибку и будет закрыто, отправить отчет. Пока не нажмешь отправить отчет макросовтцу или не отправить, программа не работает, выбираю не отправлять и ComboFix продолжает работу.
