Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Вирус в паметта

RuRkO
в Премахване на зловреден софтуер

Featured Replies

Обновете MalwareBytes' Anti-Malware и направете бързо сканиране. След това:

gmer_zip.gif

Изтеглете GMER Rootkit Scanner. Разархивирайте го на вашия десктоп.

Преди да сканирате се уверете, че всички останали работещи програми в момента са изключени и вашия антивирусен софтуер няма да предприема никакви действия по време на сканирането на Gmer. Не използвайте компютъра си, докато трае сканирането.

Преименувайте GMER.exe на Tool.exe и кликнете два пъти пъти върху Tool.exe , за да стартирате програмата.

Внимание: Сканирането може да доведе до грешки, затова не предприемайте никакви действия върху редовете маркирани с "<--- ROOKIT" без да съм Ви посочил да го направите.

Ако е открита активност на rootkit ще бъдете попитани дали желаете да бъде направено пълно сканиране на системата.

  • Изберете NO.
  • В десния панел ще видите какво е било проверено, нека всичко си остане така. Необходимо е само да се уверите, че пред "Show All" няма отметка.
  • Сега кликнете върху бутона Scan .

След като сканирането приключи е възможно да получите информация за друга rootkit активност.

  • Изберете OK .
  • Gmer ще Ви отвори лог файла. Кликнете на бутона Save... и в полето за име на файла, напишете Gmer.txt .
  • Запишете лог файла на вашия десктоп.

  • Автор

ето логовете

Malwarebytes' Anti-Malware 1.44

Database version: 3559

Windows 5.1.2600 Service Pack 3

Internet Explorer 6.0.2900.5512

14.1.2010 г. 14:59:31

mbam-log-2010-01-14 (14-59-31).txt

Scan type: Quick Scan

Objects scanned: 118317

Time elapsed: 11 minute(s), 54 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

GMER 1.0.15.15281 - http://www.gmer.net

Rootkit scan 2010-01-14 17:41:55

Windows 5.1.2600 Service Pack 3

Running: Tool.exe; Driver: C:\DOCUME~1\MarTin\LOCALS~1\Temp\kxtdrpog.sys

---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xB88EE6B8]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xB88EE574]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xB88EEA52]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xB88EE14C]

SSDT spsh.sys ZwEnumerateKey [0xF76DDDA4]

SSDT spsh.sys ZwEnumerateValueKey [0xF76DE132]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xB88EE64E]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xB88EE08C]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xB88EE0F0]

SSDT spsh.sys ZwQueryKey [0xF76DE20A]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xB88EE76E]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xB88EE72E]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xB88EE8AE]

INT 0x39 ? 86376BF8

INT 0x3A ? 857B7F00

INT 0x3A ? 857B7F00

INT 0x3A ? 857B7F00

INT 0x3E ? 86376BF8

INT 0x3F ? 86376BF8

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateProcessEx [0xB88F782E]

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateSection [0xB88F7678]

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwLoadDriver [0xB88F77AC]

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) NtCreateSection

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!_abnormal_termination + 150 804E27AC 4 Bytes JMP EFADB88E

.text ntoskrnl.exe!_abnormal_termination + 428 804E2A84 4 Bytes CALL F801E317

PAGE ntoskrnl.exe!NtCreateSection 805652B3 7 Bytes JMP B88F767C \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)

PAGE ntoskrnl.exe!ZwCreateProcessEx 8057FC60 7 Bytes JMP B88F7832 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)

PAGE ntoskrnl.exe!ZwLoadDriver 805A3AF1 7 Bytes JMP B88F77B0 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)

? spsh.sys The system cannot find the file specified. !

.text USBPORT.SYS!DllUnload B9C6F8AC 5 Bytes JMP 857B74E0

.text abeiroau.SYS B9BA4386 35 Bytes [00, 00, 00, 00, 00, 00, 20, ...]

.text abeiroau.SYS B9BA43AA 24 Bytes [00, 00, 00, 00, 00, 00, 00, ...]

.text abeiroau.SYS B9BA43C4 3 Bytes [00, 80, 02]

.text abeiroau.SYS B9BA43C9 1 Byte [30]

.text abeiroau.SYS B9BA43C9 11 Bytes [30, 00, 00, 00, 5E, 02, 00, ...] {XOR [EAX], AL; ADD [EAX], AL; POP ESI; ADD AL, [EAX]; ADD [EAX], AL; ADD [EAX], AL}

.text ...

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Winamp\winamp.exe[3076] USER32.dll!SetScrollInfo 7E419056 7 Bytes JMP 0424B6F6 C:\Program Files\Winamp\Plugins\gen_jumpex.dll

.text C:\Program Files\Winamp\winamp.exe[3076] USER32.dll!GetScrollInfo 7E42DFE2 7 Bytes JMP 0424B67E C:\Program Files\Winamp\Plugins\gen_jumpex.dll

.text C:\Program Files\Winamp\winamp.exe[3076] USER32.dll!ShowScrollBar 7E42F2F2 5 Bytes JMP 0424B77A C:\Program Files\Winamp\Plugins\gen_jumpex.dll

.text C:\Program Files\Winamp\winamp.exe[3076] USER32.dll!GetScrollPos 7E42F704 5 Bytes JMP 0424B6A6 C:\Program Files\Winamp\Plugins\gen_jumpex.dll

.text C:\Program Files\Winamp\winamp.exe[3076] USER32.dll!SetScrollPos 7E42F750 5 Bytes JMP 0424B721 C:\Program Files\Winamp\Plugins\gen_jumpex.dll

.text C:\Program Files\Winamp\winamp.exe[3076] USER32.dll!GetScrollRange 7E42F787 5 Bytes JMP 0424B6CB C:\Program Files\Winamp\Plugins\gen_jumpex.dll

.text C:\Program Files\Winamp\winamp.exe[3076] USER32.dll!SetScrollRange 7E42F99B 5 Bytes JMP 0424B74C C:\Program Files\Winamp\Plugins\gen_jumpex.dll

.text C:\Program Files\Winamp\winamp.exe[3076] USER32.dll!EnableScrollBar 7E468005 7 Bytes JMP 0424B656 C:\Program Files\Winamp\Plugins\gen_jumpex.dll

.text C:\Documents and Settings\MarTin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3592] ntdll.dll!NtCreateFile + 6 7C90D096 4 Bytes [28, 00, 15, 00]

.text C:\Documents and Settings\MarTin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3592] ntdll.dll!NtCreateFile + B 7C90D09B 1 Byte [E2]

.text C:\Documents and Settings\MarTin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3592] ntdll.dll!NtOpenFile + 6 7C90D586 4 Bytes [68, 00, 15, 00]

.text C:\Documents and Settings\MarTin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3592] ntdll.dll!NtOpenFile + B 7C90D58B 1 Byte [E2]

.text C:\Documents and Settings\MarTin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3592] ntdll.dll!NtOpenProcess + 6 7C90D5E6 4 Bytes [A8, 01, 15, 00]

.text C:\Documents and Settings\MarTin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3592] ntdll.dll!NtOpenProcess + B 7C90D5EB 1 Byte [E2]

.text C:\Documents and Settings\MarTin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3592] ntdll.dll!NtOpenProcessToken + 6 7C90D5F6 4 Bytes CALL 7B90EAFC

.text C:\Documents and Settings\MarTin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3592] ntdll.dll!NtOpenProcessToken + B 7C90D5FB 1 Byte [E2]

.text C:\Documents and Settings\MarTin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3592] ntdll.dll!NtOpenProcessTokenEx + 6 7C90D606 4 Bytes [A8, 02, 15, 00]

.text C:\Documents and Settings\MarTin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3592] ntdll.dll!NtOpenProcessTokenEx + B 7C90D60B 1 Byte [E2]

.text C:\Documents and Settings\MarTin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3592] ntdll.dll!NtOpenThread + 6 7C90D646 4 Bytes [68, 01, 15, 00]

.text C:\Documents and Settings\MarTin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3592] ntdll.dll!NtOpenThread + B 7C90D64B 1 Byte [E2]

.text C:\Documents and Settings\MarTin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3592] ntdll.dll!NtOpenThreadToken + 6 7C90D656 4 Bytes [68, 02, 15, 00]

.text C:\Documents and Settings\MarTin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3592] ntdll.dll!NtOpenThreadToken + B 7C90D65B 1 Byte [E2]

.text C:\Documents and Settings\MarTin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3592] ntdll.dll!NtOpenThreadTokenEx + 6 7C90D666 4 Bytes CALL 7B90EB6D

.text C:\Documents and Settings\MarTin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3592] ntdll.dll!NtOpenThreadTokenEx + B 7C90D66B 1 Byte [E2]

.text C:\Documents and Settings\MarTin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3592] ntdll.dll!NtQueryAttributesFile + 6 7C90D6F6 4 Bytes [A8, 00, 15, 00]

.text C:\Documents and Settings\MarTin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3592] ntdll.dll!NtQueryAttributesFile + B 7C90D6FB 1 Byte [E2]

.text C:\Documents and Settings\MarTin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3592] ntdll.dll!NtQueryFullAttributesFile + 6 7C90D796 4 Bytes CALL 7B90EC9B

.text C:\Documents and Settings\MarTin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3592] ntdll.dll!NtQueryFullAttributesFile + B 7C90D79B 1 Byte [E2]

.text C:\Documents and Settings\MarTin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3592] ntdll.dll!NtSetInformationFile + 6 7C90DC46 4 Bytes [28, 01, 15, 00]

.text C:\Documents and Settings\MarTin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3592] ntdll.dll!NtSetInformationFile + B 7C90DC4B 1 Byte [E2]

.text C:\Documents and Settings\MarTin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3592] ntdll.dll!NtSetInformationThread + 6 7C90DC96 4 Bytes [28, 02, 15, 00]

.text C:\Documents and Settings\MarTin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3592] ntdll.dll!NtSetInformationThread + B 7C90DC9B 1 Byte [E2]

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT \WINDOWS\System32\Drivers\SCSIPORT.SYS[ntoskrnl.exe!DbgBreakPoint] 863762D8

IAT pci.sys[ntoskrnl.exe!IoDetachDevice] [F76F0DDC] spsh.sys

IAT pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F76F0E30] spsh.sys

IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F76C6042] spsh.sys

IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F76C613E] spsh.sys

IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F76C60C0] spsh.sys

IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F76C6800] spsh.sys

IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F76C66D6] spsh.sys

IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F76D5B90] spsh.sys

IAT \SystemRoot\system32\DRIVERS\USBPORT.SYS[ntoskrnl.exe!DbgBreakPoint] 857B75E0

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!RtlInitUnicodeString] 8800001C

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!swprintf] 001CBA86

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!KeSetEvent] C61AEB00

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoCreateSymbolicLink] 001C8986

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoGetConfigurationInformation] 86C61200

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoDeleteSymbolicLink] 00001C8B

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!MmFreeMappingAddress] 96868801

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoFreeErrorLogEntry] 8800001C

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoDisconnectInterrupt] 001CB286

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!MmUnmapIoSpace] 88968B00

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!ObReferenceObjectByPointer] 8900001C

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IofCompleteRequest] 001CA496

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!RtlCompareUnicodeString] C6168B00

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IofCallDriver] 001CC186

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!MmAllocateMappingAddress] 428A0A00

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoAllocateErrorLogEntry] C286880C

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoConnectInterrupt] 8B00001C

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoDetachDevice] 24A48DFA

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!KeWaitForSingleObject] 00000000

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!KeInitializeEvent] 4B8BDF8B

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!KeCancelTimer] 8D3F0304

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!RtlAnsiStringToUnicodeString] CB033043

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!RtlInitAnsiString] 0673C13B

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoBuildDeviceIoControlRequest] C13B0003

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoQueueWorkItem] 8366FA72

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!MmMapIoSpace] 75000E7B

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoInvalidateDeviceRelations] 0B7D80E3

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoReportDetectedDevice] 307B8D00

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoReportResourceForDetection] 00AA840F

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!RtlxAnsiStringToUnicodeSize] 83660000

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!NlsMbCodePageTag] 6A000E7A

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!PoRequestPowerIrp] C6647400

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!KeInsertByKeyDeviceQueue] 001CC386

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!PoRegisterDeviceForIdleDetection] 4F8B0200

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!sprintf] 968D5140

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!MmMapLockedPagesSpecifyCache] 00001C98

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!ObfDereferenceObject] 22F6E852

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoGetAttachedDeviceReference] 478B0000

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoInvalidateDeviceState] 50016A40

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!ZwClose] 1CB48E8D

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!ObReferenceObjectByHandle] E8510000

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!ZwCreateDirectoryObject] 000022E4

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoBuildSynchronousFsdRequest] 6A18538B

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!PoStartNextPowerIrp] 868D5200

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoCreateDevice] 00001CA0

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!RtlCopyUnicodeString] 22D2E850

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoAllocateDriverObjectExtension] 4B8B0000

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!RtlQueryRegistryValues] 51016A18

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!ZwOpenKey] 1CBC968D

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!RtlFreeUnicodeString] E8520000

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoStartTimer] 000022C0

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!KeInitializeTimer] 8A05478A

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoInitializeTimer] 001CC38E

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!KeInitializeDpc] 30C48300

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!KeInitializeSpinLock] 1CC58688

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoInitializeIrp] 80E90000

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!ZwCreateKey] C6000000

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!RtlAppendUnicodeStringToString] 001CC386

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!RtlIntegerToUnicodeString] 438B0100

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!ZwSetValueKey] 8E8D5018

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!KeInsertQueueDpc] 00001C98

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!KefAcquireSpinLockAtDpcLevel] 2292E851

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoStartPacket] 538B0000

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!KefReleaseSpinLockFromDpcLevel] 52016A18

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoBuildAsynchronousFsdRequest] 1CB4868D

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoFreeMdl] E8500000

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!MmUnlockPages] 00002280

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoWriteErrorLogEntry] 8A05478A

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!KeRemoveByKeyDeviceQueue] 001CC38E

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!MmMapLockedPagesWithReservedMapping] 18C48300

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!MmUnmapReservedMapping] 1CC58688

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!KeSynchronizeExecution] 43EB0000

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoStartNextPacket] 320C538A

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!KeBugCheckEx] 88F93BC0

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!KeRemoveDeviceQueue] 001CC396

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!KeSetTimer] F6317300

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!_allmul] 74070647

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!MmProbeAndLockPages] 75C0841A

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!_except_handler3] 05578A0B

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!PoSetPowerState] 968801B0

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoOpenDeviceRegistryKey] 00001CC5

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!RtlWriteRegistryValue] 57B60F66

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!RtlDeleteRegistryValue] 533B6604

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!_aulldiv] 03087408

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!strstr] 72F93B3F

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!_strupr] 8A09EBDA

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!KeQuerySystemTime] 86880547

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoWMIRegistrationControl] 00001CC5

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!KeTickCount] 88084B8A

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoAttachDeviceToDeviceStack] 001CC68E

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoDeleteDevice] 40578B00

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!ExAllocatePoolWithTag] 8D52006A

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoAllocateWorkItem] 001CC886

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoAllocateIrp] 11E85000

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoAllocateMdl] 8B000022

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!MmBuildMdlForNonPagedPool] 001CC08E

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!MmLockPagableDataSection] C4968B00

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoGetDriverObjectExtension] 8900001C

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!MmUnlockPagableImageSection] 001CCC8E

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!ExFreePoolWithTag] D0968900

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoFreeIrp] 8B00001C

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!IoFreeWorkItem] 016A4047

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!InitSafeBootMode] D4C68150

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!RtlCompareMemory] 5600001C

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!PoCallDriver] 0021E7E8

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!memmove] 18C48300

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[ntoskrnl.exe!MmHighestUserAddress] 5D5B5E5F

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[HAL.dll!KfAcquireSpinLock] 18C4830E

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[HAL.dll!READ_PORT_UCHAR] 1C959E88

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[HAL.dll!KeGetCurrentIrql] 9E880000

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[HAL.dll!KfRaiseIrql] 00001CB1

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[HAL.dll!KfLowerIrql] 0E798366

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[HAL.dll!HalGetInterruptVector] 74AAB000

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[HAL.dll!HalTranslateBusAddress] 8986C636

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[HAL.dll!KeStallExecutionProcessor] 1A00001C

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[HAL.dll!KfReleaseSpinLock] 1C8B86C6

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] C6020000

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[HAL.dll!READ_PORT_USHORT] 001C9686

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] 86C60200

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[HAL.dll!WRITE_PORT_UCHAR] 00001CB2

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[WMILIB.SYS!WmiSystemControl] 8800001C

IAT \SystemRoot\System32\Drivers\abeiroau.SYS[WMILIB.SYS!WmiCompleteRequest] 001CB99E

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\WINDOWS\system32\services.exe[600] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 005C0002

IAT C:\WINDOWS\system32\services.exe[600] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 005C0000

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/ALWIL Software)

Device \FileSystem\Ntfs \Ntfs 863DF1F8

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\usbuhci \Device\USBPDO-0 858AF500

Device \Driver\PCI_PNP1504 \Device\00000045 spsh.sys

Device \Driver\PCI_PNP1504 \Device\00000045 spsh.sys

Device \Driver\usbuhci \Device\USBPDO-1 858AF500

Device \Driver\dmio \Device\DmControl\DmIoDaemon 863E11F8

Device \Driver\dmio \Device\DmControl\DmConfig 863E11F8

Device \Driver\dmio \Device\DmControl\DmPnP 863E11F8

Device \Driver\dmio \Device\DmControl\DmInfo 863E11F8

Device \Driver\usbuhci \Device\USBPDO-2 858AF500

AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\Ftdisk \Device\HarddiskVolume1 863741F8

Device \Driver\Ftdisk \Device\HarddiskVolume2 863741F8

Device \Driver\Cdrom \Device\CdRom0 85730500

Device \Driver\Cdrom \Device\CdRom1 85730500

Device \Driver\NetBT \Device\NetBt_Wins_Export 85714500

Device \Driver\NetBT \Device\NetbiosSmb 85714500

AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\usbuhci \Device\USBFDO-0 858AF500

Device \Driver\usbuhci \Device\USBFDO-1 858AF500

Device \Driver\sptd \Device\3752332944 spsh.sys

Device \Driver\usbuhci \Device\USBFDO-2 858AF500

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 85739500

Device \Driver\NetBT \Device\NetBT_Tcpip_{DAC175CD-F4EA-4E9A-948B-8778421FBCFB} 85714500

Device \FileSystem\MRxSmb \Device\LanmanRedirector 85739500

Device \Driver\Ftdisk \Device\FtControl 863741F8

Device \Driver\viadsk \Device\Scsi\viadsk1 863E01F8

Device \Driver\viadsk \Device\Scsi\viadsk2 863E01F8

Device \Driver\viadsk \Device\Scsi\viadsk2Port1Path0Target0Lun0 863E01F8

Device \Driver\viadsk \Device\Scsi\viadsk1Port0Path0Target0Lun0 863E01F8

Device \Driver\abeiroau \Device\Scsi\abeiroau1 8572D500

Device \Driver\abeiroau \Device\Scsi\abeiroau1Port2Path0Target0Lun0 8572D500

Device \FileSystem\Cdfs \Cdfs 8587D380

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xD2 0x1C 0x3D 0x69 ...

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xA3 0x43 0x98 0xE3 ...

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xDD 0x07 0x42 0xC5 ...

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xD2 0x1C 0x3D 0x69 ...

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xA3 0x43 0x98 0xE3 ...

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xDD 0x07 0x42 0xC5 ...

Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\

Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...

Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0

Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xD2 0x1C 0x3D 0x69 ...

Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...

Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xA3 0x43 0x98 0xE3 ...

Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xDD 0x07 0x42 0xC5 ...

---- EOF - GMER 1.0.15 ----

Отидете в C:\Program Files\ESET\ESET Online Scanner и стартирайте OnlineScannerApp.exe . Следвайте първоначалните инструкции за ESET Online Scanner и направете сканиране. Накрая публикувайте резултатите.

Освен това ми кажете и как чувствате системата в момента.

  • Автор

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=8f186676889daf4ea71f4e41b4aa795d

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2010-01-10 04:01:37

# local_time=2010-01-10 06:01:37 (+0200, FLE Standard Time)

# country="Bulgaria"

# lang=1033

# osver=5.1.2600 NT Service Pack 2

# compatibility_mode=512 16777215 100 0 243628 243628 0 0

# compatibility_mode=769 16775125 100 98 4155 199418011 0 0

# compatibility_mode=8192 67108863 100 0 3920 3920 0 0

# scanned=45412

# found=0

# cleaned=0

# scan_time=2446

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=8f186676889daf4ea71f4e41b4aa795d

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2010-01-14 07:55:38

# local_time=2010-01-14 09:55:38 (+0200, FLE Standard Time)

# country="Bulgaria"

# lang=1033

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=512 16777215 100 0 601569 601569 0 0

# compatibility_mode=769 16775125 100 98 5744 199775952 11724 0

# compatibility_mode=8192 67108863 100 0 361861 361861 0 0

# scanned=47777

# found=2

# cleaned=2

# scan_time=4139

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\NPSJJUUK\auswx[1].gif Win32/Conficker.AA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

D:\New Folder (3)\bricopack-vista-inspirat-ultimate-2-crystalxp.net-en-130\pack-vista-inspirat-2-1.0.exe probably a variant of Win32/Agent.QPY trojan (deleted - quarantined) 00000000000000000000000000000000 C

Като цяло системата е добре

освен няколко неща

когато искам да отворя Volume Mixer-a ми дава

post-62442-1263499207,19_thumb.jpg

след рестартиране на компютъра по някое време ми изписва това съобщение

post-62442-1263552507,31_thumb.jpg

и след това вече немоеже да се отвори Volume Control-a

след като излезне вече нямам звук във филмите и в клипчетата и в интернет и на тези в компютъра

също така както вече ви споменах за вирусите които аваст ми изкарва постоянно . тук в лога виждам че се е изтрил един , но незнам дали са се махнали за постоянно или временно засега откакто е пусната програмата не е вадила съобщение за вирус

Редактирано от RuRkO (преглед на промените)

Регистрирайте се или влезете в профила си за да коментирате
Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.