HiJackThis/Log :Оптимизация/Анализ/Ревю

27 юли 200917 г.

Автор

Михнев, цял ден сьм сканирал с различни програми(част от които са описаните от теб). Мисля. че няма смисьл да започвам наново скан.

Не мога да гадая,не си споменавал.

Де-инсталирай AVG Anti-Spyware 7.5 ,много е вероятно това да се дължи на конфликт м/у двете.

Avast!Home има такъв вграден anti-spyware модул.Рестартирай и виж има ли проблем с Avast!.

М/у другото фиксирай следното,като затвориш браузъра преди това:

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - [url="http://download.bitdefender.com/resources/scan8/oscan8.cab"]http://download.bitdefender.com/resources/scan8/oscan8.cab[/url]

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)

Добавени ли са взаимно Outpost Firewall и Avast към доверените им зони?

27 юли 200917 г.

ComboFix 09-07-26.01 - boris 07.2009 г. 15:11.1.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1251.359.1033.18.767.449 [GMT 3:00]

Running from: c:\documents and settings\boris\Desktop\ComboFix.exe

AV: "Eset" °ЅтёІёрусЅ° сёстµј° "NOD32" 2.70 *On-access scanning enabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

FW: ActiveArmor Firewall *disabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\autorun.inf

c:\documents and settings\All Users\Start Menu\Programs\USB PC Camera Plus

c:\documents and settings\All Users\Start Menu\Programs\USB PC Camera Plus \AMCap.lnk

c:\documents and settings\All Users\Start Menu\Programs\USB PC Camera Plus \Uninstall.lnk

c:\recycler\S-1-5-21-4147604227-2205782942-563214890-6515

c:\recycler\S-1-5-21-4147604227-2205782942-563214890-6515\Desktop.ini

c:\recycler\S-1-5-21-4147604227-2205782942-563214890-6515\isl.exe

c:\windows\system32\dbqp.fon

c:\windows\system32\klipxm32.dll

c:\windows\system32\msn.dll

c:\windows\system32\poiyu

D:\autorun.inf

D:\resycled

d:\resycled\ntldr.com

E:\Autorun.inf

E:\resycled

e:\resycled\ntldr.com

.

((((((((((((((((((((((((( Files Created from 2009-06-27 to 2009-07-27 )))))))))))))))))))))))))))))))

.

2009-07-27 07:22 . 2009-07-27 07:22 152576 ----a-w- c:\documents and settings\boris\Application Data\Sun\Java\jre1.6.0_14\lzma.dll

2009-07-27 06:28 . 2009-07-27 06:28 -------- d-----w- c:\documents and settings\boris\Application Data\Malwarebytes

2009-07-27 06:28 . 2009-07-13 10:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-07-27 06:28 . 2009-07-27 06:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-07-27 06:28 . 2009-07-27 06:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-07-27 06:28 . 2009-07-13 10:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-07-26 23:48 . 2009-07-26 23:48 127 ----a-w- c:\windows\system32\105.reg

2009-07-26 10:00 . 2009-07-26 10:01 -------- d-----w- c:\windows\system32\NtmsData

2009-07-24 16:53 . 2007-09-05 08:02 17408 ----a-w- c:\windows\system32\lam4.exe

2009-07-24 06:46 . 2009-07-24 06:46 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2009-07-24 06:46 . 2009-07-24 16:21 -------- d-----w- c:\documents and settings\boris\Application Data\SUPERAntiSpyware.com

2009-07-24 06:46 . 2009-07-24 16:21 -------- d-----w- c:\program files\SUPERAntiSpyware

2009-07-24 06:01 . 2009-07-27 06:27 -------- d-----w- c:\program files\ESET

2009-07-23 06:46 . 2009-07-23 06:46 -------- d-----w- c:\documents and settings\boris\Local Settings\Application Data\Temp

2009-07-23 06:46 . 2009-07-23 06:46 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google

2009-07-23 06:34 . 2009-07-23 06:34 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google

2009-07-23 06:33 . 2009-07-23 06:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater

2009-07-14 20:13 . 2009-06-27 07:50 35507 ----a-w- c:\windows\system32\lmz.exe

2009-07-14 20:13 . 2007-09-05 08:02 31744 ----a-w- c:\windows\system32\lam5.exe

2009-07-14 20:13 . 2007-09-05 08:02 19968 ----a-w- c:\windows\system32\lam3.exe

2009-07-14 20:13 . 2007-09-05 08:02 90112 ----a-w- c:\windows\system32\lam2.exe

2009-07-14 20:13 . 2007-09-05 08:02 61440 ----a-w- c:\windows\system32\lam1.exe

2009-07-14 20:13 . 2003-04-19 08:43 86016 ----a-w- c:\windows\system32\reg.dll

2009-07-14 11:03 . 2009-07-14 11:16 -------- d-----w- c:\program files\AEDiction

2009-06-28 18:25 . 2009-07-16 06:40 -------- d-----w- C:\Downloads

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-07-27 11:50 . 2009-02-17 08:28 -------- d-----w- c:\documents and settings\boris\Application Data\Skype

2009-07-27 07:23 . 2009-04-28 18:04 -------- d-----w- c:\program files\Java

2009-07-24 20:38 . 2009-02-17 08:30 -------- d-----w- c:\program files\FlashGet

2009-07-24 06:44 . 2009-03-10 19:42 -------- d-----w- c:\program files\TVAnts

2009-07-24 06:44 . 2009-02-16 19:31 -------- d-----w- c:\program files\Common Files\InstallShield

2009-07-24 06:44 . 2009-02-16 20:49 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-07-23 06:35 . 2009-02-17 08:28 -------- d-----w- c:\program files\Google

2009-07-20 14:29 . 2009-06-02 20:56 -------- d-----w- c:\program files\PokerStars.NET

2009-07-20 06:47 . 2009-02-18 12:28 -------- d-----w- c:\program files\Flex Anticheat Games-BG

2009-07-17 14:20 . 2009-02-16 19:11 43272 ----a-w- c:\documents and settings\boris\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-07-07 12:38 . 2009-05-13 08:54 -------- d--h--w- c:\program files\Zero G Registry

2009-07-07 12:34 . 2009-04-01 11:17 -------- d-----w- c:\program files\PokerStars

2009-06-21 05:46 . 2009-02-16 20:45 485920 ----a-w- c:\windows\system32\NVUNINST.EXE

2009-06-10 05:28 . 2009-06-10 05:28 3510272 ----a-w- c:\windows\system32\nvgames.dll

2009-06-10 05:28 . 2009-06-10 05:28 4022272 ----a-w- c:\windows\system32\nvdisps.dll

2009-06-10 05:28 . 2009-06-10 05:28 86016 ----a-w- c:\windows\system32\nvmctray.dll

2009-06-10 05:28 . 2009-06-10 05:28 168004 ----a-w- c:\windows\system32\nvsvc32.exe

2009-06-10 05:28 . 2009-06-10 05:28 143360 ----a-w- c:\windows\system32\nvcolor.exe

2009-06-10 05:28 . 2009-06-10 05:28 13758464 ----a-w- c:\windows\system32\nvcpl.dll

2009-06-10 05:28 . 2009-06-10 05:28 229376 ----a-w- c:\windows\system32\nvmccs.dll

2009-06-10 03:03 . 2009-04-30 19:02 671744 ----a-w- c:\windows\system32\nvcuvid.dll

2009-06-10 03:03 . 2009-04-30 19:02 1720320 ----a-w- c:\windows\system32\nvcuda.dll

2009-06-10 03:03 . 2009-04-30 19:02 1580550 ----a-w- c:\windows\system32\nvdata.bin

2009-06-10 03:03 . 2009-04-30 19:02 1310720 ----a-w- c:\windows\system32\nvcuvenc.dll

2009-06-10 03:03 . 2009-02-16 20:46 457248 ----a-w- c:\windows\system32\nvudisp.exe

2009-06-10 03:03 . 2006-10-31 06:35 9998336 ----a-w- c:\windows\system32\nvoglnt.dll

2009-06-10 03:03 . 2006-10-31 06:35 815104 ----a-w- c:\windows\system32\nvapi.dll

2009-06-10 03:03 . 2006-10-31 06:35 8087712 ----a-w- c:\windows\system32\drivers\nv4_mini.sys

2009-06-10 03:03 . 2006-10-31 06:35 5908608 ----a-w- c:\windows\system32\nv4_disp.dll

2009-06-10 03:03 . 2006-10-31 06:35 151552 ----a-w- c:\windows\system32\nvcodins.dll

2009-06-10 03:03 . 2006-10-31 06:35 151552 ----a-w- c:\windows\system32\nvcod.dll

2009-05-22 08:44 . 2009-05-22 08:42 284 ----a-w- c:\documents and settings\boris\Application Data\ViewerApp.dat

2009-05-21 08:33 . 2009-04-28 18:04 410984 ----a-w- c:\windows\system32\deploytk.dll

2009-05-08 14:54 . 2009-02-17 08:29 2914 ----a-w- c:\windows\mozver.dat

2009-04-29 08:01 . 2009-04-29 08:01 109568 ----a-w- C:\sys.exe

2009-04-28 18:04 . 2009-04-28 18:04 152576 ----a-w- c:\documents and settings\boris\Application Data\Sun\Java\jre1.6.0_13\lzma.dll

2009-05-08 14:54 . 2009-05-08 14:54 60526 ----a-w- c:\program files\mozilla firefox\components\jar50.dll

2009-05-08 14:54 . 2009-05-08 14:54 49256 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll

2009-05-08 14:54 . 2009-05-08 14:54 166000 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-27 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-06-10 13758464]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-21 148888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"ShowDeskFix"="shell32" [X]

"RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2007-09-20 53760]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

FlexType 2K.lnk - c:\program files\Datecs\FlexType 2K\FType2K.exe [2009-3-10 95232]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^boris^Start Menu^Programs^Startup^ЎЎЎЎЎЎ.lnk]

path=c:\documents and settings\boris\Start Menu\Programs\Startup\ЎЎЎЎЎЎ.lnk

backup=c:\windows\pss\ЎЎЎЎЎЎ.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=

"c:\\Program Files\\FlashGet\\flashget.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"d:\\igri\\Counter-Strike 1.6 Sector Edition\\10155576987120806105.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe -k netsvcs [04.8.2004 і. 02:56 14336]

S2 gupdate1ca0b5fa015cd64;Ус»уі° Google Update (gupdate1ca0b5fa015cd64);c:\program files\Google\Update\GoogleUpdate.exe [23.7.2009 і. 09:34 133104]

.

Contents of the 'Scheduled Tasks' folder

2009-07-27 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-17 06:33]

2009-07-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-23 06:34]

2009-07-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-23 06:34]

.

- - - - ORPHANS REMOVED - - - -

HKCU-Run-hohohhaha - c:\windows\system32\calling.com

.

------- Supplementary Scan -------

.

uStart Page = about:blank

uInternet Settings,ProxyOverride = *.local

IE: &Download All with FlashGet - c:\progra~1\FlashGet\jc_all.htm

IE: &Download with FlashGet - c:\progra~1\FlashGet\jc_link.htm

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe

FF - ProfilePath - c:\documents and settings\boris\Application Data\Mozilla\Firefox\Profiles\vmeowxs0.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll

FF - component: c:\program files\Mozilla Firefox\extensions\[email protected]\components\qfaservices.dll

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.cookie.p3plevel", 1); // 0=low, 1=medium, 2=high, 3=custom

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.enablePad", false); // Allow client to do proxy autodiscovery

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.default", "chrome://branding/content/searchconfig.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.custom", "chrome://branding/content/searchconfig.properties");

.

**************************************************************************

driver loading error catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-07-27 15:15

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3012)

c:\windows\system32\newdll.dll

c:\windows\system32\wpdshserviceobj.dll

c:\windows\system32\portabledevicetypes.dll

c:\windows\system32\portabledeviceapi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\nvsvc32.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe

c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2009-07-27 15:17 - machine was rebooted

ComboFix-quarantined-files.txt 2009-07-27 12:16

Pre-Run: 5 780 099 072 bytes free

Post-Run: 7 433 691 136 bytes free

200

27 юли 200917 г.

Стъпка 1:

Моля, отидете на адрес http://virusscan.jotti.org , кликнете на Browse, и прикачете следните файлове за анализ: Вие ще можете да прикачвате файловете един по един.

c:\windows\system32\105.reg

c:\windows\system32\lam4.exe

След това, кликнете върху Submit. Оставете файла да бъде сканиран и след това направете screenshot на всеки един файл по отделно и го прикачете в www.4storing.com . В следващия си пост в темата, поставете линковете за изтегляне на всеки един screenshot.

Ако Jotti е натоварен, моля отидете на адрес http://www.virustotal.com .

Стъпка 2:

Изтеглете GMER Rootkit Scanner. Разархивирайте го на вашия десктоп.

Преди да сканирате се уверете, че всички останали работещи програми в момента са изключени и вашия антивирусен софтуер няма да предприема никакви действия по време на сканирането на Gmer. Не използвайте компютъра си, докато трае сканирането.

Кликнете два пъти пъти върху gmer.exe , за да стартирате програмата.

Внимание: Сканирането може да доведе до грешки, затова не предприемайте никакви действия върху редовете маркирани с "<--- ROOKIT" без да съм Ви посочил да го направите.

Ако е открита активност на rootkit ще бъдете попитани дали желаете да бъде направено пълно сканиране на системата.

Изберете NO.
В десния панел ще видите какво е било проверено, нека всичко си остане така. Необходимо е само да се уверите, че пред "Show All" няма отметка.
Сега кликнете върху бутона Scan .

След като сканирането приключи е възможно да получите информация за друга rootkit активност.

Изберете OK .
Gmer ще Ви отвори лог файла. Кликнете на бутона Save... и в полето за име на файла, напишете Gmer.txt .
Запишете лог файла на вашия десктоп.

27 юли 200917 г.

http://4storing.com/lu7jym/f0df48f68806c78...eef26e19bf.html

http://4storing.com/u98tdn/d390cc6eaa95a26...f49a018916.html

tova e ot gmer :

GMER 1.0.15.14972 - http://www.gmer.net

Rootkit scan 2009-07-28 00:36:29

Windows 5.1.2600 Service Pack 2

---- System - GMER 1.0.15 ----

SSDT sptd.sys ZwCreateKey [0xF72B00B0]

SSDT sptd.sys ZwEnumerateKey [0xF72B584E]

SSDT sptd.sys ZwEnumerateValueKey [0xF72B5BEE]

SSDT sptd.sys ZwOpenKey [0xF72B0090]

SSDT sptd.sys ZwQueryKey [0xF72B5CC6]

SSDT sptd.sys ZwQueryValueKey [0xF72B5B46]

SSDT sptd.sys ZwSetValueKey [0xF72B5D58]

---- Kernel code sections - GMER 1.0.15 ----

? C:\WINDOWS\system32\drivers\sptd.sys The process cannot access the file because it is being used by another process.

.text USBPORT.SYS!DllUnload F6B0A8AC 5 Bytes JMP 82D551B8

? System32\Drivers\abbflxve.SYS The system cannot find the path specified. !

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F72B0ABA] sptd.sys

IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F72B0C00] sptd.sys

IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F72B0B82] sptd.sys

IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F72B172E] sptd.sys

IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F72B1604] sptd.sys

IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F72C3A9A] sptd.sys

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 82FEA1D8

Device \FileSystem\Udfs \UdfsCdRom 8259E1D8

Device \FileSystem\Udfs \UdfsDisk 8259E1D8

Device \Driver\NetBT \Device\NetBT_Tcpip_{3227B240-AD69-42A1-9230-3B156E05E9B1} 826301D8

Device \Driver\usbohci \Device\USBPDO-0 82E061D8

Device \Driver\dmio \Device\DmControl\DmIoDaemon 82FEC1D8

Device \Driver\dmio \Device\DmControl\DmConfig 82FEC1D8

Device \Driver\dmio \Device\DmControl\DmPnP 82FEC1D8

Device \Driver\dmio \Device\DmControl\DmInfo 82FEC1D8

Device \Driver\usbehci \Device\USBPDO-1 82E021D8

Device \Driver\00000041 \Device\00000047 sptd.sys

Device \Driver\Ftdisk \Device\HarddiskVolume1 8305B1D8

Device \Driver\Cdrom \Device\CdRom0 82DF91D8

Device \Driver\Ftdisk \Device\HarddiskVolume2 8305B1D8

Device \Driver\Cdrom \Device\CdRom1 82DF91D8

Device \Driver\Ftdisk \Device\HarddiskVolume3 8305B1D8

Device \Driver\atapi \Device\Ide\IdePort0 8305A1D8

Device \Driver\atapi \Device\Ide\IdePort1 8305A1D8

Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-3 8305A1D8

Device \Driver\Cdrom \Device\CdRom2 82DF91D8

Device \Driver\Cdrom \Device\CdRom3 82DF91D8

Device \Driver\Cdrom \Device\CdRom4 82DF91D8

Device \Driver\NetBT \Device\NetBt_Wins_Export 826301D8

Device \Driver\NetBT \Device\NetbiosSmb 826301D8

Device \Driver\usbohci \Device\USBFDO-0 82E061D8

Device \Driver\nvata \Device\0000006c 82FEB1D8

Device \Driver\usbehci \Device\USBFDO-1 82E021D8

Device \Driver\nvata \Device\NvAta0 82FEB1D8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 826101D8

Device \Driver\nvata \Device\NvAta1 82FEB1D8

Device \FileSystem\MRxSmb \Device\LanmanRedirector 826101D8

Device \Driver\Ftdisk \Device\FtControl 8305B1D8

Device \Driver\abbflxve \Device\Scsi\abbflxve1Port4Path0Target2Lun0 82DDD980

Device \Driver\abbflxve \Device\Scsi\abbflxve1 82DDD980

Device \Driver\abbflxve \Device\Scsi\abbflxve1Port4Path0Target1Lun0 82DDD980

Device \Driver\abbflxve \Device\Scsi\abbflxve1Port4Path0Target3Lun0 82DDD980

Device \Driver\abbflxve \Device\Scsi\abbflxve1Port4Path0Target0Lun0 82DDD980

Device \FileSystem\Cdfs \Cdfs 82D0B980

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 -113541727

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 2091461595

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xDA 0x5E 0x79 0x48 ...

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x3B 0x54 0x4F 0xC9 ...

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x79 0xE0 0x08 0x87 ...

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x81 0x5B 0xDC 0xDA ...

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42@khjeh 0x27 0x16 0xDB 0x01 ...

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43@khjeh 0xE3 0xED 0x09 0xBE ...

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xDA 0x5E 0x79 0x48 ...

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x3B 0x54 0x4F 0xC9 ...

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x79 0xE0 0x08 0x87 ...

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x81 0x5B 0xDC 0xDA ...

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42@khjeh 0x27 0x16 0xDB 0x01 ...

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43@khjeh 0xE3 0xED 0x09 0xBE ...

---- EOF - GMER 1.0.15 ----

27 юли 200917 г.

Не сте спазили инструкциите ми за Gmer. Нека имам и една картинка от RootRepeal:

Изтеглете RootRepeal от тук

Разархивирайте го на вашия десктоп.

Кликнете два пъти върху RootRepeal.exe , за да стартирате програмата
Кликнете на таба Report в долната част на прозореца
Кликнете на бутона Scan
Сложете отметки пред следното:

Drivers
Processes
SSDT
Hidden Services

Кликнете на бутона OK
На следващия диалогов прозорец, сложете отметки преди всички дялове (C:\ , D:\ ....)
Кликнете на OK, за да започне процеса на сканиране

Бележка: Процеса на сканиране може да отнеме време. Моля,

не стартирайте

никакви програми, докато програмата сканира.

Когато сканирането завърши успешно ще се появи бутона Save Report
Кликнете върху Save Report и запишете лог файла на вашия десктоп, с име RootRepeal.txt
Отворете File, след което Exit , за да затворите програмата.

Копирайте и поставете съдържанието на RootRepeal.txt в следващия си пост.

Утре ще погледна screenshots в 4storing.com , че ми свърши безплатния трафик.

28 юли 200917 г.

ROOTREPEAL © AD, 2007-2009

==================================================

Scan Start Time: 2009/07/28 09:40

Program Version: Version 1.3.2.0

Windows Version: Windows XP SP2

==================================================

Drivers

-------------------

Name: 00000041

Image Path: \Driver\00000041

Address: 0x00000000 Size: 0 File Visible: No Signed: -

Status: -

Name: aaxubsib.SYS

Image Path: C:\WINDOWS\System32\Drivers\aaxubsib.SYS

Address: 0xF6652000 Size: 303104 File Visible: No Signed: -

Status: -

Name: dump_nvata.sys

Image Path: C:\WINDOWS\System32\Drivers\dump_nvata.sys

Address: 0xF2448000 Size: 106496 File Visible: No Signed: -

Status: -

Name: dump_WMILIB.SYS

Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS

Address: 0xF79D5000 Size: 8192 File Visible: No Signed: -

Status: -

Name: rootrepeal.sys

Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys

Address: 0xB8798000 Size: 49152 File Visible: No Signed: -

Status: -

SSDT

-------------------

#: 041 Function Name: NtCreateKey

Status: Hooked by "sptd.sys" at address 0xf72b00b0

#: 071 Function Name: NtEnumerateKey

Status: Hooked by "sptd.sys" at address 0xf72b584e

#: 073 Function Name: NtEnumerateValueKey

Status: Hooked by "sptd.sys" at address 0xf72b5bee

#: 119 Function Name: NtOpenKey

Status: Hooked by "sptd.sys" at address 0xf72b0090

#: 160 Function Name: NtQueryKey

Status: Hooked by "sptd.sys" at address 0xf72b5cc6

#: 177 Function Name: NtQueryValueKey

Status: Hooked by "sptd.sys" at address 0xf72b5b46

#: 247 Function Name: NtSetValueKey

Status: Hooked by "sptd.sys" at address 0xf72b5d58

==EOF==

28 юли 200917 г.

Извинявай за закъснението, но ми беше свършил безплатния трафик и се наложи nologo да ми ги качи някъде другаде, за да ги прегледам, за което сърдечно му благодаря.

Отворете Notepad и чрез комбинацията copy/paste поставете следния текст:

Killall::


Driver::

aaxubsib


File::

c:\windows\system32\105.reg

c:\windows\system32\lam4.exe

c:\windows\system32\lam5.exe

c:\windows\system32\lam3.exe

c:\windows\system32\lam2.exe

c:\windows\system32\lam1.exe

c:\windows\system32\narrator.exe

C:\sys.exe


Registry::

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"ShowDeskFix"=-

"RunNarrator"=-

[-HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

[-HKLM\~\startupfolder\C:^Documents and Settings^boris^Start Menu^Programs^Startup^ЎЎЎЎЎЎ.lnk]

Запазете файла с името CFScript.txt и го поставете върху ComboFix.

След като, програмата приключи ще Ви изведе лог файла. Отново чрез комбинацията от Copy/Paste поставете информацията тук.

29 юли 200917 г.

А как ще се извиняваш нестига ,че отделяш от времето си за да ни помогнеш !Мерси много за всичко което правиш за нас !

ComboFix 09-07-28.01 - boris 07.2009 г. 7:19.2.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1251.359.1033.18.767.487 [GMT 3:00]

Running from: c:\documents and settings\boris\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\boris\Desktop\CFScript.txt

AV: "Eset" °ЅтёІёрусЅ° сёстµј° "NOD32" 2.70 *On-access scanning enabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

FW: ActiveArmor Firewall *disabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::

"C:\sys.exe"

"c:\windows\system32\105.reg"

"c:\windows\system32\lam1.exe"

"c:\windows\system32\lam2.exe"

"c:\windows\system32\lam3.exe"

"c:\windows\system32\lam4.exe"

"c:\windows\system32\lam5.exe"

"c:\windows\system32\narrator.exe"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\sys.exe

c:\windows\system32\105.reg

c:\windows\system32\klipxm32.dll

c:\windows\system32\lam1.exe

c:\windows\system32\lam2.exe

c:\windows\system32\lam3.exe

c:\windows\system32\lam4.exe

c:\windows\system32\lam5.exe

c:\windows\system32\narrator.exe

.

((((((((((((((((((((((((( Files Created from 2009-06-28 to 2009-07-29 )))))))))))))))))))))))))))))))

.

2009-07-28 18:25 . 2009-07-28 18:25 -------- d-----w- c:\documents and settings\boris\Application Data\AVS4YOU

2009-07-28 18:25 . 2009-07-28 18:25 -------- d-----w- c:\documents and settings\All Users\Application Data\AVS4YOU

2009-07-28 18:24 . 2009-07-28 18:25 -------- d-----w- c:\program files\Common Files\AVSMedia

2009-07-28 18:24 . 2008-08-13 08:22 974848 ----a-w- c:\windows\system32\mfc70.dll

2009-07-28 18:24 . 2008-08-13 08:22 487424 ----a-w- c:\windows\system32\msvcp70.dll

2009-07-28 18:24 . 2008-08-13 08:22 344064 ----a-w- c:\windows\system32\msvcr70.dll

2009-07-28 18:24 . 2009-07-28 18:25 -------- d-----w- c:\program files\AVS4YOU

2009-07-28 18:24 . 2008-08-13 08:22 1700352 ----a-w- c:\windows\system32\GdiPlus.dll

2009-07-28 18:24 . 2008-08-13 08:22 24576 ----a-w- c:\windows\system32\msxml3a.dll