ComboFix 13-03-30.01 - Ждан 30.03.2013 22:28:22.1.4 - x86 Microsoft Windows 7 Максимальная 6.1.7601.1.1251.7.1049.18.3235.2241 [GMT 4:00] Running from: c:\users\¦фрэ\Desktop\ComboFix.exe AV: ESET Endpoint Antivirus 5.0 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1} SP: ESET Endpoint Antivirus 5.0 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C} SP: IObit Malware Fighter *Disabled/Updated* {A751AC20-3B48-5237-898A-78C4436BB78D} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\7Loader.TAG c:\windows\Downloaded Program Files\IDropPTB.dll c:\windows\PFRO.log c:\windows\system32\d2d1debug1.dll c:\windows\system32\roboot.exe c:\windows\TEMP\catchme.dll d:\documents\TombRaider.log D:\install.exe . . ((((((((((((((((((((((((( Files Created from 2013-02-28 to 2013-03-30 ))))))))))))))))))))))))))))))) . . 2013-03-30 18:43 . 2013-03-30 18:43 -------- d-----w- c:\users\Ждан\AppData\Local\temp 2013-03-30 18:43 . 2013-03-30 18:43 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp 2013-03-29 20:18 . 2013-03-29 20:18 -------- d-----w- c:\users\Ждан\AppData\Roaming\Malwarebytes 2013-03-29 20:18 . 2013-03-29 20:18 -------- d-----w- c:\programdata\Malwarebytes 2013-03-29 20:18 . 2013-03-29 20:18 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2013-03-29 20:18 . 2012-12-14 12:49 21104 ----a-w- c:\windows\system32\drivers\mbam.sys 2013-03-27 09:57 . 2013-03-27 09:58 -------- d-----w- c:\program files\trend micro 2013-03-27 09:57 . 2013-03-27 09:58 -------- d-----w- C:\rsit 2013-03-27 09:27 . 2009-07-14 07:15 288256 ----a-w- c:\windows\KernelBase.dll 2013-03-27 08:00 . 2013-03-27 08:00 -------- d-----w- c:\program files\Common Files\Java 2013-03-27 08:00 . 2013-03-27 07:58 861088 ----a-w- c:\windows\system32\npDeployJava1.dll 2013-03-27 08:00 . 2013-03-27 07:58 782240 ----a-w- c:\windows\system32\deployJava1.dll 2013-03-27 07:59 . 2013-03-27 07:59 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll 2013-03-27 07:58 . 2013-03-27 07:58 -------- d-----w- c:\program files\Java 2013-03-27 07:03 . 2013-02-10 03:20 892704 ----a-w- c:\windows\system32\nvdispgenco3220162.dll 2013-03-27 07:03 . 2013-02-10 03:20 1012512 ----a-w- c:\windows\system32\nvdispco3220294.dll 2013-03-26 16:17 . 2013-03-15 07:21 7108640 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{18A7F2CB-2947-42ED-81AB-6C4A07500349}\mpengine.dll 2013-03-26 16:04 . 2012-08-22 17:16 712048 ----a-w- c:\windows\system32\drivers\ndis.sys 2013-03-26 16:04 . 2012-07-04 19:45 33280 ----a-w- c:\windows\system32\drivers\RNDISMP.sys 2013-03-26 16:04 . 2012-05-04 09:59 514560 ----a-w- c:\windows\system32\qdvd.dll 2013-03-26 16:04 . 2011-03-25 02:57 43008 ----a-w- c:\windows\system32\drivers\usbehci.sys 2013-03-26 16:04 . 2011-03-25 02:58 258560 ----a-w- c:\windows\system32\drivers\usbhub.sys 2013-03-26 16:04 . 2011-03-25 02:58 284672 ----a-w- c:\windows\system32\drivers\usbport.sys 2013-03-26 16:04 . 2011-03-25 02:57 24064 ----a-w- c:\windows\system32\drivers\usbuhci.sys 2013-03-26 16:04 . 2011-03-25 02:58 75776 ----a-w- c:\windows\system32\drivers\usbccgp.sys 2013-03-26 16:04 . 2011-03-25 02:57 20480 ----a-w- c:\windows\system32\drivers\usbohci.sys 2013-03-26 16:04 . 2011-03-25 02:57 5888 ----a-w- c:\windows\system32\drivers\usbd.sys 2013-03-26 16:03 . 2011-12-30 05:27 478720 ----a-w- c:\windows\system32\timedate.cpl 2013-03-26 16:02 . 2012-08-31 17:18 1211760 ----a-w- c:\windows\system32\drivers\ntfs.sys 2013-03-26 15:30 . 2013-03-26 15:30 -------- d-----w- c:\program files\Mozilla Maintenance Service 2013-03-25 21:00 . 2013-02-12 03:32 15872 ----a-w- c:\windows\system32\drivers\usb8023.sys 2013-03-19 18:42 . 2013-03-19 18:42 75136 ----a-w- c:\windows\system32\PnkBstrA.exe 2013-03-19 18:42 . 2013-03-19 18:04 3123272 ----a-w- c:\windows\system32\pbsvc.exe 2013-03-17 10:59 . 2013-03-17 10:59 -------- d-----w- c:\users\Ждан\AppData\Roaming\Ubisoft 2013-03-17 10:58 . 2013-03-17 10:58 -------- d-----w- c:\programdata\Solidshield 2013-03-11 21:00 . 2013-03-11 21:00 -------- d-----w- c:\users\Ждан\AppData\Local\DOSBox 2013-03-09 15:36 . 2013-03-09 15:36 -------- d-----w- c:\users\Ждан\AppData\Roaming\Warner Bros. Interactive Entertainment 2013-03-05 15:53 . 2007-04-04 14:53 81768 ----a-w- c:\windows\system32\xinput1_3.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-03-30 14:43 . 2012-12-06 20:27 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2013-03-30 14:43 . 2012-12-06 00:56 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-03-19 18:42 . 2013-01-03 11:37 189248 ----a-w- c:\windows\system32\PnkBstrB.exe 2013-03-15 05:46 . 2012-12-06 00:12 205184 ----a-w- c:\windows\system32\nvinit.dll 2013-03-15 02:59 . 2012-12-06 00:13 4119328 ----a-w- c:\windows\system32\nvcpl.dll 2013-03-15 02:59 . 2012-12-06 00:13 3014432 ----a-w- c:\windows\system32\nvsvc.dll 2013-03-15 02:59 . 2012-12-06 00:13 634144 ----a-w- c:\windows\system32\nvvsvc.exe 2013-03-15 02:59 . 2012-12-06 00:13 2555168 ----a-w- c:\windows\system32\nvsvcr.dll 2013-03-15 02:59 . 2012-12-06 00:13 864544 ----a-w- c:\windows\system32\nv3dappshext.dll 2013-03-15 02:59 . 2012-12-06 00:13 75552 ----a-w- c:\windows\system32\nv3dappshextr.dll 2013-03-15 02:59 . 2012-12-06 00:13 62752 ----a-w- c:\windows\system32\nvshext.dll 2013-03-15 02:59 . 2012-12-06 00:13 223008 ----a-w- c:\windows\system32\nvmctray.dll 2013-02-05 14:08 . 2013-02-05 14:08 2478048 ----a-w- c:\programdata\Microsoft\VisualStudio\11.0\1049\ResourceCache.dll 2013-02-05 09:37 . 2012-12-06 01:19 11264 ----a-w- c:\windows\system32\drivers\uzeymjq1.sys 2013-01-19 16:55 . 2013-01-03 11:55 138032 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys 2013-01-19 16:54 . 2013-01-03 11:55 281688 ----a-w- c:\windows\system32\PnkBstrB.xtr 2013-01-16 21:28 . 2012-12-06 19:08 232336 ------w- c:\windows\system32\MpSigStub.exe 2013-01-15 14:49 . 2013-02-19 21:34 23872 ----a-w- c:\windows\system32\RegistryDefragBootTime.exe 2013-01-08 22:11 . 2013-02-27 15:35 1800704 ----a-w- c:\windows\system32\jscript9.dll 2013-01-08 22:03 . 2013-02-27 15:35 1129472 ----a-w- c:\windows\system32\wininet.dll 2013-01-08 22:03 . 2013-02-27 15:35 1427968 ----a-w- c:\windows\system32\inetcpl.cpl 2013-01-08 21:59 . 2013-02-27 15:35 142848 ----a-w- c:\windows\system32\ieUnatt.exe 2013-01-08 21:58 . 2013-02-27 15:35 420864 ----a-w- c:\windows\system32\vbscript.dll 2013-01-08 21:56 . 2013-02-27 15:35 2382848 ----a-w- c:\windows\system32\mshtml.tlb 2013-01-08 21:08 . 2013-01-08 21:08 242240 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys 2013-01-07 23:48 . 2013-01-03 11:37 281688 ----a-w- c:\windows\system32\PnkBstrB.ex0 2013-01-05 05:00 . 2013-02-21 21:34 3967848 ----a-w- c:\windows\system32\ntkrnlpa.exe 2013-01-05 05:00 . 2013-02-21 21:34 3913064 ----a-w- c:\windows\system32\ntoskrnl.exe 2013-01-04 04:50 . 2013-02-20 10:47 169984 ----a-w- c:\windows\system32\winsrv.dll 2013-01-04 03:00 . 2013-02-21 21:36 2347008 ----a-w- c:\windows\system32\win32k.sys 2013-01-03 05:05 . 2013-02-21 21:34 1293672 ----a-w- c:\windows\system32\drivers\tcpip.sys 2013-01-03 05:04 . 2013-02-21 21:34 187752 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS 2013-03-07 14:30 . 2013-03-26 15:29 263064 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ------- Sigcheck ------- Note: Unsigned files aren't necessarily malware. . [-] 2012-12-07 . 7BD7F45FF37FA0669CD32CA0EF46E22C . 811520 . . [6.1.7601.17514] . . c:\windows\System32\user32.dll [7] 2010-11-20 . F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 . 811520 . . [6.1.7601.17514] . . c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1] @="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}" [HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}] 2013-01-05 23:49 222712 ----a-w- c:\users\Ждан\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\SkyDriveShell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2] @="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}" [HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}] 2013-01-05 23:49 222712 ----a-w- c:\users\Ждан\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\SkyDriveShell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3] @="{BBACC218-34EA-4666-9D7A-C78F2274A524}" [HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}] 2013-01-05 23:49 222712 ----a-w- c:\users\Ждан\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\SkyDriveShell.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016] "DAEMON Tools Lite"="d:\program files\DAEMON Tools Lite\DTLite.exe" [2012-04-11 3672384] "NokiaPCInternetAccess"="c:\program files\Nokia\PC Internet Access\NPCIA.exe" [2009-09-17 663552] "Steam"="d:\program files\Steam\steam.exe" [2013-03-26 1631144] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2013-01-08 18705664] "Download Master"="d:\program files\Download Master\dmaster.exe" [2012-12-24 4267960] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\ssmmgr.exe" [2009-08-15 614400] "egui"="c:\program files\ESET\ESET Endpoint Antivirus\egui.exe" [2012-07-04 3154464] "Nvtmru"="c:\program files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-01-19 1129248] "IObit Malware Fighter"="c:\program files\IObit\IObit Malware Fighter\IMF.exe" [2012-12-25 4474832] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\System32\nvinit.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice] @="Service" . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 6] 2013-01-15 14:47 491840 ----a-w- c:\program files\IObit\Advanced SystemCare 6\ASCTray.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BTMTrayAgent] 2012-03-27 03:01 10881296 ----a-w- c:\program files\Intel\Bluetooth\btmshell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FeedDemon] 2012-05-05 03:19 7500288 ----a-w- d:\program files\FeedDemon\FeedDemon.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyDrive] 2013-01-05 23:49 255992 ----a-w- c:\users\Ждан\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmartRAM] 2013-01-15 14:48 547648 ----a-w- c:\program files\IObit\Advanced SystemCare 6\Suo10_SmartRAM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "2Gis Update Notifier"="c:\program files\2gis\3.0\2GISTrayNotifier.exe" -delayed_start "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "BLEServicesCtrl"=c:\program files\Intel\Bluetooth\BleServicesCtrl.exe "IAStorIcon"=c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe "c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" 60 "USB3MON"="c:\program files\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" "RTHDVCPL"=c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe -s "ETDCtrl"=%ProgramFiles%\Elantech\ETDCtrl.exe "NeroFilterCheck"=c:\windows\system32\NeroCheck.exe "HotKeysCmds"=c:\windows\system32\hkcmd.exe "Persistence"=c:\windows\system32\igfxpers.exe "IgfxTray"=c:\windows\system32\igfxtray.exe . R2 ICNetTrafficControl;A?aeaa? eiio?iy o?aooeea Internet;c:\windows\system32\drivers\icnet.sys [x] R3 2GISUpdateService;2GIS UpdateService;c:\program files\2gis\3.0\2GISUpdateService.exe [x] R3 AMPPALP;Протокол Intel® Centrino® Wireless Bluetooth® + High Speed;c:\windows\system32\DRIVERS\amppal.sys [x] R3 AMPPALR3;Intel® Centrino® Wireless Bluetooth® + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [x] R3 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files\Intel\Bluetooth\devmonsrv.exe [x] R3 Bluetooth Media Service;Bluetooth Media Service;c:\program files\Intel\Bluetooth\mediasrv.exe [x] R3 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files\Intel\Bluetooth\obexsrv.exe [x] R3 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [x] R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x] R3 ESHASRV;ESET SHA Service;c:\program files\ESET\ESET Endpoint Antivirus\EShaSrv.exe [x] R3 Guard.Mail.ru;Guard.Mail.ru;c:\program files\Mail.Ru\Guard\GuardMailRu.exe [x] R3 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x] R3 IconMan_R;IconMan_R;c:\program files\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x] R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x] R3 PanService;PandoraService;c:\program files\PANDORA.TV\PanService\PandoraService.exe [x] R3 Qualcomm Atheros Killer Service;Qualcomm Atheros Killer Service;c:\program files\Qualcomm Atheros\Killer Network Manager\BFNService.exe [x] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x] R3 Te.Service;Te.Service;c:\program files\Windows Kits\8.0\Testing\Runtimes\TAEF\Wex.Services.exe [x] R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x] R3 WatAdminSvc;Служба технологий активации Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 ZeroConfigService;Intel(R) PROSet/Wireless Zero Configuration Service;c:\program files\Intel\WiFi\bin\ZeroConfigService.exe [x] R4 AdvancedSystemCareService6;Advanced SystemCare Service 6;c:\program files\IObit\Advanced SystemCare 6\ASCService.exe [x] R4 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x] S0 iusb3hcs;Драйвер хост-контроллера и коммутатора Intel(R) USB 3.0;c:\windows\system32\DRIVERS\iusb3hcs.sys [x] S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [x] S1 BfLwf;Bigfoot Networks Bandwidth Control;c:\windows\system32\DRIVERS\bflwfx86.sys [x] S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x] S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x] S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x] S1 uzeymjq1;AVZ-RK Kernel Driver;c:\windows\system32\Drivers\uzeymjq1.sys [x] S2 ekrn;ESET Service;c:\program files\ESET\ESET Endpoint Antivirus\ekrn.exe [x] S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [x] S2 IMFservice;IMF Service;c:\program files\IObit\IObit Malware Fighter\IMFsrv.exe [x] S2 mitsijm2012;Диспетчер заданий Autodesk Moldflow Inventor Tool Suite Integration 2012;d:\program files\Autodesk\Inventor 2012\Moldflow\bin\mitsijm.exe [x] S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [x] S3 AMPPAL;Виртуальный адаптер Intel® Centrino® Wireless Bluetooth® + High Speed;c:\windows\system32\DRIVERS\AMPPAL.sys [x] S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [x] S3 FileMonitor;FileMonitor;c:\program files\IObit\IObit Malware Fighter\Drivers\win7_x86\FileMonitor.sys [x] S3 IntcDAud;Аудио Intel(R) для дисплеев;c:\windows\system32\DRIVERS\IntcDAud.sys [x] S3 iusb3hub;Драйвер концентратора Intel(R) USB 3.0;c:\windows\system32\DRIVERS\iusb3hub.sys [x] S3 iusb3xhc;Драйвер расширяемого хост-контроллера Intel(R) USB 3.0;c:\windows\system32\DRIVERS\iusb3xhc.sys [x] S3 L1C;NDIS Miniport Driver for the Killer e2200 PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\e22w7x86.sys [x] S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt32.sys [x] S3 MEI;Intel(R) Management Engine Interface ;c:\windows\system32\DRIVERS\HECI.sys [x] S3 NETwNs32;___ Драйвер адаптера Intel(R) Wireless WiFi Link серии 5000 для Windows 7 32 Bit ;c:\windows\system32\DRIVERS\Netwsn00.sys [x] S3 RegFilter;RegFilter;c:\program files\IObit\IObit Malware Fighter\drivers\win7_x86\regfilter.sys [x] S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys [x] S3 UrlFilter;UrlFilter;c:\program files\IObit\IObit Malware Fighter\drivers\win7_x86\UrlFilter.sys [x] . . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.mail.ru/cnt/7829 IE: &Экспорт в Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Закачать ВСЕ при помощи Download Master - d:\program files\Download Master\dmieall.htm IE: Закачать при помощи Download Master - d:\program files\Download Master\dmie.htm IE: Передать на удаленную закачку DM - d:\program files\Download Master\remdown.htm LSP: %SYSTEMROOT%\system32\BfLLR.dll TCP: DhcpNameServer = 192.168.3.1 FF - ProfilePath - c:\users\Ждан\AppData\Roaming\Mozilla\Firefox\Profiles\cv0wkgjm.default\ FF - ExtSQL: 2013-03-26 19:42; {fe272bd1-5f76-4ea4-8501-a05d35d823fc}; c:\users\Ждан\AppData\Roaming\Mozilla\Firefox\Profiles\cv0wkgjm.default\extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi FF - ExtSQL: 2013-03-26 19:42; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\Ждан\AppData\Roaming\Mozilla\Firefox\Profiles\cv0wkgjm.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi FF - ExtSQL: 2013-03-26 19:42; elemhidehelper@adblockplus.org; c:\users\Ждан\AppData\Roaming\Mozilla\Firefox\Profiles\cv0wkgjm.default\extensions\elemhidehelper@adblockplus.org.xpi FF - ExtSQL: 2013-03-26 19:44; treestyletab@piro.sakura.ne.jp; c:\users\Ждан\AppData\Roaming\Mozilla\Firefox\Profiles\cv0wkgjm.default\extensions\treestyletab@piro.sakura.ne.jp.xpi FF - ExtSQL: 2013-03-26 19:44; lazarus@interclue.com; c:\users\Ждан\AppData\Roaming\Mozilla\Firefox\Profiles\cv0wkgjm.default\extensions\lazarus@interclue.com.xpi FF - ExtSQL: 2013-03-26 19:44; adblockpopups@jessehakanen.net; c:\users\Ждан\AppData\Roaming\Mozilla\Firefox\Profiles\cv0wkgjm.default\extensions\adblockpopups@jessehakanen.net.xpi FF - ExtSQL: 2013-03-26 20:32; {73a6fe31-595d-460b-a920-fcc0f8843232}; c:\users\Ждан\AppData\Roaming\Mozilla\Firefox\Profiles\cv0wkgjm.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi FF - user.js: network.http.pipelining.maxrequests - 8 FF - user.js: network.http.request.max-start-delay - 0 FF - user.js: network.http.max-connections - 48 FF - user.js: network.http.max-connections-per-server - 16 FF - user.js: network.http.max-persistent-connections-per-proxy - 16 FF - user.js: network.http.max-persistent-connections-per-server - 8 FF - user.js: browser.turbo.enabled - true FF - user.js: browser.display.show_image_placeholders - true FF - user.js: browser.chrome.favicons - false FF - user.js: browser.urlbar.autocomplete.enabled - true FF - user.js: browser.cache.memory.capacity - 65536 FF - user.js: content.notify.ontimer - true FF - user.js: content.interrupt.parsing - true FF - user.js: content.max.tokenizing.time - 2250000 FF - user.js: content.switch.threshold - 750000 FF - user.js: plugin.expose_full_path - true FF - user.js: ui.submenuDelay - 0 . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\nvvsvc.exe c:\windows\system32\AUDIODG.EXE c:\windows\system32\WLANExt.exe c:\windows\system32\conhost.exe c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe c:\windows\system32\PnkBstrA.exe c:\program files\NVIDIA Corporation\Display\nvxdsync.exe c:\windows\system32\nvvsvc.exe c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe c:\windows\system32\taskhost.exe c:\program files\IObit\Advanced SystemCare 6\Monitor.exe c:\program files\NVIDIA Corporation\NVIDIA Update Core\ComUpdatus.exe c:\windows\system32\conhost.exe c:\program files\PC Connectivity Solution\ServiceLayer.exe c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe . ************************************************************************** . Completion time: 2013-03-30 22:48:51 - machine was rebooted ComboFix-quarantined-files.txt 2013-03-30 18:48 . Pre-Run: 38 213 943 296 байт свободно Post-Run: 38 079 885 312 байт свободно . - - End Of File - - ADF6346DFB8D36277BF0B669DDB48B53