Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Малко за профилактика

Филипов
в Премахване на зловреден софтуер

Featured Replies

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:41:29, on 15.9.2009 г.

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal


Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Programs\Avast\aswUpdSv.exe

C:\Programs\Avast\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\PFShared\UmxCfg.exe

C:\Programs\Tiny\UmxFwHlp.exe

C:\Program Files\Common Files\PFShared\UmxPol.exe

C:\Programs\Tiny\UmxAgent.exe

C:\Programs\Tiny\UmxTray.exe

C:\WINDOWS\system32\bgsvcgen.exe

C:\Program Files\CyberLink\Shared Files\RichVideo.exe

C:\Programs\Avast\ashMaiSv.exe

C:\Programs\Avast\ashWebSv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\sstray.exe

C:\Programs\ATI\atiptaxx.exe

C:\Programs\PowerDVD\PDVDServ.exe

C:\Programs\Adobe\Acrobat8\Acrobat\Acrotray.exe

C:\Programs\Avast\ashDisp.exe

C:\Programs\AdMuncher\AdMunch.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programs\Skype\Phone\Skype.exe

C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

C:\Programs\PC-Telephone\PCTel.exe

C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Programs\TotalCmd\TOTALCMD.EXE

C:\Install\HJk.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: IE 4.x-6.x BHO for Download Master - {9961627E-4059-41B4-8E0E-A7D6B3854ADF} - C:\Programs\DOWNLO~1\dmiehlp.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programs\Adobe\Acrobat8\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programs\Adobe\Acrobat8\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: DM Bar - {0E1230F8-EA50-42A9-983C-D22ABC2EED3C} - C:\Programs\Download Master\dmbar.dll

O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r

O4 - HKLM\..\Run: [ATIPTA] C:\Programs\ATI\atiptaxx.exe

O4 - HKLM\..\Run: [RemoteControl] C:\Programs\PowerDVD\PDVDServ.exe

O4 - HKLM\..\Run: [LanguageShortcut] C:\Programs\PowerDVD\Language\Language.exe

O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Programs\Adobe\Acrobat8\Acrobat\Acrotray.exe"

O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Programs\Adobe\Acrobat8\Acrobat\Acrobat_sl.exe"

O4 - HKLM\..\Run: [avast!] C:\Programs\Avast\ashDisp.exe

O4 - HKLM\..\Run: [Ad Muncher] C:\Programs\AdMuncher\AdMunch.exe /bt

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Skype] "C:\Programs\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: PC-Telephone.lnk = C:\Programs\PC-Telephone\PCTel.exe

O8 - Extra context menu item: Append to existing PDF - res://C:\Programs\Adobe\Acrobat8\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Programs\Adobe\Acrobat8\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Programs\Adobe\Acrobat8\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Programs\Adobe\Acrobat8\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Programs\Adobe\Acrobat8\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Programs\Adobe\Acrobat8\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Programs\Adobe\Acrobat8\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Programs\Adobe\Acrobat8\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Закачать ВСЕ при помощи Download Master - C:\Programs\Download Master\dmieall.htm

O8 - Extra context menu item: Закачать при помощи Download Master - C:\Programs\Download Master\dmie.htm

O8 - Extra context menu item: Передать на удаленную закачку DM - C:\Programs\Download Master\remdown.htm

O9 - Extra button: Download Master - {8DAE90AD-4583-4977-9DD4-4360F7A45C74} - C:\Programs\Download Master\dmaster.exe

O9 - Extra 'Tools' menuitem: &Download Master - {8DAE90AD-4583-4977-9DD4-4360F7A45C74} - C:\Programs\Download Master\dmaster.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1221861119250

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programs\Avast\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Programs\Avast\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programs\Avast\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programs\Avast\ashWebSv.exe

O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

O23 - Service: FW Event Manager (UmxAgent) - Computer Associates International, Inc. - C:\Programs\Tiny\UmxAgent.exe

O23 - Service: FW Configuration Interpreter (UmxCfg) - Computer Associates International, Inc. - C:\Program Files\Common Files\PFShared\UmxCfg.exe

O23 - Service: FW User-Mode Helper (UmxFwHlp) - Computer Associates International, Inc. - C:\Programs\Tiny\UmxFwHlp.exe

O23 - Service: FW Live Update (UmxLU) - Computer Associates International, Inc. - C:\Program Files\Common Files\PFShared\umxlu.exe

O23 - Service: FW Policy Manager (UmxPol) - Computer Associates International, Inc. - C:\Program Files\Common Files\PFShared\UmxPol.exe


--

End of file - 8160 bytes

Следвахте ли инструкциите от тук?

http://www.kaldata.com/forums/index.php?showtopic=132819

Липсва логът от MBAM, а трябва всичко да е в точната последователност.

След, като дадете нужната ни информация, някой от HJT Team ще се заема с вашия проблем.

  • Автор

MBAM ще почегърта, засега от AVZ 

AVZ Antiviral Toolkit log; AVZ version is 4.32

Scanning started at 15.9.2009 г. 23:01:16

Database loaded: signatures - 296359, NN profile(s) - 2, malware removal microprograms - 56, signature database released 13.09.2009 23:26

Heuristic microprograms loaded: 374

PVS microprograms loaded: 9

Digital signatures of system files loaded: 148299

Heuristic analyzer mode: Medium heuristics mode

Malware removal mode: disabled

Windows version is: 5.1.2600, Service Pack 3 ; AVZ is run with administrator rights

System Restore: enabled

1. Searching for Rootkits and other software intercepting API functions

1.1 Searching for user-mode API hooks

 Analysis: kernel32.dll, export table found in section .text

Function kernel32.dll:CreateProcessA (99) intercepted, method - APICodeHijack.JmpTo[5FF2558A]

Function kernel32.dll:CreateProcessW (103) intercepted, method - APICodeHijack.JmpTo[5FF256A6]

Function kernel32.dll:CreateRemoteThread (104) intercepted, method - APICodeHijack.JmpTo[5FF29FEA]

Function kernel32.dll:DebugActiveProcess (117) intercepted, method - APICodeHijack.JmpTo[5FF2A9E6]

Function kernel32.dll:FreeLibrary (241) intercepted, method - APICodeHijack.JmpTo[5FF25352]

Function kernel32.dll:GetProcAddress (409) intercepted, method - APICodeHijack.JmpTo[5FF2511A]

Function kernel32.dll:LoadLibraryExW (583) intercepted, method - APICodeHijack.JmpTo[5FF24FFE]

Function kernel32.dll:OpenThread (636) intercepted, method - APICodeHijack.JmpTo[5FF2A8CA]

Function kernel32.dll:TerminateProcess (844) intercepted, method - APICodeHijack.JmpTo[5FF258E2]

Function kernel32.dll:TerminateThread (845) intercepted, method - APICodeHijack.JmpTo[5FF259FE]

Function kernel32.dll:WriteProcessMemory (922) intercepted, method - APICodeHijack.JmpTo[5FF29ECE]

 Analysis: ntdll.dll, export table found in section .text

 Analysis: user32.dll, export table found in section .text

Function user32.dll:BroadcastSystemMessage (17) intercepted, method - APICodeHijack.JmpTo[5FF26BBE]

Function user32.dll:BroadcastSystemMessageA (18) intercepted, method - APICodeHijack.JmpTo[5FF26BBE]

Function user32.dll:BroadcastSystemMessageExA (19) intercepted, method - APICodeHijack.JmpTo[5FF26DF6]

Function user32.dll:BroadcastSystemMessageExW (20) intercepted, method - APICodeHijack.JmpTo[5FF26F12]

Function user32.dll:BroadcastSystemMessageW (21) intercepted, method - APICodeHijack.JmpTo[5FF26CDA]

Function user32.dll:EndTask (202) intercepted, method - APICodeHijack.JmpTo[5FF25B1A]

Function user32.dll:ExitWindowsEx (226) intercepted, method - APICodeHijack.JmpTo[5FF2B2CA]

Function user32.dll:OpenClipboard (500) intercepted, method - APICodeHijack.JmpTo[5FF238B2]

Function user32.dll:PostMessageA (512) intercepted, method - APICodeHijack.JmpTo[5FF25E6E]

Function user32.dll:PostMessageW (513) intercepted, method - APICodeHijack.JmpTo[5FF25F8A]

Function user32.dll:PostThreadMessageA (515) intercepted, method - APICodeHijack.JmpTo[5FF260A6]

Function user32.dll:PostThreadMessageW (516) intercepted, method - APICodeHijack.JmpTo[5FF261C2]

Function user32.dll:SendDlgItemMessageA (567) intercepted, method - APICodeHijack.JmpTo[5FF26986]

Function user32.dll:SendDlgItemMessageW (568) intercepted, method - APICodeHijack.JmpTo[5FF26AA2]

Function user32.dll:SendMessageA (572) intercepted, method - APICodeHijack.JmpTo[5FF25C36]

Function user32.dll:SendMessageCallbackA (573) intercepted, method - APICodeHijack.JmpTo[5FF262DE]

Function user32.dll:SendMessageCallbackW (574) intercepted, method - APICodeHijack.JmpTo[5FF263FA]

Function user32.dll:SendMessageTimeoutA (575) intercepted, method - APICodeHijack.JmpTo[5FF26516]

Function user32.dll:SendMessageTimeoutW (576) intercepted, method - APICodeHijack.JmpTo[5FF26632]

Function user32.dll:SendMessageW (577) intercepted, method - APICodeHijack.JmpTo[5FF25D52]

Function user32.dll:SendNotifyMessageA (578) intercepted, method - APICodeHijack.JmpTo[5FF2674E]

Function user32.dll:SendNotifyMessageW (579) intercepted, method - APICodeHijack.JmpTo[5FF2686A]

Function user32.dll:SetUserObjectSecurity (638) intercepted, method - APICodeHijack.JmpTo[5FF29942]

Function user32.dll:SetWindowsHookA (650) intercepted, method - APICodeHijack.JmpTo[5FF2A692]

Function user32.dll:SetWindowsHookExA (651) intercepted, method - APICodeHijack.JmpTo[5FF2A45A]

Function user32.dll:SetWindowsHookExW (652) intercepted, method - APICodeHijack.JmpTo[5FF2A576]

Function user32.dll:SetWindowsHookW (653) intercepted, method - APICodeHijack.JmpTo[5FF2A7AE]

 Analysis: advapi32.dll, export table found in section .text

Function advapi32.dll:AbortSystemShutdownW (6) intercepted, method - APICodeHijack.JmpTo[5FF2B1AE]

Function advapi32.dll:AdjustTokenPrivileges (30) intercepted, method - APICodeHijack.JmpTo[5FF29062]

Function advapi32.dll:ChangeServiceConfig2A (54) intercepted, method - APICodeHijack.JmpTo[5FF2889A]

Function advapi32.dll:ChangeServiceConfig2W (55) intercepted, method - APICodeHijack.JmpTo[5FF289B6]

Function advapi32.dll:ChangeServiceConfigA (56) intercepted, method - APICodeHijack.JmpTo[5FF28662]

Function advapi32.dll:ChangeServiceConfigW (57) intercepted, method - APICodeHijack.JmpTo[5FF2877E]

Function advapi32.dll:ControlService (68) intercepted, method - APICodeHijack.JmpTo[5FF27E9E]

Function advapi32.dll:CreateProcessAsUserA (97) intercepted, method - APICodeHijack.JmpTo[5FF29A5E]

Function advapi32.dll:CreateProcessAsUserW (99) intercepted, method - APICodeHijack.JmpTo[5FF29B7A]

Function advapi32.dll:CreateProcessWithLogonW (100) intercepted, method - APICodeHijack.JmpTo[5FF29C96]

Function advapi32.dll:CreateServiceA (102) intercepted, method - APICodeHijack.JmpTo[5FF274A2]

Function advapi32.dll:CreateServiceW (103) intercepted, method - APICodeHijack.JmpTo[5FF275BE]

Function advapi32.dll:DeleteService (177) intercepted, method - APICodeHijack.JmpTo[5FF27912]

Function advapi32.dll:EnumDependentServicesA (208) intercepted, method - APICodeHijack.JmpTo[5FF2842A]

Function advapi32.dll:EnumDependentServicesW (209) intercepted, method - APICodeHijack.JmpTo[5FF28546]

Function advapi32.dll:EnumServicesStatusA (211) intercepted, method - APICodeHijack.JmpTo[5FF28AD2]

Function advapi32.dll:EnumServicesStatusExA (212) intercepted, method - APICodeHijack.JmpTo[5FF28D0A]

Function advapi32.dll:EnumServicesStatusExW (213) intercepted, method - APICodeHijack.JmpTo[5FF28E26]

Function advapi32.dll:EnumServicesStatusW (214) intercepted, method - APICodeHijack.JmpTo[5FF28BEE]

Function advapi32.dll:InitiateSystemShutdownExW (311) intercepted, method - APICodeHijack.JmpTo[5FF2AF76]

Function advapi32.dll:InitiateSystemShutdownW (312) intercepted, method - APICodeHijack.JmpTo[5FF2AD3E]

Function advapi32.dll:OpenSCManagerA (429) intercepted, method - APICodeHijack.JmpTo[5FF2726A]

Function advapi32.dll:OpenSCManagerW (430) intercepted, method - APICodeHijack.JmpTo[5FF27386]

Function advapi32.dll:OpenServiceA (431) intercepted, method - APICodeHijack.JmpTo[5FF276DA]

Function advapi32.dll:OpenServiceW (432) intercepted, method - APICodeHijack.JmpTo[5FF277F6]

Function advapi32.dll:QueryServiceConfig2A (444) intercepted, method - APICodeHijack.JmpTo[5FF281F2]

Function advapi32.dll:QueryServiceConfig2W (445) intercepted, method - APICodeHijack.JmpTo[5FF2830E]

Function advapi32.dll:QueryServiceConfigA (446) intercepted, method - APICodeHijack.JmpTo[5FF27FBA]

Function advapi32.dll:QueryServiceConfigW (447) intercepted, method - APICodeHijack.JmpTo[5FF280D6]

Function advapi32.dll:QueryServiceStatus (451) intercepted, method - APICodeHijack.JmpTo[5FF27C66]

Function advapi32.dll:QueryServiceStatusEx (452) intercepted, method - APICodeHijack.JmpTo[5FF27D82]

Function advapi32.dll:SetFileSecurityW (552) intercepted, method - APICodeHijack.JmpTo[5FF2929A]

Function advapi32.dll:SetKernelObjectSecurity (555) intercepted, method - APICodeHijack.JmpTo[5FF293B6]

Function advapi32.dll:SetNamedSecurityInfoW (559) intercepted, method - APICodeHijack.JmpTo[5FF29826]

Function advapi32.dll:SetSecurityInfo (568) intercepted, method - APICodeHijack.JmpTo[5FF295EE]

Function advapi32.dll:SetServiceObjectSecurity (572) intercepted, method - APICodeHijack.JmpTo[5FF294D2]

Function advapi32.dll:StartServiceA (578) intercepted, method - APICodeHijack.JmpTo[5FF27A2E]

Function advapi32.dll:StartServiceW (581) intercepted, method - APICodeHijack.JmpTo[5FF27B4A]

 Analysis: ws2_32.dll, export table found in section .text

Function ws2_32.dll:WSAConnect (33) intercepted, method - CodeHijack (not defined)

Function ws2_32.dll:WSAStartup (115) intercepted, method - CodeHijack (not defined)

Function ws2_32.dll:connect (4) intercepted, method - CodeHijack (not defined)

Function ws2_32.dll:getpeername (5) intercepted, method - CodeHijack (not defined)

Function ws2_32.dll:getsockname (6) intercepted, method - CodeHijack (not defined)

Function ws2_32.dll:socket (23) intercepted, method - CodeHijack (not defined)

 Analysis: wininet.dll, export table found in section .text

 Analysis: rasapi32.dll, export table found in section .text

 Analysis: urlmon.dll, export table found in section .text

 Analysis: netapi32.dll, export table found in section .text

1.4 Searching for masking processes and drivers

 Checking not performed: extended monitoring driver (AVZPM) is not installed

 Driver loaded successfully

1.5 Checking IRP handlers

\FileSystem\ntfs[IRP_MJ_CREATE] = EEDD9344 -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted

\FileSystem\ntfs[IRP_MJ_CLOSE] = EEDD9384 -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted

\FileSystem\ntfs[IRP_MJ_WRITE] = EEDD9460 -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted

\FileSystem\ntfs[IRP_MJ_SET_INFORMATION] = EEDD94A0 -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted

\FileSystem\FastFat[IRP_MJ_CREATE] = EEDD94E0 -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted

\FileSystem\FastFat[IRP_MJ_CLOSE] = EEDD9520 -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted

\FileSystem\FastFat[IRP_MJ_WRITE] = EEDD95FC -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted

\FileSystem\FastFat[IRP_MJ_SET_INFORMATION] = EEDD963C -> C:\WINDOWS\System32\Drivers\aswSP.SYS, driver recognized as trusted

\driver\tcpip[IRP_MJ_CREATE] = EEFFF8C0 -> C:\WINDOWS\System32\DRIVERS\kmxfw.sys

\driver\tcpip[IRP_MJ_CLOSE] = EEFFFA20 -> C:\WINDOWS\System32\DRIVERS\kmxfw.sys

\driver\tcpip[IRP_MJ_DEVICE_CONTROL] = EF000480 -> C:\WINDOWS\System32\DRIVERS\kmxfw.sys

\driver\tcpip[IRP_MJ_INTERNAL_DEVICE_CONTROL] = EF000440 -> C:\WINDOWS\System32\DRIVERS\kmxfw.sys

\driver\tcpip[IRP_MJ_CLEANUP] = EEFFFA80 -> C:\WINDOWS\System32\DRIVERS\kmxfw.sys

 Checking - complete

2. Scanning RAM

 Number of processes found: 45

 Number of modules loaded: 380

Scanning RAM - complete

3. Scanning disks

4. Checking  Winsock Layered Service Provider (SPI/LSP)

 LSP settings checked. No errors detected

5. Searching for keyboard/mouse/windows events hooks (Keyloggers, Trojan DLLs)

6. Searching for opened TCP/UDP ports used by malicious software

 Checking - disabled by user

7. Heuristic system check

Latent DLL loading through AppInit_DLLs suspected: "UmxSbxExw.dll"

Checking - complete

8. Searching for vulnerabilities

>> Services: potentially dangerous service allowed: RemoteRegistry (Remote Registry)

>> Services: potentially dangerous service allowed: TermService (Terminal Services)

>> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service)

>> Services: potentially dangerous service allowed: Schedule (Task Scheduler)

>> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting Remote Desktop Sharing)

>> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager)

> Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!

>> Security: disk drives' autorun is enabled

>> Security: administrative shares (C$, D$ ...) are enabled

>> Security: anonymous user access is enabled

>> Security: sending Remote Assistant queries is enabled

Checking - complete

9. Troubleshooting wizard

 >>  HDD autorun is allowed

 >>  Network drives autorun is allowed

 >>  Removable media autorun is allowed

Checking - complete

Files scanned: 425, extracted from archives: 0, malicious software found 0, suspicions - 0

Scanning finished at 15.9.2009 г. 23:01:33

Time of scanning: 00:00:19

If you have a suspicion on presence of viruses or questions on the suspected objects,

you can address http://virusinfo.info conference

  • Автор

Malwarebytes' Anti-Malware 1.41

Database version: 2805

Windows 5.1.2600 Service Pack 3


16.9.2009 г. 00:54:13

mbam-log-2009-09-16 (00-53-57).txt


Scan type: Full Scan (C:\|D:\|E:\|G:\|H:\|I:\|J:\|K:\|)

Objects scanned: 302869

Time elapsed: 1 hour(s), 35 minute(s), 36 second(s)


Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 8


Memory Processes Infected:

(No malicious items detected)


Memory Modules Infected:

(No malicious items detected)


Registry Keys Infected:

(No malicious items detected)


Registry Values Infected:

(No malicious items detected)


Registry Data Items Infected:

(No malicious items detected)


Folders Infected:

(No malicious items detected)


Files Infected:

D:\TMP\TC\Totalcmd_sp2\Totalcmd\Utils\Ident\PLUGINS\UPXScramb.dll (Trojan.KillAV) -> No action taken.

D:\TMP\TC\Totalcmd_sp2\Totalcmd\Utils\TrialReset\Trial-Reset.exe (Malware.Packer) -> No action taken.

D:\TMP\TC\Totalcmd_sp2\Totalcmd\Utils\TrialReset\Plugins\Alcohol 1.x.dll (Malware.Packer) -> No action taken.

D:\TMP\TC\Totalcmd_sp2\Totalcmd\Utils\TrialReset\Plugins\Empty Key.dll (Malware.Packer) -> No action taken.

D:\TMP\TC\Totalcmd_sp2\Totalcmd\Utils\TrialReset\Plugins\SlySoft.dll (Malware.Packer) -> No action taken.

I:\Software\Download\FlashGet160\FGF160.EXE (Adware.Cydoor) -> No action taken.

K:\WINDOWS\system32\drivers\EPoXUSDM.SYS (Rootkit.Rustock) -> No action taken.

K:\Programs\PassView.exe (Malware.Packer.Morphine) -> No action taken.

Като гледам нищо.

Здравейте Филипов!

Аз съм Maniac и ще Ви помагам да почистите вашата система от зловреден софтуер. Анализа на логовете, както и премахването на зловредния софтуер, може да отнеме време, затова моля бъдете търпеливи. Моля, имайте предвид следното:

  • Аз ще Ви помагам само за почистването на вашата система от зловреден софтуер. За всякакви други проблеми, моля създайте нова тема в съответния форум и опишете детайлно проблема Ви.
  • Решението се отнася само за този проблем и само на този компютър.
  • Следвайте инструкциите ми стриктно, докато не Ви кажа, че системата Ви е напълно чиста. Това, че симптомите са изчезнали, не значи че всичко е наред.
  • Ако не разбирате нещо, моля Ви попитайте ме, а не рискувайте. По-добре е малко да се позабавим, отколкото да усложним нещата.
  • При наличие на руткит, аз не гарантирам 100% почистване.
  • Проявете търпение, защото процедурата по почистването на вашата система може да отнеме известно време, в зависимост от вида на зловредния софтуер.
  • Цялата кореспонденция минава през тази тема, не създавайте нова тема и не използвайте друга тема за тази цел.

Следвайте инструкциите ми стриктно и не правете нищо, освен това, което Ви казвам, за да можем да решим проблема. Избрахте ли Премахни избраните (Remove Selected), след като завърши сканирането на MalwareBytes' Anti-Malware? Ако не сте, повторете процедурата и го направете, защото е важно да бъдат изчистени.

Стъпка 1

Изтеглете Security Check от screen317 от тук или тук и го запаметете на вашия десктоп.

  • Кликнете два пъти върху SecurityCheck.exe и следвайте инструкциите.
  • Накрая, автоматично ще се отвори текстов документ, наречен checkup.txt, моля поставете съдържанието му в следващия Ви коментар в тази тема.

Стъпка 2

Изтеглете RootRepeal от тук

Разархивирайте го на вашия десктоп.

  • Кликнете два пъти върху RootRepeal.exe , за да стартирате програмата
  • Кликнете на таба Report в долната част на прозореца
  • Кликнете на бутона Scan
  • Сложете отметки пред следното:


  • Drivers

  • Processes

  • SSDT

  • Hidden Services

  • Кликнете на бутона OK
  • На следващия диалогов прозорец, сложете отметки преди всички дялове (C:\ , D:\ ....)
  • Кликнете на OK, за да започне процеса на сканиране

Бележка: Процеса на сканиране може да отнеме време. Моля,
не стартирайте
никакви програми, докато програмата сканира.

  • Когато сканирането завърши успешно ще се появи бутона Save Report
  • Кликнете върху Save Report и запишете лог файла на вашия десктоп, с име RootRepeal.txt
  • Отворете File, след което Exit , за да затворите програмата.

Копирайте и поставете съдържанието на RootRepeal.txt в следващия си пост.

Регистрирайте се или влезете в профила си за да коментирате
Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.