Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

Запълване на хард диска

Последователи

11 октомври 200916 г.

Виждате ли скрити файлове и папки? Би трябвало да се намира лога в архив, който след рестартирането да бъде поставен в AVZ4 -> LOG .

11 октомври 200916 г.

Автор

Може ли по-подробно обяснение за това, как да виждам скрити файлове?

11 октомври 200916 г.

Нека направим нещо преди това: Изпълнете същите инструкции, но със следният скрипт:

begin

SearchRootkit(true, true);

SetAVZGuardStatus(True);

StopService('GPCIDrv');

DeleteService('GPCIDrv');

StopService('GVTDrv');

DeleteService('GVTDrv');

ExecuteSysClean;

SetAVZPMStatus(true);

BC_Activate;

RebootWindows(true);

end.

11 октомври 200916 г.

Автор

Все още не излиза лога.

11 октомври 200916 г.

Извинявам се много за грешката! Оказа се, че MalwareBytes' Anti-Malware грешно е засичал този драйвер. Причината е била, че драйверът е използвал сходно пакетиране с това на популярния руткит Rustock. Проблемът вече би трябвало да е решен. Бих желал от вас последно само едно обновяване на MBAM и един пълно сканиране, за да се уверим, че всичко е наред.

Съжалявам за загубеното време!

11 октомври 200916 г.

Автор

Malwarebytes' Anti-Malware 1.41

Database version: 2937

Windows 5.1.2600 Service Pack 3

11.10.2009 ?. 17:15:52

mbam-log-2009-10-11 (17-15-52).txt

Scan type: Full Scan (C:\|)

Objects scanned: 194380

Time elapsed: 44 minute(s), 6 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 5

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\RECYCLER\S-1-5-21-746137067-1343024091-725345543-500\Dc9\2009-10-11\avz00001.dta (Rootkit.Rustock) -> Quarantined and deleted successfully. [52535142474052305180808576748515518684858068761301171301213722342617171717201717171717171721171717171717393939391717171735251717171717171717171717171717211717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717361717171717171717381839353417381717352117263637191835251718213636371918222123252326242019172417241923392324241923182337191723202318233823382339242119172319232219172419242223381917232623381917212121392220191723372339232123221938173717371734192117171717171717171717171717173232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232322219232623202325323232323232323217171717171717171717171717171717221721221717171721361718172217173232323232323232171717171717171717171717171717173817171717381718173517181724171732323232171717173232323217171717171717171717171732323232171717172517171917171717323232321717171717171717171817172517171717171717251717171717171717221717171817171722171717181717172217171718171717171717171717173232323232321717251717191717171732323232323217171718171717171717171717171721171717171817171717171717171718171717171718171717171717171717171717171817171717171717171717171717171717171717171717173232323232321717323217171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171732323232323217173232171717171717323232321717171732321717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717323232321717171732321717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171938242123222425242117171717171732323232171717172517171917171717323232321717171725171719171717171717171717171717171717171717171717171717171717171917171717172325193824192321231824212318171717173232323217171717323232321717171732323232171717173232323217171717171717171717171717171717171717171717171717171717211717171717212519382321231824212318171717171717323232321717171732323232171717173232323217171717323232321717171717171717171717171717171717171717171717171717171721171717171736252126213821262221171717171717171732323232171717173232323232321717323232321717171732323232323217171717171717171717171717171717171717171717171717171917171717173819193824192322233623392320171717173232323217171717323232323232171732321718171717173232323232321717171717171717171717171717171717171717171717171717211717171717211913014755]

C:\System Volume Information\_restore{AE19297D-23B8-4B42-99C8-D1A1D1DE5815}\RP3\A0001062.sys (Rootkit.Rustock) -> Quarantined and deleted successfully. [52535142474052305180808576748515518684858068761301171301213722342617171717201717171717171721171717171717393939391717171735251717171717171717171717171717211717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717361717171717171717381839353417381717352117263637191835251718213636371918222123252326242019172417241923392324241923182337191723202318233823382339242119172319232219172419242223381917232623381917212121392220191723372339232123221938173717371734192117171717171717171717171717173232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232322219232623202325323232323232323217171717171717171717171717171717221721221717171721361718172217173232323232323232171717171717171717171717171717173817171717381718173517181724171732323232171717173232323217171717171717171717171732323232171717172517171917171717323232321717171717171717171817172517171717171717251717171717171717221717171817171722171717181717172217171718171717171717171717173232323232321717251717191717171732323232323217171718171717171717171717171721171717171817171717171717171718171717171718171717171717171717171717171817171717171717171717171717171717171717171717173232323232321717323217171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171732323232323217173232171717171717323232321717171732321717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717323232321717171732321717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171938242123222425242117171717171732323232171717172517171917171717323232321717171725171719171717171717171717171717171717171717171717171717171717171917171717172325193824192321231824212318171717173232323217171717323232321717171732323232171717173232323217171717171717171717171717171717171717171717171717171717211717171717212519382321231824212318171717171717323232321717171732323232171717173232323217171717323232321717171717171717171717171717171717171717171717171717171721171717171736252126213821262221171717171717171732323232171717173232323232321717323232321717171732323232323217171717171717171717171717171717171717171717171717171917171717173819193824192322233623392320171717173232323217171717323232323232171732321718171717173232323232321717171717171717171717171717171717171717171717171717211717171717211913014755]

C:\System Volume Information\_restore{AE19297D-23B8-4B42-99C8-D1A1D1DE5815}\RP5\A0001177.sys (Rootkit.Rustock) -> Quarantined and deleted successfully. [52535142474052305180808576748515518684858068761301171301213722342617171717201717171717171721171717171717393939391717171735251717171717171717171717171717211717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717361717171717171717381839353417381717352117263637191835251718213636371918222123252326242019172417241923392324241923182337191723202318233823382339242119172319232219172419242223381917232623381917212121392220191723372339232123221938173717371734192117171717171717171717171717173232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232322219232623202325323232323232323217171717171717171717171717171717221721221717171721361718172217173232323232323232171717171717171717171717171717173817171717381718173517181724171732323232171717173232323217171717171717171717171732323232171717172517171917171717323232321717171717171717171817172517171717171717251717171717171717221717171817171722171717181717172217171718171717171717171717173232323232321717251717191717171732323232323217171718171717171717171717171721171717171817171717171717171718171717171718171717171717171717171717171817171717171717171717171717171717171717171717173232323232321717323217171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171732323232323217173232171717171717323232321717171732321717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717323232321717171732321717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171938242123222425242117171717171732323232171717172517171917171717323232321717171725171719171717171717171717171717171717171717171717171717171717171917171717172325193824192321231824212318171717173232323217171717323232321717171732323232171717173232323217171717171717171717171717171717171717171717171717171717211717171717212519382321231824212318171717171717323232321717171732323232171717173232323217171717323232321717171717171717171717171717171717171717171717171717171721171717171736252126213821262221171717171717171732323232171717173232323232321717323232321717171732323232323217171717171717171717171717171717171717171717171717171917171717173819193824192322233623392320171717173232323217171717323232323232171732321718171717173232323232321717171717171717171717171717171717171717171717171717211717171717211913014755]

C:\System Volume Information\_restore{AE19297D-23B8-4B42-99C8-D1A1D1DE5815}\RP5\A0001355.sys (Rootkit.Rustock) -> Quarantined and deleted successfully. [52535142474052305180808576748515518684858068761301171301213722342617171717201717171717171721171717171717393939391717171735251717171717171717171717171717211717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717361717171717171717381839353417381717352117263637191835251718213636371918222123252326242019172417241923392324241923182337191723202318233823382339242119172319232219172419242223381917232623381917212121392220191723372339232123221938173717371734192117171717171717171717171717173232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232322219232623202325323232323232323217171717171717171717171717171717221721221717171721361718172217173232323232323232171717171717171717171717171717173817171717381718173517181724171732323232171717173232323217171717171717171717171732323232171717172517171917171717323232321717171717171717171817172517171717171717251717171717171717221717171817171722171717181717172217171718171717171717171717173232323232321717251717191717171732323232323217171718171717171717171717171721171717171817171717171717171718171717171718171717171717171717171717171817171717171717171717171717171717171717171717173232323232321717323217171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171732323232323217173232171717171717323232321717171732321717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717323232321717171732321717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171938242123222425242117171717171732323232171717172517171917171717323232321717171725171719171717171717171717171717171717171717171717171717171717171917171717172325193824192321231824212318171717173232323217171717323232321717171732323232171717173232323217171717171717171717171717171717171717171717171717171717211717171717212519382321231824212318171717171717323232321717171732323232171717173232323217171717323232321717171717171717171717171717171717171717171717171717171721171717171736252126213821262221171717171717171732323232171717173232323232321717323232321717171732323232323217171717171717171717171717171717171717171717171717171917171717173819193824192322233623392320171717173232323217171717323232323232171732321718171717173232323232321717171717171717171717171717171717171717171717171717211717171717211913014755]

C:\WINDOWS\GPCIDrv.sys (Rootkit.Rustock) -> Quarantined and deleted successfully. [52535142474052305180808576748515518684858068761301171301213722342617171717201717171717171721171717171717393939391717171735251717171717171717171717171717211717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717361717171717171717381839353417381717352117263637191835251718213636371918222123252326242019172417241923392324241923182337191723202318233823382339242119172319232219172419242223381917232623381917212121392220191723372339232123221938173717371734192117171717171717171717171717173232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232322219232623202325323232323232323217171717171717171717171717171717221721221717171721361718172217173232323232323232171717171717171717171717171717173817171717381718173517181724171732323232171717173232323217171717171717171717171732323232171717172517171917171717323232321717171717171717171817172517171717171717251717171717171717221717171817171722171717181717172217171718171717171717171717173232323232321717251717191717171732323232323217171718171717171717171717171721171717171817171717171717171718171717171718171717171717171717171717171817171717171717171717171717171717171717171717173232323232321717323217171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171732323232323217173232171717171717323232321717171732321717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717323232321717171732321717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171938242123222425242117171717171732323232171717172517171917171717323232321717171725171719171717171717171717171717171717171717171717171717171717171917171717172325193824192321231824212318171717173232323217171717323232321717171732323232171717173232323217171717171717171717171717171717171717171717171717171717211717171717212519382321231824212318171717171717323232321717171732323232171717173232323217171717323232321717171717171717171717171717171717171717171717171717171721171717171736252126213821262221171717171717171732323232171717173232323232321717323232321717171732323232323217171717171717171717171717171717171717171717171717171917171717173819193824192322233623392320171717173232323217171717323232323232171732321718171717173232323232321717171717171717171717171717171717171717171717171717211717171717211913014755]

11 октомври 200916 г.

Благодаря! Моля, изчакайте, защото работим съвместно с екипа на MBAM по откриването и отстраняването на проблема.

П.П.: Часът е 18:30 от 1 час чакаме главния вирус ресърчър да се мръдне, но в един момент реши, че му писна и излезе. Препоръчвам Ви да направите като него - дайте си почивка и аз си давам, че вече ми пуши главата много. Съжалявам за причиненото неудобство, както и да се опитвам да оправдая и себе си, и тях просто няма начин. В придвижването на информацията сме: Вие -> Аз -> B-Boy[styLe] -> nossirah и всеки от нас тръпне в очакване, но явно края на веригата има проблем. При първа възможност ще Ви информираме за положението.

11 октомври 200916 г.

Автор

Няма никакъв проблем!

Ще почакам и до утре, ако е нужно.

12 октомври 200916 г.

Няма никакъв проблем!

Ще почакам и до утре, ако е нужно.

Здравейте, (временно замествам колегата Maniac)

Обновете дефинициите на Malwarebytes' Anti-Malware и направете нова проверка на системата си ?

Публикувайте лог файла от нея. Благодарим !

13 октомври 200916 г.

Автор

Malwarebytes' Anti-Malware 1.41

Database version: 2952

Windows 5.1.2600 Service Pack 3

13.10.2009 ?. 15:16:38

mbam-log-2009-10-13 (15-16-38).txt

Scan type: Full Scan (C:\|)

Objects scanned: 195049

Time elapsed: 1 hour(s), 58 minute(s), 36 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 2

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\System Volume Information\_restore{AE19297D-23B8-4B42-99C8-D1A1D1DE5815}\RP6\A0003374.sys (Rootkit.Rustock) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{AE19297D-23B8-4B42-99C8-D1A1D1DE5815}\RP6\A0003408.sys (Rootkit.Rustock) -> Quarantined and deleted successfully.

13 октомври 200916 г.

Чудесно. Моля спрете System Restore и обновете дефинициите на Malwarebytes и проверете за един финален път.

Десен бутон на My Computer => Properties => System Restore => сложете отметка пред "Turn off System Restore on all drivers" => потвърдете с Apply.

Как чувствате сега системата си ?

14 октомври 200916 г.

Автор

Malwarebytes' Anti-Malware 1.41

Database version: 2955

Windows 5.1.2600 Service Pack 3

14.10.2009 ?. 12:56:51

mbam-log-2009-10-14 (12-56-49).txt

Scan type: Full Scan (C:\|)

Objects scanned: 194634

Time elapsed: 1 hour(s), 37 minute(s), 0 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Ще видим в следващите дни, как се държи компютъра и ще докладвам за нещо нередно.

И да попитам, да махна ли сега отметката от System Restore?

Благодаря Ви много за помощта! :biggrin:

Редактирано 14 октомври 200916 г. от AHybuC (преглед на промените)

14 октомври 200916 г.

Ще видим в следващите дни, как се държи компютъра и ще докладвам за нещо нередно.

И да попитам, да махна ли сега отметката от System Restore?

Благодаря Ви много за помощта!

Чудесно, дръжте ни в течение.

Да, вече можете да стартирате System Restore отново. :eek: