В ночь повторно запустил Malwarebytes' Anti-Malware (Avast! был принудительно отключен путем перемещения некоторых файлов в другую папку. Лог прилагаю. Удивило большое число отсутствовавших ранее инфекций в файлах восстановления (я восстановление не делал). Очистил, перезапустил. Перезапуск произошел с нормальной скоростью. Перешел в безопасный режим, вернул на свое место файлы Avast!, опять перезапустил в нормальном режиме - опять долгая пауза. После этого выполнил рекомендованный скрипт. Вот результат:
ComboFix 10-10-27.01 - Konstantin 29.10.2010 7:03.4.1 - FAT32x86
Running from: c:\documents and settings\Konstantin\Рабочий стол\ComboFix.exe
Command switches used :: c:\documents and settings\Konstantin\Рабочий стол\CFScript.txt
AV: avast! Internet Security *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: avast! Internet Security *disabled* {7591DB91-41F0-48A3-B128-1A293FD8233D}
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\Drivers\atapi.sys . . . is infected!!
.
((((((((((((((((((((((((( Files Created from 2010-09-28 to 2010-10-29 )))))))))))))))))))))))))))))))
.
2010-10-27 17:37 . 2010-10-27 17:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware-2
2010-10-24 21:30 . 2010-09-07 15:12 38848 ----a-w- c:\windows\avastSS.scr
2010-10-24 20:38 . 2010-10-24 20:38 -------- d-----w- c:\windows\system32\FxsTmp
2010-10-24 20:38 . 2004-08-18 12:00 31744 ----a-w- c:\windows\system32\fxsroute.dll
2010-10-24 20:38 . 2004-08-18 12:00 31744 ----a-w- c:\windows\system32\dllcache\fxsroute.dll
2010-10-24 20:38 . 2004-08-18 12:00 11264 ----a-w- c:\windows\system32\fxssend.exe
2010-10-24 20:38 . 2004-08-18 12:00 11264 ----a-w- c:\windows\system32\dllcache\fxssend.exe
2010-10-24 20:38 . 2004-08-18 12:00 136704 ----a-w- c:\windows\system32\fxsclntR.dll
2010-10-24 20:38 . 2004-08-18 12:00 136704 ----a-w- c:\windows\system32\dllcache\fxsclntr.dll
2010-10-24 20:38 . 2004-08-18 12:00 111104 ----a-w- c:\windows\system32\fxscfgwz.dll
2010-10-24 20:38 . 2004-08-18 12:00 111104 ----a-w- c:\windows\system32\dllcache\fxscfgwz.dll
2010-10-24 20:21 . 2010-09-07 14:47 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-10-24 20:21 . 2010-09-07 14:52 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-10-24 20:21 . 2010-09-07 14:53 340048 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2010-10-24 20:21 . 2010-09-07 14:54 99792 ----a-w- c:\windows\system32\drivers\aswFW.sys
2010-10-24 20:20 . 2010-09-07 14:53 190416 ----a-w- c:\windows\system32\drivers\aswNdis2.sys
2010-10-24 20:20 . 2010-09-07 14:47 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-10-24 20:20 . 2010-09-07 14:52 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-10-24 20:20 . 2010-09-07 14:47 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-10-24 20:20 . 2010-09-07 14:47 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-10-24 20:20 . 2010-09-07 14:46 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-10-24 20:14 . 2010-03-19 19:10 12112 ----a-w- c:\windows\system32\drivers\aswNdis.sys
2010-10-24 20:13 . 2010-09-07 15:11 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-10-24 19:40 . 2010-10-24 19:40 -------- d-----w- c:\program files\MSXML 4.0
2010-10-24 19:18 . 2010-10-24 19:18 -------- d-----w- c:\program files\trend micro
2010-10-24 10:44 . 2009-10-09 20:31 315408 ----a-w- c:\windows\system32\drivers\3233581.sys
2010-10-24 08:03 . 2010-10-24 08:03 13312 ----a-w- c:\windows\system32\drivers\vdi5odg0.sys
2010-10-23 19:07 . 2010-10-23 19:07 -------- d-----w- c:\documents and settings\Konstantin\Application Data\Malwarebytes
2010-10-23 19:04 . 2010-04-29 12:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-23 19:04 . 2010-10-23 19:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-10-23 19:04 . 2010-04-29 12:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-10-23 19:04 . 2010-10-23 19:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-10-23 05:17 . 2009-10-22 10:54 37392 ----a-w- c:\windows\system32\drivers\62016502.sys
2010-10-23 05:17 . 2009-10-09 20:31 315408 ----a-w- c:\windows\system32\drivers\6201650.sys
2010-10-23 05:17 . 2009-09-25 14:59 128016 ----a-w- c:\windows\system32\drivers\62016501.sys
2010-10-23 04:56 . 2010-10-23 04:56 -------- d-----w- c:\windows\system32\wbem\Repository
2010-10-23 04:55 . 2010-10-23 04:55 -------- d-----w- c:\program files\Переводчики
2010-10-22 22:14 . 2008-06-14 17:35 272512 ------w- c:\windows\system32\dllcache\bthport.sys
2010-10-22 22:14 . 2010-09-18 06:53 974848 ------w- c:\windows\system32\dllcache\mfc42.dll
2010-10-22 22:14 . 2010-09-18 06:53 953856 ------w- c:\windows\system32\dllcache\mfc40u.dll
2010-10-22 22:14 . 2010-08-23 16:12 617472 ------w- c:\windows\system32\dllcache\comctl32.dll
2010-10-22 22:10 . 2008-04-14 18:40 26112 ----a-w- c:\windows\system32\dllcache\OLD638.tmp
2010-10-22 22:08 . 2004-08-18 12:00 31744 ----a-w- c:\windows\system32\dllcache\OLD59D.tmp
2010-10-22 22:08 . 2008-04-14 18:39 15360 ----a-w- c:\windows\system32\dllcache\OLD59A.tmp
2010-10-22 22:08 . 2004-08-18 12:00 14336 ----a-w- c:\windows\system32\dllcache\OLD597.tmp
2010-10-22 22:08 . 2004-08-18 12:00 36927 ----a-w- c:\windows\system32\dllcache\OLD594.tmp
2010-10-22 22:08 . 2008-04-14 18:39 15872 ----a-w- c:\windows\system32\dllcache\OLD591.tmp
2010-10-22 22:00 . 2004-08-18 12:00 5632 ----a-w- c:\windows\system32\dllcache\OLD480.tmp
2010-10-22 22:00 . 2004-08-18 12:00 5632 ----a-w- c:\windows\system32\dllcache\OLD47D.tmp
2010-10-22 22:00 . 2004-08-18 12:00 6144 ----a-w- c:\windows\system32\dllcache\OLD47A.tmp
2010-10-22 22:00 . 2004-08-18 12:00 5632 ----a-w- c:\windows\system32\dllcache\OLD477.tmp
2010-10-22 22:00 . 2004-08-18 12:00 6144 ----a-w- c:\windows\system32\dllcache\OLD43D.tmp
2010-10-22 21:59 . 2008-04-14 18:39 315455 ----a-w- c:\windows\system32\dllcache\OLD414.tmp
2010-10-22 21:58 . 2008-04-14 18:39 81976 ----a-w- c:\windows\system32\dllcache\OLD3ED.tmp
2010-10-22 21:58 . 2004-08-18 12:00 57398 ----a-w- c:\windows\system32\dllcache\OLD3EA.tmp
2010-10-22 21:58 . 2008-04-14 18:39 716856 ----a-w- c:\windows\system32\dllcache\OLD3E7.tmp
2010-10-22 21:37 . 2010-10-22 21:37 -------- d-----w- c:\windows\LastGood(2)
2010-10-22 18:21 . 2010-10-22 18:21 -------- d-----w- C:\__Help
2010-10-22 16:46 . 2010-08-16 08:45 590848 ------w- c:\windows\system32\dllcache\rpcrt4.dll
2010-10-22 16:45 . 2009-11-21 16:03 471552 ------w- c:\windows\system32\dllcache\aclayers.dll
2010-10-22 16:42 . 2010-08-27 08:03 119808 ------w- c:\windows\system32\dllcache\t2embed.dll
2010-10-22 16:42 . 2009-10-15 16:33 81920 ------w- c:\windows\system32\dllcache\fontsub.dll
2010-10-22 16:41 . 2009-06-21 21:48 153088 ------w- c:\windows\system32\dllcache\triedit.dll
2010-10-22 16:41 . 2010-04-28 18:15 2191744 ------w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-10-22 16:41 . 2010-04-28 05:45 2148352 ------w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-10-22 16:41 . 2010-04-28 05:45 2068608 ------w- c:\windows\system32\dllcache\ntkrnlpa.exe
2010-10-22 16:41 . 2010-04-28 05:45 2026496 ------w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-10-22 16:35 . 2008-05-08 14:02 203136 ------w- c:\windows\system32\dllcache\rmcast.sys
2010-10-22 16:34 . 2008-05-01 14:37 331776 ------w- c:\windows\system32\dllcache\msadce.dll
2010-10-22 16:26 . 2010-07-16 11:58 221184 ----a-w- c:\program files\Windows NT\Accessories\wordpad.exe
2010-10-22 16:26 . 2010-07-16 11:58 221184 ------w- c:\windows\system32\dllcache\wordpad.exe
2010-10-22 13:15 . 2010-06-18 13:36 3558912 ------w- c:\windows\system32\dllcache\moviemk.exe
2010-10-22 13:08 . 2010-02-24 13:11 455680 ------w- c:\windows\system32\dllcache\mrxsmb.sys
2010-10-22 13:07 . 2009-02-06 10:10 227840 ------w- c:\windows\system32\dllcache\wmiprvse.exe
2010-10-22 13:07 . 2009-03-06 14:23 284672 ------w- c:\windows\system32\dllcache\pdh.dll
2010-10-22 13:07 . 2009-02-09 11:25 111104 ------w- c:\windows\system32\dllcache\services.exe
2010-10-22 13:07 . 2009-02-09 10:54 401408 ------w- c:\windows\system32\dllcache\rpcss.dll
2010-10-22 13:07 . 2009-02-09 10:54 473600 ------w- c:\windows\system32\dllcache\fastprox.dll
2010-10-22 13:07 . 2009-02-09 10:54 687616 ------w- c:\windows\system32\dllcache\advapi32.dll
2010-10-22 13:07 . 2009-02-09 10:54 453120 ------w- c:\windows\system32\dllcache\wmiprvsd.dll
2010-10-22 13:07 . 2009-02-09 10:54 718848 ------w- c:\windows\system32\dllcache\ntdll.dll
2010-10-22 11:11 . 2010-08-17 13:17 58880 ------w- c:\windows\system32\dllcache\spoolsv.exe
2010-10-22 11:09 . 2010-07-27 06:30 8479744 ------w- c:\windows\system32\dllcache\shell32.dll
2010-10-22 11:08 . 2010-06-14 14:31 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe
2010-10-22 11:07 . 2010-10-22 11:07 -------- d-----w- c:\windows\ie8updates
2010-10-22 11:06 . 2010-09-10 05:51 247808 ------w- c:\windows\system32\dllcache\ieproxy.dll
2010-10-22 11:06 . 2010-09-10 05:51 602112 ------w- c:\windows\system32\dllcache\msfeeds.dll
2010-10-22 11:06 . 2010-09-10 05:51 1986560 ------w- c:\windows\system32\dllcache\iertutil.dll
2010-10-22 11:06 . 2010-09-10 05:51 55296 ------w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-10-22 11:06 . 2010-09-10 05:51 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
2010-10-22 11:06 . 2010-09-10 05:51 743424 ------w- c:\windows\system32\dllcache\iedvtool.dll
2010-10-22 11:06 . 2010-09-10 05:51 11080192 ------w- c:\windows\system32\dllcache\ieframe.dll
2010-10-22 11:04 . 2009-11-27 17:13 17920 ------w- c:\windows\system32\dllcache\msyuv.dll
2010-10-22 11:04 . 2010-02-05 18:27 1293312 ------w- c:\windows\system32\dllcache\quartz.dll
2010-10-22 11:03 . 2010-08-26 13:39 357248 ------w- c:\windows\system32\dllcache\srv.sys
2010-10-22 10:56 . 2008-10-15 16:37 337408 ------w- c:\windows\system32\dllcache\netapi32.dll
2010-10-22 09:22 . 2008-09-10 01:15 1307648 ------w- c:\windows\system32\dllcache\msxml6.dll
2010-10-22 09:22 . 2008-04-14 18:17 86016 ------w- c:\windows\system32\dllcache\msxml6r.dll
2010-10-22 09:22 . 2008-04-14 18:39 102912 ------w- c:\windows\system32\dllcache\dpcdll.dll
2010-10-22 09:20 . 2008-04-14 18:40 451584 ----a-w- c:\windows\system32\fxsapi.dll
2010-10-22 09:19 . 2008-04-14 18:40 294912 ------w- c:\windows\system32\dllcache\dlimport.exe
2010-10-22 09:12 . 2006-12-28 21:31 19569 ----a-w- c:\windows\003290_.tmp
2010-10-22 08:23 . 2010-10-22 08:23 -------- d-----w- C:\8c5e26121b1f26a493e721a34a
2010-10-21 19:09 . 2010-10-21 19:09 -------- d-----w- c:\documents and settings\Konstantin\DoctorWeb
2010-10-21 15:08 . 2001-10-19 18:06 26112 ----a-w- c:\windows\system32\dllcache\EXCH_seos.dll
2010-10-21 15:07 . 2004-08-18 12:00 92416 ----a-w- c:\windows\system32\dllcache\mga.sys
2010-10-21 15:06 . 2004-08-18 12:00 10129408 ----a-w- c:\windows\system32\dllcache\hwxkor.dll
2010-10-21 15:06 . 2008-04-14 18:39 13463552 ----a-w- c:\windows\system32\dllcache\hwxjpn.dll
2010-10-21 15:06 . 2004-08-18 12:00 10096640 ----a-w- c:\windows\system32\dllcache\hwxcht.dll
2010-10-21 15:06 . 2004-08-18 12:00 36864 ----a-w- c:\windows\system32\dllcache\hanjadic.dll
2010-10-21 15:06 . 2004-08-18 12:00 7680 ----a-w- c:\windows\system32\dllcache\ftpctrs2.dll
2010-10-21 15:06 . 2004-08-18 12:00 6144 ----a-w- c:\windows\system32\dllcache\ftlx041e.dll
2010-10-21 15:06 . 2004-08-18 12:00 14848 ----a-w- c:\windows\system32\dllcache\flattemp.exe
2010-10-21 15:06 . 2001-10-19 18:06 43520 ----a-w- c:\windows\system32\dllcache\EXCH_fcachdll.dll
2010-10-21 15:06 . 2004-08-18 12:00 25856 ----a-w- c:\windows\system32\dllcache\et4000.sys
2010-10-21 15:06 . 2004-08-18 12:00 57856 ----a-w- c:\windows\system32\dllcache\esuimgd.dll
2010-10-21 15:06 . 2004-08-18 12:00 45056 ----a-w- c:\windows\system32\dllcache\esunid.dll
2010-10-21 15:06 . 2004-08-18 12:00 31744 ----a-w- c:\windows\system32\dllcache\esucmd.dll
2010-10-21 15:04 . 2003-04-14 17:36 16384 ----a-w- c:\windows\system32\dllcache\tcptsat.dll
2010-10-21 15:04 . 2004-08-18 12:00 19968 ----a-w- c:\windows\system32\dllcache\inetsloc.dll
2010-10-21 15:04 . 2004-08-18 12:00 7680 ----a-w- c:\windows\system32\dllcache\inetmgr.exe
2010-10-21 15:04 . 2004-08-18 12:00 171520 ----a-w- c:\windows\system32\dllcache\iisui.dll
2010-10-21 15:04 . 2004-08-18 12:00 5632 ----a-w- c:\windows\system32\dllcache\iisrstap.dll
2010-10-21 15:04 . 2004-08-18 12:00 14848 ----a-w- c:\windows\system32\dllcache\iisreset.exe
2010-10-21 15:04 . 2004-08-18 12:00 6144 ----a-w- c:\windows\system32\dllcache\ftpsapi2.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-26 19:21 . 2010-09-26 19:21 286720 ------w- c:\windows\Setup1.exe
2010-09-26 19:21 . 2010-09-26 19:21 73216 ----a-w- c:\windows\ST6UNST.EXE
2010-09-18 09:23 . 2007-10-10 10:31 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2007-10-10 10:31 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-18 06:53 . 2004-08-18 09:00 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2004-08-18 09:00 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-10 05:51 . 2007-10-10 10:34 916480 ----a-w- c:\windows\system32\wininet.dll
2010-09-10 05:51 . 2004-08-18 09:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-09-10 05:51 . 2004-08-18 09:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2010-09-02 20:26 . 2010-09-02 20:26 51716 ----a-w- c:\windows\system32\pdf995mon.dll
2010-09-02 20:26 . 2010-09-02 20:26 249856 ----a-w- c:\windows\system32\pdfmona.dll
2010-09-01 11:52 . 2004-08-18 09:00 285824 ----a-w- c:\windows\system32\atmfd.dll
2010-09-01 07:57 . 2007-10-10 10:31 1852928 ----a-w- c:\windows\system32\win32k.sys
2010-08-27 08:03 . 2007-10-10 10:29 119808 ----a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:54 . 2007-10-10 10:26 99840 ----a-w- c:\windows\system32\srvsvc.dll
2010-08-27 01:43 . 2010-08-13 15:44 5120 ----a-w- c:\windows\system32\xpsp4res.dll
2010-08-26 13:39 . 2007-10-10 10:30 357248 ----a-w- c:\windows\system32\drivers\srv.sys
2010-08-23 16:12 . 2007-10-10 10:30 617472 ----a-w- c:\windows\system32\comctl32.dll
2010-08-17 13:17 . 2007-10-10 10:27 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-16 08:45 . 2007-10-10 10:33 590848 ----a-w- c:\windows\system32\rpcrt4.dll
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\windows\system32\FxsTmp ----
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\sn xPluginsShell]
@="{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}"
[HKEY_CLASSES_ROOT\CLSID\{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}]
2010-09-07 15:14 152160 ----a-w- c:\program files\Alwil Software\Avast5\snxPlugins.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pdfFactory Pro Диспетчер pdfFactory Pro v3"="c:\windows\System32\spool\DRIVERS\W32X86\3\fppdis3a.exe" [2007-02-24 503808]
"LXSUPMON"="c:\windows\system32\LXSUPMON.EXE" [2001-10-09 818176]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"VMSnap3"="c:\windows\VMSnap3.EXE" [2006-08-30 49152]
"Domino"="c:\windows\Domino.EXE" [2006-06-28 49152]
"SoundMan"="SOUNDMAN.EXE" [2000-05-19 155648]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-04-01 5562368]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [BU]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\ѓ«*ў*®Ґ ¬Ґ*о\Џа®Ја*¬¬л\Ђўв®§*Јаг§Є*\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
Update Scheduler for Proteus Professional 7.lnk - c:\program files\Proteus 7 Pro\BIN\UDSCHED.EXE [2010-6-28 66076]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-06-03 00:50 1144104 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2005-04-01 13:16 5562368 ----a-w- c:\windows\system32\nvcpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2005-04-01 13:16 86016 ----a-w- c:\windows\system32\nvmctray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2005-04-01 13:16 1495040 ----a-w- c:\windows\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WebcamMaxAutoRun]
2010-04-30 02:41 6043888 ----a-w- c:\program files\WEB-камера\WebcamMax\WebcamMax.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"f:\\Program Files\\Загрузчики\\BitTorrent_6.4\\bittorrent.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\System32\\LEXPPS.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9828:TCP"= 9828:TCP:BitComet 9828 TCP
"9828:UDP"= 9828:UDP:BitComet 9828 UDP
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R0 62016502;62016502 Boot Guard Driver;c:\windows\system32\drivers\62016502.sys [23.10.2010 8:17 37392]
R0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\drivers\aswNdis.sys [24.10.2010 23:14 12112]
R0 aswNdis2;avast! Firewall Core Firewall Service;c:\windows\system32\drivers\aswNdis2.sys [24.10.2010 23:20 190416]
R1 62016501;62016501;c:\windows\system32\drivers\62016501.sys [23.10.2010 8:17 128016]
R1 aswFW;avast! TDI Firewall driver;c:\windows\system32\drivers\aswFW.sys [24.10.2010 23:21 99792]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [24.10.2010 23:21 340048]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [24.10.2010 23:21 165584]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [24.10.2010 23:21 17744]
R2 Iprip;Слушатель RIP;c:\windows\System32\svchost.exe -k netsvcs [18.08.2004 12:00 14336]
R2 NSHE;Guardant Emulator Driver;c:\windows\system32\drivers\NSHE.SYS [18.06.2010 9:18 97792]
R3 WWSPLIT;Willing Webcam WDM Driver;c:\windows\system32\drivers\wwsplit.sys [12.09.2010 1:40 301952]
S1 88778891;88778891;c:\windows\system32\DRIVERS\88778891.sys --> c:\windows\system32\DRIVERS\88778891.sys [?]
S2 avast! Firewall;avast! Firewall;"c:\program files\Alwil Software\Avast5\afwServ.exe" --> c:\program files\Alwil Software\Avast5\afwServ.exe [?]
S2 DicterUpdateService;Dicter Service;c:\program files\Переводчики\Dicter\DicterService.exe --> c:\program files\Переводчики\Dicter\DicterService.exe [?]
S2 gupdate;Служба Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [16.09.2010 9:07 136176]
S3 adatadrv;Autodata Protection Service;c:\windows\system32\DRIVERS\adatadrv.sys --> c:\windows\system32\DRIVERS\adatadrv.sys [?]
S3 TEUSBMU;Panasonic Analog PBX USB Main Unit driver;c:\windows\system32\drivers\TEUSBMU.sys [30.09.2010 17:07 20992]
S3 vaxscsi;vaxscsi;c:\windows\system32\drivers\vaxscsi.sys [01.06.2010 16:16 223128]
S3 vmfilter303;vmfilter303;c:\windows\system32\drivers\vmfilter303.sys [28.07.2010 20:55 428160]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [01.06.2010 16:06 643072]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
Contents of the 'Scheduled Tasks' folder
2010-10-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-16 06:07]
2010-10-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-16 06:07]
.
.
------- Supplementary Scan -------
.
uStart Page = about
:blank
IE: &З&агрузить &с помощью BitComet - e:\program files\BitComet\BitComet.exe/AddLink.htm
IE: &З&агрузить все видео файлы с помощью BitComet - e:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: &З&агрузить все с помощью BitComet - e:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: &Экспорт в Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: + Offline &Explorer: Download the link - file://f:\program files\Offline Explorer Enterprise4.5\Add_UrlO.htm
IE: + Offline E&xplorer: Download the current page - file://f:\program files\Offline Explorer Enterprise4.5\Add_AllO.htm
IE: Google ВикиКомментарии... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
IE: Закачать все при помощи FlashGet - e:\program files\FlashGet\jc_all.htm
IE: Закачать при помощи FlashGet - e:\program files\FlashGet\jc_link.htm
TCP: {032C0615-A66C-40E8-93D9-D8FC4E51A6B9} = 77.121.32.2
DPF: {66D393D5-4D80-497C-9F4F-F3839E090202} - hxxp://www.pysoft.com/Downloads/WebCamPlayerOCX.cab
FF - ProfilePath - c:\documents and settings\Konstantin\Application Data\Mozilla\Firefox\Profiles\1g8om9ig.default\
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
f:\program files\Ѓа*㧥ал\FireFox 3.6.3\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
f:\program files\Ѓа*㧥ал\FireFox 3.6.3\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2010-10-29 07:14
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(3296)
c:\windows\system32\WININET.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\tcpsvcs.exe
f:\program files\Alcohol 120\StarWind\StarWindService.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-10-29 07:18:14 - machine was rebooted
ComboFix-quarantined-files.txt 2010-10-29 04:18
ComboFix2.txt 2010-10-28 18:55
Pre-Run: 1*023*082*496 байт свободно
Post-Run: 1*011*941*376 байт свободно
Current=4 Default=4 Failed=3 LastKnownGood=6 Sets=1,2,3,4,5,6
- - End Of File - - 8B71F931E10B4048A715267A3D8C50CE
