Грешка: Task Manager Has Been Disabled From Your Administrator [Решен]

16 октомври 200916 г.

Изключете Skype и повторете.

16 октомври 200916 г.

Автор

ComboFix 09-10-16.03 - Kemran 10/17/2009 1:29.5.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.1023.677 [GMT 3:00]

Running from: c:\documents and settings\Kemran\Desktop\Tool.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_ASC3360PR

-------\Service_asc3360pr

-------\Legacy_ASC3360PR

((((((((((((((((((((((((( Files Created from 2009-09-16 to 2009-10-16 )))))))))))))))))))))))))))))))

.

2009-10-16 21:56 . 2009-10-16 21:56 -------- d-----w- C:\_OTM

2009-10-16 19:39 . 2009-10-16 19:47 -------- d-----w- C:\Tool

2009-10-16 18:49 . 2009-10-16 18:49 -------- d-----w- c:\program files\Driver Cleaner Pro

2009-10-16 18:43 . 2003-06-18 14:31 17920 ----a-w- c:\windows\system32\mdimon.dll

2009-10-16 18:41 . 2009-10-16 18:41 -------- d-----w- c:\program files\Microsoft ActiveSync

2009-10-16 18:40 . 2009-10-16 18:41 -------- d-----w- c:\windows\SHELLNEW

2009-10-16 18:40 . 2009-10-16 18:40 -------- d-----w- c:\program files\Microsoft.NET

2009-10-16 18:10 . 2009-10-16 18:10 -------- d--h--w- c:\windows\system32\GroupPolicy

2009-10-16 17:48 . 2009-10-16 17:48 -------- d-----w- c:\documents and settings\Kemran\Application Data\Malwarebytes

2009-10-16 17:48 . 2009-09-10 11:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-10-16 17:48 . 2009-10-16 17:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-10-16 17:48 . 2009-10-16 17:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-10-16 17:48 . 2009-09-10 11:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-10-16 17:08 . 2009-10-16 17:08 -------- d-----w- c:\program files\Lavalys

2009-10-16 13:56 . 2009-10-16 13:56 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite

2009-10-16 13:56 . 2009-10-16 13:56 -------- d-----w- c:\program files\DAEMON Tools Toolbar

2009-10-16 13:56 . 2009-10-16 13:56 -------- d-----w- c:\program files\DAEMON Tools Lite

2009-10-16 13:30 . 2009-10-16 13:30 721904 ----a-w- c:\windows\system32\drivers\sptd.sys

2009-10-16 13:29 . 2009-10-16 18:38 -------- d-----w- c:\documents and settings\Kemran\Application Data\DAEMON Tools Lite

2009-10-16 12:40 . 2009-10-16 12:43 -------- d-----w- c:\program files\NovaClock

2009-10-16 12:37 . 2009-10-16 12:37 -------- d--h--w- c:\windows\Icons

2009-10-16 12:29 . 2006-12-19 13:53 24072 ----a-w- c:\windows\system32\uxtuneup.dll

2009-10-15 17:25 . 2008-04-13 21:24 22016 -c--a-w- c:\windows\system32\dllcache\msircomm.sys

2009-10-15 17:25 . 2008-04-13 21:24 22016 ----a-w- c:\windows\system32\drivers\MSIRCOMM.sys

2009-10-15 16:56 . 2009-10-15 16:56 -------- d-----w- c:\windows\Datecs

2009-10-15 16:56 . 2000-12-12 21:55 28672 ----a-w- c:\windows\system32\newdll.dll

2009-10-15 16:56 . 2000-11-17 10:47 8992 ----a-w- c:\windows\system32\kbdbphz.dLL

2009-10-15 16:56 . 2000-11-15 03:52 6416 ----a-w- c:\windows\system32\kbdbds.Dll

2009-10-15 16:56 . 1999-12-07 11:00 6416 ----a-w- c:\windows\system32\kbdbp.Dll

2009-10-15 16:56 . 1999-11-18 07:04 7440 ----a-w- c:\windows\system32\KBDDLL.DLL

2009-10-15 16:56 . 1999-11-11 15:47 6416 ----a-w- c:\windows\system32\kbdinori.Dll

2009-10-15 16:56 . 1999-11-11 15:47 6416 ----a-w- c:\windows\system32\kbdinasa.Dll

2009-10-15 16:56 . 1999-11-11 15:47 6928 ----a-w- c:\windows\system32\kbdhebx.Dll

2009-10-15 16:56 . 1997-04-03 23:00 8992 ----a-w- c:\windows\system32\KBDBPH.dLL

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-10-16 22:11 . 2009-10-14 20:10 -------- d-----w- c:\documents and settings\Kemran\Application Data\Skype

2009-10-16 21:58 . 2009-10-14 20:11 -------- d-----w- c:\documents and settings\Kemran\Application Data\skypePM

2009-10-16 21:39 . 2009-10-14 19:11 43272 ----a-w- c:\documents and settings\Kemran\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-10-16 19:13 . 2009-10-14 20:58 -------- d-----w- c:\documents and settings\Kemran\Application Data\AIMP

2009-10-16 13:45 . 2009-10-14 21:59 -------- d-----w- c:\documents and settings\Kemran\Application Data\uTorrent

2009-10-14 21:59 . 2009-10-14 21:59 -------- d-----w- c:\program files\uTorrent

2009-10-14 21:42 . 2009-10-14 21:42 -------- d-----w- c:\program files\Webteh

2009-10-14 21:36 . 2009-10-14 20:16 -------- d-----w- c:\program files\AlienGUIse

2009-10-14 20:58 . 2009-10-14 20:58 -------- d-----w- c:\program files\AIMP2

2009-10-14 20:28 . 2009-10-14 20:27 -------- d-----w- c:\program files\VIA

2009-10-14 20:27 . 2009-10-14 19:16 -------- d-----w- c:\program files\Common Files\InstallShield

2009-10-14 20:16 . 2009-10-14 20:16 -------- d-----w- c:\program files\Common Files\Stardock

2009-10-14 20:11 . 2009-10-14 20:11 56 ---ha-w- c:\windows\system32\ezsidmv.dat

2009-10-14 20:10 . 2009-10-14 20:09 -------- d-----r- c:\program files\Skype

2009-10-14 20:09 . 2009-10-14 20:09 -------- d-----w- c:\program files\Common Files\Skype

2009-10-14 20:09 . 2009-10-14 20:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype

2009-10-14 19:59 . 2009-10-14 19:59 -------- d-----w- c:\program files\C-Media 3D Audio

2009-10-14 19:59 . 2009-10-14 19:17 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-10-14 19:58 . 2009-10-14 19:58 -------- d-----w- c:\documents and settings\Kemran\Application Data\TuneUp Software

2009-10-14 19:36 . 2009-10-14 19:17 -------- d-----w- c:\program files\ATI Technologies

2009-10-14 19:19 . 2009-10-14 19:19 0 ----a-w- c:\windows\nsreg.dat

2009-10-14 18:58 . 2009-10-14 18:58 -------- d-----w- c:\program files\microsoft frontpage

2009-10-14 18:52 . 2009-10-14 18:52 21640 ----a-w- c:\windows\system32\emptyregdb.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

c:\documents and settings\All Users\Start Menu\Programs\Startup\

FlexType 2K.lnk - c:\windows\Datecs\Flex2K.exe [2009-10-15 225280]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLUA"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"DisableTaskMgr"= 1 (0x1)

"DisableRegistryTools"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]

2001-12-20 20:34 24576 ----a-w- c:\program files\AlienGUIse\fastload.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\system32\wbsys.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" -autorun

"Skype"="c:\program files\Skype\Phone\Skype.exe" /nosplash /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe"

"RaidTool"=c:\program files\VIA\RAID\raid_tool.exe

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"d:\\D-MAC's tools\\INSTALLS\\Mozilla FireFox\\Firefox Setup 3.5.2.exe"=

"c:\\WINDOWS\\system32\\wscntfy.exe"=

"c:\\PROGRA~1\\COMMON~1\\INSTAL~1\\engine\\6\\INTEL3~1\\IKernel.exe"=

"c:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"= c:\\PROGRAM FILES\\ATI TECHNOLOGIES\\ATI CONTROL PANEL\\ATIPTAXX.EXE

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

"d:\\D-MAC's tools\\Other\\TuneUp Utilities 2007\\TuneUp Utilities 2007.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\AIMP2\\AIMP2.exe"=

"d:\\D-MAC's tools\\INSTALLS\\WinRAR\\WinRar Setup.exe"=

"c:\\Program Files\\AlienGUIse\\wbload.exe"=

"c:\\WINDOWS\\Datecs\\Flex2K.exe"=

"c:\\WINDOWS\\system32\\Ati2evxx.exe"=

"c:\\WINDOWS\\system32\\netsh.exe"=

R3 asc3360pr;asc3360pr;\??\c:\windows\system32\drivers\smjrj.sys --> c:\windows\system32\drivers\smjrj.sys [?]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - ASC3360PR

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

UxTuneUp

.

------- Supplementary Scan -------

.

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

TCP: {3EFE8D44-8683-48AC-827C-19E8DE02CB9A} = 212.25.58.8 212.25.58.2

FF - ProfilePath - c:\documents and settings\Kemran\Application Data\Mozilla\Firefox\Profiles\nu4whop3.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.bg/

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-10-17 01:34

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1343024091-1972579041-1177238915-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]

@Denied: (Full) (LocalSystem)

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(692)

c:\windows\system32\Ati2evxx.dll

c:\program files\AlienGUIse\fastload.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\ati2evxx.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2009-10-16 1:36 - machine was rebooted

ComboFix-quarantined-files.txt 2009-10-16 22:36

ComboFix2.txt 2009-10-16 20:09

ComboFix3.txt 2009-10-16 19:47

ComboFix4.txt 2009-10-16 19:13

Pre-Run: 10,440,769,536 bytes free

Post-Run: 10,359,660,544 bytes free

166

16 октомври 200916 г.

Стъпка 1:

Отворете Notepad и чрез комбинацията copy/paste поставете следния текст:

Killall::


FCopy::

c:\windows\system32\drivers\smjrj.sys |  c:\documents and settings\Kemran\Desktop\Suspicious files\smjrj.sys.vir

C:\windows\system32\drivers\asc3360p.sys | c:\documents and settings\Kemran\Desktop\Suspicious files\asc3360p.sys.vir

Запазете файла с името CFScript.txt и го поставете върху ComboFix.

След като, програмата приключи ще Ви изведе лог файла. Отново чрез комбинацията от Copy/Paste поставете информацията тук.

Стъпка 2:

Архивирайте новосъздадената на вашия десктоп папка, наречена Suspicious files и я прикрепете към www.rapidshare.com . Накрая публикувайте линк за изтегляне.

Ще ми е необходима помощ за вашия леко... усложнен случай.

16 октомври 200916 г.

Автор

ето го и новият Лог но не се създаде никаква папка на десктоп-а ми :cheers:

ComboFix 09-10-16.03 - Kemran 10/17/2009 1:47.6.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.1023.752 [GMT 3:00]

Running from: c:\documents and settings\Kemran\Desktop\Tool.exe

Command switches used :: c:\documents and settings\Kemran\Desktop\CFScript.txt