Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Win:Vitro

cxcx
в Премахване на зловреден софтуер

Featured Replies

Здравейте,

вчера пипнах вируса win:vitro, до колкото разбрах поразява всички .exe файлове и слага iframe на html и php файловете. Форматирах c:/ , инсталирах на ново win-a , веднага влезнах през сейф мод - изчистих и останалите дялове.. и сега е същото.. пак го пипнах. Може ли някакви съвети как да го изчистя?

Здравей!

1) Изтеглете ComboFix от: тук

2) Запазете го на работния си плот (десктоп).

3) Спрете Real-Time защитата на вашия антивирусен продукт.

4) Кликнете два пъти върху combofix.exe

5) ComboFix ще започне да сканира вашата система, докато трае сканирането не барайте нищо. Накрая ще се рестартира компютъра Ви.

6) След рестарта изчакайте да завърши сканирането на ComboFix и да генерира лог файл. Когато сканирането завърши ще Ви изскочи Notepad, копирайте съдържанието му и го публикувайте в следващия си пост тук. Ако не Ви изскочи, влезте в C:\ и намерете файл с името combofix.txt . Отворете го, копирайте съдържанието му и го публикувайте тук.

  • Автор

ComboFix.txtЗдравей,

наложи се да преинсталирам още веднъж, след преинстала първата работа ми беше да сваля програмата и да я стартирам. Ето и файла.

Благодаря!

Отворете Start -> Run... и напишете "ComboFix /u" (без кавичките) и натисни OK.

След това:

Изтеглете Malwarebytes' Anti-Malware от тук

Кликнете два пъти върху mbam-setup.exe за да инсталирате програмата.

  • * Уверете се, че има отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware, след това кликнете на Finish.
    * Ако има намерени по-нови обновления, тя ще ги изтегли и инсталира.
    * Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.
    * Сканирането ще отнеме малко време, затова моля бъдете търпеливи.
    * Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.
    * Уверете се, че на всички редове има отметки, и кликнете Remove Selected.
    * Когато всичко бъде премахнато, логът ще бъде отворен в Notepad. Копирайте лога и го публикувайте в следващия си коментар в темата.

Бележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемите вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

Редактирано от Fixer (преглед на промените)

  • Автор
Malwarebytes' Anti-Malware 1.37

Database version: 2192

Windows 5.1.2600 Service Pack 2

29.5.2009 г. 16:05:54

mbam-log-2009-05-29 (16-05-54).txt

Scan type: Full Scan (C:\|D:\|E:\|F:\|G:\|)

Objects scanned: 133810

Time elapsed: 2 minute(s), 55 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Сигурен ли сте, че все още имате проблем? Сканирайте с Dr Web CureIt! и SuperAntiSpyware и накрая пуснете лог файл от HiJackThis в същата тема:

http://www.kaldata.com/forums/index.php?s=...t&p=1183396

Според логовете до този момент, вашата система е чиста.

  • Автор

Здравейте,

аз както казах преинсталирах уиндоуса преди 30 минути. Може в момента да го няма. Ще изчакам няколко дни и пак ако антивирусната ми започне да ми хваща заразени файлове ще сканирам с програмите, които казахте.

Благодаря ви, МНОГО!

  • Автор

Пак ме намери ..

Нод-а не се спря да трие, тези програми дето ми даде не намериха нищо (все още superantispyware сканира). Вече нямам идея какво да направя, че тъпия вирус да се махне . Не мога спокойно да работя на компютъра си от този вирус..

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 20:43:51, on 29.5.2009 г.

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

E:\WINDOWS\System32\smss.exe

E:\WINDOWS\system32\winlogon.exe

E:\WINDOWS\system32\services.exe

E:\WINDOWS\system32\lsass.exe

E:\WINDOWS\system32\svchost.exe

E:\WINDOWS\System32\svchost.exe

E:\WINDOWS\system32\spoolsv.exe

E:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

E:\WINDOWS\explorer.exe

E:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

E:\WINDOWS\system32\ctfmon.exe

E:\Program Files\Skype\Phone\Skype.exe

E:\Program Files\Skype\Plugin Manager\skypePM.exe

E:\Program Files\uTorrent\uTorrent.exe

E:\Program Files\Mozilla Firefox\firefox.exe

E:\WINDOWS\system32\msiexec.exe

E:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

E:\Documents and Settings\Niki\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.avast.com/eng/theres_a_red_circle.html

O4 - HKLM\..\Run: [HDAudDeck] E:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1

O4 - HKLM\..\Run: [egui] "E:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice

O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [skype] "E:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [reader_s] E:\Documents and Settings\Niki\reader_s.exe

O4 - HKCU\..\Run: [sUPERAntiSpyware] E:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKUS\S-1-5-18\..\Run: [reader_s] E:\WINDOWS\system32\config\systemprofile\reader_s.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [reader_s] E:\WINDOWS\system32\config\systemprofile\reader_s.exe (User 'Default user')

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - E:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: !SASWinLogon - E:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - E:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe

O23 - Service: ESET Service (ekrn) - ESET - E:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

--

End of file - 2341 bytes

Редактирано от cxcx (преглед на промените)

Попаднахме на нещо:

1) Изтеглете ComboFix от: тук

2) Запазете го на работния си плот (десктоп).

3) Спрете Real-Time защитата на вашия антивирусен продукт.

4) Отворете Notepad и чрез copy/paste поставете следното:

Killall::


File::

E:\Documents and Settings\Niki\reader_s.exe

C:\Windows\System32\reader_s.exe 

C:\WINDOWS\Temp\infected\reader_s.exe

C:\WINDOWS\Temp\windows\system32\reader_s.exe

Запазете файла с името CFScript.txt и го поставете върху ComboFix.

cfscriptyr1.gif

След, като програмата приключи ще Ви изведе лог файла. Чрез Copy/Paste поставете информацията тук.

  • Автор
ComboFix 09-05-28.09 - Niki 05.2009 г. 21:03.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1251.359.1033.18.3062.2574 [GMT 3:00]

Running from: e:\documents and settings\Niki\Desktop\ComboFix.exe

Command switches used :: e:\documents and settings\Niki\Desktop\CFScript.txt

AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

* Resident AV is active

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::

"c:\windows\System32\reader_s.exe"

"c:\windows\Temp\infected\reader_s.exe"

"c:\windows\Temp\windows\system32\reader_s.exe"

"e:\documents and settings\Niki\reader_s.exe"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_PROTECT

-------\Service_protect

((((((((((((((((((((((((( Files Created from 2009-04-28 to 2009-05-29 )))))))))))))))))))))))))))))))

.

2009-05-29 17:42 . 2009-05-29 17:42 117760 ----a-w e:\documents and settings\Niki\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL

2009-05-29 17:42 . 2009-05-29 17:42 -------- d-----w e:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2009-05-29 17:42 . 2009-05-29 17:42 -------- d-----w e:\program files\SUPERAntiSpyware

2009-05-29 17:42 . 2009-05-29 17:42 -------- d-----w e:\documents and settings\Niki\Application Data\SUPERAntiSpyware.com

2009-05-29 17:42 . 2009-05-29 17:42 -------- d-----w e:\program files\Common Files\Wise Installation Wizard

2009-05-29 17:40 . 2009-05-29 17:40 -------- d-----w e:\documents and settings\Niki\DoctorWeb

2009-05-29 17:32 . 2009-05-29 17:32 -------- d-----w e:\documents and settings\NetworkService\Local Settings\Application Data\ESET

2009-05-29 17:32 . 2009-05-29 17:32 -------- d-----w e:\documents and settings\LocalService\Local Settings\Application Data\ESET

2009-05-29 17:31 . 2009-05-29 17:31 -------- d-----w e:\documents and settings\Niki\Local Settings\Application Data\ESET

2009-05-29 17:29 . 2009-05-29 17:29 -------- d-----w e:\documents and settings\All Users\Application Data\ESET

2009-05-29 17:24 . 2009-05-29 17:29 -------- d-----w e:\program files\ESET

2009-05-29 17:22 . 2009-05-29 17:22 48 ---ha-w e:\windows\system32\ezsidmv.dat

2009-05-29 17:22 . 2009-05-29 17:22 -------- d-----w e:\documents and settings\Niki\Application Data\skypePM

2009-05-29 17:20 . 2009-05-29 17:52 -------- d-----w e:\documents and settings\Niki\Application Data\Skype

2009-05-29 17:20 . 2009-05-29 17:20 -------- d-----w e:\program files\Skype

2009-05-29 17:20 . 2009-05-29 17:20 -------- d-----w e:\program files\Common Files\Skype

2009-05-29 17:19 . 2009-05-29 17:20 -------- d-----w e:\documents and settings\All Users\Application Data\Skype

2009-05-29 17:18 . 2009-05-29 17:18 -------- d-----w e:\program files\uTorrent

2009-05-29 17:18 . 2009-05-29 18:00 -------- d-----w e:\documents and settings\Niki\Application Data\uTorrent

2009-05-29 17:18 . 2009-05-29 17:18 0 ----a-w e:\windows\nsreg.dat

2009-05-29 17:18 . 2009-05-29 17:18 -------- d-----w e:\documents and settings\Niki\Local Settings\Application Data\Mozilla

2009-05-29 17:18 . 2009-05-29 17:18 -------- d-----w e:\documents and settings\Niki\Application Data\Malwarebytes

2009-05-29 16:51 . 2009-05-29 17:27 -------- d-----w e:\windows\ASUSInstAll

2009-05-29 16:50 . 2009-05-29 16:50 -------- d-s---w e:\windows\system32\config\systemprofile\UserData

2009-05-29 16:49 . 2008-03-21 03:34 920088 ----a-r e:\windows\system32\igxpun.exe

2009-05-29 16:47 . 2009-05-29 16:47 -------- dc----w e:\windows\system32\DRVSTORE

2009-05-29 16:47 . 2009-05-29 16:47 -------- d-----w e:\program files\Intel

2009-05-29 16:47 . 2009-05-29 16:47 -------- d-----w E:\Intel

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-05-29 17:18 . 2009-05-29 17:18 84 ----a-w e:\windows\system32\3.tmp

2009-05-29 16:54 . 2009-05-29 16:54 -------- d-----w e:\program files\VIA

2009-05-29 16:54 . 2009-05-29 16:54 -------- d-----w e:\program files\Common Files\InstallShield

2009-05-29 16:53 . 2009-05-29 16:53 84 ----a-w e:\windows\system32\2.tmp

2009-05-29 16:49 . 2004-08-03 20:14 212480 ----a-w e:\windows\system32\drivers\ndis.sys

2009-05-29 16:48 . 2009-05-29 16:48 84 ----a-w e:\windows\system32\59.tmp

2009-05-29 16:48 . 2009-05-29 16:48 0 ----a-w e:\windows\system32\57.tmp

2009-05-29 16:48 . 2009-05-29 16:48 84 ----a-w e:\windows\system32\54.tmp

2009-05-29 13:16 . 2009-05-29 13:16 12328 ----a-w e:\documents and settings\Niki\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-05-29 13:02 . 2009-05-29 13:02 -------- d-----w e:\documents and settings\Administrator\Application Data\Malwarebytes

2009-05-29 13:02 . 2009-05-29 13:02 -------- d-----w e:\program files\Malwarebytes' Anti-Malware

2009-05-29 13:02 . 2009-05-29 13:02 -------- d-----w e:\documents and settings\All Users\Application Data\Malwarebytes

2009-05-29 12:29 . 2009-05-29 12:29 -------- d-----w e:\program files\Alwil Software

2009-05-29 12:26 . 2009-05-29 12:26 -------- d--h--w e:\program files\InstallShield Installation Information

2009-05-29 12:25 . 2009-05-29 12:25 12328 ----a-w e:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-05-29 12:23 . 2009-05-29 12:18 86327 ----a-w e:\windows\pchealth\helpctr\OfflineCache\index.dat

2009-05-29 12:23 . 2009-05-29 12:23 115052 ----a-w e:\windows\pchealth\helpctr\Config\Cache\Professional_32_1033.dat

2009-05-29 12:19 . 2009-05-29 12:19 -------- d-----w e:\program files\microsoft frontpage

2009-05-29 12:16 . 2009-05-29 12:16 21640 ----a-w e:\windows\system32\emptyregdb.dat

2009-05-26 10:20 . 2009-05-29 13:02 40160 ----a-w e:\windows\system32\drivers\mbamswissarmy.sys

2009-05-26 10:19 . 2009-05-29 13:02 19096 ----a-w e:\windows\system32\drivers\mbam.sys

.

------- Sigcheck -------

[-] 2009-05-29 16:49 212480 7E57CE856E683050D1931BA7DBA1527C e:\windows\system32\dllcache\ndis.sys

[-] 2009-05-29 16:49 212480 7E57CE856E683050D1931BA7DBA1527C e:\windows\system32\drivers\ndis.sys

[-] 2004-08-03 21:56 111104 A87DCFF06C5431BA3E0F5650D4BE1A9F e:\windows\system32\wuauclt.exe

[7] 2004-08-03 21:56 111104 4126D27CECE4471E00E425411F7306B5 e:\windows\system32\dllcache\wuauclt.exe

[-] 2004-08-03 21:56 24576 3C754F69574C139F6B471BB2C4FEE31C e:\windows\system32\userinit.exe

[-] 2004-08-03 21:56 24576 3C754F69574C139F6B471BB2C4FEE31C e:\windows\system32\dllcache\USERINIT.EXE

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "e:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"e:\\Program Files\\uTorrent\\uTorrent.exe"=

"e:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 ehdrv;ehdrv;e:\windows\system32\drivers\ehdrv.sys [06.2.2009 г. 14:23 106208]

R1 epfwtdir;epfwtdir;e:\windows\system32\drivers\epfwtdir.sys [06.2.2009 г. 14:24 93336]

R1 SASDIFSV;SASDIFSV;e:\program files\SUPERAntiSpyware\sasdifsv.sys [26.5.2009 г. 10:05 9968]

R1 SASKUTIL;SASKUTIL;e:\program files\SUPERAntiSpyware\SASKUTIL.SYS [26.5.2009 г. 10:05 72944]

R2 ekrn;ESET Service;e:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [06.2.2009 г. 14:23 727720]

R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller;e:\windows\system32\drivers\l1e51x86.sys [29.5.2009 г. 15:26 36864]

R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;e:\windows\system32\drivers\viahduaa.sys [29.5.2009 г. 19:54 845184]

S3 MBAMSwissArmy;MBAMSwissArmy;e:\windows\system32\drivers\mbamswissarmy.sys [29.5.2009 г. 16:02 40160]

S3 SASENUM;SASENUM;e:\program files\SUPERAntiSpyware\SASENUM.SYS [26.5.2009 г. 10:05 7408]

.

- - - - ORPHANS REMOVED - - - -

SafeBoot-procexp90.Sys

.

------- Supplementary Scan -------

.

FF - ProfilePath - e:\documents and settings\Niki\Application Data\Mozilla\Firefox\Profiles\av9ogoam.default\

FF - component: e:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-05-29 21:05

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1040)

e:\program files\SUPERAntiSpyware\SASSEH.DLL

e:\windows\system32\browselc.dll

.

------------------------ Other Running Processes ------------------------

.

e:\windows\system32\imapi.exe

.

**************************************************************************

.

Completion time: 2009-05-29 21:06 - machine was rebooted

ComboFix-quarantined-files.txt 2009-05-29 18:06

ComboFix2.txt 2009-05-29 12:31

Pre-Run: 58 563 575 808 bytes free

Post-Run: 58 620 874 752 bytes free

142

Отворете Notepad и чрез copy/paste поставете следното:

KillAll::


File::

e:\windows\system32\3.tmp

e:\windows\system32\2.tmp

e:\windows\system32\59.tmp

e:\windows\system32\57.tmp

e:\windows\system32\54.tmp


Folder::

e:\program files\Alwil Software

Запазете файла с името CFScript.txt и го поставете върху ComboFix.

cfscriptyr1.gif

След, като програмата приключи ще Ви изведе лог файла. Чрез Copy/Paste поставете информацията тук.

  • Автор

Здравейте,

след като го направих не ми генерира лог (не знам защо). След това го направих 2-ри път и ето въпросният лог:

ComboFix 09-05-28.09 - Niki 05.2009 г. 21:23.4 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1251.359.1033.18.3062.2681 [GMT 3:00]

Running from: e:\documents and settings\Niki\Desktop\ComboFix.exe

Command switches used :: e:\documents and settings\Niki\Desktop\CFScript.txt

AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::

"e:\windows\system32\2.tmp"

"e:\windows\system32\3.tmp"

"e:\windows\system32\54.tmp"

"e:\windows\system32\57.tmp"

"e:\windows\system32\59.tmp"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

---- Previous Run -------

.

e:\program files\Alwil Software

e:\program files\Alwil Software\Avast4\Setup\setup.ini

e:\windows\system32\2.tmp

e:\windows\system32\3.tmp

e:\windows\system32\54.tmp

e:\windows\system32\57.tmp

e:\windows\system32\59.tmp

.

((((((((((((((((((((((((( Files Created from 2009-04-28 to 2009-05-29 )))))))))))))))))))))))))))))))

.

2009-05-29 17:42 . 2009-05-29 17:42 117760 ----a-w e:\documents and settings\Niki\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL

2009-05-29 17:42 . 2009-05-29 17:42 -------- d-----w e:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2009-05-29 17:42 . 2009-05-29 17:42 -------- d-----w e:\program files\SUPERAntiSpyware

2009-05-29 17:42 . 2009-05-29 17:42 -------- d-----w e:\documents and settings\Niki\Application Data\SUPERAntiSpyware.com

2009-05-29 17:42 . 2009-05-29 17:42 -------- d-----w e:\program files\Common Files\Wise Installation Wizard

2009-05-29 17:40 . 2009-05-29 17:40 -------- d-----w e:\documents and settings\Niki\DoctorWeb

2009-05-29 17:32 . 2009-05-29 17:32 -------- d-----w e:\documents and settings\NetworkService\Local Settings\Application Data\ESET

2009-05-29 17:32 . 2009-05-29 17:32 -------- d-----w e:\documents and settings\LocalService\Local Settings\Application Data\ESET

2009-05-29 17:31 . 2009-05-29 17:31 -------- d-----w e:\documents and settings\Niki\Local Settings\Application Data\ESET

2009-05-29 17:29 . 2009-05-29 17:29 -------- d-----w e:\documents and settings\All Users\Application Data\ESET

2009-05-29 17:24 . 2009-05-29 17:29 -------- d-----w e:\program files\ESET

2009-05-29 17:22 . 2009-05-29 17:22 48 ---ha-w e:\windows\system32\ezsidmv.dat

2009-05-29 17:22 . 2009-05-29 17:22 -------- d-----w e:\documents and settings\Niki\Application Data\skypePM

2009-05-29 17:20 . 2009-05-29 17:52 -------- d-----w e:\documents and settings\Niki\Application Data\Skype

2009-05-29 17:20 . 2009-05-29 17:20 -------- d-----w e:\program files\Skype

2009-05-29 17:20 . 2009-05-29 17:20 -------- d-----w e:\program files\Common Files\Skype

2009-05-29 17:19 . 2009-05-29 17:20 -------- d-----w e:\documents and settings\All Users\Application Data\Skype

2009-05-29 17:18 . 2009-05-29 17:18 -------- d-----w e:\program files\uTorrent

2009-05-29 17:18 . 2009-05-29 18:00 -------- d-----w e:\documents and settings\Niki\Application Data\uTorrent

2009-05-29 17:18 . 2009-05-29 17:18 0 ----a-w e:\windows\nsreg.dat

2009-05-29 17:18 . 2009-05-29 17:18 -------- d-----w e:\documents and settings\Niki\Local Settings\Application Data\Mozilla

2009-05-29 17:18 . 2009-05-29 17:18 -------- d-----w e:\documents and settings\Niki\Application Data\Malwarebytes

2009-05-29 16:51 . 2009-05-29 17:27 -------- d-----w e:\windows\ASUSInstAll

2009-05-29 16:50 . 2009-05-29 16:50 -------- d-s---w e:\windows\system32\config\systemprofile\UserData

2009-05-29 16:49 . 2008-03-21 03:34 920088 ----a-r e:\windows\system32\igxpun.exe

2009-05-29 16:47 . 2009-05-29 16:47 -------- dc----w e:\windows\system32\DRVSTORE

2009-05-29 16:47 . 2009-05-29 16:47 -------- d-----w e:\program files\Intel

2009-05-29 16:47 . 2009-05-29 16:47 -------- d-----w E:\Intel

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-05-29 16:54 . 2009-05-29 16:54 -------- d-----w e:\program files\VIA

2009-05-29 16:54 . 2009-05-29 16:54 -------- d-----w e:\program files\Common Files\InstallShield

2009-05-29 16:49 . 2004-08-03 20:14 212480 ----a-w e:\windows\system32\drivers\ndis.sys

2009-05-29 13:16 . 2009-05-29 13:16 12328 ----a-w e:\documents and settings\Niki\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-05-29 13:02 . 2009-05-29 13:02 -------- d-----w e:\documents and settings\Administrator\Application Data\Malwarebytes

2009-05-29 13:02 . 2009-05-29 13:02 -------- d-----w e:\program files\Malwarebytes' Anti-Malware

2009-05-29 13:02 . 2009-05-29 13:02 -------- d-----w e:\documents and settings\All Users\Application Data\Malwarebytes

2009-05-29 12:26 . 2009-05-29 12:26 -------- d--h--w e:\program files\InstallShield Installation Information

2009-05-29 12:25 . 2009-05-29 12:25 12328 ----a-w e:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-05-29 12:23 . 2009-05-29 12:18 86327 ----a-w e:\windows\pchealth\helpctr\OfflineCache\index.dat

2009-05-29 12:23 . 2009-05-29 12:23 115052 ----a-w e:\windows\pchealth\helpctr\Config\Cache\Professional_32_1033.dat

2009-05-29 12:19 . 2009-05-29 12:19 -------- d-----w e:\program files\microsoft frontpage

2009-05-29 12:16 . 2009-05-29 12:16 21640 ----a-w e:\windows\system32\emptyregdb.dat

2009-05-26 10:20 . 2009-05-29 13:02 40160 ----a-w e:\windows\system32\drivers\mbamswissarmy.sys

2009-05-26 10:19 . 2009-05-29 13:02 19096 ----a-w e:\windows\system32\drivers\mbam.sys

.

------- Sigcheck -------

[-] 2009-05-29 16:49 212480 7E57CE856E683050D1931BA7DBA1527C e:\windows\system32\dllcache\ndis.sys

[-] 2009-05-29 16:49 212480 7E57CE856E683050D1931BA7DBA1527C e:\windows\system32\drivers\ndis.sys

[-] 2004-08-03 21:56 111104 A87DCFF06C5431BA3E0F5650D4BE1A9F e:\windows\system32\wuauclt.exe

[7] 2004-08-03 21:56 111104 4126D27CECE4471E00E425411F7306B5 e:\windows\system32\dllcache\wuauclt.exe

[-] 2004-08-03 21:56 24576 3C754F69574C139F6B471BB2C4FEE31C e:\windows\system32\userinit.exe

[-] 2004-08-03 21:56 24576 3C754F69574C139F6B471BB2C4FEE31C e:\windows\system32\dllcache\USERINIT.EXE

.

((((((((((((((((((((((((((((( SnapShot@2009-05-29_18.05.30 )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-05-29 16:50 . 2009-05-29 18:14 32768 e:\windows\system32\config\systemprofile\UserData\index.dat

- 2009-05-29 16:50 . 2009-05-29 17:54 32768 e:\windows\system32\config\systemprofile\UserData\index.dat

+ 2009-05-29 16:50 . 2009-05-29 18:14 32768 e:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012009052920090530\index.dat

- 2009-05-29 16:50 . 2009-05-29 18:03 32768 e:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012009052920090530\index.dat

+ 2009-05-29 16:50 . 2009-05-29 18:14 32768 e:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat

- 2009-05-29 16:50 . 2009-05-29 18:03 32768 e:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat

+ 2009-05-29 16:50 . 2009-05-29 18:14 32768 e:\windows\system32\config\systemprofile\Cookies\index.dat

- 2009-05-29 16:50 . 2009-05-29 18:03 32768 e:\windows\system32\config\systemprofile\Cookies\index.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

e:\documents and settings\All Users\Start Menu\Programs\Startup\

ESET NOD32 Antivirus.lnk - e:\program files\ESET\ESET NOD32 Antivirus\egui.exe [2009-2-6 2021400]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "e:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"e:\\Program Files\\uTorrent\\uTorrent.exe"=

"e:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 ehdrv;ehdrv;e:\windows\system32\drivers\ehdrv.sys [06.2.2009 г. 14:23 106208]

R1 epfwtdir;epfwtdir;e:\windows\system32\drivers\epfwtdir.sys [06.2.2009 г. 14:24 93336]

R1 SASDIFSV;SASDIFSV;e:\program files\SUPERAntiSpyware\sasdifsv.sys [26.5.2009 г. 10:05 9968]

R1 SASKUTIL;SASKUTIL;e:\program files\SUPERAntiSpyware\SASKUTIL.SYS [26.5.2009 г. 10:05 72944]

R2 ekrn;ESET Service;e:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [06.2.2009 г. 14:23 727720]

R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller;e:\windows\system32\drivers\l1e51x86.sys [29.5.2009 г. 15:26 36864]

R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;e:\windows\system32\drivers\viahduaa.sys [29.5.2009 г. 19:54 845184]

S3 MBAMSwissArmy;MBAMSwissArmy;e:\windows\system32\drivers\mbamswissarmy.sys [29.5.2009 г. 16:02 40160]

S3 SASENUM;SASENUM;e:\program files\SUPERAntiSpyware\SASENUM.SYS [26.5.2009 г. 10:05 7408]

.

.

------- Supplementary Scan -------

.

FF - ProfilePath - e:\documents and settings\Niki\Application Data\Mozilla\Firefox\Profiles\av9ogoam.default\

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-05-29 21:25

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(556)

e:\program files\ESET\ESET NOD32 Antivirus\eplgHooks.dll

.

------------------------ Other Running Processes ------------------------

.

e:\windows\system32\imapi.exe

e:\program files\Internet Explorer\IEXPLORE.EXE

.

**************************************************************************

.

Completion time: 2009-05-29 21:26 - machine was rebooted

ComboFix-quarantined-files.txt 2009-05-29 18:26

ComboFix2.txt 2009-05-29 18:06

ComboFix3.txt 2009-05-29 12:31

Pre-Run: 58 621 730 816 bytes free

Post-Run: 58 615 545 856 bytes free

153

  • Автор

Здравейте,

сега мисля, че е добре. Пуснал съм нод да сканира, намира вируси но в другите дялово, в уиндоуса не намира. Ако се появи пак - ще пиша.

Не можете да си представите, колко съм ви благодарен.

Благодаря ви много.

Моля, опитайте нещо последно: Сканирайте с Dr Web, както е описано тук:

http://www.kaldata.com/forums/index.php?s=...t&p=1183396

Обърнете внимание, когато открие нещо дали не е Win32/Virut.

Редактирано от Fixer (преглед на промените)

  • Автор

Здравей,

намери един но не беше от вида, който каза.

Регистрирайте се или влезете в профила си за да коментирате
Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.