Аз съм нов в доста понятия надявам се да изпълня точни инструкциите! Дневник на сканирането Версия на базата данни с вирусни сигнатури: 5746 (20101230) Дата: 30.12.2010 г. Час: 17:10:55 Сканирани дискове, папки и файлове: Оперативна памет Оперативна памет - Win32/Olmarik троянски кон - избраното действие е задържано до завършване на сканирането Брой на сканираните обекти: 379 Брой открити заплахи: 1 Общо почистени обекти: 0 Час на завършване: 17:11:02 Общо време на сканиране: 7 сек. (00:00:07) Някои ако може да ми обясни как да го махна този вирус ще бъде супер!!!

Редактирано 31 декември 201015 г. от nologo (преглед на промените)

Привет, Generalisimos!

Следвайте следната инструкция за работа с TDSSKiller (по-подробна инструкция на английски език: TDSSKiller):

• Изтеглете TDSSKiller и го разархивирайте на десктопa.
• Стартирайте TDSSKiller.exe, след това Start Scan.
• Ако бъде открит инфектиран (infected) файл, проверете дали е избрана опцията Cure (по подразбиране). Ако е избрана Cure - натиснете Continue, снимка:

  

• Ако бъде открит подозрителен (suspicious) файл, проверете дали е избрана опцията Skip (по подразбиране). Ако е избрана Skip - натиснете Continue.
• Възможно е програмата да изиска рестарт. Ако е така - потвърдете с Reboot Now.

  -Ако няма рестартиране, отидете на Report. Ще се появи лог файл. Копирайте и поставете съдържанието му в следващия си коментар.

  -Ако има рестартиране, отидете на в системната директория. Там трябва да има файл с формат: TDSSKiller.[Version]_[Date]_[Time]_log.txt. Отворете го, копирайте и поставете съдържанието му в следващия си коментар.

Забележка: За sptd.sys натиснете Skip.

P.S. След това изпълнете стъпка 4 от тази тема. Очаквам логове от TDSSKiller и DDS. Успех!

Здравей 2010/12/30 23:11:03.0265 TDSS rootkit removing tool 2.4.12.0 Dec 16 2010 09:46:46 2010/12/30 23:11:03.0265 ================================================================================ 2010/12/30 23:11:03.0265 SystemInfo: 2010/12/30 23:11:03.0265 2010/12/30 23:11:03.0265 OS Version: 5.1.2600 ServicePack: 3.0 2010/12/30 23:11:03.0265 Product type: Workstation 2010/12/30 23:11:03.0265 ComputerName: GENERALISIMOS 2010/12/30 23:11:03.0265 UserName: Administrator 2010/12/30 23:11:03.0265 Windows directory: C:\WINDOWS 2010/12/30 23:11:03.0265 System windows directory: C:\WINDOWS 2010/12/30 23:11:03.0265 Processor architecture: Intel x86 2010/12/30 23:11:03.0265 Number of processors: 2 2010/12/30 23:11:03.0265 Page size: 0x1000 2010/12/30 23:11:03.0265 Boot type: Normal boot 2010/12/30 23:11:03.0265 ================================================================================ 2010/12/30 23:11:03.0765 Initialize success 2010/12/30 23:11:17.0343 ================================================================================ 2010/12/30 23:11:17.0343 Scan started 2010/12/30 23:11:17.0343 Mode: Manual; 2010/12/30 23:11:17.0343 ================================================================================ 2010/12/30 23:11:17.0796 Aavmker4 (8d488938e2f7048906f1fbd3af394887) C:\WINDOWS\system32\drivers\Aavmker4.sys 2010/12/30 23:11:17.0859 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys 2010/12/30 23:11:17.0890 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys 2010/12/30 23:11:18.0000 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys 2010/12/30 23:11:18.0031 AFD (4d43e74f2a1239d53929b82600f1971c) C:\WINDOWS\System32\drivers\afd.sys 2010/12/30 23:11:18.0218 Ambfilt (267fc636801edc5ab28e14036349e3be) C:\WINDOWS\system32\drivers\Ambfilt.sys 2010/12/30 23:11:18.0312 Amfilter (f826b306d88c2cea3e64d1be7e83bb73) C:\WINDOWS\system32\DRIVERS\Amfilter.sys 2010/12/30 23:11:18.0359 Amusbprt (c861a356af7277f6ae23cc70b0a9559c) C:\WINDOWS\system32\DRIVERS\Amusbprt.sys 2010/12/30 23:11:18.0437 aswFsBlk (a0d86b8ac93ef95620420c7a24ac5344) C:\WINDOWS\system32\drivers\aswFsBlk.sys 2010/12/30 23:11:18.0515 aswFW (25ace55b10046e9e6e9b148fa7abd3b7) C:\WINDOWS\system32\drivers\aswFW.sys 2010/12/30 23:11:18.0546 aswMon2 (7d880c76a285a41284d862e2d798ec0d) C:\WINDOWS\system32\drivers\aswMon2.sys 2010/12/30 23:11:18.0578 aswNdis (7b948e3657bea62e437bc46ca6ef6012) C:\WINDOWS\system32\DRIVERS\aswNdis.sys 2010/12/30 23:11:18.0671 aswNdis2 (125febcb61d33b358afc20866b8a9842) C:\WINDOWS\system32\drivers\aswNdis2.sys 2010/12/30 23:11:18.0718 aswRdr (69823954bbd461a73d69774928c9737e) C:\WINDOWS\system32\drivers\aswRdr.sys 2010/12/30 23:11:18.0750 aswSnx (81f10376af5f0f466f03cb2c5321b7ed) C:\WINDOWS\system32\drivers\aswSnx.sys 2010/12/30 23:11:18.0843 aswSP (7ecc2776638b04553f9a85bd684c3abf) C:\WINDOWS\system32\drivers\aswSP.sys 2010/12/30 23:11:18.0875 aswTdi (095ed820a926aa8189180b305e1bcfc9) C:\WINDOWS\system32\drivers\aswTdi.sys 2010/12/30 23:11:18.0906 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys 2010/12/30 23:11:18.0984 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys 2010/12/30 23:11:19.0031 atksgt (f0d933b42cd0594048e4d5200ae9e417) C:\WINDOWS\system32\DRIVERS\atksgt.sys 2010/12/30 23:11:19.0062 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys 2010/12/30 23:11:19.0156 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys 2010/12/30 23:11:19.0203 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys 2010/12/30 23:11:19.0234 BIOS (be5d50529799b9bab6be879ec768b6cf) C:\WINDOWS\system32\drivers\BIOS.sys 2010/12/30 23:11:19.0328 Cardex (04e1c782cf14b7282ebc633b0fd3ed16) C:\WINDOWS\system32\drivers\TBPANEL.SYS 2010/12/30 23:11:19.0375 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys 2010/12/30 23:11:19.0406 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys 2010/12/30 23:11:19.0484 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys 2010/12/30 23:11:19.0515 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys 2010/12/30 23:11:19.0546 CDRPDACC (30b37c18e1725eb9f25039e9a1fb9b7e) C:\Program Files\Quintessential Media Player\cdrpdacc.sys 2010/12/30 23:11:19.0765 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys 2010/12/30 23:11:19.0796 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys 2010/12/30 23:11:19.0875 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys 2010/12/30 23:11:19.0906 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys 2010/12/30 23:11:19.0937 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys 2010/12/30 23:11:19.0984 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys 2010/12/30 23:11:20.0046 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys 2010/12/30 23:11:20.0109 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys 2010/12/30 23:11:20.0140 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys 2010/12/30 23:11:20.0171 fixustor (b1fde1c0b7249b72b25cad6ffa36e744) C:\WINDOWS\system32\drivers\fixustor.sys 2010/12/30 23:11:20.0234 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys 2010/12/30 23:11:20.0281 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys 2010/12/30 23:11:20.0328 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys 2010/12/30 23:11:20.0421 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys 2010/12/30 23:11:20.0468 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys 2010/12/30 23:11:20.0562 hamachi (833051c6c6c42117191935f734cfbd97) C:\WINDOWS\system32\DRIVERS\hamachi.sys 2010/12/30 23:11:20.0593 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 2010/12/30 23:11:20.0718 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys 2010/12/30 23:11:20.0781 HTTP (f6aacf5bce2893e0c1754afeb672e5c9) C:\WINDOWS\system32\Drivers\HTTP.sys 2010/12/30 23:11:20.0906 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys 2010/12/30 23:11:20.0953 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys 2010/12/30 23:11:21.0187 IntcAzAudAddService (0503eb6f3359e1c6e4c46fef376405ef) C:\WINDOWS\system32\drivers\RtkHDAud.sys 2010/12/30 23:11:21.0328 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys 2010/12/30 23:11:21.0359 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys 2010/12/30 23:11:21.0375 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 2010/12/30 23:11:21.0468 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys 2010/12/30 23:11:21.0500 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys 2010/12/30 23:11:21.0531 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys 2010/12/30 23:11:21.0625 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys 2010/12/30 23:11:21.0656 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys 2010/12/30 23:11:21.0750 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys 2010/12/30 23:11:21.0781 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys 2010/12/30 23:11:21.0812 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys 2010/12/30 23:11:21.0906 KSecDD (c6ebf1d6ad71df30db49b8d3287e1368) C:\WINDOWS\system32\drivers\KSecDD.sys 2010/12/30 23:11:21.0968 lirsgt (f8a7212d0864ef5e9185fb95e6623f4d) C:\WINDOWS\system32\DRIVERS\lirsgt.sys 2010/12/30 23:11:22.0093 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys 2010/12/30 23:11:22.0125 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys 2010/12/30 23:11:22.0203 Monfilt (c7d9f9717916b34c1b00dd4834af485c) C:\WINDOWS\system32\drivers\Monfilt.sys 2010/12/30 23:11:22.0296 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys 2010/12/30 23:11:22.0328 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys 2010/12/30 23:11:22.0421 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys 2010/12/30 23:11:22.0453 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys 2010/12/30 23:11:22.0484 MRxSmb (7170ab42b51954def2781a4d1cce65f4) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 2010/12/30 23:11:22.0593 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys 2010/12/30 23:11:22.0625 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys 2010/12/30 23:11:22.0640 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys 2010/12/30 23:11:22.0656 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys 2010/12/30 23:11:22.0765 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys 2010/12/30 23:11:22.0796 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys 2010/12/30 23:11:22.0890 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys 2010/12/30 23:11:22.0906 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys 2010/12/30 23:11:22.0921 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys 2010/12/30 23:11:23.0015 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys 2010/12/30 23:11:23.0046 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys 2010/12/30 23:11:23.0062 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys 2010/12/30 23:11:23.0078 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys 2010/12/30 23:11:23.0203 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys 2010/12/30 23:11:23.0250 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys 2010/12/30 23:11:23.0343 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys 2010/12/30 23:11:23.0593 nv (b9b1bb146eb9a83dcf0f5635b09d3d43) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys 2010/12/30 23:11:23.0765 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 2010/12/30 23:11:23.0781 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 2010/12/30 23:11:23.0812 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys 2010/12/30 23:11:23.0890 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys 2010/12/30 23:11:23.0921 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys 2010/12/30 23:11:23.0953 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys 2010/12/30 23:11:24.0046 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys 2010/12/30 23:11:24.0093 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys 2010/12/30 23:11:24.0359 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys 2010/12/30 23:11:24.0375 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys 2010/12/30 23:11:24.0406 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys 2010/12/30 23:11:24.0562 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys 2010/12/30 23:11:24.0609 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 2010/12/30 23:11:24.0687 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys 2010/12/30 23:11:24.0718 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys 2010/12/30 23:11:24.0765 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys 2010/12/30 23:11:24.0859 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 2010/12/30 23:11:24.0890 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys 2010/12/30 23:11:24.0984 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys 2010/12/30 23:11:25.0000 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys 2010/12/30 23:11:25.0078 RTL8023xp (1e11171c0b9989e1bdaa59e96b2e81c4) C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys 2010/12/30 23:11:25.0156 rtl8139 (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS 2010/12/30 23:11:25.0218 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys 2010/12/30 23:11:25.0265 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys 2010/12/30 23:11:25.0328 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys 2010/12/30 23:11:25.0390 sfdrv01 (4c0d673281178cb496011a2e28571fc8) C:\WINDOWS\system32\drivers\sfdrv01.sys 2010/12/30 23:11:25.0468 sfhlp02 (15be2b5e4dc5b8623cf167720682abc9) C:\WINDOWS\system32\drivers\sfhlp02.sys 2010/12/30 23:11:25.0484 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys 2010/12/30 23:11:25.0515 sfsync02 (d14d5c9c11998da690fa75460f4f1cf3) C:\WINDOWS\system32\drivers\sfsync02.sys 2010/12/30 23:11:25.0546 sfsync03 (b27f70092a84b2a381d1fcdbbb82f876) C:\WINDOWS\system32\drivers\sfsync03.sys 2010/12/30 23:11:25.0625 Suspicious service (NoAccess): SKYNETkrgodyuw 2010/12/30 23:11:25.0656 SKYNETkrgodyuw - detected Rootkit.Win32.TDSS.tdl2 (0) 2010/12/30 23:11:25.0703 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys 2010/12/30 23:11:25.0750 sptd (cdddec541bc3c96f91ecb48759673505) C:\WINDOWS\system32\Drivers\sptd.sys 2010/12/30 23:11:25.0750 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505 2010/12/30 23:11:25.0765 sptd - detected Locked file (1) 2010/12/30 23:11:25.0828 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys 2010/12/30 23:11:25.0859 Srv (e89b42b216bc86ada4345908284519cb) C:\WINDOWS\system32\DRIVERS\srv.sys 2010/12/30 23:11:25.0906 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys 2010/12/30 23:11:25.0968 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys 2010/12/30 23:11:26.0046 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys 2010/12/30 23:11:26.0078 TBPanel (04e1c782cf14b7282ebc633b0fd3ed16) C:\WINDOWS\system32\drivers\TBPanel.sys 2010/12/30 23:11:26.0125 Tcpip (ad978a1b783b5719720cff204b666c8e) C:\WINDOWS\system32\DRIVERS\tcpip.sys 2010/12/30 23:11:26.0203 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys 2010/12/30 23:11:26.0234 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys 2010/12/30 23:11:26.0250 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys 2010/12/30 23:11:26.0328 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys 2010/12/30 23:11:26.0468 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys 2010/12/30 23:11:26.0531 usbbus (9419faac6552a51542dbba02971c841c) C:\WINDOWS\system32\DRIVERS\lgusbbus.sys 2010/12/30 23:11:26.0625 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys 2010/12/30 23:11:26.0656 UsbDiag (c0a466fa4ffec464320e159bc1bbdc0c) C:\WINDOWS\system32\DRIVERS\lgusbdiag.sys 2010/12/30 23:11:26.0687 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys 2010/12/30 23:11:26.0781 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys 2010/12/30 23:11:26.0796 USBModem (f74a54774a9b0afeb3c40adec68aa600) C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys 2010/12/30 23:11:26.0828 usbstor (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 2010/12/30 23:11:26.0921 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys 2010/12/30 23:11:26.0953 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys 2010/12/30 23:11:27.0000 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys 2010/12/30 23:11:27.0078 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys 2010/12/30 23:11:27.0109 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys 2010/12/30 23:11:27.0203 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys 2010/12/30 23:11:27.0281 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys 2010/12/30 23:11:27.0437 ================================================================================ 2010/12/30 23:11:27.0437 Scan finished 2010/12/30 23:11:27.0437 ================================================================================ 2010/12/30 23:11:27.0453 Detected object count: 2 2010/12/30 23:14:33.0359 HKLM\SYSTEM\ControlSet001\services\SKYNETkrgodyuw - will be deleted after reboot 2010/12/30 23:14:33.0359 HKLM\SYSTEM\ControlSet002\services\SKYNETkrgodyuw - will be deleted after reboot 2010/12/30 23:14:33.0375 C:\WINDOWS\system32\drivers\SKYNETqoowbppo.sys - will be deleted after reboot 2010/12/30 23:14:33.0375 Rootkit.Win32.TDSS.tdl2(SKYNETkrgodyuw) - User select action: Delete 2010/12/30 23:14:33.0375 Locked file(sptd) - User select action: Skip 2010/12/30 23:14:48.0078 Deinitialize success

Имаше TDSS рууткит:

2010/12/30 23:14:33.0375 Rootkit.Win32.TDSS.tdl2

Няма да е лошо да пуснем тежката артилерия за проверка. Затова следвайте следните стъпки за работа с ComboFix:

1. Изтеглете ComboFix от следните миръри: от BleepingComputer или от ForoSpyware.

След изтегляне на файла го запишете (бутон Save -> Save as) ComboFix на вашия десктоп, снимка:

След като изтеглите ComboFix на десктопа, иконката на програмата би трябвало да изглежда така:

2. Затворете всички работещи приложения или отворени прозорци. Прекратете временно работата на антивирусната програма и на други програми за сигурност, ако има такива. За целта може да прегледате информацията от този линк: How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs.

3. Стартирайте с двоен клик ComboFix.exe. За целта използвайте YES, за да се съгласите с условията за използване на програмата. Важно: след като се стартира ComboFix не бива да се движи мишката или да се кликва върху отворения прозорец на програмата. Просто търпеливо оставете ComboFix да си свърши работата, без да използвате компютъра за други цели.

4. ComboFix ще спре временно Интернет връзката, но след като приключи работата на програмата тази връзка ще бъде възстановена автоматично. ComboFix ще сканира за проблеми и за заразени файлове, като това може да отнеме известно време. Моля да бъдете търпеливи. Ако има проблем с Интернет връзката, моля да прочетете това: Manually restoring the Internet connection section.

5. Когато работата на ComboFix приключи, ще се появи текстов документ (log) в Notepad, виж снимката:

Копирайте (Copy) и поставете (Paste) съдържанието на лога в следващия си коментар.

Забележка: При проблеми с ComboFix копирайте (Copy) и поставете (Paste) съдържанието на C:\BUG.txt в следващия си коментар.

Етого и него ComboFix 10-12-30.01 - Administrator 12.2010 г. 0:12.2.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.2047.1490 [GMT 2:00] Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe AV: avast! Internet Security *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D} FW: avast! Internet Security *Disabled* {7591DB91-41F0-48A3-B128-1A293FD8233D} WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\klipxm32.dll c:\windows\system32\SKYNETadvxkmeq.dat c:\windows\system32\SKYNETbddnoddu.dat c:\windows\XSxS . ((((((((((((((((((((((((( Files Created from 2010-11-28 to 2010-12-30 ))))))))))))))))))))))))))))))) . 2010-12-30 21:14 . 2010-12-30 21:14 77912 ----a-w- c:\windows\system32\drivers\klmdb.sys 2010-12-30 19:52 . 2010-12-30 19:52 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software 2010-12-30 19:52 . 2010-12-30 19:52 -------- d-----w- c:\documents and settings\Administrator\Application Data\TuneUp Software 2010-12-30 17:24 . 2010-09-07 15:52 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys 2010-12-30 17:24 . 2010-09-07 15:47 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys 2010-12-30 17:24 . 2010-09-07 15:53 340048 ----a-w- c:\windows\system32\drivers\aswSnx.sys 2010-12-30 17:24 . 2010-09-07 15:54 99792 ----a-w- c:\windows\system32\drivers\aswFW.sys 2010-12-30 17:23 . 2010-09-07 15:53 190416 ----a-w- c:\windows\system32\drivers\aswNdis2.sys 2010-12-30 17:23 . 2010-09-07 15:47 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys 2010-12-30 17:23 . 2010-09-07 15:52 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2010-12-30 17:23 . 2010-09-07 15:47 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys 2010-12-30 17:23 . 2010-09-07 15:47 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys 2010-12-30 17:23 . 2010-09-07 15:46 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys 2010-12-30 17:23 . 2010-09-07 16:12 38848 ----a-w- c:\windows\avastSS.scr 2010-12-30 17:23 . 2010-09-07 15:24 12112 ----a-w- c:\windows\system32\drivers\aswNdis.sys 2010-12-30 17:23 . 2010-09-07 16:11 167592 ----a-w- c:\windows\system32\aswBoot.exe 2010-12-30 17:23 . 2010-12-30 17:23 -------- d-----w- c:\program files\Alwil Software 2010-12-30 17:23 . 2010-12-30 17:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software 2010-12-30 15:23 . 2010-12-20 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-12-30 15:23 . 2010-12-20 16:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-12-30 14:54 . 2010-12-30 20:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2010-12-30 14:54 . 2010-12-30 20:01 -------- d-----w- c:\program files\Spybot - Search & Destroy 2010-12-30 14:37 . 2010-12-30 14:37 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes 2010-12-30 14:37 . 2010-12-30 14:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-12-30 14:37 . 2010-12-30 17:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-12-30 13:31 . 2010-12-30 20:01 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP 2010-12-30 13:25 . 2010-12-30 13:25 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools 2010-12-29 23:22 . 2010-12-29 23:22 -------- d-----w- c:\program files\Ask.com 2010-12-29 21:47 . 2010-12-29 21:47 -------- d-----w- c:\documents and settings\Administrator\Application Data\fltk.org 2010-12-28 20:56 . 2010-12-28 20:56 -------- d-----w- c:\documents and settings\Administrator\Application Data\FreeArc 2010-12-28 20:56 . 2010-12-28 20:56 -------- d-----w- c:\program files\FreeArc 2010-12-27 21:03 . 2010-12-29 20:20 -------- d-----w- c:\program files\Pando Networks 2010-12-27 21:03 . 2010-12-29 20:18 -------- d-----w- c:\program files\GamersFirst 2010-12-27 18:08 . 2004-07-15 22:20 733184 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iKernel.dll 2010-12-27 18:08 . 2004-07-15 22:20 69715 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\ctor.dll 2010-12-27 18:08 . 2004-07-15 22:19 266240 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iscript.dll 2010-12-27 18:08 . 2004-07-15 22:18 172032 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iuser.dll 2010-12-27 18:08 . 2004-07-15 22:18 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\DotNetInstaller.exe 2010-12-27 18:07 . 2010-12-27 18:07 303236 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\setup.dll 2010-12-27 18:07 . 2010-12-27 18:07 180356 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iGdi.dll 2010-12-26 15:08 . 2010-12-26 15:08 -------- d-----w- c:\documents and settings\All Users\Application Data\ESTsoft 2010-12-26 15:08 . 2010-12-26 15:08 -------- d-----w- c:\documents and settings\Administrator\Application Data\ESTsoft 2010-12-26 15:08 . 2010-12-26 15:08 -------- d-----w- c:\program files\ESTsoft 2010-12-25 19:02 . 2010-12-26 14:39 -------- d-----w- c:\documents and settings\All Users\Application Data\WinZip 2010-12-01 19:25 . 2010-12-01 19:25 281760 ----a-w- c:\windows\system32\drivers\atksgt.sys 2010-12-01 19:25 . 2010-12-01 19:25 25888 ----a-w- c:\windows\system32\drivers\lirsgt.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-11-22 19:31 . 2010-11-22 19:31 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys 2010-11-22 19:31 . 2010-11-22 19:31 103736 ----a-w- c:\windows\system32\PnkBstrB.exe 2010-11-02 17:36 . 2010-11-14 17:07 359016 ----a-w- c:\windows\vncutil.exe 2010-11-02 17:36 . 2010-04-22 06:16 84584 ----a-w- c:\windows\SOUNDMAN.EXE 2010-11-02 17:36 . 2010-04-22 06:16 1833576 ----a-w- c:\windows\SkyTel.exe 2010-11-02 17:36 . 2010-04-22 06:16 891496 ----a-w- c:\windows\system32\RTSndMgr.CPL 2010-11-02 17:36 . 2010-04-22 06:16 1489512 ----a-w- c:\windows\RtlUpd.exe 2010-11-02 17:36 . 2010-04-22 06:16 9721960 ----a-w- c:\windows\RTLCPL.EXE 2010-11-02 17:36 . 2010-04-22 06:16 6188648 ----a-w- c:\windows\system32\drivers\RtkHDAud.sys 2010-11-02 17:36 . 2010-11-14 17:07 54888 ----a-w- c:\windows\system32\RtkCoInstXP.dll 2010-11-02 17:36 . 2010-11-14 17:07 129640 ----a-w- c:\windows\RtkAudioService.exe 2010-11-02 17:36 . 2010-04-22 06:16 19580520 ----a-w- c:\windows\RTHDCPL.EXE 2010-11-02 17:35 . 2010-04-22 06:16 2180712 ----a-w- c:\windows\MicCal.exe 2010-11-02 17:35 . 2010-08-25 18:48 64104 ----a-w- c:\windows\ALCMTR.EXE 2010-11-02 17:35 . 2010-04-22 06:16 285288 ----a-w- c:\windows\system32\ALSNDMGR.CPL 2010-11-02 17:35 . 2010-04-22 06:16 2815592 ----a-w- c:\windows\ALCWZRD.EXE 2010-10-29 09:40 . 2010-10-28 11:33 8992 ----a-w- c:\windows\system32\KBDBPH.dLL 2010-10-28 08:46 . 2010-04-22 06:16 1251944 ----a-w- c:\windows\RtlExUpd.dll 2010-10-22 06:23 . 2010-09-02 16:04 61440 ----a-w- c:\windows\system32\OpenCL.dll 2010-10-22 06:23 . 2009-10-05 10:10 14532608 ----a-w- c:\windows\system32\nvoglnt.dll 2010-10-22 06:23 . 2010-11-14 16:57 888424 ----a-w- c:\windows\system32\nvdispco32.dll 2010-10-22 06:23 . 2010-11-14 16:57 813672 ----a-w- c:\windows\system32\nvgenco32.dll 2010-10-22 06:23 . 2009-10-05 10:10 4882432 ----a-w- c:\windows\system32\nvcuda.dll 2010-10-22 06:23 . 2009-10-05 10:10 2932840 ----a-w- c:\windows\system32\nvcuvid.dll 2010-10-22 06:23 . 2009-10-05 10:10 2666600 ----a-w- c:\windows\system32\nvcuvenc.dll 2010-10-22 06:23 . 2010-09-02 16:04 13012992 ----a-w- c:\windows\system32\nvcompiler.dll 2010-10-22 06:23 . 2009-10-05 10:10 9623680 ----a-w- c:\windows\system32\drivers\nv4_mini.sys 2010-10-22 06:23 . 2009-10-05 10:10 6359552 ----a-w- c:\windows\system32\nv4_disp.dll 2010-10-22 06:23 . 2009-10-05 10:10 1462272 ----a-w- c:\windows\system32\nvapi.dll 2010-10-16 10:05 . 2010-10-16 10:05 81920 ----a-w- c:\windows\system32\nvwddi.dll 2010-10-16 10:05 . 2010-10-16 10:05 335872 ----a-w- c:\windows\system32\nvrsar.dll 2010-10-16 10:05 . 2010-10-16 10:05 331776 ----a-w- c:\windows\system32\nvrshe.dll 2010-10-16 10:05 . 2010-10-16 10:05 286720 ----a-w- c:\windows\system32\nvrsfr.dll 2010-10-16 10:05 . 2010-10-16 10:05 282624 ----a-w- c:\windows\system32\nvrses.dll 2010-10-16 10:05 . 2010-10-16 10:05 282624 ----a-w- c:\windows\system32\nvrsel.dll 2010-10-16 10:05 . 2010-10-16 10:05 278528 ----a-w- c:\windows\system32\nvrsde.dll 2010-10-16 10:05 . 2010-10-16 10:05 274432 ----a-w- c:\windows\system32\nvrsnl.dll 2010-10-16 10:05 . 2010-10-16 10:05 274432 ----a-w- c:\windows\system32\nvrsesm.dll 2010-10-16 10:05 . 2010-10-16 10:05 270336 ----a-w- c:\windows\system32\nvrsru.dll 2010-10-16 10:05 . 2010-10-16 10:05 270336 ----a-w- c:\windows\system32\nvrsptb.dll 2010-10-16 10:05 . 2010-10-16 10:05 266240 ----a-w- c:\windows\system32\nvrsko.dll 2010-10-16 10:05 . 2010-10-16 10:05 262144 ----a-w- c:\windows\system32\nvrshu.dll 2010-10-16 10:05 . 2010-10-16 10:05 258048 ----a-w- c:\windows\system32\nvrstr.dll 2010-10-16 10:05 . 2010-10-16 10:05 258048 ----a-w- c:\windows\system32\nvrssl.dll 2010-10-16 10:05 . 2010-10-16 10:05 258048 ----a-w- c:\windows\system32\nvrssk.dll 2010-10-16 10:05 . 2010-10-16 10:05 253952 ----a-w- c:\windows\system32\nvrsth.dll 2010-10-16 10:05 . 2010-10-16 10:05 253952 ----a-w- c:\windows\system32\nvrssv.dll 2010-10-16 10:05 . 2010-10-16 10:05 253952 ----a-w- c:\windows\system32\nvrsda.dll 2010-10-16 10:05 . 2010-10-16 10:05 249856 ----a-w- c:\windows\system32\nvrsfi.dll 2010-10-16 10:05 . 2010-10-16 10:05 249856 ----a-w- c:\windows\system32\nvrseng.dll 2010-10-16 10:05 . 2010-10-16 10:05 249856 ----a-w- c:\windows\system32\nvrscs.dll 2010-10-16 10:05 . 2010-10-16 10:05 229376 ----a-w- c:\windows\system32\nvrszhc.dll 2010-10-16 10:05 . 2010-10-16 10:05 126976 ----a-w- c:\windows\system32\nvrszht.dll 2010-10-16 10:05 . 2010-10-16 10:05 282624 ----a-w- c:\windows\system32\nvrsit.dll 2010-10-16 10:05 . 2010-10-16 10:05 277608 ----a-w- c:\windows\system32\nvmccs.dll 2010-10-16 10:05 . 2010-10-16 10:05 274432 ----a-w- c:\windows\system32\nvrspt.dll 2010-10-16 10:05 . 2010-10-16 10:05 270336 ----a-w- c:\windows\system32\nvrsja.dll 2010-10-16 10:05 . 2010-10-16 10:05 258048 ----a-w- c:\windows\system32\nvrspl.dll 2010-10-16 10:05 . 2010-10-16 10:05 253952 ----a-w- c:\windows\system32\nvrsno.dll 2010-10-16 10:05 . 2010-10-16 10:05 156776 ----a-w- c:\windows\system32\nvsvc32.exe 2010-10-16 10:05 . 2010-10-16 10:05 145000 ----a-w- c:\windows\system32\nvcolor.exe 2010-10-16 10:05 . 2010-10-16 10:05 13851752 ----a-w- c:\windows\system32\nvcpl.dll 2010-10-16 10:05 . 2010-10-16 10:05 110696 ----a-w- c:\windows\system32\nvmctray.dll 2010-10-04 20:02 . 2010-11-14 17:00 53248 ----a-w- c:\windows\system32\CSVer.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] 2010-09-28 20:44 1400712 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712] [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\snxPluginsShell] @="{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}" [HKEY_CLASSES_ROOT\CLSID\{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}] 2010-09-07 16:14 152160 ----a-w- c:\program files\Alwil Software\Avast5\snxPlugins.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TBPanel"="c:\program files\Vtune\TBPanel.exe" [2009-10-05 2158592] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-09-03 94208] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-10-11 14940040] "BitComet"="c:\program files\BitComet\BitComet.exe" [2010-11-11 10720048] "Fraps"="i:\programi\OPERACION CPU\FRAPS 2.9.9\FRAPS.EXE" [2009-08-29 1560304] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952] "UMonit"="c:\windows\system32\umonit.exe" [2004-05-11 53248] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "ProcessLassoManagementConsole"="c:\program files\Process Lasso\processlasso.exe" [2009-11-25 380944] "ProcessGovernor"="c:\program files\Process Lasso\processgovernor.exe" [2009-11-25 224784] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-10-16 110696] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-10-16 13851752] "nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-08-25 1753192] "RTHDCPL"="RTHDCPL.EXE" [2010-11-02 19580520] "avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoThumbnailCache"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB] 2001-12-20 21:34 24576 ----a-w- c:\program files\AlienGUIse\fastload.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\system32\wbsys.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0aswBoot.exe /M:daa9d2b3 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] 2008-04-14 10:42 1695232 --sh--w- c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] 2010-12-19 12:45 1242448 ----a-w- d:\games\steem\steam.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"= "c:\\Program Files\\BitComet\\BitComet.exe"= "c:\\Program Files\\Opera\\opera.exe"= "d:\\Games\\Dirt.2-RELOADED\\dirt2_game.exe"= "i:\\igri\\Resident.Evil.5-RELOADED\\RE5DX9.EXE"= "i:\\igri\\Resident.Evil.5-RELOADED\\RE5DX10.EXE"= "d:\\Games\\instal sungur\\Binaries\\Singularity.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\Program Files\\Ubisoft\\Ubisoft Game Launcher\\UbisoftGameLauncher.exe"= "i:\\igri\\CSS.v4044.2010\\CSS\\CSS\\50713369113018621019.exe"= "i:\\igri\\CSS.v4044.2010\\CSS\\CSS\\25032919931590986397.exe"= "i:\\igri\\CSS.v4044.2010\\CSS\\CSS\\42801320801076645286.exe"= "i:\\igri\\CSS.v4044.2010\\CSS\\CSS\\99172676769871204941.exe"= "i:\\igri\\CSS.v4044.2010\\CSS\\CSS\\71349043845667872354.exe"= "i:\\igri\\CSS.v4044.2010\\CSS\\CSS\\54077142487044110931.exe"= "i:\\igri\\CSS.v4044.2010\\CSS\\CSS\\30965914282127511176.exe"= "i:\\igri\\CSS.v4044.2010\\CSS\\CSS\\58370854779965968260.exe"= "i:\\igri\\CSS.v4044.2010\\CSS\\CSS\\45905386361334965549.exe"= "i:\\igri\\CSS.v4044.2010\\CSS\\CSS\\06130412184034184839.exe"= "i:\\igri\\CSS.v4044.2010\\CSS\\CSS\\51153284370391720033.exe"= "i:\\igri\\CSS.v4044.2010\\CSS\\CSS\\50450950672248940492.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "d:\\Games\\Pro.Evolution.Soccer.2011-RELOADED\\pes2011.exe"= "f:\\Igri\\Need.for.Speed.Hot.Pursuit\\Launcher.exe"= "f:\\Igri\\Apache.Air.Assault-RELOADED\\Apache Air Assault\\launcher.exe"= "f:\\Igri\\Apache.Air.Assault-RELOADED\\Apache Air Assault\\yuPlay\\yuPlay.exe"= "i:\\igri\\CSS.v4044.2010\\CSS\\CSS\\02652641243095927871.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26901:TCP"= 26901:TCP:BitComet 26901 TCP "26901:UDP"= 26901:UDP:BitComet 26901 UDP "9951:TCP"= 9951:TCP:BitComet 9951 TCP "9951:UDP"= 9951:UDP:BitComet 9951 UDP "18850:TCP"= 18850:TCP:BitComet 18850 TCP "18850:UDP"= 18850:UDP:BitComet 18850 UDP "24704:TCP"= 24704:TCP:BitComet 24704 TCP "24704:UDP"= 24704:UDP:BitComet 24704 UDP "9759:TCP"= 9759:TCP:BitComet 9759 TCP "9759:UDP"= 9759:UDP:BitComet 9759 UDP R0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\drivers\aswNdis.sys [30.12.2010 г. 19:23 12112] R0 aswNdis2;avast! Firewall Core Firewall Service;c:\windows\system32\drivers\aswNdis2.sys [30.12.2010 г. 19:23 190416] R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:\windows\system32\drivers\sfsync03.sys [06.12.2005 г. 17:11 35328] R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [21.4.2010 г. 02:33 691696] R1 aswFW;avast! TDI Firewall driver;c:\windows\system32\drivers\aswFW.sys [30.12.2010 г. 19:24 99792] R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [30.12.2010 г. 19:24 340048] R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [30.12.2010 г. 19:24 165584] R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [22.4.2010 г. 08:11 13696] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [30.12.2010 г. 19:24 17744] R3 fixustor;fixustor;c:\windows\system32\drivers\fixustor.sys [02.5.2010 г. 21:57 6656] S2 avast! Firewall;avast! Firewall;c:\program files\Alwil Software\Avast5\afwServ.exe [30.12.2010 г. 19:23 119200] S2 gupdate;Услуга Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [22.4.2010 г. 07:45 135664] S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [14.11.2010 г. 19:07 1691480] S3 FT39C1;FT39C1 Filter; [x] S3 GarenaPEngine;GarenaPEngine; [x] S3 HidNt;FT33C2 Driver for Input Devices; [x] S3 Mac606;FT33C2 FILTER; [x] S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?] S3 RGService;RGService;c:\program files\RadioGet\RGService.exe [09.10.2010 г. 17:29 348160] --- Other Services/Drivers In Memory --- *NewlyCreated* - KLMDB *Deregistered* - klmdb . Contents of the 'Scheduled Tasks' folder 2010-12-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-04-22 05:45] 2010-12-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-04-22 05:45] 2010-12-30 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job - c:\program files\Ask.com\UpdateTask.exe [2010-09-28 20:44] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.garena.com/ uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: &С&валяне &с BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm IE: &С&валяне на всички с BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html . - - - - ORPHANS REMOVED - - - - SafeBoot-klmdb.sys ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-12-31 00:25 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run UMonit = c:\windows\system32\umonit.exe?r.sys?d_18???Pid_0165????????6&PID27C8???B\?O??????????????????????????A~??????????????v?l??? ??|`??|????]??|??D~????????????F$?|??B~??B~*?,???????????????????????????????????B~??????????????v?????T???~?v???????v???v???????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-746137067-1336601894-1177238915-500\Software\Microsoft\SystemCertificates\AddressBook*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) [HKEY_USERS\S-1-5-21-746137067-1336601894-1177238915-500\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID] @Denied: (Full) (LocalSystem) [HKEY_USERS\S-1-5-21-746137067-1336601894-1177238915-500\Software\SecuROM\License information*] "datasecu"=hex:78,2a,0a,b2,b9,ef,42,5b,b6,5a,f1,10,c1,26,12,72,7b,b7,85,34,43, d3,87,3a,67,46,67,fb,64,76,e7,69,20,13,22,0c,1a,85,91,51,5d,33,d0,bf,6a,2c,\ "rkeysecu"=hex:18,3e,bf,91,84,20,e0,18,76,fa,8c,aa,40,5b,62,7b . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(872) c:\program files\AlienGUIse\fastload.dll . Completion time: 2010-12-31 00:26:32 ComboFix-quarantined-files.txt 2010-12-30 22:26 Pre-Run: 9 128 833 024 bytes free Post-Run: 9 191 174 144 bytes free - - End Of File - - DB39CE2702D526631323EF6A85F0779A

Утре ще продължим. Ще може ли още два лога, те са лесни:

Стъпка 1

Следвайте следната инструкция за работа с Security Check:

• Изтеглете Security Check (автор: screen317) от тук или от тук и го запишете на десктопа.
• Кликнете два пъти върху SecurityCheck.exe и следвайте инструкциите.
• Когато програмата завърши работата си, ще се отвори един текстов документ: checkup.txt.
• Копирайте съдържанието с Копирай (Copy) на checkup.txt и с Постави (Paste) го поставете в следващия си коментар.

Стъпка 2

• Следвайте следната инструкция за работа с MBRCheck
• Изтеглете: MBRCheck.exe на вашия десктоп.
• Спрете временно антивирусната си програма
• Стартирайте MBRCheck.exe (за Vista и Windows 7 ще трябва да потвърдите през UAC)
• След това на десктопа ще се появи черен прозорец
• Ако има намерен непознат бууткод (bootcode), ще се появят няколко опции. Не ги използвайте! Само натиснете N, след това ENTER два пъти.
• Ако няма проблеми, само натиснете ENTER
• Ще се генерира текстов файл - MBRCheck_mm.dd.yy_hh.mm.ss на вашия десктоп (тук mm е месец, dd - ден, yyyy - година, hh - час, mm - минута и ss - секунда). Oтворете този файл, маркирайте и копирайте с десен клик Copy (Копирай или Ctrl+С) изцяло текста, който се съдържа в него. Публикувайте копирания текст с Paste (Постави) в следващия си коментар.

Ето 1:

Results of screen317's Security Check version 0.99.8

Windows XP Service Pack 3

Internet Explorer 6 Out of date!

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Disabled!

avast! Internet Security

Antivirus up to date!

```````````````````````````````

Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware

Wise Disk Cleaner Professional v5.43

Java 6 Update 21

Out of date Java installed!

Adobe Flash Player 10.0.32.18

Adobe Reader 9.4.1

Out of date Adobe Reader installed!

````````````````````````````````

Process Check:

objlist.exe by Laurent

Alwil Software Avast5 afwServ.exe

Alwil Software Avast5 AvastSvc.exe

Alwil Software Avast5 avastUI.exe

``````````End of Log````````````

Ето и 2:

MBRCheck, version 1.2.3

© 2010, AD

Command-line:

Windows Version: Windows XP Professional

Windows Information: Service Pack 3 (build 2600)

Logical Drives Mask: 0x0000c3fd

Kernel Drivers (total 135):

0x804D7000 \WINDOWS\system32\ntkrnlpa.exe

0x806E4000 \WINDOWS\system32\hal.dll

0xB85A8000 \WINDOWS\system32\KDCOM.DLL

0xB84B8000 \WINDOWS\system32\BOOTVID.dll

0xB7EB4000 spyw.sys

0xB85AA000 \WINDOWS\System32\Drivers\WMILIB.SYS

0xB7E9C000 \WINDOWS\System32\Drivers\SCSIPORT.SYS

0xB7E6E000 ACPI.sys

0xB7E5D000 pci.sys

0xB80A8000 isapnp.sys

0xB8670000 pciide.sys

0xB8328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS

0xB80B8000 MountMgr.sys

0xB7E3E000 ftdisk.sys

0xB85AC000 dmload.sys

0xB7E18000 dmio.sys

0xB8330000 PartMgr.sys

0xB8338000 sfsync02.sys

0xB80C8000 sfsync03.sys

0xB80D8000 VolSnap.sys

0xB7E00000 atapi.sys

0xB80E8000 disk.sys

0xB80F8000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS

0xB7DE0000 fltMgr.sys

0xB7DCE000 sr.sys

0xB7DB7000 KSecDD.sys

0xB7D2A000 Ntfs.sys

0xB7CFD000 NDIS.sys

0xB7CD0000 aswNdis2.sys

0xB85AE000 aswNdis.sys

0xB8340000 sfhlp02.sys

0xB7CBE000 sfdrv01.sys

0xB7CA4000 Mup.sys

0xB8138000 \SystemRoot\system32\DRIVERS\intelppm.sys

0xB732E000 \SystemRoot\system32\DRIVERS\nv4_mini.sys

0xB731A000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS

0xB72F2000 \SystemRoot\system32\DRIVERS\HDAudBus.sys

0xB8390000 \SystemRoot\system32\DRIVERS\usbuhci.sys

0xB72CE000 \SystemRoot\system32\DRIVERS\USBPORT.SYS

0xB8398000 \SystemRoot\system32\DRIVERS\usbehci.sys

0xB72B9000 \SystemRoot\system32\DRIVERS\Rtnicxp.sys

0xB83B0000 \SystemRoot\system32\DRIVERS\fdc.sys

0xB8148000 \SystemRoot\system32\DRIVERS\serial.sys

0xB8560000 \SystemRoot\system32\DRIVERS\serenum.sys

0xB727D000 \SystemRoot\system32\DRIVERS\parport.sys

0xB8158000 \SystemRoot\system32\DRIVERS\imapi.sys

0xB8168000 \SystemRoot\system32\DRIVERS\cdrom.sys

0xB8178000 \SystemRoot\system32\DRIVERS\redbook.sys

0xB725A000 \SystemRoot\system32\DRIVERS\ks.sys

0xB87F2000 \SystemRoot\system32\DRIVERS\audstub.sys

0xB8188000 \SystemRoot\system32\DRIVERS\rasl2tp.sys

0xB8578000 \SystemRoot\system32\DRIVERS\ndistapi.sys

0xB7243000 \SystemRoot\system32\DRIVERS\ndiswan.sys

0xB8198000 \SystemRoot\system32\DRIVERS\raspppoe.sys

0xB81A8000 \SystemRoot\system32\DRIVERS\raspptp.sys

0xB83D8000 \SystemRoot\system32\DRIVERS\TDI.SYS

0xB7232000 \SystemRoot\system32\DRIVERS\psched.sys

0xB81B8000 \SystemRoot\system32\DRIVERS\msgpc.sys

0xB83E8000 \SystemRoot\system32\DRIVERS\ptilink.sys

0xB83F8000 \SystemRoot\system32\DRIVERS\raspti.sys

0xB7202000 \SystemRoot\system32\DRIVERS\rdpdr.sys

0xB81C8000 \SystemRoot\system32\DRIVERS\termdd.sys

0xB8408000 \SystemRoot\system32\DRIVERS\kbdclass.sys

0xB8410000 \SystemRoot\system32\DRIVERS\mouclass.sys

0xB85B6000 \SystemRoot\system32\DRIVERS\swenum.sys

0xB71A4000 \SystemRoot\system32\DRIVERS\update.sys

0xB8598000 \SystemRoot\system32\DRIVERS\mssmbios.sys

0xB81E8000 \SystemRoot\System32\Drivers\NDProxy.SYS

0xB4A56000 \SystemRoot\system32\drivers\RtkHDAud.sys

0xB4A32000 \SystemRoot\system32\drivers\portcls.sys

0xB81F8000 \SystemRoot\system32\drivers\drmk.sys

0xB8208000 \SystemRoot\system32\DRIVERS\usbhub.sys

0xB85C0000 \SystemRoot\system32\DRIVERS\USBD.SYS

0xB8438000 \SystemRoot\system32\DRIVERS\flpydisk.sys

0xB85C4000 \SystemRoot\System32\Drivers\Fs_Rec.SYS

0xB86E6000 \SystemRoot\System32\Drivers\Null.SYS

0xB85C8000 \SystemRoot\System32\Drivers\Beep.SYS

0xB8460000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS

0xB8468000 \SystemRoot\system32\DRIVERS\Amfilter.sys

0xB8470000 \SystemRoot\System32\drivers\vga.sys

0xB85CC000 \SystemRoot\System32\Drivers\mnmdd.SYS

0xB85D0000 \SystemRoot\System32\DRIVERS\RDPCDD.sys

0xB8480000 \SystemRoot\System32\Drivers\Msfs.SYS

0xB8490000 \SystemRoot\System32\Drivers\Npfs.SYS

0xB8580000 \SystemRoot\system32\DRIVERS\rasacd.sys

0xB490F000 \SystemRoot\system32\DRIVERS\ipsec.sys

0xB48B6000 \SystemRoot\system32\DRIVERS\tcpip.sys

0xB489F000 \SystemRoot\System32\Drivers\aswFW.SYS

0xB4879000 \SystemRoot\system32\DRIVERS\ipnat.sys

0xB8238000 \SystemRoot\system32\DRIVERS\wanarp.sys

0xB8248000 \SystemRoot\System32\Drivers\aswTdi.SYS

0xB4851000 \SystemRoot\system32\DRIVERS\netbt.sys

0xB482F000 \SystemRoot\System32\drivers\afd.sys

0xB8258000 \SystemRoot\system32\DRIVERS\netbios.sys

0xB4804000 \SystemRoot\system32\DRIVERS\rdbss.sys

0xB4794000 \SystemRoot\system32\DRIVERS\mrxsmb.sys

0xB8268000 \SystemRoot\System32\Drivers\Fips.SYS

0xB5080000 \??\C:\WINDOWS\system32\drivers\BIOS.sys

0xB4745000 \SystemRoot\System32\Drivers\aswSP.SYS

0xB46EC000 \SystemRoot\System32\Drivers\aswSnx.SYS

0xB8380000 \SystemRoot\System32\Drivers\Aavmker4.SYS

0xB85DA000 \SystemRoot\system32\drivers\fixustor.sys

0xB83A8000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS

0xB45C7000 \SystemRoot\system32\DRIVERS\hidusb.sys

0xB8298000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS

0xB83B8000 \SystemRoot\system32\DRIVERS\usbccgp.sys

0xB45C3000 \SystemRoot\system32\DRIVERS\mouhid.sys

0xB45BF000 \SystemRoot\system32\DRIVERS\kbdhid.sys

0xB82A8000 \SystemRoot\System32\Drivers\Cdfs.SYS

0xB458F000 \SystemRoot\System32\Drivers\dump_atapi.sys

0xB85DC000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS

0xBF800000 \SystemRoot\System32\win32k.sys

0xB45A7000 \SystemRoot\System32\drivers\Dxapi.sys

0xB83C8000 \SystemRoot\System32\watchdog.sys

0xBD000000 \SystemRoot\System32\drivers\dxg.sys

0xB87A4000 \SystemRoot\System32\drivers\dxgthk.sys

0xBD012000 \SystemRoot\System32\nv4_disp.dll

0xBFFA0000 \SystemRoot\System32\ATMFD.DLL

0xB4966000 \SystemRoot\System32\Drivers\aswFsBlk.SYS

0xB3961000 \SystemRoot\system32\DRIVERS\ndisuio.sys

0xB363A000 \SystemRoot\System32\Drivers\aswMon2.SYS

0xB2987000 \SystemRoot\system32\drivers\wdmaud.sys

0xB2AFC000 \SystemRoot\system32\drivers\sysaudio.sys

0xB2939000 \SystemRoot\system32\drivers\kmixer.sys

0xB25EA000 \SystemRoot\system32\DRIVERS\mrxdav.sys

0xB85E0000 \SystemRoot\System32\Drivers\ParVdm.SYS

0xB85EC000 \SystemRoot\System32\Drivers\TBPanel.SYS

0xB257F000 \SystemRoot\system32\DRIVERS\atksgt.sys

0xB85F6000 \??\C:\Program Files\Quintessential Media Player\cdrpdacc.sys

0xB84A0000 \SystemRoot\system32\DRIVERS\lirsgt.sys

0xB248D000 \SystemRoot\system32\DRIVERS\srv.sys

0xB221C000 \SystemRoot\System32\Drivers\HTTP.sys

0xB8450000 \SystemRoot\System32\Drivers\aswRdr.SYS

0xB860E000 \SystemRoot\system32\drivers\splitter.sys

0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 33):

0 System Idle Process

4 System

784 C:\WINDOWS\system32\smss.exe

848 csrss.exe

872 C:\WINDOWS\system32\winlogon.exe

916 C:\WINDOWS\system32\services.exe

928 C:\WINDOWS\system32\lsass.exe

1104 C:\WINDOWS\system32\nvsvc32.exe

1172 C:\WINDOWS\system32\svchost.exe

1236 svchost.exe

1332 C:\WINDOWS\system32\svchost.exe

1416 svchost.exe

1528 svchost.exe

1716 C:\Program Files\AlienGUIse\wbload.exe

1840 C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

1956 C:\WINDOWS\explorer.exe

484 C:\WINDOWS\system32\spoolsv.exe

604 C:\WINDOWS\system32\umonit.exe

824 C:\Program Files\Common Files\Java\Java Update\jusched.exe

1428 C:\WINDOWS\system32\rundll32.exe

1508 svchost.exe

1740 C:\WINDOWS\RTHDCPL.EXE

1732 C:\Program Files\Java\jre6\bin\jqs.exe

1892 C:\Program Files\Alwil Software\Avast5\AvastUI.exe

2176 C:\Program Files\Vtune\TBPANEL.exe

2232 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

2280 C:\Program Files\Skype\Phone\Skype.exe

2488 I:\programi\operacion CPU\Fraps 2.9.9\fraps.exe

3664 alg.exe

3668 C:\WINDOWS\system32\wscntfy.exe

1684 C:\Program Files\Skype\Plugin Manager\skypePM.exe

3008 C:\Program Files\Opera\opera.exe

636 C:\Documents and Settings\Administrator\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000004`e22d6a00 (NTFS)

\\.\E: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS)

\\.\F: --> \\.\PhysicalDrive1 at offset 0x00000002`7116f400 (NTFS)

\\.\I: --> \\.\PhysicalDrive0 at offset 0x0000001f`ff588800 (NTFS)

PhysicalDrive0 Model Number: HitachiHDT725025VLA380, Rev: V5DOA7EA

PhysicalDrive1 Model Number: SAMSUNGHD160JJ, Rev: ZM100-47

Size Device Name MBR Status

--------------------------------------------

232 GB \\.\PhysicalDrive0 Windows XP MBR code detected

SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A

149 GB \\.\PhysicalDrive1 Windows XP MBR code detected

SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A

Done!

Редактирано 30 декември 201015 г. от Generalisimos (преглед на промените)

Сега изтеглете The Avenger и го разархивирайте на десктопа. Стартирайте avenger.exe, копирайте следния текст и го поставете в текстовото поле на програмата:

Drivers to delete:
klmdb

Registry keys to delete:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\klmdb.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\klmdb.sys

Files to delete:
C:\WINDOWS\system32\drivers\klmdb.sys

Уверете се, че Scan for rootkits и Automatically disable any rootkits found имат отметки.

След това изберете Execute и при въпрос от страна на програмата, кликнете върху Yes, при което компютъра ще се рестартира. След рестартта копирайте и поставете съдържанието на лог файла от програмата, намиращ се в C:\avenger.txt в следващия си коментар в тази тема.

P.S. Ако The Avenger има проблем с антивирусната програма, изключете я временно.

Logfile of The Avenger Version 2.0, © by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\klmdb" not found! Deletion of driver "klmdb" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Error: registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\klmdb.sys" not found! Deletion of registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\klmdb.sys" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Error: registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\klmdb.sys" not found! Deletion of registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\klmdb.sys" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist File "C:\WINDOWS\system32\drivers\klmdb.sys" deleted successfully. Completed script processing. ******************* Finished! Terminate.

Дотук добре. Ще трябва да проверим дали има някакви остатъци. Затова следвайте следната инструкция за работа с DDS:

• Стартирайте DDS с двоен клик на иконката, като потвърдите с Run.
• След приключване на работата на DDS копирайте с Copy текста от двата файлови лога, които ще се появят в Notepad: DDS.txt и Attach.txt и ги запазете (бутон Save -> Save as) на десктопа. После прикачете двата лога към следващия си коментар по темата (погледнете опцията "прикачени файлове", когато публикувате мнение).

P.S. Пускам DDS, понеже логовете стават бързо и лесно.

Редактирано 31 декември 201015 г. от nologo (преглед на промените)

Ето ги !

Добре, сега пуснете бързо сканиране с MBAM, за да видим дали има нещо останало. Ето как:

• Стартирайте Malwarebytes' Anti-Malware и изберете Perform Quick Scan, след това кликнете на Scan.
• Сканирането ще отнеме малко време, затова моля бъдете търпеливи.
• Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.
• Уверете се, че на всички редове има отметки, и кликнете Remove Selected.
• Когато всичко бъде премахнато, логът ще бъде отворен в Notepad. Копирайте лога и го публикувайте в следващия си коментар в темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 5422 Windows 5.1.2600 Service Pack 3 Internet Explorer 6.0.2900.5512 31.12.2010 г. 13:34:53 mbam-log-2010-12-31 (13-34-53).txt Scan type: Quick scan Objects scanned: 127119 Time elapsed: 55 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

Много добре. Сега има ли някакви оплаквания от Windows?

За сега няма много съм благодарен за отделеното време. И мога да пожелая здраве,щастие късмет през новата година и весело посрещане !!!

Супер! Следва почистване на програмите, които използвахме досега, както и обновяване на Java RE и Adobe Reader:

Стъпка 1

Деинсталирайте ComboFix: Start -> Run -> поставете с Copy/ Paste следния текст, маркиран в синьо: ComboFix /Uninstall

натиснете Enter.

Стъпка 2

Изтеглете OTС.exe от тук и го стартирайте. Така ще бъдат почистени инструменти и файлове, които използвахме в темата. Когато OTС.exe завърши почистването, натиснете Yes за рестарт на Windows. Ако има останали инструменти и логове, почистете и тях.

Стъпка 3

1. Инсталирайте последната версия: Java SE Runtime Environment 6 Update 23 x86.

2. Обновете Adobe Reader до последната версия, ето линк. След обновяването стартирайте Adobe Reader и се съгласете с условията за използване.

Маркирам проблема като решен. Весели празници и успех!