Проверка за бацил!?

18 януари 201016 г.

Няма да копирам цялата тази тема, а само ще поставя резултатите от сканирането, както ми препоръча B-boy[styLe] :

Malwarebytes' Anti-Malware 1.44

Malwarebytes' Anti-Malware 1.44
Версия на базата от данни: 3588
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.11

18.1.2010 г. 14:17:48
mbam-log-2010-01-18 (14-17-39).txt

Тип сканиране: Пълно сканиране (C:\|D:\|)
Сканирани обекти: 186130
Изминало време: 14 minute(s), 41 second(s)

Заразени процеси в паметта: 0
Заразени модули в паметта: 0
Заразени ключове в регистратурата: 0
Заразени стойности в регистратурата: 0
Заразени информационни обекти в регистратурата: 4
Заразени папки: 0
Заразени файлове: 6

Заразени процеси в паметта:
(Не бяха открити заплахи)

Заразени модули в паметта:
(Не бяха открити заплахи)

Заразени ключове в регистратурата:
(Не бяха открити заплахи)

Заразени стойности в регистратурата:
(Не бяха открити заплахи)

Заразени информационни обекти в регистратурата:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> No action taken.

Заразени папки:
(Не бяха открити заплахи)

Заразени файлове:
C:\vbox_subs.exe (Trojan.Agent) -> No action taken.
C:\System Volume Information\_restore{C064B0EB-40CB-49D3-84DB-0C1A435E3BB9}\RP51\A0032476.exe (Trojan.Agent) -> No action taken.
C:\System Volume Information\_restore{C064B0EB-40CB-49D3-84DB-0C1A435E3BB9}\RP51\A0032484.exe (Trojan.Agent) -> No action taken.
C:\System Volume Information\_restore{C064B0EB-40CB-49D3-84DB-0C1A435E3BB9}\RP51\A0032485.exe (BackDoor.Bifrost) -> No action taken.
D:\vbox_subs.exe (Trojan.Agent) -> No action taken.
C:\Program Files\kbdBF.dll (Spyware.OnlineGames) -> No action taken.

hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:24:32, on 18.1.2010 г.
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20583)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\UltraVNC\WinVNC.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\UltraVNC\WinVNC.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\kaldata.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft....k/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.btk.bg:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 10.*;<local>
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted IP range: http://10.230.56.2
O15 - Trusted IP range: http://10.96.79.55
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset...lineScanner.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.ad...Plus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1C89E15D-4F3C-4961-B682-D2EAAA6C7EF4}: NameServer = 192.168.1.1,212.39.90.42
O17 - HKLM\System\CCS\Services\Tcpip\..\{24B0A447-301A-4EA0-A32B-041FDF187983}: NameServer = 192.168.1.1
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: OpenVPN Service (OpenVPNService) - Unknown owner - C:\Program Files\OpenVPN\bin\openvpnserv.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: uvnc_service - UltraVNC - C:\Program Files\UltraVNC\WinVNC.exe

--
End of file - 4785 bytes

18 януари 201016 г.

Моля, повторете процедурата с MalwareBytes' Anti-Malware, като този път, след като сканирането завърши и открие опасните обекти, изберете Remove Selected. След това, генерирайте и нов лог файл от HJT.

18 януари 201016 г.

Автор

Ами аз избрах Remove Selected - даже ми поиска да се рестартира! А лог файла от hijackthis е правен след това! Но ще го повторя - няма проблеми! Хм! Предния път намери 10 заразени обекта - след което му дадох да ги зитрие - сега намери пак 3! Има нещо гнило май!

Malwarebytes' Anti-Malware 1.44
Версия на базата от данни: 3588
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.11

18.1.2010 г. 16:11:29
mbam-log-2010-01-18 (16-11-29).txt

Тип сканиране: Пълно сканиране (C:\|D:\|)
Сканирани обекти: 185886
Изминало време: 17 minute(s), 53 second(s)

Заразени процеси в паметта: 0
Заразени модули в паметта: 0
Заразени ключове в регистратурата: 0
Заразени стойности в регистратурата: 0
Заразени информационни обекти в регистратурата: 3
Заразени папки: 0
Заразени файлове: 0

Заразени процеси в паметта:
(Не бяха открити заплахи)

Заразени модули в паметта:
(Не бяха открити заплахи)

Заразени ключове в регистратурата:
(Не бяха открити заплахи)

Заразени стойности в регистратурата:
(Не бяха открити заплахи)

Заразени информационни обекти в регистратурата:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Заразени папки:
(Не бяха открити заплахи)

Заразени файлове:
(Не бяха открити заплахи)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:16:27, on 18.1.2010 г.
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20583)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\kaldata.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft....k/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.btk.bg:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 10.*;<local>
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted IP range: http://10.230.56.2
O15 - Trusted IP range: http://10.96.79.55
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset...lineScanner.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.ad...Plus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1C89E15D-4F3C-4961-B682-D2EAAA6C7EF4}: NameServer = 192.168.1.1,212.39.90.42
O17 - HKLM\System\CCS\Services\Tcpip\..\{24B0A447-301A-4EA0-A32B-041FDF187983}: NameServer = 192.168.1.1
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: OpenVPN Service (OpenVPNService) - Unknown owner - C:\Program Files\OpenVPN\bin\openvpnserv.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

--
End of file - 4581 bytes

Редактирано 18 януари 201016 г. от icemans (преглед на промените)

18 януари 201016 г.

Автор

М/у двете сканирания деинсталирах UltraVNC, като предпоставка за проблем!

18 януари 201016 г.

Стъпка 1:

Стартирайте HijackThis, кликнете на Config, а след това върху Misc Tools
Отворете Open Uninstall Manager
Цъкнете на Save List (това ще генерира uninstall_list.txt)
Изберете Save, а накрая копирайте и поставете резултатите в следващия Ви пост.

Стъпка 2:

Изтеглете GMER Rootkit Scanner. Разархивирайте го на вашия десктоп.

Преди да сканирате се уверете, че всички останали работещи програми в момента са изключени и вашия антивирусен софтуер няма да предприема никакви действия по време на сканирането на Gmer. Не използвайте компютъра си, докато трае сканирането.

Преименувайте GMER.exe на Tool.exe и кликнете два пъти пъти върху Tool.exe , за да стартирате програмата.

Внимание: Сканирането може да доведе до грешки, затова не предприемайте никакви действия върху редовете маркирани с "<--- ROOKIT" без да съм Ви посочил да го направите.

Ако е открита активност на rootkit ще бъдете попитани дали желаете да бъде направено пълно сканиране на системата.

Изберете NO.
В десния панел ще видите какво е било проверено, нека всичко си остане така. Необходимо е само да се уверите, че пред "Show All" няма отметка.
Сега кликнете върху бутона Scan .

След като сканирането приключи е възможно да получите информация за друга rootkit активност.

Изберете OK .
Gmer ще Ви отвори лог файла. Кликнете на бутона Save... и в полето за име на файла, напишете Gmer.txt .
Запишете лог файла на вашия десктоп.

Стъпка 3:

Изтеглете ComboFix от някой от следните линкове:

Линк 1

Линк 2

* ВАЖНО !!! Запазете ComboFix.exe на вашия десктоп

Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.

Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs

Преименувайте ComboFix.exe на Tool.exe

Стартирайте Tool.exe и следвайте инструкциите.

Бележка: ComboFix ще се стартира без инсталирана Recovery Console.

Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repair режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.

Следвайте инструкциите, за да позволите на ComboFix да изтегли и инсталира Microsoft Windows Recovery Console. В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.

** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:

Изберете Yes, за да продължи сканирането за зловреден софтуер.

Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:\ComboFix.txt в следващия Ви коментар в тази тема.

Бележка:

Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.
ComboFix ще нулира всички настройки на Microsoft Internet Explorer, включително да направи IE браузър по подразбиране.
ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразяват чрез autorun. Ако това е проблем за вас - моля, уведомете ме.
ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.
В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:\BUG.txt в следващия Ви коментар в тази тема.

Работата на ComboFix, може да отнеме до 20-30 минути, за да завърши, моля имайте търпение.

Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.

19 януари 201016 г.

Автор

Trend Micro

Acrobat.com
Acrobat.com
Adobe AIR
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.2
Advanced IP Address Calculator v1.1
Broadcom Management Programs
Broadcom NetXtreme Ethernet Controller
BulgarianPhonetic XP by G. Atanasov
CCleaner
Cisco Networking Academy curriculum 4.0.0.0
ESET Online Scanner v3
HijackThis 2.0.2
Intel® Graphics Media Accelerator Driver
IP-TV Player 0.28.1
J2SE Runtime Environment 5.0 Update 6
Java™ 6 Update 17
K-Lite Codec Pack 5.4.4 (Standard)
Malwarebytes' Anti-Malware
Microsoft Office Professional Edition 2003
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Mozilla Firefox (3.5.5)
OpenVPN 2.1_rc22
Packet Tracer 4.11
PaperlessPrinter version 3.0
PL-2303 USB-to-Serial
Ralink RT2870 Wireless LAN Card
Realtek High Definition Audio Driver
SA Dictionary 2005 T2
sala's WinXP SP2 Terminal Server Patch
VNC Free Edition 4.1.2
Windows XP Service Pack 3
WinRAR archiver
ZyDAS IEEE 802.11 b+g Wireless LAN - USB

Tази програма Gmer ми отне повече време за сканиране, отколкото Combo Fix-а, както беше писано по-горе. Но възникна и един проблем! По време на сканирането обаче - след около един час - имаше явно токов удар, тъй като е голям сняг днес тука и компа се рестартира. Пуснах пак Gmer - този път сканирането отне по-малко време и ето го лога:

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-19 14:04:38
Windows 5.1.2600 Service Pack 3
Running: Tool.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\pxtdrpod.sys

---- Services - GMER 1.0.15 ----

Service C:\WINDOWS\system32\svchost.exe (*** hidden *** ) [AUTO] ktzwuxszz <-- ROOTKIT !!!

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\ktzwuxszz@DisplayName Security Center
Reg HKLM\SYSTEM\CurrentControlSet\Services\ktzwuxszz@Type 32
Reg HKLM\SYSTEM\CurrentControlSet\Services\ktzwuxszz@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\Services\ktzwuxszz@ErrorControl 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\ktzwuxszz@ImagePath %SystemRoot%\system32\svchost.exe -k netsvcs
Reg HKLM\SYSTEM\CurrentControlSet\Services\ktzwuxszz@ObjectName LocalSystem
Reg HKLM\SYSTEM\CurrentControlSet\Services\ktzwuxszz@Description Provides user experience theme management.
Reg HKLM\SYSTEM\CurrentControlSet\Services\ktzwuxszz\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\Services\ktzwuxszz\Parameters@ServiceDll C:\WINDOWS\system32\uhsjfm.dll
Reg HKLM\SYSTEM\ControlSet002\Services\ktzwuxszz@DisplayName Security Center
Reg HKLM\SYSTEM\ControlSet002\Services\ktzwuxszz@Type 32
Reg HKLM\SYSTEM\ControlSet002\Services\ktzwuxszz@Start 2
Reg HKLM\SYSTEM\ControlSet002\Services\ktzwuxszz@ErrorControl 0
Reg HKLM\SYSTEM\ControlSet002\Services\ktzwuxszz@ImagePath %SystemRoot%\system32\svchost.exe -k netsvcs
Reg HKLM\SYSTEM\ControlSet002\Services\ktzwuxszz@ObjectName LocalSystem
Reg HKLM\SYSTEM\ControlSet002\Services\ktzwuxszz@Description Provides user experience theme management.
Reg HKLM\SYSTEM\ControlSet002\Services\ktzwuxszz\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\ktzwuxszz\Parameters@ServiceDll C:\WINDOWS\system32\uhsjfm.dll
Reg HKLM\SYSTEM\ControlSet003\Services\ktzwuxszz@DisplayName Security Center
Reg HKLM\SYSTEM\ControlSet003\Services\ktzwuxszz@Type 32
Reg HKLM\SYSTEM\ControlSet003\Services\ktzwuxszz@Start 2
Reg HKLM\SYSTEM\ControlSet003\Services\ktzwuxszz@ErrorControl 0
Reg HKLM\SYSTEM\ControlSet003\Services\ktzwuxszz@ImagePath %SystemRoot%\system32\svchost.exe -k netsvcs
Reg HKLM\SYSTEM\ControlSet003\Services\ktzwuxszz@ObjectName LocalSystem
Reg HKLM\SYSTEM\ControlSet003\Services\ktzwuxszz@Description Provides user experience theme management.
Reg HKLM\SYSTEM\ControlSet003\Services\ktzwuxszz\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\ktzwuxszz\Parameters@ServiceDll C:\WINDOWS\system32\uhsjfm.dll

---- EOF - GMER 1.0.15 ----

И ComboFix

ComboFix 10-01-18.02 - Administrator 01.2010 г. 14:16:31.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.1015.653 [GMT 2:00]
Running from: c:\documents and settings\Administrator\Desktop\Tool.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycled\Recycled
c:\recycler\S-1-5-21-1229272821-1284227242-725345543-500

.
((((((((((((((((((((((((( Files Created from 2009-12-19 to 2010-01-19 )))))))))))))))))))))))))))))))
.

2010-01-15 15:11 . 2008-04-14 03:42 1306624 -c----w- c:\windows\system32\dllcache\msxml6.dll
2010-01-15 15:10 . 2008-04-14 03:42 176640 ------w- c:\windows\system32\napstat.exe
2010-01-15 15:09 . 2010-01-15 15:09 -------- d-----w- c:\windows\ServicePackFiles
2010-01-15 15:06 . 2007-08-10 18:46 26488 ----a-w- c:\windows\system32\spupdsvc.exe
2010-01-15 06:42 . 2010-01-15 06:42 -------- d-----w- c:\windows\system32\wbem\Repository
2010-01-13 09:07 . 2010-01-15 06:41 -------- d-----w- c:\documents and settings\Administrator\Application Data\uTorrent
2010-01-06 12:49 . 2002-12-24 19:18 3712 ----a-w- c:\windows\system32\drivers\cfadisk.sys
2009-12-28 09:41 . 2009-12-28 09:41 -------- d-----w- c:\program files\ESET
2009-12-24 09:54 . 2009-12-24 09:54 767328 ----a-w- c:\windows\system32\kdfinj.dll
2009-12-24 09:54 . 2008-10-17 08:50 79104 ----a-w- c:\windows\system32\drivers\Mkd2Nadr.sys
2009-12-24 09:54 . 2008-10-17 08:50 131072 ----a-w- c:\windows\system32\drivers\Mkd2kfNT.sys
2009-12-22 10:38 . 2009-03-04 15:30 709248 ----a-w- c:\windows\system32\drivers\rt2870.sys
2009-12-22 10:38 . 2009-03-04 15:23 221184 ----a-w- c:\windows\system32\RaCoInst.dll
2009-12-22 10:38 . 2009-12-22 10:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Ralink Driver
2009-12-22 10:38 . 2009-03-04 15:30 709248 ----a-w- c:\documents and settings\All Users\Application Data\Ralink Driver\RT2870 Wireless LAN Card\Driver\rt2870.sys
2009-12-22 10:38 . 2009-03-04 15:23 221184 ----a-w- c:\documents and settings\All Users\Application Data\Ralink Driver\RT2870 Wireless LAN Card\Driver\RaCoInst.dll
2009-12-22 10:38 . 2009-03-04 15:23 13931 ----a-w- c:\windows\system32\RaCoInst.dat
2009-12-22 10:38 . 2008-08-06 14:31 528384 ----a-w- c:\documents and settings\All Users\Application Data\Ralink Driver\RT2870 Wireless LAN Card\Driver\RaInst.exe
2009-12-22 10:38 . 2007-05-17 09:17 192512 ----a-w- c:\documents and settings\All Users\Application Data\Ralink Driver\RT2870 Wireless LAN Card\Driver\CoInstaller.dll
2009-12-22 10:38 . 2006-11-02 05:21 319456 ----a-w- c:\documents and settings\All Users\Application Data\Ralink Driver\RT2870 Wireless LAN Card\Driver\difxapi.dll
2009-12-22 10:38 . 2009-12-22 10:38 -------- d-----w- c:\documents and settings\Administrator\Application Data\InstallShield
2009-12-21 14:26 . 2009-12-21 14:26 -------- d-----w- c:\program files\Common Files\Adobe
2009-12-21 14:24 . 2009-11-20 11:08 38784 ----a-w- c:\documents and settings\Administrator\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-12-21 14:24 . 2009-12-21 14:24 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-12-21 14:23 . 2009-12-21 14:23 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2009-12-21 09:30 . 2008-04-13 22:09 5504 ----a-w- c:\windows\system32\drivers\mstee.sys
2009-12-21 09:30 . 2008-04-13 22:16 10880 ----a-w- c:\windows\system32\drivers\ndisip.sys
2009-12-21 09:30 . 2008-04-13 22:16 15232 ----a-w- c:\windows\system32\drivers\streamip.sys
2009-12-21 09:30 . 2008-04-13 22:16 11136 ----a-w- c:\windows\system32\drivers\slip.sys
2009-12-21 09:30 . 2008-04-13 22:16 19200 ----a-w- c:\windows\system32\drivers\wstcodec.sys
2009-12-21 09:30 . 2008-04-13 22:16 85248 ----a-w- c:\windows\system32\drivers\nabtsfec.sys
2009-12-21 09:30 . 2008-04-13 22:16 17024 ----a-w- c:\windows\system32\drivers\ccdecode.sys
2009-12-21 09:30 . 2008-04-13 22:15 60032 ----a-w- c:\windows\system32\drivers\usbaudio.sys
2009-12-21 09:30 . 2005-01-14 07:32 53248 ----a-w- c:\windows\system32\PAStiSvc.exe
2009-12-21 09:30 . 2008-04-14 03:42 53760 ----a-w- c:\windows\system32\vfwwdm32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-18 13:43 . 2009-11-20 11:28 -------- d-----w- c:\program files\UltraVNC
2010-01-18 12:21 . 2010-01-18 12:21 -------- d-----w- c:\program files\Trend Micro
2010-01-18 12:00 . 2010-01-18 12:00 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-01-18 12:00 . 2010-01-18 12:00 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-18 12:00 . 2010-01-18 12:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-16 09:54 . 2007-12-16 22:15 64808 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-15 15:12 . 2007-10-31 03:46 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-01-07 14:07 . 2010-01-18 12:00 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 14:07 . 2010-01-18 12:00 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-22 11:40 . 2009-11-19 11:28 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-12-22 10:38 . 2007-10-31 03:54 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-14 11:17 . 2009-12-14 11:17 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-12-13 13:53 . 2009-12-13 13:53 -------- d-----w- c:\program files\CCleaner
2009-12-13 13:23 . 2009-12-07 12:02 -------- d-----w- c:\program files\OpenVPN
2009-12-13 09:24 . 2009-12-13 09:24 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-13 09:24 . 2008-04-14 10:21 -------- d-----w- c:\program files\Java
2009-12-13 09:24 . 2009-12-13 09:24 152576 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-12-13 09:22 . 2009-12-13 09:22 79488 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-12-11 09:18 . 2009-11-20 11:05 -------- d-----w- c:\documents and settings\Administrator\Application Data\Hamachi
2009-12-09 08:03 . 2009-11-20 08:03 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-11-22 06:22 . 2009-11-22 06:22 -------- d-----w- c:\program files\ZyDAS Technology Corporation
2009-11-20 15:09 . 2009-11-20 15:09 -------- d-----w- c:\documents and settings\Administrator\Application Data\UltraVNC
2009-11-20 13:26 . 2009-11-20 13:26 25984 ----a-w- c:\windows\system32\drivers\tap0901.sys
2009-11-20 11:23 . 2009-09-23 08:41 25280 ----a-w- c:\windows\system32\drivers\hamachi.sys
2009-11-19 11:36 . 2009-11-18 15:38 376832 ----a-w- c:\windows\system32\AegisI5Installer.exe
2009-11-19 11:29 . 2009-11-19 11:29 1962544 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player_ax.exe
2002-12-11 22:00 . 2008-01-22 15:27 6325 ----a-w- c:\program files\BgphXP.inf
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ZDWLan Utility.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ZDWLan Utility.lnk
backup=c:\windows\pss\ZDWLan Utility.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-09-04 10:08 935288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 03:42 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
2007-09-20 04:33 61952 ----a-w- c:\windows\system32\HDAShCut.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2007-01-13 08:47 163840 ----a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2007-01-13 08:47 131072 ----a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2007-01-13 08:46 135168 ----a-w- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2006-10-11 16:36 16267776 ----a-w- c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-12-13 09:24 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R0 cfadisk;CompactFlash Filter Driver;c:\windows\system32\drivers\cfadisk.sys [1/6/2010 2:49 PM 3712]
S2 ktzwuxszz;Security Center;c:\windows\system32\svchost.exe -k netsvcs [8/4/2004 1:56 AM 14336]
S3 BRGSp50;BRGSp50 NDIS Protocol Driver;c:\windows\system32\drivers\BRGSp50.sys [8/27/2009 3:09 PM 20608]
S3 CH341SER;CH341SER;c:\windows\system32\drivers\CH341SER.SYS [3/5/2009 12:05 PM 35824]
S3 Mkd2kfNt;Mkd2kfNt;c:\windows\system32\drivers\Mkd2kfNT.sys [12/24/2009 11:54 AM 131072]
S3 Mkd2Nadr;Mkd2Nadr;c:\windows\system32\drivers\Mkd2Nadr.sys [12/24/2009 11:54 AM 79104]
S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [12/22/2009 12:38 PM 709248]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ktzwuxszz
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyServer = proxy.btk.bg:80
uInternet Settings,ProxyOverride = 10.*;<local>
TCP: {1C89E15D-4F3C-4961-B682-D2EAAA6C7EF4} = 192.168.1.1,212.39.90.42
TCP: {24B0A447-301A-4EA0-A32B-041FDF187983} = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\c705jvq9.default\
FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\c705jvq9.default\extensions\[email protected]\plugins\npRACtrl.dll
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe
AddRemove-HijackThis - c:\program files\Trend Micro\HijackThis\HijackThis.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-19 14:18
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ktzwuxszz]
"ServiceDll"="c:\windows\system32\uhsjfm.dll"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2068)
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
Completion time: 2010-01-19 14:19:21
ComboFix-quarantined-files.txt 2010-01-19 12:19

Pre-Run: 33 692 512 256 bytes free
Post-Run: 33 763 381 248 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - B6A545B34F02E9B01B8CD90E502DDDAB

19 януари 201016 г.

Ясно! Благодаря за информацията!

Отворете Notepad и чрез комбинацията copy/paste поставете следния текст:

http://www.kaldata.com/forums/index.php?showtopic=147383


KillAll::


Collect::

c:\windows\system32\uhsjfm.dll


NetSvc::

ktzwuxszz


Rootkit::

ktzwuxszz


Registry::

[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ktzwuxszz]

Запазете файла с името CFScript.txt и го поставете върху ComboFix.

След като, програмата приключи ще Ви изведе лог файла. Отново чрез комбинацията от Copy/Paste поставете информацията тук.

19 януари 201016 г.

Автор

ComboFix 10-01-18.02 - Administrator 01.2010 г. 16:28:17.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.1015.645 [GMT 2:00]
Running from: c:\documents and settings\Administrator\Desktop\Tool.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
.

((((((((((((((((((((((((( Files Created from 2009-12-19 to 2010-01-19 )))))))))))))))))))))))))))))))
.

2010-01-18 12:21 . 2010-01-18 12:21 -------- d-----w- c:\program files\Trend Micro
2010-01-18 12:00 . 2010-01-18 12:00 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-01-18 12:00 . 2010-01-07 14:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-18 12:00 . 2010-01-18 12:00 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-18 12:00 . 2010-01-18 12:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-18 12:00 . 2010-01-07 14:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-15 15:10 . 2008-04-14 03:42 176640 ------w- c:\windows\system32\napstat.exe
2010-01-15 15:09 . 2010-01-15 15:09 -------- d-----w- c:\windows\ServicePackFiles
2010-01-15 15:06 . 2007-08-10 18:46 26488 ----a-w- c:\windows\system32\spupdsvc.exe
2010-01-15 06:42 . 2010-01-15 06:42 -------- d-----w- c:\windows\system32\wbem\Repository
2010-01-13 09:07 . 2010-01-15 06:41 -------- d-----w- c:\documents and settings\Administrator\Application Data\uTorrent
2010-01-06 12:49 . 2002-12-24 19:18 3712 ----a-w- c:\windows\system32\drivers\cfadisk.sys
2009-12-28 09:41 . 2009-12-28 09:41 -------- d-----w- c:\program files\ESET
2009-12-24 09:54 . 2009-12-24 09:54 767328 ----a-w- c:\windows\system32\kdfinj.dll
2009-12-24 09:54 . 2008-10-17 08:50 79104 ----a-w- c:\windows\system32\drivers\Mkd2Nadr.sys
2009-12-24 09:54 . 2008-10-17 08:50 131072 ----a-w- c:\windows\system32\drivers\Mkd2kfNT.sys
2009-12-22 10:38 . 2009-03-04 15:30 709248 ----a-w- c:\windows\system32\drivers\rt2870.sys
2009-12-22 10:38 . 2009-03-04 15:23 221184 ----a-w- c:\windows\system32\RaCoInst.dll
2009-12-22 10:38 . 2009-12-22 10:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Ralink Driver
2009-12-22 10:38 . 2009-03-04 15:30 709248 ----a-w- c:\documents and settings\All Users\Application Data\Ralink Driver\RT2870 Wireless LAN Card\Driver\rt2870.sys
2009-12-22 10:38 . 2009-03-04 15:23 221184 ----a-w- c:\documents and settings\All Users\Application Data\Ralink Driver\RT2870 Wireless LAN Card\Driver\RaCoInst.dll
2009-12-22 10:38 . 2009-03-04 15:23 13931 ----a-w- c:\windows\system32\RaCoInst.dat
2009-12-22 10:38 . 2008-08-06 14:31 528384 ----a-w- c:\documents and settings\All Users\Application Data\Ralink Driver\RT2870 Wireless LAN Card\Driver\RaInst.exe
2009-12-22 10:38 . 2007-05-17 09:17 192512 ----a-w- c:\documents and settings\All Users\Application Data\Ralink Driver\RT2870 Wireless LAN Card\Driver\CoInstaller.dll
2009-12-22 10:38 . 2006-11-02 05:21 319456 ----a-w- c:\documents and settings\All Users\Application Data\Ralink Driver\RT2870 Wireless LAN Card\Driver\difxapi.dll
2009-12-22 10:38 . 2009-12-22 10:38 -------- d-----w- c:\documents and settings\Administrator\Application Data\InstallShield
2009-12-21 14:26 . 2009-12-21 14:26 -------- d-----w- c:\program files\Common Files\Adobe
2009-12-21 14:24 . 2009-11-20 11:08 38784 ----a-w- c:\documents and settings\Administrator\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-12-21 14:24 . 2009-12-21 14:24 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-12-21 14:23 . 2009-12-21 14:23 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2009-12-21 09:30 . 2008-04-13 22:09 5504 ----a-w- c:\windows\system32\drivers\mstee.sys
2009-12-21 09:30 . 2008-04-13 22:16 10880 ----a-w- c:\windows\system32\drivers\ndisip.sys
2009-12-21 09:30 . 2008-04-13 22:16 15232 ----a-w- c:\windows\system32\drivers\streamip.sys
2009-12-21 09:30 . 2008-04-13 22:16 11136 ----a-w- c:\windows\system32\drivers\slip.sys
2009-12-21 09:30 . 2008-04-13 22:16 19200 ----a-w- c:\windows\system32\drivers\wstcodec.sys
2009-12-21 09:30 . 2008-04-13 22:16 85248 ----a-w- c:\windows\system32\drivers\nabtsfec.sys
2009-12-21 09:30 . 2008-04-13 22:16 17024 ----a-w- c:\windows\system32\drivers\ccdecode.sys
2009-12-21 09:30 . 2008-04-13 22:15 60032 ----a-w- c:\windows\system32\drivers\usbaudio.sys
2009-12-21 09:30 . 2005-01-14 07:32 53248 ----a-w- c:\windows\system32\PAStiSvc.exe
2009-12-21 09:30 . 2008-04-14 03:42 53760 ----a-w- c:\windows\system32\vfwwdm32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-18 13:43 . 2009-11-20 11:28 -------- d-----w- c:\program files\UltraVNC
2010-01-16 09:54 . 2007-12-16 22:15 64808 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-15 15:12 . 2007-10-31 03:46 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-12-22 11:40 . 2009-11-19 11:28 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-12-22 10:38 . 2007-10-31 03:54 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-14 11:17 . 2009-12-14 11:17 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-12-13 13:53 . 2009-12-13 13:53 -------- d-----w- c:\program files\CCleaner
2009-12-13 13:23 . 2009-12-07 12:02 -------- d-----w- c:\program files\OpenVPN
2009-12-13 09:24 . 2009-12-13 09:24 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-13 09:24 . 2008-04-14 10:21 -------- d-----w- c:\program files\Java
2009-12-13 09:24 . 2009-12-13 09:24 152576 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-12-13 09:22 . 2009-12-13 09:22 79488 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-12-11 09:18 . 2009-11-20 11:05 -------- d-----w- c:\documents and settings\Administrator\Application Data\Hamachi
2009-12-09 08:03 . 2009-11-20 08:03 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-11-22 06:22 . 2009-11-22 06:22 -------- d-----w- c:\program files\ZyDAS Technology Corporation
2009-11-20 15:09 . 2009-11-20 15:09 -------- d-----w- c:\documents and settings\Administrator\Application Data\UltraVNC
2009-11-20 13:26 . 2009-11-20 13:26 25984 ----a-w- c:\windows\system32\drivers\tap0901.sys
2009-11-20 11:23 . 2009-09-23 08:41 25280 ----a-w- c:\windows\system32\drivers\hamachi.sys
2009-11-19 11:36 . 2009-11-18 15:38 376832 ----a-w- c:\windows\system32\AegisI5Installer.exe
2009-11-19 11:29 . 2009-11-19 11:29 1962544 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player_ax.exe
2002-12-11 22:00 . 2008-01-22 15:27 6325 ----a-w- c:\program files\BgphXP.inf
.

((((((((((((((((((((((((((((( SnapShot@2010-01-19_12.18.31 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-01-19 14:31 . 2010-01-19 14:31 16384 c:\windows\temp\Perflib_Perfdata_d8.dat
+ 2001-08-23 12:00 . 2010-01-19 12:32 40128 c:\windows\system32\perfc009.dat
- 2001-08-23 12:00 . 2010-01-19 12:13 40128 c:\windows\system32\perfc009.dat
+ 2001-08-23 12:00 . 2010-01-19 12:32 311740 c:\windows\system32\perfh009.dat
- 2001-08-23 12:00 . 2010-01-19 12:13 311740 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ZDWLan Utility.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ZDWLan Utility.lnk
backup=c:\windows\pss\ZDWLan Utility.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-09-04 10:08 935288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 03:42 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
2007-09-20 04:33 61952 ----a-w- c:\windows\system32\HDAShCut.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2007-01-13 08:47 163840 ----a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2007-01-13 08:47 131072 ----a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2007-01-13 08:46 135168 ----a-w- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2006-10-11 16:36 16267776 ----a-w- c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-12-13 09:24 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R0 cfadisk;CompactFlash Filter Driver;c:\windows\system32\drivers\cfadisk.sys [1/6/2010 2:49 PM 3712]
S2 ktzwuxszz;Security Center;c:\windows\system32\svchost.exe -k netsvcs [8/4/2004 1:56 AM 14336]
S3 BRGSp50;BRGSp50 NDIS Protocol Driver;c:\windows\system32\drivers\BRGSp50.sys [8/27/2009 3:09 PM 20608]
S3 CH341SER;CH341SER;c:\windows\system32\drivers\CH341SER.SYS [3/5/2009 12:05 PM 35824]
S3 Mkd2kfNt;Mkd2kfNt;c:\windows\system32\drivers\Mkd2kfNT.sys [12/24/2009 11:54 AM 131072]
S3 Mkd2Nadr;Mkd2Nadr;c:\windows\system32\drivers\Mkd2Nadr.sys [12/24/2009 11:54 AM 79104]
S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [12/22/2009 12:38 PM 709248]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ktzwuxszz
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyServer = proxy.btk.bg:80
uInternet Settings,ProxyOverride = 10.*;<local>
TCP: {1C89E15D-4F3C-4961-B682-D2EAAA6C7EF4} = 192.168.1.1,212.39.90.42
TCP: {24B0A447-301A-4EA0-A32B-041FDF187983} = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\c705jvq9.default\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-19 16:31
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ktzwuxszz]
"ServiceDll"="c:\windows\system32\uhsjfm.dll"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1452)
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\System32\PAStiSvc.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-01-19 16:32:47 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-19 14:32
ComboFix2.txt 2010-01-19 12:19

Pre-Run: 33 760 530 432 bytes free
Post-Run: 33 728 028 672 bytes free

- - End Of File - - 8EB4234FDB34CDCA36BA97EA11CC5BFD

Компютъра се рестартира преди да изведе лог файла - предполагам, че е нормално! И когато преместих текстовия файл в/у ComboFix ми предложи да изтегля нова версия на програмата, което аз НЕ направих!

Редактирано 19 януари 201016 г. от icemans (преглед на промените)

19 януари 201016 г.

Не е направено както трябва, защото скриптът не се е активирал. Моля, внимателно повторете процедурата, като се уверите, че всичко е както съм описал.

19 януари 201016 г.

Автор

Еми хващам и премествам файла CFScript.txt в/у Tool.exe, което всъщност ми е ComboFix-а преименуван според инструкциите! При това ми се стартира програмата - каза ми, че има нова версия, но аз отказах да я изтегля и той започна да си RUN-ва! След което се ретсартира!

19 януари 201016 г.

Как така ще откажеш? Изтрий Combo-Fix.exe (старото копие) и си изтегли ново копие от линковете, които бях дал.

19 януари 201016 г.

Автор

ComboFix 10-01-18.02 - Administrator 01.2010 г. 16:46:06.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.1015.707 [GMT 2:00]
Running from: c:\documents and settings\Administrator\Desktop\Tool.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
.

((((((((((((((((((((((((( Files Created from 2009-12-19 to 2010-01-19 )))))))))))))))))))))))))))))))
.

2010-01-18 12:21 . 2010-01-18 12:21 -------- d-----w- c:\program files\Trend Micro
2010-01-18 12:00 . 2010-01-18 12:00 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-01-18 12:00 . 2010-01-07 14:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-18 12:00 . 2010-01-18 12:00 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-18 12:00 . 2010-01-18 12:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-18 12:00 . 2010-01-07 14:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-15 15:10 . 2008-04-14 03:42 176640 ------w- c:\windows\system32\napstat.exe
2010-01-15 15:09 . 2010-01-15 15:09 -------- d-----w- c:\windows\ServicePackFiles
2010-01-15 15:06 . 2007-08-10 18:46 26488 ----a-w- c:\windows\system32\spupdsvc.exe
2010-01-15 06:42 . 2010-01-15 06:42 -------- d-----w- c:\windows\system32\wbem\Repository
2010-01-13 09:07 . 2010-01-15 06:41 -------- d-----w- c:\documents and settings\Administrator\Application Data\uTorrent
2010-01-06 12:49 . 2002-12-24 19:18 3712 ----a-w- c:\windows\system32\drivers\cfadisk.sys
2009-12-28 09:41 . 2009-12-28 09:41 -------- d-----w- c:\program files\ESET
2009-12-24 09:54 . 2009-12-24 09:54 767328 ----a-w- c:\windows\system32\kdfinj.dll
2009-12-24 09:54 . 2008-10-17 08:50 79104 ----a-w- c:\windows\system32\drivers\Mkd2Nadr.sys
2009-12-24 09:54 . 2008-10-17 08:50 131072 ----a-w- c:\windows\system32\drivers\Mkd2kfNT.sys
2009-12-22 10:38 . 2009-03-04 15:30 709248 ----a-w- c:\windows\system32\drivers\rt2870.sys
2009-12-22 10:38 . 2009-03-04 15:23 221184 ----a-w- c:\windows\system32\RaCoInst.dll
2009-12-22 10:38 . 2009-12-22 10:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Ralink Driver
2009-12-22 10:38 . 2009-03-04 15:30 709248 ----a-w- c:\documents and settings\All Users\Application Data\Ralink Driver\RT2870 Wireless LAN Card\Driver\rt2870.sys
2009-12-22 10:38 . 2009-03-04 15:23 221184 ----a-w- c:\documents and settings\All Users\Application Data\Ralink Driver\RT2870 Wireless LAN Card\Driver\RaCoInst.dll
2009-12-22 10:38 . 2009-03-04 15:23 13931 ----a-w- c:\windows\system32\RaCoInst.dat
2009-12-22 10:38 . 2008-08-06 14:31 528384 ----a-w- c:\documents and settings\All Users\Application Data\Ralink Driver\RT2870 Wireless LAN Card\Driver\RaInst.exe
2009-12-22 10:38 . 2007-05-17 09:17 192512 ----a-w- c:\documents and settings\All Users\Application Data\Ralink Driver\RT2870 Wireless LAN Card\Driver\CoInstaller.dll
2009-12-22 10:38 . 2006-11-02 05:21 319456 ----a-w- c:\documents and settings\All Users\Application Data\Ralink Driver\RT2870 Wireless LAN Card\Driver\difxapi.dll
2009-12-22 10:38 . 2009-12-22 10:38 -------- d-----w- c:\documents and settings\Administrator\Application Data\InstallShield
2009-12-21 14:26 . 2009-12-21 14:26 -------- d-----w- c:\program files\Common Files\Adobe
2009-12-21 14:24 . 2009-11-20 11:08 38784 ----a-w- c:\documents and settings\Administrator\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-12-21 14:24 . 2009-12-21 14:24 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-12-21 14:23 . 2009-12-21 14:23 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2009-12-21 09:30 . 2008-04-13 22:09 5504 ----a-w- c:\windows\system32\drivers\mstee.sys
2009-12-21 09:30 . 2008-04-13 22:16 10880 ----a-w- c:\windows\system32\drivers\ndisip.sys
2009-12-21 09:30 . 2008-04-13 22:16 15232 ----a-w- c:\windows\system32\drivers\streamip.sys
2009-12-21 09:30 . 2008-04-13 22:16 11136 ----a-w- c:\windows\system32\drivers\slip.sys
2009-12-21 09:30 . 2008-04-13 22:16 19200 ----a-w- c:\windows\system32\drivers\wstcodec.sys
2009-12-21 09:30 . 2008-04-13 22:16 85248 ----a-w- c:\windows\system32\drivers\nabtsfec.sys
2009-12-21 09:30 . 2008-04-13 22:16 17024 ----a-w- c:\windows\system32\drivers\ccdecode.sys
2009-12-21 09:30 . 2008-04-13 22:15 60032 ----a-w- c:\windows\system32\drivers\usbaudio.sys
2009-12-21 09:30 . 2005-01-14 07:32 53248 ----a-w- c:\windows\system32\PAStiSvc.exe
2009-12-21 09:30 . 2008-04-14 03:42 53760 ----a-w- c:\windows\system32\vfwwdm32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-18 13:43 . 2009-11-20 11:28 -------- d-----w- c:\program files\UltraVNC
2010-01-16 09:54 . 2007-12-16 22:15 64808 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-15 15:12 . 2007-10-31 03:46 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-12-22 11:40 . 2009-11-19 11:28 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-12-22 10:38 . 2007-10-31 03:54 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-14 11:17 . 2009-12-14 11:17 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-12-13 13:53 . 2009-12-13 13:53 -------- d-----w- c:\program files\CCleaner
2009-12-13 13:23 . 2009-12-07 12:02 -------- d-----w- c:\program files\OpenVPN
2009-12-13 09:24 . 2009-12-13 09:24 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-13 09:24 . 2008-04-14 10:21 -------- d-----w- c:\program files\Java
2009-12-13 09:24 . 2009-12-13 09:24 152576 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-12-13 09:22 . 2009-12-13 09:22 79488 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-12-11 09:18 . 2009-11-20 11:05 -------- d-----w- c:\documents and settings\Administrator\Application Data\Hamachi
2009-12-09 08:03 . 2009-11-20 08:03 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-11-22 06:22 . 2009-11-22 06:22 -------- d-----w- c:\program files\ZyDAS Technology Corporation
2009-11-20 15:09 . 2009-11-20 15:09 -------- d-----w- c:\documents and settings\Administrator\Application Data\UltraVNC
2009-11-20 13:26 . 2009-11-20 13:26 25984 ----a-w- c:\windows\system32\drivers\tap0901.sys
2009-11-20 11:23 . 2009-09-23 08:41 25280 ----a-w- c:\windows\system32\drivers\hamachi.sys
2009-11-19 11:36 . 2009-11-18 15:38 376832 ----a-w- c:\windows\system32\AegisI5Installer.exe
2009-11-19 11:29 . 2009-11-19 11:29 1962544 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player_ax.exe
2002-12-11 22:00 . 2008-01-22 15:27 6325 ----a-w- c:\program files\BgphXP.inf
.

((((((((((((((((((((((((((((( SnapShot@2010-01-19_12.18.31 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-01-19 14:48 . 2010-01-19 14:48 16384 c:\windows\temp\Perflib_Perfdata_f8.dat
+ 2001-08-23 12:00 . 2010-01-19 14:35 40128 c:\windows\system32\perfc009.dat
- 2001-08-23 12:00 . 2010-01-19 12:13 40128 c:\windows\system32\perfc009.dat
+ 2001-08-23 12:00 . 2010-01-19 14:35 311740 c:\windows\system32\perfh009.dat
- 2001-08-23 12:00 . 2010-01-19 12:13 311740 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ZDWLan Utility.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ZDWLan Utility.lnk
backup=c:\windows\pss\ZDWLan Utility.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-09-04 10:08 935288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 03:42 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
2007-09-20 04:33 61952 ----a-w- c:\windows\system32\HDAShCut.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2007-01-13 08:47 163840 ----a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2007-01-13 08:47 131072 ----a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2007-01-13 08:46 135168 ----a-w- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2006-10-11 16:36 16267776 ----a-w- c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-12-13 09:24 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R0 cfadisk;CompactFlash Filter Driver;c:\windows\system32\drivers\cfadisk.sys [1/6/2010 2:49 PM 3712]
S2 ktzwuxszz;Security Center;c:\windows\system32\svchost.exe -k netsvcs [8/4/2004 1:56 AM 14336]
S3 BRGSp50;BRGSp50 NDIS Protocol Driver;c:\windows\system32\drivers\BRGSp50.sys [8/27/2009 3:09 PM 20608]
S3 CH341SER;CH341SER;c:\windows\system32\drivers\CH341SER.SYS [3/5/2009 12:05 PM 35824]
S3 Mkd2kfNt;Mkd2kfNt;c:\windows\system32\drivers\Mkd2kfNT.sys [12/24/2009 11:54 AM 131072]
S3 Mkd2Nadr;Mkd2Nadr;c:\windows\system32\drivers\Mkd2Nadr.sys [12/24/2009 11:54 AM 79104]
S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [12/22/2009 12:38 PM 709248]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyServer = proxy.btk.bg:80
uInternet Settings,ProxyOverride = 10.*;<local>
TCP: {1C89E15D-4F3C-4961-B682-D2EAAA6C7EF4} = 192.168.1.1,212.39.90.42
TCP: {24B0A447-301A-4EA0-A32B-041FDF187983} = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\c705jvq9.default\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-19 16:48
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ktzwuxszz]
"ServiceDll"="c:\windows\system32\uhsjfm.dll"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(360)
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\System32\PAStiSvc.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-01-19 16:50:12 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-19 14:50
ComboFix2.txt 2010-01-19 14:32
ComboFix3.txt 2010-01-19 12:19

Pre-Run: 33 736 462 336 bytes free
Post-Run: 33 700 962 304 bytes free

- - End Of File - - 33BD6FE209F39E22DF23A1287BD21B79

Как така ще откажеш? Изтрий Combo-Fix.exe (старото копие) и си изтегли ново копие от линковете, които бях дал.

Ами точно от първия линк я изтеглих днес по обяд. Първия път когато я пуснах не ми каза, че има ново копие - сега обаче при тази манипулация ми казва, че има нова версия!

19 януари 201016 г.

Изтегли новата версия и опитай със скрипта, който ти дадох.

19 януари 201016 г.

Автор

Повторих процедурата като този път изтеглих програмата от ВТОРИЯ линк! Този път не ми каза, че има нова версия! Резултата:

ComboFix 10-01-18.03 - Administrator 01.2010 г. 17:06:07.4.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.1015.612 [GMT 2:00]
Running from: c:\documents and settings\Administrator\Desktop\Tool.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
.

((((((((((((((((((((((((( Files Created from 2009-12-19 to 2010-01-19 )))))))))))))))))))))))))))))))
.

2010-01-18 12:21 . 2010-01-18 12:21 -------- d-----w- c:\program files\Trend Micro
2010-01-18 12:00 . 2010-01-18 12:00 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-01-18 12:00 . 2010-01-07 14:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-18 12:00 . 2010-01-18 12:00 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-18 12:00 . 2010-01-18 12:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-18 12:00 . 2010-01-07 14:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-15 15:10 . 2008-04-14 03:42 176640 ------w- c:\windows\system32\napstat.exe
2010-01-15 15:09 . 2010-01-15 15:09 -------- d-----w- c:\windows\ServicePackFiles
2010-01-15 15:06 . 2007-08-10 18:46 26488 ----a-w- c:\windows\system32\spupdsvc.exe
2010-01-15 06:42 . 2010-01-15 06:42 -------- d-----w- c:\windows\system32\wbem\Repository
2010-01-13 09:07 . 2010-01-15 06:41 -------- d-----w- c:\documents and settings\Administrator\Application Data\uTorrent
2010-01-06 12:49 . 2002-12-24 19:18 3712 ----a-w- c:\windows\system32\drivers\cfadisk.sys
2009-12-28 09:41 . 2009-12-28 09:41 -------- d-----w- c:\program files\ESET
2009-12-24 09:54 . 2009-12-24 09:54 767328 ----a-w- c:\windows\system32\kdfinj.dll
2009-12-24 09:54 . 2008-10-17 08:50 79104 ----a-w- c:\windows\system32\drivers\Mkd2Nadr.sys
2009-12-24 09:54 . 2008-10-17 08:50 131072 ----a-w- c:\windows\system32\drivers\Mkd2kfNT.sys
2009-12-22 10:38 . 2009-03-04 15:30 709248 ----a-w- c:\windows\system32\drivers\rt2870.sys
2009-12-22 10:38 . 2009-03-04 15:23 221184 ----a-w- c:\windows\system32\RaCoInst.dll
2009-12-22 10:38 . 2009-12-22 10:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Ralink Driver
2009-12-22 10:38 . 2009-03-04 15:30 709248 ----a-w- c:\documents and settings\All Users\Application Data\Ralink Driver\RT2870 Wireless LAN Card\Driver\rt2870.sys
2009-12-22 10:38 . 2009-03-04 15:23 221184 ----a-w- c:\documents and settings\All Users\Application Data\Ralink Driver\RT2870 Wireless LAN Card\Driver\RaCoInst.dll
2009-12-22 10:38 . 2009-03-04 15:23 13931 ----a-w- c:\windows\system32\RaCoInst.dat
2009-12-22 10:38 . 2008-08-06 14:31 528384 ----a-w- c:\documents and settings\All Users\Application Data\Ralink Driver\RT2870 Wireless LAN Card\Driver\RaInst.exe
2009-12-22 10:38 . 2007-05-17 09:17 192512 ----a-w- c:\documents and settings\All Users\Application Data\Ralink Driver\RT2870 Wireless LAN Card\Driver\CoInstaller.dll
2009-12-22 10:38 . 2006-11-02 05:21 319456 ----a-w- c:\documents and settings\All Users\Application Data\Ralink Driver\RT2870 Wireless LAN Card\Driver\difxapi.dll
2009-12-22 10:38 . 2009-12-22 10:38 -------- d-----w- c:\documents and settings\Administrator\Application Data\InstallShield
2009-12-21 14:26 . 2009-12-21 14:26 -------- d-----w- c:\program files\Common Files\Adobe
2009-12-21 14:24 . 2009-11-20 11:08 38784 ----a-w- c:\documents and settings\Administrator\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-12-21 14:24 . 2009-12-21 14:24 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-12-21 14:23 . 2009-12-21 14:23 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2009-12-21 09:30 . 2008-04-13 22:09 5504 ----a-w- c:\windows\system32\drivers\mstee.sys
2009-12-21 09:30 . 2008-04-13 22:16 10880 ----a-w- c:\windows\system32\drivers\ndisip.sys
2009-12-21 09:30 . 2008-04-13 22:16 15232 ----a-w- c:\windows\system32\drivers\streamip.sys
2009-12-21 09:30 . 2008-04-13 22:16 11136 ----a-w- c:\windows\system32\drivers\slip.sys
2009-12-21 09:30 . 2008-04-13 22:16 19200 ----a-w- c:\windows\system32\drivers\wstcodec.sys
2009-12-21 09:30 . 2008-04-13 22:16 85248 ----a-w- c:\windows\system32\drivers\nabtsfec.sys
2009-12-21 09:30 . 2008-04-13 22:16 17024 ----a-w- c:\windows\system32\drivers\ccdecode.sys
2009-12-21 09:30 . 2008-04-13 22:15 60032 ----a-w- c:\windows\system32\drivers\usbaudio.sys
2009-12-21 09:30 . 2005-01-14 07:32 53248 ----a-w- c:\windows\system32\PAStiSvc.exe
2009-12-21 09:30 . 2008-04-14 03:42 53760 ----a-w- c:\windows\system32\vfwwdm32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-18 13:43 . 2009-11-20 11:28 -------- d-----w- c:\program files\UltraVNC
2010-01-16 09:54 . 2007-12-16 22:15 64808 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-15 15:12 . 2007-10-31 03:46 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-12-22 11:40 . 2009-11-19 11:28 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-12-22 10:38 . 2007-10-31 03:54 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-14 11:17 . 2009-12-14 11:17 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-12-13 13:53 . 2009-12-13 13:53 -------- d-----w- c:\program files\CCleaner
2009-12-13 13:23 . 2009-12-07 12:02 -------- d-----w- c:\program files\OpenVPN
2009-12-13 09:24 . 2009-12-13 09:24 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-13 09:24 . 2008-04-14 10:21 -------- d-----w- c:\program files\Java
2009-12-13 09:24 . 2009-12-13 09:24 152576 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-12-13 09:22 . 2009-12-13 09:22 79488 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-12-11 09:18 . 2009-11-20 11:05 -------- d-----w- c:\documents and settings\Administrator\Application Data\Hamachi
2009-12-09 08:03 . 2009-11-20 08:03 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-11-22 06:22 . 2009-11-22 06:22 -------- d-----w- c:\program files\ZyDAS Technology Corporation
2009-11-20 15:09 . 2009-11-20 15:09 -------- d-----w- c:\documents and settings\Administrator\Application Data\UltraVNC
2009-11-20 13:26 . 2009-11-20 13:26 25984 ----a-w- c:\windows\system32\drivers\tap0901.sys
2009-11-20 11:23 . 2009-09-23 08:41 25280 ----a-w- c:\windows\system32\drivers\hamachi.sys
2009-11-19 11:36 . 2009-11-18 15:38 376832 ----a-w- c:\windows\system32\AegisI5Installer.exe
2009-11-19 11:29 . 2009-11-19 11:29 1962544 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player_ax.exe
2002-12-11 22:00 . 2008-01-22 15:27 6325 ----a-w- c:\program files\BgphXP.inf
.

((((((((((((((((((((((((((((( SnapShot@2010-01-19_12.18.31 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-01-19 15:08 . 2010-01-19 15:08 16384 c:\windows\temp\Perflib_Perfdata_104.dat
+ 2001-08-23 12:00 . 2010-01-19 14:52 40128 c:\windows\system32\perfc009.dat
- 2001-08-23 12:00 . 2010-01-19 12:13 40128 c:\windows\system32\perfc009.dat
+ 2001-08-23 12:00 . 2010-01-19 14:52 311740 c:\windows\system32\perfh009.dat
- 2001-08-23 12:00 . 2010-01-19 12:13 311740 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ZDWLan Utility.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ZDWLan Utility.lnk
backup=c:\windows\pss\ZDWLan Utility.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-09-04 10:08 935288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 03:42 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
2007-09-20 04:33 61952 ----a-w- c:\windows\system32\HDAShCut.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2007-01-13 08:47 163840 ----a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2007-01-13 08:47 131072 ----a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2007-01-13 08:46 135168 ----a-w- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2006-10-11 16:36 16267776 ----a-w- c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-12-13 09:24 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R0 cfadisk;CompactFlash Filter Driver;c:\windows\system32\drivers\cfadisk.sys [1/6/2010 2:49 PM 3712]
S2 ktzwuxszz;Security Center;c:\windows\system32\svchost.exe -k netsvcs [8/4/2004 1:56 AM 14336]
S3 BRGSp50;BRGSp50 NDIS Protocol Driver;c:\windows\system32\drivers\BRGSp50.sys [8/27/2009 3:09 PM 20608]
S3 CH341SER;CH341SER;c:\windows\system32\drivers\CH341SER.SYS [3/5/2009 12:05 PM 35824]
S3 Mkd2kfNt;Mkd2kfNt;c:\windows\system32\drivers\Mkd2kfNT.sys [12/24/2009 11:54 AM 131072]
S3 Mkd2Nadr;Mkd2Nadr;c:\windows\system32\drivers\Mkd2Nadr.sys [12/24/2009 11:54 AM 79104]
S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [12/22/2009 12:38 PM 709248]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyServer = proxy.btk.bg:80
uInternet Settings,ProxyOverride = 10.*;<local>
TCP: {1C89E15D-4F3C-4961-B682-D2EAAA6C7EF4} = 192.168.1.1,212.39.90.42
TCP: {24B0A447-301A-4EA0-A32B-041FDF187983} = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\c705jvq9.default\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-19 17:08
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ktzwuxszz]
"ServiceDll"="c:\windows\system32\uhsjfm.dll"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1728)
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\System32\PAStiSvc.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-01-19 17:09:55 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-19 15:09
ComboFix2.txt 2010-01-19 14:50
ComboFix3.txt 2010-01-19 14:32
ComboFix4.txt 2010-01-19 12:19

Pre-Run: 33 705 455 616 bytes free
Post-Run: 33 670 197 248 bytes free

- - End Of File - - D5808FC256363E178FC7C611DF7B623B

19 януари 201016 г.

Градски, Нод 32 ли е съпричастен за тази твоя идилия-одисея!? Всъщност се чудя как да я нарека. Заради ужасната си репутация смятам да отворя очите на всички унесени фенове на Нод 32 колко е безпогрешен проактивният им лидер... Maniac, на всички останали ще им е интересно и весело донякъде. Искам да спориш,отстояваш и доказваш позиция - стига с тези минуси. Поздрави

19 януари 201016 г.

Градски, Нод 32 ли е съпричастен за тази твоя идилия-одисея!? Всъщност се чудя как да я нарека. Заради ужасната си репутация смятам да отворя очите на всички унесени фенове на Нод 32 колко е безпогрешен проактивният им лидер... Maniac, на всички останали ще им е интересно и весело донякъде. Искам да спориш,отстояваш и доказваш позиция - стига с тези минуси. Поздрави

Проблема не е в NOD32 в случая. Никоя антивирусна не го премахва...защото използва руткит техники да се закрепи, а услугите са му все с различни имена и не може да се състави точен алгоритъм за премахването му и това трябва да стане ръчно.

Сорка, че се намесих в темата колега...

19 януари 201016 г.

' date='19 януари 2010 - 18:34 ' timestamp='1263918856' post='1612638']
Проблема не е в NOD32 в случая. Никоя антивирусна не го премахва...защото използва руткит техники да се закрепи, а услугите са му все с различни имена и не може да се състави точен алгоритъм за премахването му и това трябва да стане ръчно.

Сорка, че се намесих в темата колега...

Би-бой, някои програми изобщо няма да му позволят да се закрепи и да се изяви. Например и при двете водещи азиатски програми това няма как да се случи - освен при неадекватен ползвател. Защо отново не ги пробваш и да предоставиш актуално мнение - ти можеш да си обективен. Лично аз, ако съм само с Авира - по-добре да не пиша как бих се чувствал.Иначе Винаги ще харесвам немската си любимка - тя все ми е подръка за инсталиране. Поздрави

19 януари 201016 г.

Би-бой, някои програми изобщо няма да му позволят да се закрепи и да се изяви. Например и при двете водещи азиатски програми това няма как да се случи - освен при неадекватен ползвател. Защо отново не ги пробваш и да предоставиш актуално мнение - ти можеш да си обективен. Лично аз, ако съм само с Авира - по-добре да не пиша как бих се чувствал.Иначе Винаги ще харесвам немската си любимка - тя все ми е подръка за инсталиране. Поздрави

Аз не съм само с нея, но на Windows 7 x64, руткит техниките не вървят. Все пак си имам и COMODO. Но остави настрана азиатските програми. Говорим, че никой СТАНДАРТЕН антивирус без ХИПС механизми не би го спрял. Защо наскоро го почиствах на компютри с avast, Avira, дори Norton и Kaspersky...

А IDS/HIPS определено не са за всеки.

19 януари 201016 г.

Автор

Ами НЕ! Нямам спомен на този компютър да е имало инсталирано НОД32 някога! Maniac не знам дали се получава нещо или не, но правя всичко както трябва - не виждам нищо сложно в цялата работа, че да я объркам!

19 януари 201016 г.

Ами НЕ! Нямам спомен на този компютър да е имало инсталирано НОД32 някога! Maniac не знам дали се получава нещо или не, но правя всичко както трябва - не виждам нищо сложно в цялата работа, че да я объркам!

А мислиш ли, че е възможно и лесно да прогнозираш стъпките на вредоносния код!? Тези неща са много по-сложни и многовариантни отколкото двамата с Maniac можете дори да предположите. Споделям го не за да ви дразня - а за да сте наясно. Реално точно кой антивирус не се е справил не е от съществено значение. Успех!

19 януари 201016 г.

Здравейте аз съм редовен читател на този раздел,поздравления за труда който полагате и на 2та Маняк и Б-Боинг.

Прави ми впечатление че все повече,заразени идват без антивирусна това е много странно,а в този случай наистина Нод няма нищо общо.

Ама много бързо ги триете тия папки,от рапидшеър не може човек да свари да я изтеглиНе съм бил ваш пациент и се надявам никога да не стана,Поздрави.

20 януари 201016 г.

Автор

''' Това можеше да ми го спестиш в тази тема, че и без това се разводни много!

Редактирано 20 януари 201016 г. от icemans (преглед на промените)

20 януари 201016 г.

Щом съм казал, че не се прави както съм инструктирал, значи не е!

Изтеглете The Avenger (от Swandog46) и го запазете на вашия десктоп. Разархивирайте архива на вашия десктоп, отново.

Стартирайте avenger.exe, копирайте следния скрипт и го поставете в текстовото поле на програмата:

Begin copying here:

Files to delete:

c:\windows\system32\uhsjfm.dll


Drivers to disable:

ktzwuxszz


Drivers to delete:

ktzwuxszz


Registry keys to delete:

HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ktzwuxszz

Бележка: Този скрипт е създаден специално за този потребител. Ако Вие не сте този потребител, НЕ ползвайте този скрипт, защото ной може да повреди сериозно вашата система.

Уверете се, че Scan for rootkits и Automatically disable any rootkits found имат отметки.

Накрая, изберете Execute и при въпрос от страна на програмата, кликнете върху Yes, при което комюпътър ще се рестартира. След рестартирането, копирайте и поставете съдържанието на лог файла от програмата, намиращ се в C:\avenger.txt в следващия Ви коментар в тази тема.

1

20 януари 201016 г.

Автор

Logfile of The Avenger Version 2.0, © by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Error: file "c:\windows\system32\uhsjfm.dll" not found!
Deletion of file "c:\windows\system32\uhsjfm.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Driver "ktzwuxszz" disabled successfully.
Driver "ktzwuxszz" deleted successfully.

Error: registry key "HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ktzwuxszz" not found!
Deletion of registry key "HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ktzwuxszz" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Completed script processing.

*******************

Finished! Terminate.

20 януари 201016 г.

Изтрийте вашето копие от ComboFix, изтеглете ново и повторете първите инструкции за ComboFix, които Ви дадох.

Добре дошли!

Проверка за бацил!?

Featured Replies

Регистрирайте се или влезете в профила си за да коментирате

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)