фейсбук вирус и на моя компютър! Моля помогнете! ufa.exe [РЕШЕН]

24 август 201114 г.

Здравейте,

Изчетох повечето теми свързани с тази и се надявам да помогнете и на мен, за което предварително Ви благодаря!

Системата е Microsoft Windows XP Professional Version 2002 Service Pack 2.

AMD Athlon™ 64 x 2 Dual Core Processor 4000+ 2.11GHz, 1,93 GB of RAM

Нямам инсталационен диск на Windows.

От вчера ми се появи следното предупреждение от антивирусната програма Norton AntiVirus - "ENHANCED PROTECTION MODE",

Помислих, че се е скапала и я деинсталирах, като на нейно място инсталирах Avast. Оказа се че и тя не работи, след което огледах "task manager-a" и видях процеса "ufi.exe" , който ме доведе тук във форума! В систем трея (долу в дясно до часовника) ми се появиха иконите и на двете антивирусни, но не мога да ги стартирам!

Следвах първоначалните инструкции от другите постове и изтеглих "ComboFix" . При сканирането си изтегли "Windows Recovery Consolе, после се рестартира и накрая създаде "log.txt" файл.

След това сканиране изчезнаха иконите на двете антивирусни от систем трея (долу в дясно до часовника)!

Съдържанието на файла е следното:

ComboFix 11-08-24.02 - Usr 08.2011 г. 16:29:24.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.2.1251.359.1033.18.1983.1315 [GMT 3:00]

Running from: c:\documents and settings\Usr\Desktop\ComboFix.exe

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Usr\Application Data\logs.dat

c:\documents and settings\Usr\Application Data\PriceGong

c:\documents and settings\Usr\Application Data\PriceGong\Data\1.xml

c:\documents and settings\Usr\Application Data\PriceGong\Data\a.xml

c:\documents and settings\Usr\Application Data\PriceGong\Data\b.xml

c:\documents and settings\Usr\Application Data\PriceGong\Data\c.xml

c:\documents and settings\Usr\Application Data\PriceGong\Data\d.xml

c:\documents and settings\Usr\Application Data\PriceGong\Data\e.xml

c:\documents and settings\Usr\Application Data\PriceGong\Data\f.xml

c:\documents and settings\Usr\Application Data\PriceGong\Data\g.xml

c:\documents and settings\Usr\Application Data\PriceGong\Data\h.xml

c:\documents and settings\Usr\Application Data\PriceGong\Data\i.xml

c:\documents and settings\Usr\Application Data\PriceGong\Data\J.xml

c:\documents and settings\Usr\Application Data\PriceGong\Data\k.xml

c:\documents and settings\Usr\Application Data\PriceGong\Data\l.xml

c:\documents and settings\Usr\Application Data\PriceGong\Data\m.xml

c:\documents and settings\Usr\Application Data\PriceGong\Data\mru.xml

c:\documents and settings\Usr\Application Data\PriceGong\Data\n.xml

c:\documents and settings\Usr\Application Data\PriceGong\Data\o.xml

c:\documents and settings\Usr\Application Data\PriceGong\Data\p.xml

c:\documents and settings\Usr\Application Data\PriceGong\Data\q.xml

c:\documents and settings\Usr\Application Data\PriceGong\Data\r.xml

c:\documents and settings\Usr\Application Data\PriceGong\Data\s.xml

c:\documents and settings\Usr\Application Data\PriceGong\Data\t.xml

c:\documents and settings\Usr\Application Data\PriceGong\Data\u.xml

c:\documents and settings\Usr\Application Data\PriceGong\Data\v.xml

c:\documents and settings\Usr\Application Data\PriceGong\Data\w.xml

c:\documents and settings\Usr\Application Data\PriceGong\Data\x.xml

c:\documents and settings\Usr\Application Data\PriceGong\Data\y.xml

c:\documents and settings\Usr\Application Data\PriceGong\Data\z.xml

c:\program files\update.exe

C:\test.txt

c:\windows\btc_client_iplist.txt

c:\windows\front_ip_list.txt

c:\windows\geoiplist

c:\windows\geoiplist.rar

c:\windows\iecheck_iplist.txt

c:\windows\info1

c:\windows\iplist.txt

c:\windows\iun6002.exe

c:\windows\l1rezerv.exe

c:\windows\loader2.exe_ok

c:\windows\ntdll.dl

c:\windows\phoenix

c:\windows\phoenix.rar

c:\windows\phoenix\kernels\phatk\__init__.py

c:\windows\phoenix\kernels\phatk\__init__.pyc

c:\windows\phoenix\kernels\phatk\BFIPatcher.py

c:\windows\phoenix\kernels\phatk\kernel.cl

c:\windows\phoenix\kernels\poclbm\__init__.py

c:\windows\phoenix\kernels\poclbm\__init__.pyc

c:\windows\phoenix\kernels\poclbm\BFIPatcher.py

c:\windows\phoenix\kernels\poclbm\kernel.cl

c:\windows\phoenix\phoenix.exe

c:\windows\proc_list1.log

c:\windows\rpcminer

c:\windows\rpcminer.rar

c:\windows\rpcminer\bitcoinminercuda_10.cubin

c:\windows\rpcminer\bitcoinminercuda_11.cubin

c:\windows\rpcminer\bitcoinminercuda_20.cubin

c:\windows\rpcminer\bitcoinmineropencl.cl

c:\windows\rpcminer\cudart32_32_16.dll

c:\windows\rpcminer\curllib.dll

c:\windows\rpcminer\libeay32.dll

c:\windows\rpcminer\libsasl.dll

c:\windows\rpcminer\openldap.dll

c:\windows\rpcminer\rpcminer-4way.exe

c:\windows\rpcminer\rpcminer-cpu.exe

c:\windows\rpcminer\rpcminer-cuda.exe

c:\windows\rpcminer\rpcminer-opencl.exe

c:\windows\rpcminer\ssleay32.dll

c:\windows\services32.exe

c:\windows\sysdriver32.exe

c:\windows\sysdriver32_.exe

c:\windows\system32\drivers\etc\HSTS~1

c:\windows\system32\drivers\etc\hоsts

c:\windows\system32\ezGOSvc.dll

c:\windows\system32\Winbooterr

c:\windows\systemup.exe

c:\windows\Temp\2387790.exe

c:\windows\Temp\4947341.exe

c:\windows\Temp\6122.exe

c:\windows\ufa.rar

c:\windows\update.1

c:\windows\update.1\svchost.exe

c:\windows\update.2

c:\windows\update.2\svchost.exe

c:\windows\update.5.0

c:\windows\update.5.0\svchost.exe

c:\windows\update.7.1

c:\windows\update.7.1\svchostdriver.exe

c:\windows\update.tray-10-0\svchost.exe

c:\windows\update.tray-7-0\svchost.exe

c:\windows\winlog-dirs.txt

c:\windows\winlog-ids.txt

c:\windows\winsetupapi.log

.

c:\windows\system32\srsvc.dll . . . is infected!!

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_DDSERVICE

-------\Legacy_EZGOSVC

-------\Legacy_RKHIT

-------\Legacy_SRVBTCCLIENT

-------\Legacy_SRVIECHECK

-------\Legacy_SRVSYSDRIVER32

-------\Legacy_WXPDRIVERS

-------\Service_ddservice

-------\Service_ezGOSvc

-------\Service_RkHit

-------\Service_srvbtcclient

-------\Service_srviecheck

-------\Service_srvsysdriver32

-------\Service_wxpdrivers

.

((((((((((((((((((((((((( Files Created from 2011-07-24 to 2011-08-24 )))))))))))))))))))))))))))))))

.

2011-08-24 13:35 . 2011-08-24 13:35 -------- d-----w- c:\windows\system32\xircom

2011-08-24 13:35 . 2011-08-24 13:35 -------- d-----w- c:\windows\system32\wbem\snmp

2011-08-24 13:35 . 2011-08-24 13:35 -------- d-----w- c:\windows\system32\restore

2011-08-24 12:56 . 2011-08-24 13:11 -------- d-----w- c:\program files\PCSafeDoctor

2011-08-23 16:56 . 2011-08-23 16:56 -------- d-----w- c:\program files\Common Files\SYMANT~1

2011-08-23 16:33 . 2011-08-24 13:32 -------- d--h--w- c:\windows\update.tray-7-0

2011-08-23 16:33 . 2011-08-23 16:33 -------- d--h--w- c:\windows\update.tray-7-0-lnk

2011-08-23 16:29 . 2011-07-04 11:36 309848 ----a-w- c:\windows\system32\drivers\aswSP.sys

2011-08-23 16:29 . 2011-07-04 11:32 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2011-08-23 16:29 . 2011-07-04 11:36 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2011-08-23 16:29 . 2011-07-04 11:35 43608 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2011-08-23 16:29 . 2011-07-04 11:32 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2011-08-23 16:29 . 2011-07-04 11:35 102616 ----a-w- c:\windows\system32\drivers\aswmon2.sys

2011-08-23 16:29 . 2011-07-04 11:35 96344 ----a-w- c:\windows\system32\drivers\aswmon.sys

2011-08-23 16:29 . 2011-07-04 11:32 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys

2011-08-23 16:29 . 2011-07-04 11:43 40112 ----a-w- c:\windows\avastSS.scr

2011-08-23 16:29 . 2011-07-04 11:43 199304 ----a-w- c:\windows\system32\aswBoot.exe

2011-08-23 06:34 . 2011-08-23 06:34 -------- d-----w- c:\windows\ufa

2011-08-23 06:33 . 2011-08-23 06:34 246272 ----a-w- c:\windows\unrar.exe

2011-08-23 06:15 . 2011-08-23 06:15 -------- d-----w- c:\windows\av_ico

2011-08-23 06:13 . 2011-08-24 13:32 -------- d--h--w- c:\windows\update.tray-10-0

2011-08-23 06:13 . 2011-08-23 06:13 -------- d--h--w- c:\windows\update.tray-10-0-lnk

2011-08-11 17:49 . 2011-08-11 17:49 -------- d-----w- c:\program files\Common Files\PCSuite

2011-07-28 20:30 . 2011-07-28 20:30 -------- d-----w- c:\documents and settings\UpdatusUser

2011-07-28 20:29 . 2011-05-25 06:09 543336 ----a-w- c:\windows\system32\easyupdatusapiu.dll

2011-07-28 20:29 . 2011-07-28 20:40 273344 ----a-w- c:\windows\system32\nvdrsdb0.bin

2011-07-28 20:29 . 2011-07-28 20:40 1 ----a-w- c:\windows\system32\nvdrssel.bin

2011-07-28 20:29 . 2011-07-28 20:40 273344 ----a-w- c:\windows\system32\nvdrsdb1.bin

2011-07-28 20:29 . 2011-05-25 06:09 899688 ----a-w- c:\windows\system32\nvdispco3220150.dll

2011-07-28 20:29 . 2011-05-25 06:09 865896 ----a-w- c:\windows\system32\nvgenco322090.dll

2011-07-28 20:16 . 2011-07-28 20:16 -------- d-----w- c:\documents and settings\All Users\Application Data\nView_Profiles

2011-07-28 20:11 . 2011-07-28 20:11 -------- d-----w- c:\windows\OPTIONS

2011-07-28 20:06 . 2005-05-03 10:43 69632 ------r- c:\windows\Alcmtr.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-08-11 05:20 . 2011-05-18 05:11 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-07-28 20:10 . 2008-08-19 18:42 15600 ----a-w- c:\windows\gdrv.sys

2011-07-06 15:14 . 2010-08-25 14:40 101616 ----a-w- c:\windows\system32\drivers\idmtdi.sys

2011-07-02 12:55 . 2011-07-02 12:55 1409 ----a-w- c:\windows\QTFont.for

2011-06-26 07:26 . 2011-07-02 07:46 663424 ----a-w- c:\windows\system32\ezGOSvcApp.exe

2011-06-26 15:34 . 2011-04-18 19:07 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[-] 2006-12-17 . C7BE59B07C6EB74BEA6FD67C1B164015 . 360576 . . [5.1.2600.2892] . . c:\windows\system32\drivers\tcpip.sys

.

c:\windows\System32\srsvc.dll ... is missing !!

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{481f306a-420c-4673-be90-543b7d62a78e}"= "c:\program files\LogiTool\prxtbLog0.dll" [2011-01-17 175912]

.

[HKEY_CLASSES_ROOT\clsid\{481f306a-420c-4673-be90-543b7d62a78e}]

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]

2011-01-17 14:54 175912 ----a-w- c:\program files\ConduitEngine\prxConduitEngin0.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{481f306a-420c-4673-be90-543b7d62a78e}]

2011-01-17 14:54 175912 ----a-w- c:\program files\LogiTool\prxtbLog0.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{481f306a-420c-4673-be90-543b7d62a78e}"= "c:\program files\LogiTool\prxtbLog0.dll" [2011-01-17 175912]

"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngin0.dll" [2011-01-17 175912]

.

[HKEY_CLASSES_ROOT\clsid\{481f306a-420c-4673-be90-543b7d62a78e}]

.

[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{481F306A-420C-4673-BE90-543B7D62A78E}"= "c:\program files\LogiTool\prxtbLog0.dll" [2011-01-17 175912]

.

[HKEY_CLASSES_ROOT\clsid\{481f306a-420c-4673-be90-543b7d62a78e}]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IDM Shell Extension]

@="{CDC95B92-E27C-4745-A8C5-64A52A78855D}"

[HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}]

2011-05-30 16:50 21864 ----a-w- c:\program files\Internet Download Manager\IDMShellExt.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-03-14 68856]

"Rainlendar2"="c:\program files\Rainlendar2\Rainlendar2.exe" [2010-07-11 2199040]

"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2010-09-19 3241312]

"BitTorrent"="c:\program files\BitTorrent\BitTorrent.exe" [2011-03-25 400760]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-08-18 17360520]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]

"MutlimediaKbdDriver"="c:\program files\Delux\Multimedia Keyboard Driver\KbdDrv.exe" [2007-03-27 1384448]

"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 110592]

"Tweak UI"="TWEAKUI.CPL" [2000-06-18 106544]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]

"MPlayerForWindows_UpdateReminder"="c:\program files\MPlayer for Windows\AutoUpdate.exe" [2010-10-17 235005]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]

"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 16380416]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-11-20 110184]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-11-20 12669544]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableSecureUIAPaths"= 0 (0x0)

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoSMMyPictures"= 1 (0x1)

.

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"ForceClassicControlPanel"= 1 (0x1)

"NoSMMyPictures"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"FirewallOverride"=dword:00000001

"DisableThumbnailCache"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Documents and Settings\\Usr\\My Documents\\Downloads\\Programs\\facebook-pic00005267.exe"= c:\\windows\\nvsvc32.exe

"c:\\Documents and Settings\\Usr\\My Documents\\Downloads\\Programs\\Flash-Player_2.exe"=

"c:\\Program Files\\BitTorrent\\BitTorrent.exe"=

.

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [14.12.2008 г. 12:28 717296]

R1 IDMTDI;IDMTDI;c:\windows\system32\drivers\idmtdi.sys [25.8.2010 г. 17:40 101616]

R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [28.7.2011 г. 23:29 2214504]

S2 gupdate1ca19cf9970e89e;Услуга Google Update (gupdate1ca19cf9970e89e);c:\program files\Google\Update\GoogleUpdate.exe [10.8.2009 г. 18:31 133104]

S2 kpfuytloj;Config Update;c:\windows\system32\svchost.exe -k netsvcs [04.8.2004 г. 03:56 14336]

S3 ALSysIO;ALSysIO;\??\c:\windows\Temp\ALSysIO.sys --> c:\windows\Temp\ALSysIO.sys [?]

S3 Cap713x;Cap713x Video Capture;c:\windows\system32\DRIVERS\Cap713x.sys --> c:\windows\system32\DRIVERS\Cap713x.sys [?]

S3 EraserUtilRebootDrv;EraserUtilRebootDrv;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys --> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [?]

S3 FlyPCI;FlyPCI;\??\c:\fly200~1\FlyPCI.sys --> c:\fly200~1\FlyPCI.sys [?]

S3 gupdatem;Услуга на Google Актуализация (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [10.8.2009 г. 18:31 133104]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - WUAUSERV

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

kpfuytloj

.

Contents of the 'Scheduled Tasks' folder

.

2011-07-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cc4f00ab19d836.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-10 15:31]

.

2011-07-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-1336601894-725345543-1003Core1cc4fbda928e1c6.job

- c:\documents and settings\Usr\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-08-02 20:32]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://fullarticles.net

uInternet Connection Wizard,ShellNext = hxxp://help.gigaget.com/online/stat_inst.php?pid=0000

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html

IE: Свали видео съдържанието на FLV с IDM - c:\program files\Internet Download Manager\IEGetVL.htm

IE: Свали всички линкове с IDM - c:\program files\Internet Download Manager\IEGetAll.htm

IE: Свали с IDM - c:\program files\Internet Download Manager\IEExt.htm

IE: {{60237576-b24c-4ba9-9740-c9f3ec9db557} - {EAADF17C-B6EA-4511-8549-A67CFD406EAF} - c:\progra~1\SkyCode\WEBTRA~1\wt2ie.dll

Trusted Zone: ubb.bg\ebb

TCP: DhcpNameServer = 192.168.1.1

FF - ProfilePath - c:\documents and settings\Usr\Application Data\Mozilla\Firefox\Profiles\ln46abpy.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2771935&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2771935&q=

.

- - - - ORPHANS REMOVED - - - -

.

ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - c:\program files\AVAST Software\Avast\ashShell.dll

HKLM-Run-nwiz - nwiz.exe

HKLM-Run-wxpdrv - c:\windows\services32.exe

HKLM-Run-tray_ico - (no file)

HKLM-Run-tray_ico0 - c:\windows\update.tray-10-0\svchost.exe

HKLM-Run-tray_ico1 - c:\windows\update.tray-7-0\svchost.exe

HKLM-Run-tray_ico2 - (no file)

HKLM-Run-tray_ico3 - (no file)

HKLM-Run-tray_ico4 - (no file)

HKLM-Run-systemup - c:\windows\systemup.exe

HKLM-Run-l1rezerv.exe - c:\windows\l1rezerv.exe

HKLM-Run-avast - c:\program files\AVAST Software\Avast\avastUI.exe

HKU-Default-RunOnce-nltide3 - rundll32 advpack.dll

Notify-NavLogon - (no file)

SafeBoot-WudfPf

SafeBoot-WudfRd

AddRemove-avast - c:\program files\AVAST Software\Avast\aswRunDll.exe

AddRemove-NVIDIA Display Control Panel - c:\program files\NVIDIA Corporation\Uninstall\nvuninst.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-08-24 16:35

Windows 5.1.2600 Service Pack 2 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\kpfuytloj]

"ServiceDll"="c:\windows\system32\cfgnm.dll"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]

@Denied: (Full) (Everyone)

"scansk"=hex(0):8d,d6,79,4b,fc,a2,69,75,10,75,a3,53,6d,56,dd,7d,78,7d,8e,76,27,

2a,de,e4,f4,79,f0,33,bb,92,4c,0e,98,55,b4,9e,c5,37,4f,14,00,00,00,00,00,00,\

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7f3e2633-8b34-451d-951f-9744f2906483}]

@Denied: (Full) (Everyone)

"Model"=dword:0000004d

"Therad"=dword:0000001d

"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a,

1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'explorer.exe'(3904)

c:\program files\Internet Download Manager\IDMShellExt.dll

c:\program files\Internet Download Manager\IDMNetMon.DLL

c:\program files\Windows Media Player\wmpband.dll

c:\windows\system32\msi.dll

c:\windows\system32\WPDShServiceObj.dll

c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll

c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL

c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_eng.nlr

c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\nvsvc32.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\windows\system32\rundll32.exe

c:\program files\Common Files\Nokia\MPlatform\NokiaMServer.exe

c:\windows\RTHDCPL.EXE

c:\windows\system32\RUNDLL32.EXE

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2011-08-24 16:38:43 - machine was rebooted

ComboFix-quarantined-files.txt 2011-08-24 13:38

.

Pre-Run: 6 976 507 904 bytes free

Post-Run: 7 403 425 792 bytes free

.

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=AlwaysOff /fastdetect /noexecute=alwaysoff /usepmtimer

.

- - End Of File - - E5B81420D894A4A8691FDD64BB4EA335

Редактирано 24 август 201114 г. от bgr79 (преглед на промените)

Цитирай

24 август 201114 г.

Ок...заемаме се с проблема. Ще ми трябва малко време за анализ на лог файла.

Цитирай

24 август 201114 г.

*.Изтеглете прикачения файл и го провлачете и пуснете в Combofix (както е показано на картинката отдолу).

Публикувано изображение

*. По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !

*. Когато Combofix приключи ще създаде лог файла. Моля, публикувайте този файл в следващия си пост.

CFScript.txt

Цитирай

24 август 201114 г.

Автор

Здравей,

изтеглих файла и го пуснах върху иконата на ComboFix. След това програмата се стартира и започна да сканира. После показа диалогов прозорец, че имам активна антивирусна - avast, която трябва да затворя преди да натисна "ОК". Потърсих антивирусната - Control Panel => ADD or Remove Programs - но я няма на компа.

Продължих с "ОК" въпреки, че не можах да изключа антивирусната, после пак излезе диалогов прозорец, че още има антивирусна, пак избрах "ОК" или "YES" (не запомних), след което ComboFix поиска да направи update, който позволих. След това отново се появи първия диалогов прозорец, че има активна антивирусна на компа, която да изключа преди да избера "ОК".

Какво да направя сега?

Цитирай

24 август 201114 г.

Просто се съгласете с всички диалогови прозорци и позволете на проверката да се извърши.

Иначе незнам как сте я деинсталирали, но наистина имате остатъци от avast!

Ако проверката не се осъществи, ще се наложи първо да почистим тях преди да продължим.

2011-08-23 16:29 . 2011-07-04 11:36 309848 ----a-w- c:\windows\system32\drivers\aswSP.sys

2011-08-23 16:29 . 2011-07-04 11:32 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2011-08-23 16:29 . 2011-07-04 11:36 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2011-08-23 16:29 . 2011-07-04 11:35 43608 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2011-08-23 16:29 . 2011-07-04 11:32 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2011-08-23 16:29 . 2011-07-04 11:35 102616 ----a-w- c:\windows\system32\drivers\aswmon2.sys

2011-08-23 16:29 . 2011-07-04 11:35 96344 ----a-w- c:\windows\system32\drivers\aswmon.sys

2011-08-23 16:29 . 2011-07-04 11:32 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys

2011-08-23 16:29 . 2011-07-04 11:43 40112 ----a-w- c:\windows\avastSS.scr

2011-08-23 16:29 . 2011-07-04 11:43 199304 ----a-w- c:\windows\system32\aswBoot.exe

На мен ми се налага да излезна и затова ще продължим утре.

Лека вечер засега !

Цитирай

24 август 201114 г.

Автор

Здравей,

когато имаш възможност погледни какво съм направил.

Отново повторих стъпките с натискане на "ОК" на диалоговите прозорци. Последва сканиране с ComboFix, рестартиране на компа и създаване на нов "log.txt" - файл, който кръстих "log2.txt".

Иконата на антивирусната вече не изглежда като активна т.е. не е картинка а като непознат тип файл. Изтрих я!

Съдържанието на файла е следното:

ComboFix 11-08-24.04 - Usr 08.2011 г. 21:35:34.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.2.1251.359.1033.18.1983.997 [GMT 3:00]

Running from: c:\documents and settings\Usr\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Usr\Desktop\CFScript.txt

AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

* Created a new restore point

.

FILE ::

"c:\documents and settings\Usr\My Documents\Downloads\Programs\facebook-pic00005267.exe"

"c:\documents and settings\Usr\My Documents\Downloads\Programs\Flash-Player_2.exe"

"c:\windows\nvsvc32.exe"

"c:\windows\system32\cfgnm.dll"

"c:\windows\system32\ezGOSvcApp.exe"

"c:\windows\unrar.exe"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Usr\My Documents\Downloads\Programs\Flash-Player_2.exe

c:\windows\av_ico

c:\windows\av_ico\ico_avast_desktop.ico

c:\windows\av_ico\ico_avast_start.ico

c:\windows\av_ico\ico_norton_start.ico

c:\windows\btc_client_iplist.txt

c:\windows\front_ip_list.txt

c:\windows\geoiplist

c:\windows\geoiplist.rar

c:\windows\iecheck_iplist.txt

c:\windows\info1

c:\windows\iplist.txt

c:\windows\l1rezerv.exe

c:\windows\loader2.exe_ok

c:\windows\nvsvc32.exe

c:\windows\phoenix

c:\windows\phoenix.rar

c:\windows\phoenix\kernels\phatk\__init__.py

c:\windows\phoenix\kernels\phatk\__init__.pyc

c:\windows\phoenix\kernels\phatk\BFIPatcher.py

c:\windows\phoenix\kernels\phatk\kernel.cl

c:\windows\phoenix\kernels\poclbm\__init__.py

c:\windows\phoenix\kernels\poclbm\__init__.pyc

c:\windows\phoenix\kernels\poclbm\BFIPatcher.py

c:\windows\phoenix\kernels\poclbm\kernel.cl

c:\windows\phoenix\phoenix.exe

c:\windows\proc_list1.log

c:\windows\rpcminer

c:\windows\rpcminer.rar

c:\windows\rpcminer\bitcoinminercuda_10.cubin

c:\windows\rpcminer\bitcoinminercuda_11.cubin

c:\windows\rpcminer\bitcoinminercuda_20.cubin

c:\windows\rpcminer\bitcoinmineropencl.cl

c:\windows\rpcminer\cudart32_32_16.dll

c:\windows\rpcminer\curllib.dll

c:\windows\rpcminer\libeay32.dll

c:\windows\rpcminer\libsasl.dll

c:\windows\rpcminer\openldap.dll

c:\windows\rpcminer\rpcminer-4way.exe

c:\windows\rpcminer\rpcminer-cpu.exe

c:\windows\rpcminer\rpcminer-cuda.exe

c:\windows\rpcminer\rpcminer-opencl.exe

c:\windows\rpcminer\ssleay32.dll

c:\windows\sysdriver32.exe

c:\windows\sysdriver32_.exe

c:\windows\system32\drivers\etc\HSTS~1

c:\windows\system32\drivers\etc\hоsts

c:\windows\system32\ezGOSvcApp.exe

c:\windows\systemup.exe

c:\windows\ufa

c:\windows\ufa.rar

c:\windows\ufa\ufa.exe

c:\windows\unrar.exe

c:\windows\update.2

c:\windows\update.2\svchost.exe

c:\windows\update.5.0

c:\windows\update.5.0\svchost.exe

c:\windows\update.7.1

c:\windows\update.tray-10-0-lnk

c:\windows\update.tray-10-0-lnk\svchost.exe

c:\windows\update.tray-10-0

c:\windows\update.tray-7-0-lnk

c:\windows\update.tray-7-0-lnk\svchost.exe

c:\windows\update.tray-7-0

c:\windows\winsetupapi.log

.

c:\windows\system32\srsvc.dll . . . is infected!!

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_KPFUYTLOJ

-------\Legacy_SRVBTCCLIENT

-------\Legacy_SRVIECHECK

-------\Legacy_SRVSYSDRIVER32

-------\Service_kpfuytloj

-------\Service_srvbtcclient

-------\Service_srviecheck

-------\Service_srvsysdriver32

.

((((((((((((((((((((((((( Files Created from 2011-07-24 to 2011-08-24 )))))))))))))))))))))))))))))))

.

2011-08-24 13:35 . 2011-08-24 13:35 -------- d-----w- c:\windows\system32\xircom

2011-08-24 13:35 . 2011-08-24 13:35 -------- d-----w- c:\windows\system32\wbem\snmp

2011-08-24 13:35 . 2011-08-24 13:35 -------- d-----w- c:\windows\system32\restore

2011-08-24 13:35 . 2011-08-24 13:35 -------- d-----w- c:\program files\microsoft frontpage