PCTech Forums

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:25:02, on 18.02.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\VDOTool\TBPanel.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\WebMoney Agent\wmagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Documents and Settings\Ирина\Application Data\Mail.Ru\Agent\MAgent.exe
C:\Program Files\Auslogics\AusLogics BoostSpeed\boostspeed.exe
C:\Program Files\Download Master\dmaster.exe
C:\Program Files\Yandex\Online\online.exe
C:\Program Files\Yandex\Online\YaChat\yachat.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\AIMP2\AIMP2.exe
C:\Program Files\Maxthon\Maxthon.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Ссылки
R3 - URLSearchHook: (no name) - {83821C2B-32A8-4DD7-B6D4-44309A78E668} - C:\Documents and Settings\Ирина\Application Data\Mail.Ru\Agent\Mra\dll\newmrasearch.dll
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: IE 4.x-6.x BHO for Download Master - {9961627E-4059-41B4-8E0E-A7D6B3854ADF} - C:\PROGRA~1\DOWNLO~1\dmiehlp.dll
O3 - Toolbar: DM Bar - {0E1230F8-EA50-42A9-983C-D22ABC2EED3C} - C:\Program Files\Download Master\dmbar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Gainward] C:\Program Files\VDOTool\TBPanel.exe /A
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MAgent] C:\Program Files\Mail.Ru\Agent\MAgent.exe -LM
O4 - HKLM\..\Run: [wmagent.exe] "C:\Program Files\WebMoney Agent\wmagent.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MAgent] C:\Documents and Settings\Ирина\Application Data\Mail.Ru\Agent\MAgent.exe -CU
O4 - HKCU\..\Run: [Auslogics BoostSpeed 4] C:\Program Files\Auslogics\AusLogics BoostSpeed\boostspeed.exe
O4 - HKCU\..\Run: [Download Master] C:\Program Files\Download Master\dmaster.exe -autorun
O4 - HKCU\..\Run: [YandexOnline] "C:\Program Files\Yandex\Online\online.exe" -AutoStart
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: &Экспорт в Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Добавить в Анти-Баннер - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: Закачать ВСЕ при помощи Download Master - C:\Program Files\Download Master\dmieall.htm
O8 - Extra context menu item: Закачать при помощи Download Master - C:\Program Files\Download Master\dmie.htm
O9 - Extra button: Статистика защиты веб-трафика - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Mail.Ru Агент - {7558B7E5-7B26-4201-BEDB-00D5FF534523} - C:\Program Files\Mail.Ru\Agent\magent.exe
O9 - Extra 'Tools' menuitem: Mail.Ru Агент - {7558B7E5-7B26-4201-BEDB-00D5FF534523} - C:\Program Files\Mail.Ru\Agent\magent.exe
O9 - Extra button: Download Master - {8DAE90AD-4583-4977-9DD4-4360F7A45C74} - C:\Program Files\Download Master\dmaster.exe
O9 - Extra 'Tools' menuitem: &Download Master - {8DAE90AD-4583-4977-9DD4-4360F7A45C74} - C:\Program Files\Download Master\dmaster.exe
O9 - Extra button: Справочные материалы - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Mail.Ru Агент - {7558B7E5-7B26-4201-BEDB-00D5FF534523} - C:\Documents and Settings\Ирина\Application Data\Mail.Ru\Agent\magent.exe (HKCU)
O9 - Extra 'Tools' menuitem: Mail.Ru Агент - {7558B7E5-7B26-4201-BEDB-00D5FF534523} - C:\Documents and Settings\Ирина\Application Data\Mail.Ru\Agent\magent.exe (HKCU)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{74F16C80-08A0-4026-9F19-1D5F9E7981E7}: NameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = kg.ukrtelecom.net
O17 - HKLM\System\CS1\Services\Tcpip\..\{74F16C80-08A0-4026-9F19-1D5F9E7981E7}: NameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = kg.ukrtelecom.net
O17 - HKLM\System\CS2\Services\Tcpip\..\{74F16C80-08A0-4026-9F19-1D5F9E7981E7}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = kg.ukrtelecom.net
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Журнал событий (Eventlog) - Корпорация Майкрософт - C:\WINDOWS\system32\services.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Служба COM записи компакт-дисков IMAPI (ImapiService) - Корпорация Майкрософт - C:\WINDOWS\system32\imapi.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Plug and Play (PlugPlay) - Корпорация Майкрософт - C:\WINDOWS\system32\services.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: Смарт-карты (SCardSvr) - Корпорация Майкрософт - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Журналы и оповещения производительности (SysmonLog) - Корпорация Майкрософт - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Теневое копирование тома (VSS) - Корпорация Майкрософт - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Адаптер производительности WMI (WmiApSrv) - Корпорация Майкрософт - C:\WINDOWS\system32\wbem\wmiapsrv.exe

--
End of file - 10641 bytes

Hello jell,

I really don't see anything bad in your HJT log.

Are you experiencing a particular problem?

Hi, Gecko!
my spyware doctor found some "possible_website_hijacks" and can't fix it

jell,

Please download to your desktop.

Double click combofix.exe and follow the prompts.

Do not exit Combofix while it is running you my loose all your personal settings!
Important Note - Do not mouseclick combofix's window while it's running, that may cause it to stall.

When it's done running it will produce a log for you. Please post that log in your next reply.

ComboFix 09-02-19.01 - Ирина 2009-02-20 21:00:28.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1251.1.1049.18.1023.533 [GMT 2:00]
Running from: c:\documents and settings\Ирина\Рабочий стол\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)
AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated)
FW: Kaspersky Internet Security *disabled*
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Ирина\ravmonlog
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\program files\INSTALL.LOG
c:\windows\file.bat
c:\windows\system32\a.exe

----- BITS: Possible infected sites -----

hxxp://soft.export.yandex.ru
hxxp://download.yandex.ru
.
((((((((((((((((((((((((( Files Created from 2009-01-20 to 2009-02-20 )))))))))))))))))))))))))))))))
.

2009-02-20 15:15 . 2009-02-20 18:25 <DIR> dr-h----- c:\documents and settings\Ирина\Recent
2009-02-20 15:15 . 2009-02-20 18:25 <DIR> dr-h----- c:\documents and settings\Ирина\Recent
2009-02-18 20:35 . 2009-02-18 20:33 160,792 --a------ c:\windows\system32\drivers\pctfw2.sys
2009-02-18 20:05 . 2009-02-18 20:35 <DIR> d-------- c:\program files\Common Files\PC Tools
2009-02-18 20:05 . 2009-02-18 20:05 <DIR> d-------- c:\documents and settings\Ирина\Application Data\PC Tools
2009-02-18 20:05 . 2008-08-25 12:36 81,288 --a------ c:\windows\system32\drivers\iksyssec.sys
2009-02-18 20:05 . 2008-08-25 12:36 66,952 --a------ c:\windows\system32\drivers\iksysflt.sys
2009-02-18 20:05 . 2008-08-25 12:36 40,840 --a------ c:\windows\system32\drivers\ikfilesec.sys
2009-02-18 20:05 . 2008-06-02 16:19 29,576 --a------ c:\windows\system32\drivers\kcom.sys
2009-02-18 18:17 . 2009-02-18 18:17 <DIR> d-------- c:\documents and settings\Администратор\Application Data\Help
2009-02-18 17:51 . 2009-02-18 17:51 <DIR> d-------- c:\documents and settings\Администратор\Application Data\Opera
2009-02-18 17:24 . 2009-02-18 17:24 <DIR> d-------- c:\program files\Trend Micro
2009-02-18 13:32 . 2009-02-18 13:32 <DIR> d-------- c:\documents and settings\Ирина\DoctorWeb
2009-02-18 13:32 . 2009-02-18 13:32 <DIR> d-------- c:\documents and settings\Ирина\DoctorWeb
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> dr-h----- c:\documents and settings\Администратор\SendTo
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> dr-h----- c:\documents and settings\Администратор\SendTo
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> d--h----- c:\documents and settings\Администратор\Recent
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> d--h----- c:\documents and settings\Администратор\Recent
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> d--h----- c:\documents and settings\Администратор\PrintHood
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> d--h----- c:\documents and settings\Администратор\PrintHood
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> d--h----- c:\documents and settings\Администратор\NetHood
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> d--h----- c:\documents and settings\Администратор\NetHood
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> d-------- c:\documents and settings\Администратор\Рабочий стол
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> d-------- c:\documents and settings\Администратор\Рабочий стол
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> d-------- c:\documents and settings\Администратор\Мои документы
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> d-------- c:\documents and settings\Администратор\Мои документы
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> dr------- c:\documents and settings\Администратор\Главное меню
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> dr------- c:\documents and settings\Администратор\Главное меню
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> d-------- c:\documents and settings\Администратор\Избранное
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> d-------- c:\documents and settings\Администратор\Избранное
2009-02-18 10:33 . 2009-02-20 21:01 <DIR> d--h----- c:\documents and settings\Администратор\Local Settings
2009-02-18 10:33 . 2009-02-20 21:01 <DIR> d--h----- c:\documents and settings\Администратор\Local Settings
2009-02-18 10:33 . 2007-09-26 18:10 <DIR> d--hs---- c:\documents and settings\Администратор\Cookies
2009-02-18 10:33 . 2007-09-26 18:10 <DIR> d--hs---- c:\documents and settings\Администратор\Cookies
2009-02-18 10:33 . 2009-02-18 10:44 <DIR> d---s---- c:\documents and settings\Администратор\Application Data\Microsoft
2009-02-18 10:33 . 2009-02-18 17:51 <DIR> dr-h----- c:\documents and settings\Администратор\Application Data
2009-02-18 10:33 . 2009-02-18 17:51 <DIR> dr-h----- c:\documents and settings\Администратор\Application Data
2009-02-18 10:33 . 2009-02-18 10:44 <DIR> d--h----- c:\documents and settings\Администратор\Шаблоны
2009-02-18 10:33 . 2009-02-18 10:44 <DIR> d--h----- c:\documents and settings\Администратор\Шаблоны
2009-02-18 10:33 . 2009-02-18 18:20 <DIR> d-------- c:\documents and settings\Администратор
2009-02-18 10:33 . 2009-02-18 18:21 786,432 --ah----- c:\documents and settings\Администратор\NTUSER.DAT
2009-02-18 10:33 . 2009-02-18 18:21 786,432 --ah----- c:\documents and settings\Администратор\NTUSER.DAT
2009-02-17 19:23 . 2009-02-17 19:23 <DIR> d-------- c:\program files\TNR Vision 3.4
2009-02-15 19:34 . 2009-02-15 19:34 <DIR> d-------- c:\program files\Kachni-ka.ru
2009-02-09 04:32 . 2009-02-09 04:32 <DIR> d-------- c:\program files\Common Files\Windows Live
2009-02-08 18:04 . 2009-02-08 18:05 <DIR> d-------- c:\program files\Your Uninstaller 2008
2009-02-08 18:04 . 2009-02-08 18:04 <DIR> d-------- c:\documents and settings\Ирина\Application Data\URSoft
2009-02-07 18:56 . 2009-02-07 18:56 <DIR> d-------- c:\program files\ipSPACE
2009-02-06 23:22 . 2009-02-20 15:19 <DIR> d-------- c:\documents and settings\Ирина\Application Data\YaChatData
2009-02-06 23:20 . 2009-02-06 23:20 <DIR> d-------- c:\program files\Yandex
2009-02-06 23:20 . 2009-02-06 23:20 <DIR> d-------- c:\documents and settings\Ирина\Application Data\Yandex
2009-01-31 20:35 . 2009-02-03 19:44 101,287 --a------ c:\windows\system32\drivers\klin.dat
2009-01-31 20:35 . 2009-02-03 19:44 89,601 --a------ c:\windows\system32\drivers\klick.dat
2009-01-31 20:34 . 2009-01-31 20:34 <DIR> d-------- c:\program files\Kaspersky Lab
2009-01-31 20:34 . 2009-02-20 18:46 <DIR> d-------- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-01-31 20:34 . 2009-02-20 21:01 4,426,272 --ahs---- c:\windows\system32\drivers\fidbox.dat
2009-01-31 20:34 . 2009-02-20 21:01 548,896 --ahs---- c:\windows\system32\drivers\fidbox2.dat
2009-01-31 20:34 . 2009-02-20 21:01 36,708 --ahs---- c:\windows\system32\drivers\fidbox.idx
2009-01-31 20:34 . 2009-02-20 21:01 4,004 --ahs---- c:\windows\system32\drivers\fidbox2.idx
2009-01-24 10:40 . 2009-01-24 10:40 <DIR> d-------- c:\documents and settings\All Users\Application Data\PC Tools
2009-01-23 19:01 . 2009-01-29 18:24 760 --a-s---- c:\windows\system32\1081827863.dat
2009-01-21 11:50 . 2009-02-20 20:58 <DIR> d-------- c:\program files\Spyware Doctor

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-20 18:58 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-02-20 18:48 --------- d-----w c:\documents and settings\Ирина\Application Data\Skype
2009-02-20 16:45 --------- d-----w c:\documents and settings\Ирина\Application Data\skypePM
2009-02-20 13:23 --------- d-----w c:\program files\AIMP2
2009-02-18 16:21 786,432 ---ha-w c:\documents and settings\Администратор\NTUSER.DAT
2009-02-18 16:21 786,432 ---ha-w c:\documents and settings\Администратор\NTUSER.DAT
2009-02-18 16:17 --------- d-----w c:\documents and settings\Администратор\Application Data\Help
2009-02-18 15:51 --------- d-----w c:\documents and settings\Администратор\Application Data\Opera
2009-02-18 15:10 --------- d-----w c:\documents and settings\Ирина\Application Data\WebMoney
2009-02-18 08:44 --------- d-s---w c:\documents and settings\Администратор\Application Data\Microsoft
2009-02-09 02:33 --------- d-----w c:\program files\Download Master
2009-02-08 22:32 --------- d-----w c:\program files\Opera
2009-02-05 18:20 88 --sh--r c:\documents and settings\All Users\Application Data\C793956FC2.sys
2009-02-05 18:20 2,516 --sha-w c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2009-02-05 18:20 --------- d-----w c:\documents and settings\All Users\Application Data\Corel
2009-02-05 14:13 33,808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-01-30 13:25 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-01-30 11:38 --------- d-----w c:\program files\FlashGet
2009-01-28 17:20 --------- d-----w c:\documents and settings\Ирина\Application Data\Auslogics
2009-01-24 08:03 --------- d-----w c:\program files\WebMoney
2009-01-21 10:31 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-01-21 10:31 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-18 11:54 --------- d-----w c:\program files\Bullfrog
2009-01-15 17:09 --------- d-----w c:\program files\WebMoney Agent
2009-01-15 15:38 --------- d-----w c:\documents and settings\Гость\Application Data\Mra
2009-01-12 16:47 73,216 ----a-w c:\windows\ST6UNST.EXE
2009-01-12 16:47 307,200 ------w c:\windows\Setup1.exe
2008-12-24 17:29 --------- d-----w c:\program files\CCleaner
2008-12-21 16:58 --------- d-----w c:\program files\Auslogics
2007-12-09 19:09 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat
2007-07-26 20:47 66,408 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2007-07-26 20:47 54,112 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2007-07-26 20:47 34,688 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2007-07-26 20:47 46,456 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2007-07-26 20:47 171,880 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
.

------- Sigcheck -------

2006-04-20 14:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
2004-08-18 14:00 359040 9f4b36614a0fc234525ba224957de55c c:\windows\$NtUninstallKB917953$\tcpip.sys
2006-04-20 13:51 359808 021415ad071ef3944c27dc9597ed2214 c:\windows\system32\dllcache\tcpip.sys
2006-04-20 13:51 359808 021415ad071ef3944c27dc9597ed2214 c:\windows\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-18 15360]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-05-30 21718312]
"Auslogics BoostSpeed 4"="c:\program files\Auslogics\AusLogics BoostSpeed\boostspeed.exe" [2008-12-22 364144]
"Download Master"="c:\program files\Download Master\dmaster.exe" [2009-02-06 3769856]
"YandexOnline"="c:\program files\Yandex\Online\online.exe" [2009-01-22 2558728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Gainward"="c:\program files\VDOTool\TBPanel.exe" [2007-06-26 2165272]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-07-23 8466432]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-07-23 81920]
"MAgent"="c:\program files\Mail.Ru\Agent\MAgent.exe" [2008-02-02 4457976]
"wmagent.exe"="c:\program files\WebMoney Agent\wmagent.exe" [2008-10-01 209376]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-02-05 206088]
"RTHDCPL"="RTHDCPL.EXE" [2007-01-30 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"nwiz"="nwiz.exe" [2007-07-23 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-18 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ac3filter"= ac3filter.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Главное меню^Программы^Автозагрузка^Ускоренный запуск Adobe Reader.lnk]
path=c:\documents and settings\All Users\Главное меню\Программы\Автозагрузка\Ускоренный запуск Adobe Reader.lnk
backup=c:\windows\pss\Ускоренный запуск Adobe Reader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\ICQ6\\ICQ.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\FlashGet\\flashget.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"13646:TCP"= 13646:TCP:NortonAV
"16433:TCP"= 16433:TCP:NortonAV

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 33808]
R1 pctfw2;pctfw2;c:\windows\system32\drivers\pctfw2.sys [2009-02-18 160792]
R1 prodrv04;Star Force copy protection driver v4;c:\windows\system32\drivers\prodrv04.sys [2007-10-30 114272]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-04-30 24592]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-02-18 356920]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bd21aac3-6c61-11dc-8103-806d6172696f}]
\Shell\AutoRun\command - D:\Run.exe
.
Contents of the 'Scheduled Tasks' folder

2008-09-20 c:\windows\Tasks\User_Feed_Synchronization-{BDE22DC6-A729-4976-9666-DE470A8C6369}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 18:36]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
mStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
IE: &ICQ Toolbar Search - c:\program files\ICQToolbar\toolbaru.dll/SEARCH.HTML
IE: &Экспорт в Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Закачать ВСЕ при помощи Download Master - c:\program files\Download Master\dmieall.htm
IE: Закачать при помощи Download Master - c:\program files\Download Master\dmie.htm
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} - c:\program files\Mail.Ru\Agent\magent.exe
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} - c:\program files\Download Master\dmaster.exe
LSP: c:\program files\Common Files\PC Tools\LSP\PCTLsp.dll
TCP: {74F16C80-08A0-4026-9F19-1D5F9E7981E7} = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Ирина\Application Data\Mozilla\Firefox\Profiles\xjdmll0l.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://www.bigmir.net
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... id=afex&q=
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll

---- FIREFOX POLICIES ----
FF - user.js: network.proxy.type - 0
FF - user.js: network.proxy.http -
user_pref(network.proxy.http_port,);
FF - user.js: network.proxy.no_proxies_on -
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-20 21:03:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


c:\windows\TEMP\cch~22f975c5.htp 8192 bytes
c:\windows\TEMP\cch~22f97e05.htp 8192 bytes

scan completed successfully
hidden files: 2

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(1276)
c:\program files\Common Files\PC Tools\LSP\PCTLsp.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\windows\system32\rundll32.exe
c:\program files\Yandex\Online\yachat\yachat.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Completion time: 2009-02-20 21:06:40 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-20 19:06:38

Pre-Run: 16 241 786 880 байт свободно
Post-Run: 16,508,731,392 байт свободно

246 --- E O F --- 2007-12-24 01:01:07

ComboFix 09-02-19.01 - Ирина 2009-02-21 17:00:17.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1251.1.1049.18.1023.526 [GMT 2:00]
Running from: c:\documents and settings\Ирина\Рабочий стол\ComboFix.exe
Command switches used :: c:\documents and settings\Ирина\Рабочий стол\CFScript.txt
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)
AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated)
FW: Kaspersky Internet Security *disabled*
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:\windows\TEMP\cch~22f975c5.htp 8192 bytes
c:\windows\TEMP\cch~22f97e05.htp 8192 bytes
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\All Users\Application Data\TEMP

----- BITS: Possible infected sites -----

hxxp://soft.export.yandex.ru
hxxp://download.yandex.ru
.
((((((((((((((((((((((((( Files Created from 2009-01-21 to 2009-02-21 )))))))))))))))))))))))))))))))
.

2009-02-18 20:35 . 2009-02-18 20:33 160,792 --a------ c:\windows\system32\drivers\pctfw2.sys
2009-02-18 20:05 . 2009-02-18 20:35 <DIR> d-------- c:\program files\Common Files\PC Tools
2009-02-18 20:05 . 2009-02-18 20:05 <DIR> d-------- c:\documents and settings\Ирина\Application Data\PC Tools
2009-02-18 20:05 . 2008-08-25 12:36 81,288 --a------ c:\windows\system32\drivers\iksyssec.sys
2009-02-18 20:05 . 2008-08-25 12:36 66,952 --a------ c:\windows\system32\drivers\iksysflt.sys
2009-02-18 20:05 . 2008-08-25 12:36 40,840 --a------ c:\windows\system32\drivers\ikfilesec.sys
2009-02-18 20:05 . 2008-06-02 16:19 29,576 --a------ c:\windows\system32\drivers\kcom.sys
2009-02-18 18:17 . 2009-02-18 18:17 <DIR> d-------- c:\documents and settings\Администратор\Application Data\Help
2009-02-18 17:51 . 2009-02-18 17:51 <DIR> d-------- c:\documents and settings\Администратор\Application Data\Opera
2009-02-18 17:24 . 2009-02-18 17:24 <DIR> d-------- c:\program files\Trend Micro
2009-02-18 13:32 . 2009-02-18 13:32 <DIR> d-------- c:\documents and settings\Ирина\DoctorWeb
2009-02-18 13:32 . 2009-02-18 13:32 <DIR> d-------- c:\documents and settings\Ирина\DoctorWeb
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> dr-h----- c:\documents and settings\Администратор\SendTo
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> dr-h----- c:\documents and settings\Администратор\SendTo
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> d--h----- c:\documents and settings\Администратор\Recent
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> d--h----- c:\documents and settings\Администратор\Recent
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> d--h----- c:\documents and settings\Администратор\PrintHood
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> d--h----- c:\documents and settings\Администратор\PrintHood
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> d--h----- c:\documents and settings\Администратор\NetHood
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> d--h----- c:\documents and settings\Администратор\NetHood
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> d-------- c:\documents and settings\Администратор\Рабочий стол
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> d-------- c:\documents and settings\Администратор\Рабочий стол
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> d-------- c:\documents and settings\Администратор\Мои документы
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> d-------- c:\documents and settings\Администратор\Мои документы
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> dr------- c:\documents and settings\Администратор\Главное меню
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> dr------- c:\documents and settings\Администратор\Главное меню
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> d-------- c:\documents and settings\Администратор\Избранное
2009-02-18 10:44 . 2009-02-18 10:44 <DIR> d-------- c:\documents and settings\Администратор\Избранное
2009-02-18 10:33 . 2009-02-21 17:01 <DIR> d--h----- c:\documents and settings\Администратор\Local Settings
2009-02-18 10:33 . 2009-02-21 17:01 <DIR> d--h----- c:\documents and settings\Администратор\Local Settings
2009-02-18 10:33 . 2007-09-26 18:10 <DIR> d--hs---- c:\documents and settings\Администратор\Cookies
2009-02-18 10:33 . 2007-09-26 18:10 <DIR> d--hs---- c:\documents and settings\Администратор\Cookies
2009-02-18 10:33 . 2009-02-18 10:44 <DIR> d---s---- c:\documents and settings\Администратор\Application Data\Microsoft
2009-02-18 10:33 . 2009-02-18 17:51 <DIR> dr-h----- c:\documents and settings\Администратор\Application Data
2009-02-18 10:33 . 2009-02-18 17:51 <DIR> dr-h----- c:\documents and settings\Администратор\Application Data
2009-02-18 10:33 . 2009-02-18 10:44 <DIR> d--h----- c:\documents and settings\Администратор\Шаблоны
2009-02-18 10:33 . 2009-02-18 10:44 <DIR> d--h----- c:\documents and settings\Администратор\Шаблоны
2009-02-18 10:33 . 2009-02-18 18:20 <DIR> d-------- c:\documents and settings\Администратор
2009-02-18 10:33 . 2009-02-18 18:21 786,432 --ah----- c:\documents and settings\Администратор\NTUSER.DAT
2009-02-18 10:33 . 2009-02-18 18:21 786,432 --ah----- c:\documents and settings\Администратор\NTUSER.DAT
2009-02-17 19:23 . 2009-02-17 19:23 <DIR> d-------- c:\program files\TNR Vision 3.4
2009-02-15 19:34 . 2009-02-15 19:34 <DIR> d-------- c:\program files\Kachni-ka.ru
2009-02-09 04:32 . 2009-02-09 04:32 <DIR> d-------- c:\program files\Common Files\Windows Live
2009-02-08 18:04 . 2009-02-08 18:05 <DIR> d-------- c:\program files\Your Uninstaller 2008
2009-02-08 18:04 . 2009-02-08 18:04 <DIR> d-------- c:\documents and settings\Ирина\Application Data\URSoft
2009-02-07 18:56 . 2009-02-07 18:56 <DIR> d-------- c:\program files\ipSPACE
2009-02-06 23:22 . 2009-02-20 15:19 <DIR> d-------- c:\documents and settings\Ирина\Application Data\YaChatData
2009-02-06 23:20 . 2009-02-06 23:20 <DIR> d-------- c:\program files\Yandex
2009-02-06 23:20 . 2009-02-06 23:20 <DIR> d-------- c:\documents and settings\Ирина\Application Data\Yandex
2009-01-31 20:35 . 2009-02-03 19:44 101,287 --a------ c:\windows\system32\drivers\klin.dat
2009-01-31 20:35 . 2009-02-03 19:44 89,601 --a------ c:\windows\system32\drivers\klick.dat
2009-01-31 20:34 . 2009-01-31 20:34 <DIR> d-------- c:\program files\Kaspersky Lab
2009-01-31 20:34 . 2009-02-21 11:50 <DIR> d-------- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-01-31 20:34 . 2009-02-21 00:17 4,426,272 --ahs---- c:\windows\system32\drivers\fidbox.dat
2009-01-31 20:34 . 2009-02-21 00:17 548,896 --ahs---- c:\windows\system32\drivers\fidbox2.dat
2009-01-31 20:34 . 2009-02-21 00:17 36,708 --ahs---- c:\windows\system32\drivers\fidbox.idx
2009-01-31 20:34 . 2009-02-21 00:17 4,004 --ahs---- c:\windows\system32\drivers\fidbox2.idx
2009-01-24 10:40 . 2009-01-24 10:40 <DIR> d-------- c:\documents and settings\All Users\Application Data\PC Tools
2009-01-23 19:01 . 2009-01-29 18:24 760 --a-s---- c:\windows\system32\1081827863.dat
2009-01-21 11:50 . 2009-02-21 16:59 <DIR> d-------- c:\program files\Spyware Doctor

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-21 15:01 --------- d-----w c:\documents and settings\Ирина\Application Data\Skype
2009-02-21 14:01 --------- d-----w c:\documents and settings\Ирина\Application Data\skypePM
2009-02-21 12:49 --------- d-----w c:\program files\AIMP2
2009-02-18 16:21 786,432 ---ha-w c:\documents and settings\Администратор\NTUSER.DAT
2009-02-18 16:21 786,432 ---ha-w c:\documents and settings\Администратор\NTUSER.DAT
2009-02-18 16:17 --------- d-----w c:\documents and settings\Администратор\Application Data\Help
2009-02-18 15:51 --------- d-----w c:\documents and settings\Администратор\Application Data\Opera
2009-02-18 15:10 --------- d-----w c:\documents and settings\Ирина\Application Data\WebMoney
2009-02-18 08:44 --------- d-s---w c:\documents and settings\Администратор\Application Data\Microsoft
2009-02-09 02:33 --------- d-----w c:\program files\Download Master
2009-02-08 22:32 --------- d-----w c:\program files\Opera
2009-02-05 18:20 88 --sh--r c:\documents and settings\All Users\Application Data\C793956FC2.sys
2009-02-05 18:20 2,516 --sha-w c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2009-02-05 18:20 --------- d-----w c:\documents and settings\All Users\Application Data\Corel
2009-02-05 14:13 33,808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-01-30 13:25 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-01-30 11:38 --------- d-----w c:\program files\FlashGet
2009-01-28 17:20 --------- d-----w c:\documents and settings\Ирина\Application Data\Auslogics
2009-01-24 08:03 --------- d-----w c:\program files\WebMoney
2009-01-21 10:31 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-01-21 10:31 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-18 11:54 --------- d-----w c:\program files\Bullfrog
2009-01-15 17:09 --------- d-----w c:\program files\WebMoney Agent
2009-01-15 15:38 --------- d-----w c:\documents and settings\Гость\Application Data\Mra
2009-01-12 16:47 73,216 ----a-w c:\windows\ST6UNST.EXE
2009-01-12 16:47 307,200 ------w c:\windows\Setup1.exe
2008-12-24 17:29 --------- d-----w c:\program files\CCleaner
2008-12-21 16:58 --------- d-----w c:\program files\Auslogics
2008-12-13 13:18 578,048 ----a-w c:\windows\system32\user32.DLL
2007-12-09 19:09 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat
2007-07-26 20:47 66,408 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2007-07-26 20:47 54,112 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2007-07-26 20:47 34,688 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2007-07-26 20:47 46,456 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2007-07-26 20:47 171,880 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
.

------- Sigcheck -------

2006-04-20 14:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
2004-08-18 14:00 359040 9f4b36614a0fc234525ba224957de55c c:\windows\$NtUninstallKB917953$\tcpip.sys
2006-04-20 13:51 359808 021415ad071ef3944c27dc9597ed2214 c:\windows\system32\dllcache\tcpip.sys
2006-04-20 13:51 359808 021415ad071ef3944c27dc9597ed2214 c:\windows\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-18 15360]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-05-30 21718312]
"Auslogics BoostSpeed 4"="c:\program files\Auslogics\AusLogics BoostSpeed\boostspeed.exe" [2008-12-22 364144]
"Download Master"="c:\program files\Download Master\dmaster.exe" [2009-02-06 3769856]
"YandexOnline"="c:\program files\Yandex\Online\online.exe" [2009-01-22 2558728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Gainward"="c:\program files\VDOTool\TBPanel.exe" [2007-06-26 2165272]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-07-23 8466432]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-07-23 81920]
"MAgent"="c:\program files\Mail.Ru\Agent\MAgent.exe" [2008-02-02 4457976]
"wmagent.exe"="c:\program files\WebMoney Agent\wmagent.exe" [2008-10-01 209376]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-02-05 206088]
"RTHDCPL"="RTHDCPL.EXE" [2007-01-30 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"nwiz"="nwiz.exe" [2007-07-23 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-18 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ac3filter"= ac3filter.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Главное меню^Программы^Автозагрузка^Ускоренный запуск Adobe Reader.lnk]
path=c:\documents and settings\All Users\Главное меню\Программы\Автозагрузка\Ускоренный запуск Adobe Reader.lnk
backup=c:\windows\pss\Ускоренный запуск Adobe Reader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\ICQ6\\ICQ.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\FlashGet\\flashget.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"13646:TCP"= 13646:TCP:NortonAV
"16433:TCP"= 16433:TCP:NortonAV

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 33808]
R1 pctfw2;pctfw2;c:\windows\system32\drivers\pctfw2.sys [2009-02-18 160792]
R1 prodrv04;Star Force copy protection driver v4;c:\windows\system32\drivers\prodrv04.sys [2007-10-30 114272]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-04-30 24592]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-02-18 356920]

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bd21aac3-6c61-11dc-8103-806d6172696f}]
\Shell\AutoRun\command - D:\Run.exe
.
Contents of the 'Scheduled Tasks' folder

2008-09-20 c:\windows\Tasks\User_Feed_Synchronization-{BDE22DC6-A729-4976-9666-DE470A8C6369}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 18:36]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
mStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
IE: &ICQ Toolbar Search - c:\program files\ICQToolbar\toolbaru.dll/SEARCH.HTML
IE: &Экспорт в Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Закачать ВСЕ при помощи Download Master - c:\program files\Download Master\dmieall.htm
IE: Закачать при помощи Download Master - c:\program files\Download Master\dmie.htm
IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} - c:\program files\Mail.Ru\Agent\magent.exe
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} - c:\program files\Download Master\dmaster.exe
LSP: c:\program files\Common Files\PC Tools\LSP\PCTLsp.dll
TCP: {74F16C80-08A0-4026-9F19-1D5F9E7981E7} = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Ирина\Application Data\Mozilla\Firefox\Profiles\xjdmll0l.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://www.bigmir.net
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... id=afex&q=
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll

---- FIREFOX POLICIES ----
FF - user.js: network.proxy.type - 0
FF - user.js: network.proxy.http -
user_pref(network.proxy.http_port,);
FF - user.js: network.proxy.no_proxies_on -
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-21 17:01:42
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(1268)
c:\program files\Common Files\PC Tools\LSP\PCTLsp.dll
.
Completion time: 2009-02-21 17:02:37
ComboFix-quarantined-files.txt 2009-02-21 15:02:35
ComboFix2.txt 2009-02-20 19:06:41

Pre-Run: 16 338 202 624 байт свободно
Post-Run: 16,327,573,504 байт свободно

234 --- E O F --- 2007-12-24 01:01:07

jell,

As best as I can tell your log looks clean, I'm not 100% sure because of the language difference.

How's it running now?

Gecko, I think it's ok now. Thanks a lot !