Malwarebytes' Anti-Malware лог:
Malwarebytes' Anti-Malware 1.32
Версия базы данных: 1634
Windows 5.1.2600 Service Pack 3
09.01.2009 20:46:38
mbam-log-2009-01-09 (20-46-38).txt
Тип проверки: Полная (C:\|D:\|E:\|F:\|G:\|H:\|I:\|)
Проверено объектов: 146294
Прошло времени: 2 hour(s), 39 minute(s), 21 second(s)
Заражено процессов в памяти: 0
Заражено модулей в памяти: 0
Заражено ключей реестра: 3
Заражено значений реестра: 0
Заражено параметров реестра: 0
Заражено папок: 0
Заражено файлов: 1
Заражено процессов в памяти:
(Вредоносные программы не обнаружены)
Заражено модулей в памяти:
(Вредоносные программы не обнаружены)
Заражено ключей реестра:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\utixnda4 (Worm.Bagel) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\utixnda4 (Worm.Bagel) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\utixnda4 (Worm.Bagel) -> Quarantined and deleted successfully.
Заражено значений реестра:
(Вредоносные программы не обнаружены)
Заражено параметров реестра:
(Вредоносные программы не обнаружены)
Заражено папок:
(Вредоносные программы не обнаружены)
Заражено файлов:
D:\WINDOWS\SYSTEM32\DRIVERS\utixnda4.sys (Worm.Bagel) -> Quarantined and deleted successfully.
Combo-fix лог:
ComboFix 09-01-09.03 - born 2009-01-10 13:55:42.3 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.128.9 [GMT 2:00]
Running from: d:\documents and settings\born\Рабочий стол\ComboFix.exe
Command switches used :: d:\documents and settings\born\Рабочий стол\WindowsXP-KB310994-SP2-Pro-BootDisk-RUS.exe
AV: Антивирусная система Eset NOD32 2.70 *On-access scanning disabled* (Outdated)
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2008-12-10 to 2009-01-10 )))))))))))))))))))))))))))))))
.
2009-01-09 17:08 . 2009-01-09 17:08 <DIR> d-------- d:\program files\Malwarebytes' Anti-Malware
2009-01-09 17:08 . 2009-01-09 17:08 <DIR> d-------- d:\documents and settings\BORN\Application Data\Malwarebytes
2009-01-09 17:08 . 2009-01-09 17:08 <DIR> d-------- d:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-09 17:08 . 2009-01-04 18:38 38,496 --a------ d:\windows\SYSTEM32\DRIVERS\mbamswissarmy.sys
2009-01-09 17:08 . 2009-01-04 18:38 15,504 --a------ d:\windows\SYSTEM32\DRIVERS\mbam.sys
2009-01-09 16:57 . 2009-01-09 16:57 <DIR> d-------- d:\program files\Far
2009-01-09 16:49 . 2009-01-09 16:49 11,264 --a------ d:\windows\SYSTEM32\DRIVERS\uzixnda4.sys
2009-01-09 16:42 . 2009-01-09 16:42 <DIR> d-------- d:\program files\RegCleaner
2009-01-09 16:02 . 2009-01-09 16:05 952 --ahs---- d:\windows\SYSTEM32\KGyGaAvL.sys
2009-01-09 15:51 . 2009-01-09 15:51 <DIR> d-------- d:\program files\PowerQuest
2009-01-09 15:24 . 2009-01-09 15:24 <DIR> d-------- d:\program files\Foxit Software
2009-01-09 14:26 . 2009-01-10 00:01 32 --ahs---- d:\windows\SYSTEM32\DRIVERS\fidbox.idx
2009-01-09 14:26 . 2009-01-10 00:01 32 --ahs---- d:\windows\SYSTEM32\DRIVERS\fidbox.dat
2009-01-09 14:24 . 2009-01-09 14:24 <DIR> d-------- D:\1
2009-01-08 18:50 . 2009-01-08 18:50 <DIR> d-------- D:\2
2009-01-08 18:19 . 2009-01-08 18:19 <DIR> d-------- d:\documents and settings\LocalService\Главное меню
2009-01-08 18:00 . 2008-07-08 13:54 148,496 --a------ d:\windows\SYSTEM32\DRIVERS\
09492094.sys
2009-01-08 17:44 . 2009-01-08 17:44 <DIR> d-------- d:\windows\SYSTEM32\ru-ru
2009-01-08 17:42 . 2009-01-08 17:42 <DIR> d-------- d:\windows\ServicePackFiles
2009-01-08 17:36 . 2006-12-29 00:31 19,569 --a------ d:\windows\
002711_.tmp
2009-01-08 17:31 . 2009-01-08 17:31 <DIR> d-------- d:\windows\EHome
2009-01-08 15:25 . 2009-01-08 15:25 <DIR> d-------- d:\program files\uTorrent
2009-01-08 15:24 . 2009-01-08 15:25 <DIR> d-------- d:\documents and settings\BORN\Application Data\uTorrent
2009-01-08 14:02 . 2007-08-19 03:33 77,824 --a------ d:\windows\SYSTEM32\IeBlinder.dll
2009-01-04 21:49 . 2009-01-08 17:07 68 --a------ d:\windows\SYSTEM32\o
2008-12-27 23:36 . 2008-12-27 23:36 <DIR> d-------- d:\program files\Cossacks - The Art Of War
2008-12-27 23:23 . 2007-11-02 19:33 1,602,240 --a------ d:\windows\uncsetup.exe
2008-12-27 18:15 . 2007-11-02 19:34 1,895,104 --a------ d:\windows\una2setup.exe
2008-12-27 16:26 . 2007-11-02 19:34 1,891,008 --a------ d:\windows\unasetup.exe
2008-12-27 16:26 . 2008-12-27 16:26 53,248 --a------ d:\windows\SYSTEM32\unrar.dll
2008-12-23 17:20 . 2008-12-23 17:20 <DIR> d-------- d:\documents and settings\BORN\Application Data\PRMT
2008-12-15 13:31 . 2008-12-15 13:31 512,096 --a------ d:\windows\SYSTEM32\DRIVERS\amon.sys
2008-12-15 13:31 . 2008-12-15 13:31 298,104 --a------ d:\windows\SYSTEM32\imon.dll
2008-12-15 13:31 . 2008-12-15 13:31 15,424 --a------ d:\windows\SYSTEM32\DRIVERS\nod32drv.sys
2008-12-11 19:50 . 2008-12-11 19:50 <DIR> d-------- d:\program files\QIP
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-16 19:06 --------- d-----w d:\documents and settings\born\Application Data\Winamp
2008-11-13 18:35 --------- d-----w d:\program files\Opera
2008-11-13 16:00 --------- d-----w d:\program files\Process Killer
2008-11-13 15:20 --------- d-----w d:\program files\DrWeb
2008-11-13 15:13 --------- d-----w d:\documents and settings\born\Application Data\InstallShield
2008-11-11 18:27 --------- d-----w d:\program files\Unlocker
2008-11-11 18:06 --------- d-----w d:\documents and settings\All Users\Application Data\PrevxCSI
2008-11-11 14:02 --------- d-----w d:\program files\ESET
2008-10-16 12:13 202,776 ----a-w d:\windows\SYSTEM32\wuweb.dll
2008-10-16 12:13 1,809,944 ----a-w d:\windows\SYSTEM32\wuaueng.dll
2008-10-16 12:12 561,688 ----a-w d:\windows\SYSTEM32\wuapi.dll
2008-10-16 12:12 323,608 ----a-w d:\windows\SYSTEM32\wucltui.dll
2008-10-16 12:09 92,696 ----a-w d:\windows\SYSTEM32\cdm.dll
2008-10-16 12:09 51,224 ----a-w d:\windows\SYSTEM32\wuauclt.exe
2008-10-16 12:09 43,544 ----a-w d:\windows\SYSTEM32\wups2.dll
2008-10-16 12:08 34,328 ----a-w d:\windows\SYSTEM32\wups.dll
2007-10-18 15:42 17,320 ----a-w d:\documents and settings\born\Application Data\GDIPFONTCACHEV1.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Punto Switcher"="d:\program files\Punto Switcher\ps.exe" [2002-12-05 198656]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UnlockerAssistant"="d:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]
"Process Killer"="d:\program files\Process Killer\prkiller.exe" [2005-07-30 38400]
"nod32kui"="d:\program files\Eset\nod32kui.exe" [2008-12-15 949376]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
d:\documents and settings\BORN\ѓ«*ў*®Ґ ¬Ґ*о\Џа®Ја*¬¬л\Ђўв®§*Јаг§Є*\
is-MNR8O.lnk - d:\documents and settings\born\ђ*Ў®зЁ© бв®«\Virus Removal Tool\is-MNR8O\startup.exe [08.01.2009 18:07:52 65536]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"= ctwdm32.dll
"vidc.3ivx"= 3ivxVfWCodec.dll
"vidc.3iv2"= 3ivxVfWCodec.dll
"msacm.divxa32"= divxa32.acm
"VIDC.HFYU"= huffyuv.dll
"VIDC.i263"= i263_32.drv
"msacm.imc"= imc32.acm
"VIDC.VP31"= vp31vfw.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\uTorrent\\uTorrent.exe"=
R1 cdawdm;CDAWDM;d:\windows\SYSTEM32\DRIVERS\CDAWDM.SYS [29.03.2008 12:15:23 46735]
R1 is-MNR8Odrv;is-MNR8Odrv;d:\windows\SYSTEM32\DRIVERS\
09492094.sys [08.01.2009 18:00:35 148496]
R1 nod32drv;nod32drv;d:\windows\SYSTEM32\DRIVERS\nod32drv.sys [15.12.2008 13:31:33 15424]
R1 uzixnda4;AVZ-RK Kernel Driver;d:\windows\SYSTEM32\DRIVERS\uzixnda4.sys [09.01.2009 16:49:09 11264]
R1 VENABLER;VENABLER;d:\windows\SYSTEM32\DRIVERS\VENABLER.SYS [05.05.2008 21:58:31 7217]
R3 FsHotKey;FsHotKey;d:\windows\SYSTEM32\DRIVERS\FSHOTKEY.SYS [29.03.2008 12:15:23 3855]
R3 mirrorv3;mirrorv3;d:\windows\SYSTEM32\DRIVERS\rminiv3.sys [01.11.2006 6:01:56 3328]
R4 hl_mull;hl_mull;d:\windows\SYSTEM32\DRIVERS\hl_mull.sys [22.06.2008 17:18:11 67712]
S3 NtApm;Драйвер интерфейса NT Apm/Legacy;d:\windows\SYSTEM32\DRIVERS\NtApm.sys [29.03.2008 12:15:26 9472]
S3 viafilter;VIA USB Filter;d:\windows\SYSTEM32\DRIVERS\viausb1.sys [05.05.2008 21:47:27 9728]
S4 haspflt;haspflt;d:\windows\SYSTEM32\DRIVERS\haspflt.sys [22.06.2008 18:10:44 29024]
--- Other Services/Drivers In Memory ---
*Deregistered* - raddrvv3
.
Contents of the 'Scheduled Tasks' folder
2009-01-10 d:\windows\Tasks\Symantec NetDetect.job
- d:\program files\Symantec\LiveUpdate\NDETECT.EXE []
.
.
------- Supplementary Scan -------
.
uStart Page = about
:blank
IE: &Экспорт в Microsoft Excel - d:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: {{7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - i:\progs\Translaters\Promt\PRMTIE\prmtie5.htm
IE: {{7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - i:\progs\Translaters\Promt\PRMTIE\options.htm
IE: {{A5C181DB-CF6E-441C-A6AC-482700A98CFD} - {0A0DBB4F-AA8B-4087-87CA-022A5F0698FB} - d:\windows\system32\IeBlinder.dll
IE: {{EF326744-4CBB-4579-83B0-040BE095A9F4} - {0A0DBB4F-AA8B-4086-87CA-022A5F0698FB} - d:\windows\system32\IeBlinder.dll
LSP: d:\windows\System32\imon.dll
TCP: {ADD77CD3-32C9-4745-9EBA-B913419BC86C} = 192.168.1.1
TCP: {DC3F57A0-FE0A-4B3F-A733-EDA52EA1057E} = 195.5.46.12 195.5.46.11
O16 -: DirectAnimation Java Classes - file://d:\windows\Java\classes\dajava.cab
d:\windows\Downloaded Program Files\DirectAnimation Java Classes.osd
O16 -: Microsoft XML Parser for Java - file://d:\windows\Java\classes\xmldso.cab
d:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2009-01-10 13:58:21
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'lsass.exe'(576)
d:\windows\System32\imon.dll
.
Completion time: 2009-01-10 14:00:24
ComboFix-quarantined-files.txt 2009-01-10 12:00:18
ComboFix3.txt 2009-01-09 21:37:16
ComboFix2.txt 2009-01-10 11:09:14
Pre-Run: 747*356*160 байт свободно
Post-Run: 738,123,776 байт свободно
WindowsXP-KB310994-SP2-Pro-BootDisk-RUS.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional RU" /fastdetect /NoExecute=OptIn
C:\="Microsoft Windows 98"
163 --- E O F --- 2009-01-08 15:01:04
высылаю новые avptool_syscheck.zip и hijackthis
проблемма с нодом осталась(
