1. Файл quarantine.zip отправил
2. Ссылка Вирустотал -
http://www.virustotal.com/file-scan/...c3e-1298857598
3. Логи прицепил
4. Сообщение MBAM
Код:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Database version: 5750
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
28.02.2011 9:22:36
mbam-log-2011-02-28 (09-22-12).txt
Scan type: Full scan (C:\|D:\|F:\|H:\|)
Objects scanned: 265063
Time elapsed: 16 minute(s), 47 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 9
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 1
Files Infected: 13
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{F0E06662-71F5-4fb0-A9A2-70DBA996EAC3} (Adware.LinkPlacing) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{4ECB0173-D952-42C3-802A-E3B04E5AD127} (Adware.LinkPlacing) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{CAFDA1CA-DD5F-41DC-BE5D-9E06E01E510C} (Adware.LinkPlacing) -> No action taken.
HKEY_CLASSES_ROOT\LinkPlacing.LPBHOImpl.1 (Adware.LinkPlacing) -> No action taken.
HKEY_CLASSES_ROOT\LinkPlacing.LPBHOImpl (Adware.LinkPlacing) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0E06662-71F5-4FB0-A9A2-70DBA996EAC3} (Adware.LinkPlacing) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{F0E06662-71F5-4FB0-A9A2-70DBA996EAC3} (Adware.LinkPlacing) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{F0E06662-71F5-4FB0-A9A2-70DBA996EAC3} (Adware.LinkPlacing) -> No action taken.
HKEY_CLASSES_ROOT\AppID\LinkPlacing.DLL (Adware.LinkPlacing) -> No action taken.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogoff (PUM.Hijack.StartMenu) -> Bad: (1) Good: (0) -> No action taken.
Folders Infected:
c:\documents and settings\User\application data\winxrar (Trojan.Agent) -> No action taken.
Files Infected:
c:\program files\ToolBHO\module.dll (Adware.LinkPlacing) -> No action taken.
c:\WINDOWS\system32\green fields 3d.scr (Malware.Packer.Gen) -> No action taken.
d:\Distr\site\wsex5files\keygen website x5 rus.exe (Trojan.Dropper.PGen) -> No action taken.
d:\мои документы\Проги\norton windoctor\Stubs\1727fadf1eabcb14d58c4ee39ebd78bacfe10ea\REGWDOC.EXE (Trojan.Backdoor) -> No action taken.
d:\мои документы\Проги\norton windoctor\Stubs\c4dedf3f4df0882dd06f93ca88316ea38192dce0\windoc.exe (Trojan.Backdoor) -> No action taken.
d:\мои документы\Проги\norton windoctor\Stubs\dbfaa46b6d7e2fdb8e943531ec634229cdd6ab19\SymUndo.exe (Trojan.Backdoor) -> No action taken.
c:\documents and settings\User\application data\winxrar\dot.gif (Trojan.Agent) -> No action taken.
c:\documents and settings\User\application data\winxrar\htmlayout.dll (Trojan.Agent) -> No action taken.
c:\documents and settings\User\application data\winxrar\key (Trojan.Agent) -> No action taken.
c:\documents and settings\User\application data\winxrar\left.png (Trojan.Agent) -> No action taken.
c:\documents and settings\User\application data\winxrar\rules.css (Trojan.Agent) -> No action taken.
c:\documents and settings\User\application data\winxrar\s.htm (Trojan.Agent) -> No action taken.
c:\documents and settings\User\application data\winxrar\sview (Trojan.Agent) -> No action taken.
Все, что нашел MBAM - убил. Надо было?
