[Zabejalo]

Pili, всё сделал. Отчет SDFix (report_) в прикреплённом файле.

Вот ComboFix 09-02-15.01 - Администратор 2009-02-19 14:15:30.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.2.1251.1.1049.18.1022.851 [GMT 3:00]
Running from: c:\documents and settings\Администратор\Рабочий стол\ComboFix.exe
Command switches used :: c:\documents and settings\Администратор\Рабочий стол\WindowsXP-KB310994-SP2-Pro-BootDisk-RUS.exe
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated)

читать дальше »

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system\oeminfo.ini

.
((((((((((((((((((((((((( Files Created from 2009-01-19 to 2009-02-19 )))))))))))))))))))))))))))))))
.

2009-02-19 14:06 . 2009-02-19 14:06 <DIR> d-------- c:\windows\ERUNT
2009-02-19 14:04 . 2007-05-23 12:13 <DIR> d--h----- c:\documents and settings\Администратор\Шаблоны
2009-02-19 14:04 . 2007-05-23 12:13 <DIR> d--h----- c:\documents and settings\Администратор\Шаблоны
2009-02-19 14:04 . 2009-02-19 14:12 <DIR> d-------- c:\documents and settings\Администратор\Рабочий стол
2009-02-19 14:04 . 2009-02-19 14:12 <DIR> d-------- c:\documents and settings\Администратор\Рабочий стол
2009-02-19 14:04 . 2007-05-23 16:07 <DIR> d-------- c:\documents and settings\Администратор\Мои документы
2009-02-19 14:04 . 2007-05-23 16:07 <DIR> d-------- c:\documents and settings\Администратор\Мои документы
2009-02-19 14:04 . 2007-05-23 16:07 <DIR> dr------- c:\documents and settings\Администратор\Главное меню
2009-02-19 14:04 . 2007-05-23 16:07 <DIR> dr------- c:\documents and settings\Администратор\Главное меню
2009-02-19 14:04 . 2009-02-19 14:04 <DIR> d-------- c:\documents and settings\Администратор\Избранное
2009-02-19 14:04 . 2009-02-19 14:04 <DIR> d-------- c:\documents and settings\Администратор\Избранное
2009-02-19 14:04 . 2009-02-19 14:04 <DIR> d-------- c:\documents and settings\Администратор
2009-02-18 16:22 . 2009-02-19 14:10 <DIR> d-------- C:\SDFix
2009-02-08 21:29 . 2009-02-08 21:29 11,264 --a------ c:\windows\system32\drivers\uzk0ndkx.sys
2009-02-07 19:15 . 2009-02-07 19:15 <DIR> d-------- c:\documents and settings\Admin\DoctorWeb
2009-02-07 13:24 . 2009-02-19 09:32 136,388,640 --ahs---- c:\windows\system32\drivers\fidbox.dat
2009-02-07 13:24 . 2009-02-19 09:32 1,600,424 --ahs---- c:\windows\system32\drivers\fidbox.idx
2009-01-30 11:07 . 2009-01-30 11:07 <DIR> d-------- c:\program files\ESET
2009-01-30 11:07 . 2009-01-30 11:07 <DIR> d-------- c:\documents and settings\All Users\Application Data\ESET
2009-01-27 12:27 . 2008-12-23 17:51 9,828 --a------ C:\EANG000.TTF
2009-01-27 12:20 . 2009-01-27 12:20 <DIR> d-------- c:\documents and settings\Admin\WINDOWS
2009-01-27 12:20 . 1997-06-02 12:15 298,496 --a------ c:\windows\unin0419.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-30 08:43 --------- d-----w c:\program files\Winamp
2009-01-30 08:35 --------- d-----w c:\program files\Common Files\ACD Systems
2009-01-27 09:22 --------- d-----w c:\program files\1Cv77Buh
.

------- Sigcheck -------

2004-09-17 14:16 503808 a975a70fcefe2a224412214320c89ded c:\windows\system32\winlogon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GEST"="m‘|\ь" [X]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-28 8466432]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-28 81920]
"CAP3ON"="c:\windows\system32\spool\drivers\w32x86\3\CAP3ONN.EXE" [2002-08-22 22528]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-11-10 1980200]
"RTHDCPL"="RTHDCPL.EXE" [2007-09-19 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2007-08-03 c:\windows\SkyTel.EXE]
"nwiz"="nwiz.exe" [2007-06-28 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]

c:\documents and settings\All Users\ѓ«*ў*®Ґ ¬Ґ*о\Џа®Ја*¬¬л\Ђўв®§*Јаг§Є*\
Canon LASER SHOT LBP-1120 тїуAзизц.LNK - c:\windows\system32\spool\drivers\w32x86\3\CAP3LAK.EXE [2008-09-01 30720]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2002-04-26 20:53 12288 c:\program files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\ALCMTR.EXE"=
"c:\\WINDOWS\\system32\\nwiz.exe"=
"c:\\WINDOWS\\system32\\userinit.exe"=
"c:\\WINDOWS\\RTHDCPL.EXE"=
"c:\\WINDOWS\\SkyTel.EXE"=

R1 uzk0ndkx;AVZ-RK Kernel Driver;c:\windows\system32\drivers\uzk0ndkx.sys [2009-02-08 11264]
S1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2008-11-10 104456]
S1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2008-11-10 92168]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-11-10 711240]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys --> e:\NTGLM7X.sys [?]
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-Trickler - c:\documents and settings\admin\local settings\temp\~vis0000\fsg_4104.exe



**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-19 14:16:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-02-19 14:17:05
ComboFix-quarantined-files.txt 2009-02-19 11:17:04

Pre-Run: 81*683*673*088 байт свободно
Post-Run: 81,677,623,296 байт свободно

109