Facebook вирусът --> Enhаnced Protection Mode на антивирусната

29 юли 201115 г.

Пробвайте така: http://www.kaldata.com/forums/index.php?showtopic=181613&view=findpost&p=2039117

29 юли 201115 г.

Автор

~~По време на инсталацията излезе прозорец да се регистрирам като потребител на Avirа. Не се регистрирам, нали.~~

Така, не се регистрирах, инсталацията завърши, чадърчето се отвори. Ще наглася отново настройките на Avira и ще го пусна пак да сканира. Новия доклад от сканиранито ще желаеш ли да видиш ?

Редактирано 29 юли 201115 г. от vratarqt (преглед на промените)

29 юли 201115 г.

Ами може, да. PS: Преди проверката не забравяйте да обновите дефинииците.

29 юли 201115 г.

Автор

Обнових дефинициите, да, ето го и доклада : Avira AntiVir Personal Report file date: 29 Юли 2011 г. 13:45 Scanning for 3304681 virus strains and unwanted programs. The program is running as an unrestricted full version. Online services are available: Licensee : Avira AntiVir Personal - Free Antivirus Serial number : 0000149996-ADJIE-0000001 Platform : Windows XP Windows version : (Service Pack 3) [5.1.2600] Boot mode : Normally booted Username : SYSTEM Computer name : VLADO Version information: BUILD.DAT : 10.2.0.696 35934 Bytes 29.6.2011 г. 17:32:00 AVSCAN.EXE : 10.3.0.7 484008 Bytes 29.7.2011 г. 10:19:19 AVSCAN.DLL : 10.0.5.0 47464 Bytes 29.7.2011 г. 10:19:19 LUKE.DLL : 10.3.0.5 45416 Bytes 29.7.2011 г. 10:19:19 LUKERES.DLL : 10.0.0.1 12648 Bytes 10.2.2010 г. 21:40:49 AVSCPLR.DLL : 10.3.0.7 119656 Bytes 29.7.2011 г. 10:19:19 AVREG.DLL : 10.3.0.9 88833 Bytes 29.7.2011 г. 10:19:19 VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 г. 07:05:36 VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 г. 04:53:55 VBASE002.VDF : 7.11.3.0 1950720 Bytes 09.2.2011 г. 04:53:56 VBASE003.VDF : 7.11.5.225 1980416 Bytes 07.4.2011 г. 08:30:38 VBASE004.VDF : 7.11.8.178 2354176 Bytes 31.5.2011 г. 08:30:40 VBASE005.VDF : 7.11.10.251 1788416 Bytes 07.7.2011 г. 08:30:41 VBASE006.VDF : 7.11.10.252 2048 Bytes 07.7.2011 г. 08:30:41 VBASE007.VDF : 7.11.10.253 2048 Bytes 07.7.2011 г. 08:30:41 VBASE008.VDF : 7.11.10.254 2048 Bytes 07.7.2011 г. 08:30:41 VBASE009.VDF : 7.11.10.255 2048 Bytes 07.7.2011 г. 08:30:41 VBASE010.VDF : 7.11.11.0 2048 Bytes 07.7.2011 г. 08:30:41 VBASE011.VDF : 7.11.11.1 2048 Bytes 07.7.2011 г. 08:30:41 VBASE012.VDF : 7.11.11.2 2048 Bytes 07.7.2011 г. 08:30:41 VBASE013.VDF : 7.11.11.75 688128 Bytes 12.7.2011 г. 08:30:41 VBASE014.VDF : 7.11.11.104 978944 Bytes 13.7.2011 г. 08:30:42 VBASE015.VDF : 7.11.11.137 655360 Bytes 14.7.2011 г. 08:30:42 VBASE016.VDF : 7.11.11.184 699392 Bytes 18.7.2011 г. 09:56:59 VBASE017.VDF : 7.11.11.214 414208 Bytes 19.7.2011 г. 09:57:08 VBASE018.VDF : 7.11.11.242 772096 Bytes 20.7.2011 г. 09:57:28 VBASE019.VDF : 7.11.12.3 1291776 Bytes 20.7.2011 г. 09:58:03 VBASE020.VDF : 7.11.12.30 844288 Bytes 21.7.2011 г. 09:58:24 VBASE021.VDF : 7.11.12.67 149504 Bytes 24.7.2011 г. 09:58:28 VBASE022.VDF : 7.11.12.93 195072 Bytes 25.7.2011 г. 09:58:32 VBASE023.VDF : 7.11.12.113 150528 Bytes 26.7.2011 г. 09:58:36 VBASE024.VDF : 7.11.12.152 182784 Bytes 28.7.2011 г. 09:58:41 VBASE025.VDF : 7.11.12.153 2048 Bytes 28.7.2011 г. 09:58:41 VBASE026.VDF : 7.11.12.154 2048 Bytes 28.7.2011 г. 09:58:41 VBASE027.VDF : 7.11.12.155 2048 Bytes 28.7.2011 г. 09:58:41 VBASE028.VDF : 7.11.12.156 2048 Bytes 28.7.2011 г. 09:58:41 VBASE029.VDF : 7.11.12.157 2048 Bytes 28.7.2011 г. 09:58:42 VBASE030.VDF : 7.11.12.158 2048 Bytes 28.7.2011 г. 09:58:42 VBASE031.VDF : 7.11.12.165 25600 Bytes 29.7.2011 г. 10:19:18 Engineversion : 8.2.6.22 AEVDF.DLL : 8.1.2.1 106868 Bytes 21.4.2011 г. 04:53:28 AESCRIPT.DLL : 8.1.3.73 1622395 Bytes 20.7.2011 г. 08:29:56 AESCN.DLL : 8.1.7.2 127349 Bytes 21.4.2011 г. 04:53:27 AESBX.DLL : 8.2.1.34 323957 Bytes 20.7.2011 г. 08:29:54 AERDL.DLL : 8.1.9.13 639349 Bytes 20.7.2011 г. 08:29:53 AEPACK.DLL : 8.2.9.5 676214 Bytes 20.7.2011 г. 08:29:53 AEOFFICE.DLL : 8.1.2.13 201083 Bytes 29.7.2011 г. 09:59:32 AEHEUR.DLL : 8.1.2.148 3576184 Bytes 29.7.2011 г. 09:59:30 AEHELP.DLL : 8.1.17.7 254327 Bytes 29.7.2011 г. 09:58:45 AEGEN.DLL : 8.1.5.6 401780 Bytes 20.7.2011 г. 08:29:43 AEEMU.DLL : 8.1.3.0 393589 Bytes 21.4.2011 г. 04:53:14 AECORE.DLL : 8.1.22.4 196983 Bytes 20.7.2011 г. 08:29:42 AEBB.DLL : 8.1.1.0 53618 Bytes 21.4.2011 г. 04:53:14 AVWINLL.DLL : 10.0.0.0 19304 Bytes 21.4.2011 г. 04:53:36 AVPREF.DLL : 10.0.3.2 44904 Bytes 29.7.2011 г. 10:19:19 AVREP.DLL : 10.0.0.10 174120 Bytes 29.7.2011 г. 10:19:19 AVARKT.DLL : 10.0.26.1 255336 Bytes 29.7.2011 г. 10:19:18 AVEVTLOG.DLL : 10.0.0.9 203112 Bytes 29.7.2011 г. 10:19:18 SQLITE3.DLL : 3.6.19.0 355688 Bytes 20.7.2011 г. 13:40:24 AVSMTP.DLL : 10.0.0.17 63848 Bytes 21.4.2011 г. 04:53:36 NETNT.DLL : 10.0.0.0 11624 Bytes 21.4.2011 г. 04:53:46 RCIMAGE.DLL : 10.0.0.35 2589544 Bytes 29.7.2011 г. 10:19:18 RCTEXT.DLL : 10.0.64.0 97640 Bytes 29.7.2011 г. 10:19:18 Configuration settings for the scan: Jobname.............................: Complete system scan Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp Logging.............................: Default Primary action......................: delete Secondary action....................: ignore Scan master boot sector.............: on Scan boot sector....................: on Boot sectors........................: C:, D:, E:, Process scan........................: on Extended process scan...............: on Scan registry.......................: on Search for rootkits.................: on Integrity checking of system files..: off Scan all files......................: All files Scan archives.......................: on Recursion depth.....................: 20 Smart extensions....................: on Macro heuristic.....................: on File heuristic......................: Advanced Deviating risk categories...........: +APPL,+GAME,+JOKE,+PCK,+PFS,+SPR, Start of the scan: 29 Юли 2011 г. 13:45 Starting search for hidden objects. HKEY_USERS\S-1-5-21-602162358-813497703-839522115-1003\Software\Microsoft\Protected Storage System Provider\S-1-5-21-602162358-813497703-839522115-1003\data [NOTE] The registry entry is invisible. The scan of running processes will be started Scan process 'avscan.exe' - '68' Module(s) have been scanned Scan process 'avcenter.exe' - '99' Module(s) have been scanned Scan process 'dllhost.exe' - '48' Module(s) have been scanned Scan process 'dllhost.exe' - '41' Module(s) have been scanned Scan process 'vssvc.exe' - '35' Module(s) have been scanned Scan process 'avgnt.exe' - '53' Module(s) have been scanned Scan process 'AVWEBGRD.EXE' - '39' Module(s) have been scanned Scan process 'sched.exe' - '51' Module(s) have been scanned Scan process 'avshadow.exe' - '25' Module(s) have been scanned Scan process 'avguard.exe' - '60' Module(s) have been scanned Scan process 'taskmgr.exe' - '38' Module(s) have been scanned Scan process 'alg.exe' - '32' Module(s) have been scanned Scan process 'wscntfy.exe' - '24' Module(s) have been scanned Scan process 'CALMAIN.exe' - '26' Module(s) have been scanned Scan process 'UAService7.exe' - '6' Module(s) have been scanned Scan process 'ULCDRSvr.exe' - '6' Module(s) have been scanned Scan process 'svchost.exe' - '38' Module(s) have been scanned Scan process 'svchost.exe' - '35' Module(s) have been scanned Scan process 'nvsvc32.exe' - '35' Module(s) have been scanned Scan process 'mdm.exe' - '20' Module(s) have been scanned Scan process 'jqs.exe' - '32' Module(s) have been scanned Scan process 'DevSvc.exe' - '43' Module(s) have been scanned Scan process 'CDAC11BA.EXE' - '8' Module(s) have been scanned Scan process 'ASCService.exe' - '34' Module(s) have been scanned Scan process 'PMonitor.exe' - '72' Module(s) have been scanned Scan process 'rundll32.exe' - '35' Module(s) have been scanned Scan process 'ctfmon.exe' - '23' Module(s) have been scanned Scan process 'jusched.exe' - '20' Module(s) have been scanned Scan process 'SOUNDMAN.EXE' - '30' Module(s) have been scanned Scan process 'spoolsv.exe' - '54' Module(s) have been scanned Scan process 'Explorer.EXE' - '96' Module(s) have been scanned Scan process 'svchost.exe' - '32' Module(s) have been scanned Scan process 'svchost.exe' - '157' Module(s) have been scanned Scan process 'svchost.exe' - '37' Module(s) have been scanned Scan process 'svchost.exe' - '50' Module(s) have been scanned Scan process 'lsass.exe' - '50' Module(s) have been scanned Scan process 'services.exe' - '26' Module(s) have been scanned Scan process 'winlogon.exe' - '65' Module(s) have been scanned Scan process 'csrss.exe' - '12' Module(s) have been scanned Scan process 'smss.exe' - '2' Module(s) have been scanned Starting master boot sector scan: Master boot sector HD0 [iNFO] No virus was found! Start scanning boot sectors: Boot sector 'C:\' [iNFO] No virus was found! Boot sector 'D:\' [iNFO] No virus was found! Boot sector 'E:\' [iNFO] No virus was found! Starting to scan executable files (registry). The registry was scanned ( '532' files ). Starting the file scan: Begin scan in 'C:\' C:\Documents and Settings\Vlado Kurtev\Application Data\Oxin's Style!\3DSeXVilla Crack 30.001\install\3DSex1.cab [0] Archive type: CAB (Microsoft) --> fc3DSexVillaRun.exe [DETECTION] Is the TR/Gendal.dx.255 Trojan The registration entry <HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore\DisableSR> was successfully repaired. [NOTE] A backup was created as '4d870f2c.qua' ( QUARANTINE ) [NOTE] The file was deleted! Begin scan in 'D:\' <NEW VOLUME> D:\new\medal of honor\Medal_Of_Honour_NOCD.ace [0] Archive type: ACE --> MOHAA.exe [WARNING] Insufficient memory. The file was not scanned. D:\System Volume Information\_restore{5E86EB6D-957F-44BF-BF31-3D0EC3A9B4C5}\RP546\A0126402.exe [DETECTION] This file has been compressed using unusual runtime compression (PCK/PESpin). Please verify the origin of this file. [NOTE] A backup was created as '55f62787.qua' ( QUARANTINE ) [NOTE] The file was deleted! Begin scan in 'E:\' <Локален диск> E:\System Volume Information\_restore{4CBF801A-AF24-4288-9815-8CFDA075CDEA}\RP332\A0083680.exe [DETECTION] Is the TR/Agent.5120.182 Trojan [NOTE] A backup was created as '07a84016.qua' ( QUARANTINE ) [NOTE] The file was deleted! End of the scan: 29 Юли 2011 г. 15:18 Used time: 1:32:30 Hour(s) The scan has been done completely. 9216 Scanned directories 387673 Files were scanned 3 Viruses and/or unwanted programs were found 0 Files were classified as suspicious 3 files were deleted 0 Viruses and unwanted programs were repaired 3 Files were moved to quarantine 0 Files were renamed 0 Files cannot be scanned 387670 Files not concerned 3099 Archives were scanned 1 Warnings 4 Notes 518763 Objects were scanned with rootkit scan 1 Hidden objects were found

29 юли 201115 г.

Супер, как е сега положението ?

Бтв ето ги и двете финални проверки които държа да направим:

СТЪПКА 1

Следвайте следната инструкция за работа с Rootkit UnHooker:

Изтеглете този файл на десктопа.
Разархивирайте архива и стартирайте RkU3.8.388.590.exe, отидете на Report и сложете всички отметки. Натиснете OK.
Изчакайте програмата да завърши работа. След това кликнете на File, после Save Report. Запазете (Save as) файла с име report.txt на десктопа.
Публикувайте съдържанието на файла report.txt в следващия си коментар.

СТЪПКА 2

Следвайте следната инструкция за работа с GMER:

Изтеглете този файл и го разархивирайте на десктопа.
Временно спрете Интернет и всички работещи програми, както и антивирусната си програма (ако има такава).
Преименувайте GMER.exe на Tool.exe и го стартирайте.

Забележки:
1. Сканирането може да доведе до грешки, затова не предприемайте никакви действия върху редовете маркирани с "<--- ROOKIT" без да имате инструкция за това.
2. Ако GMER не се стартира или не работи коректно, не предприемайте повторен опит за стартиране. Moже да пробвате и в Safe Mode, но само веднъж.
Ако бъде открит Rootkit, ще последва въпрос дали желаете пълно сканиране на системата. Изберете NO.
В десния панел на програмата ще видите какво е проверено, но не променяйте нищо. Убедете се, че на Show All няма отметка.
Маркирайте всички устройства: C:, D: и пр.
Натиснете бутона Scan и изчакайте програмата да завърши сканирането.
Когато завърши сканирането, натиснете бутона Save и запишете (save as) резултатите на десктопа с име: Results.log
Вече можете да включите Интернет.

29 юли 201115 г.

Автор

Здравей, изтеглих и инсталирах на декстопа Rootkit UnHooker. ~~Когато я пуснах и отидох на Report нямаше нищо за отмятане. Затова направо натискам Scan.~~ Моя грешка.

Така, Rootkit UnHooker приключи работа. Когато се появи питане за отметки, кои хард дискове да сканира , излезе това :

http://prikachi.com/images/685/3625685Y.png

Дадох ОК, програмата приключи работа, ето доклада : Въпрос : Отстрани в дясно на снимката , на Avira, да дам ли Remove ?

RkU Version: 3.8.388.590, Type LE (SR2)

==============================================

OS Name: Windows XP

Version 5.1.2600 (Service Pack 3)

Number of processors #1

==============================================

>SSDT State

==============================================

ntoskrnl.exe-->NtClose, Type: Address change 0x805678DD-->F7BACE14 [unknown module filename]

ntoskrnl.exe-->NtCreateKey, Type: Address change 0x8057065D-->F7BACDCE [unknown module filename]

ntoskrnl.exe-->NtCreateSection, Type: Address change 0x805652B3-->F7BACE1E [unknown module filename]

ntoskrnl.exe-->NtCreateThread, Type: Address change 0x8058E64B-->F7BACDC4 [unknown module filename]

ntoskrnl.exe-->NtDeleteKey, Type: Address change 0x805952CA-->F7BACDD3 [unknown module filename]

ntoskrnl.exe-->NtDeleteValueKey, Type: Address change 0x80592D5C-->F7BACDDD [unknown module filename]

ntoskrnl.exe-->NtDuplicateObject, Type: Address change 0x805715E0-->F7BACE0F [unknown module filename]

ntoskrnl.exe-->NtEnumerateKey, Type: Address change 0x80570D64-->F7442D48 [sptd.sys]

ntoskrnl.exe-->NtEnumerateValueKey, Type: Address change 0x80590677-->F74430C0 [sptd.sys]

ntoskrnl.exe-->NtLoadKey, Type: Address change 0x805AED6D-->F7BACDE2 [unknown module filename]

ntoskrnl.exe-->NtOpenKey, Type: Address change 0x80568D59-->F7442AE2 [sptd.sys]

ntoskrnl.exe-->NtOpenProcess, Type: Address change 0x805717C7-->F7BACDB0 [unknown module filename]

ntoskrnl.exe-->NtOpenThread, Type: Address change 0x8058A1C9-->F7BACDB5 [unknown module filename]

ntoskrnl.exe-->NtQueryKey, Type: Address change 0x80570A6D-->F744318A [sptd.sys]

ntoskrnl.exe-->NtQueryValueKey, Type: Address change 0x8056A1F2-->F7443022 [sptd.sys]

ntoskrnl.exe-->NtReplaceKey, Type: Address change 0x8064F0DC-->F7BACDEC [unknown module filename]

ntoskrnl.exe-->NtRestoreKey, Type: Address change 0x8064EC71-->F7BACDE7 [unknown module filename]

ntoskrnl.exe-->NtSetContextThread, Type: Address change 0x8062DD17-->F7BACE23 [unknown module filename]

ntoskrnl.exe-->NtSetValueKey, Type: Address change 0x80572889-->F7BACDD8 [unknown module filename]

ntoskrnl.exe-->NtTerminateProcess, Type: Address change 0x805822EC-->F7BACDBF [unknown module filename]

==============================================

>Shadow

==============================================

win32k.sys-->NtUserSetWindowsHookEx, Type: Address change 0xBF85277A-->F7BACE28 [unknown module filename]

win32k.sys-->NtUserSetWinEventHook, Type: Address change 0xBF8F0049-->F7BACE2D [unknown module filename]

==============================================

>Processes

==============================================

0x82FC87F8 [4] System

0x82CFC590 [352] C:\Program Files\IObit\Advanced SystemCare 4\PMonitor.exe (IObit, Advanced SystemCare Performance Monitor)

0x82B54648 [604] C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe (IObit, Advanced SystemCare Service)

0x82CEAC90 [664] C:\WINDOWS\system32\smss.exe (Microsoft Corporation, Windows NT Session Manager)

0x82C81DA0 [688] C:\WINDOWS\system32\drivers\CDAC11BA.EXE (Macrovision, Macrovision RTS Service)

0x82C50DA0 [700] C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe (InterVideo Inc., Capture Device Service)

0x82B44488 [720] C:\WINDOWS\system32\csrss.exe (Microsoft Corporation, Client Server Runtime Process)

0x82AE8390 [744] C:\WINDOWS\system32\winlogon.exe (Microsoft Corporation, Windows NT Logon Application)

0x82ABD620 [792] C:\WINDOWS\system32\services.exe (Microsoft Corporation, Services and Controller app)

0x82E10DA0 [804] C:\WINDOWS\system32\lsass.exe (Microsoft Corporation, LSA Shell (Export Version))

0x82B94A38 [912] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)

0x82E10500 [972] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)

0x82ACBDA0 [1032] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)

0x82B337B8 [1124] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)

0x82B78848 [1180] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)

0x82BF0988 [1216] C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc., Java Quick Starter Service)

0x82DB4558 [1236] C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe (Microsoft Corporation, Machine Debug Manager)

0x82E17A18 [1304] C:\WINDOWS\system32\nvsvc32.exe (NVIDIA Corporation, NVIDIA Driver Helper Service, Version 93.71)

0x82B5DBE0 [1556] C:\WINDOWS\explorer.exe (Microsoft Corporation, Windows Explorer)

0x82C44970 [1672] C:\WINDOWS\system32\spoolsv.exe (Microsoft Corporation, Spooler SubSystem App)

0x824E6BC0 [1776] C:\WINDOWS\system32\TuneUpDefragService.exe (TuneUp Software GmbH, TuneUp Drive Defrag Service)

0x827D4CB0 [1796] C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe (Avira GmbH, AntiVir WebGuard Service)

0x82BFD338 [1812] C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp., Realtek Sound Manager)

0x827B8B28 [1820] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc., Java Update Scheduler)

0x82AB6628 [1880] C:\WINDOWS\system32\dllhost.exe (Microsoft Corporation, COM Surrogate)

0x82BE9458 [1900] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation, CTF Loader)

0x82B904E0 [1908] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)

0x82BB4A38 [1932] C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc., ULCDRSvr)

0x82BFFDA0 [1948] C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH, Antivirus Scheduler)

0x82C33B80 [1952] C:\WINDOWS\system32\rundll32.exe (Microsoft Corporation, Run a DLL as an App)

0x82B8FBE0 [2056] C:\WINDOWS\system32\UAService7.exe

0x8238D090 [2216] C:\Documents and Settings\Vlado Kurtev\desktop\MustBeRandomlyNamed\eApOplTmLeOFldOVpc.exe (UG North, RKULE, SR2 Normandy)

0x82A915E8 [2460] C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc., Canon Camera Access Library 8)

0x82D0A578 [2536] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH, Antivirus System Tray Tool)

0x82AF4450 [2736] C:\WINDOWS\system32\wscntfy.exe (Microsoft Corporation, Windows Security Center Notification App)

0x82D0D818 [2788] C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH, Antivirus On-Access Service)

0x82CF8110 [2888] C:\WINDOWS\system32\dllhost.exe (Microsoft Corporation, COM Surrogate)

0x82C6B020 [2956] C:\WINDOWS\system32\alg.exe (Microsoft Corporation, Application Layer Gateway Service)

0x8276FAE8 [2964] C:\WINDOWS\system32\taskmgr.exe (Microsoft Corporation, Windows TaskManager)

0x827E4D08 [3268] C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH, AntiVir shadow copy service)

0x82770DA0 [3640] C:\WINDOWS\system32\vssvc.exe (Microsoft Corporation, Microsoft® Volume Shadow Copy Service)

0x827E1AC8 [3768] C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation, Firefox)

==============================================

>Drivers

==============================================

0xBF012000 C:\WINDOWS\System32\nv4_disp.dll 4530176 bytes (NVIDIA Corporation, NVIDIA Compatible Windows 2000 Display driver, Version 93.71 )

0xF5F4A000 C:\WINDOWS\system32\drivers\ALCXWDM.SYS 4124672 bytes (Realtek Semiconductor Corp., Realtek AC'97 Audio Driver (WDM))

0xF640A000 C:\WINDOWS\system32\DRIVERS\nv4_mini.sys 3997696 bytes (NVIDIA Corporation, NVIDIA Compatible Windows 2000 Miniport Driver, Version 93.71 )

0x804D7000 C:\WINDOWS\system32\ntoskrnl.exe 2189056 bytes (Microsoft Corporation, NT Kernel & System)

0x804D7000 PnpManager 2189056 bytes

0x804D7000 RAW 2189056 bytes

0x804D7000 WMIxWDM 2189056 bytes

0xBF800000 Win32k 1847296 bytes

0xBF800000 C:\WINDOWS\System32\win32k.sys 1847296 bytes (Microsoft Corporation, Multi-User Win32 Driver)

0xF743D000 00000052 856064 bytes

0xF743D000 sptd.sys 856064 bytes

0xF72C5000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)

0xF3DF9000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)

0xF50BA000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)

0xF3F06000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)

0xF63A4000 C:\WINDOWS\system32\drivers\ds1wdm.sys 335872 bytes (Yamaha Corp., Yamaha PCI(x) Audio System (WDM)[1013])

0xB94A9000 C:\WINDOWS\system32\DRIVERS\srv.sys 335872 bytes (Microsoft Corporation, Server driver)

0xF5F00000 C:\WINDOWS\System32\Drivers\dtscsi.sys 303104 bytes

0xBFFA0000 C:\WINDOWS\System32\ATMFD.DLL 286720 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)

0xB9523000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)

0xF5118000 C:\WINDOWS\system32\DRIVERS\rdpdr.sys 196608 bytes (Microsoft Corporation, Microsoft RDP Device redirector)

0xF73F7000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)

0xF7298000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)

0xF3E91000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)

0xF3EDE000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)

0xB52E0000 C:\WINDOWS\system32\DRIVERS\avipbb.sys 159744 bytes (Avira GmbH, Avira Driver for Security Enhancement)

0xF73A1000 dmio.sys 155648 bytes (Microsoft Corp., Veritas Software, NT Disk Manager I/O Driver)

0xF3DD3000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)

0xB99DF000 C:\WINDOWS\System32\Drivers\Fastfat.SYS 147456 bytes (Microsoft Corporation, Fast FAT File System Driver)

0xF6380000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))

0xF6339000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)

0xF635D000 C:\WINDOWS\system32\drivers\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)

0xF3EBC000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)

0x806EE000 ACPI_HAL 131840 bytes

0x806EE000 C:\WINDOWS\system32\hal.dll 131840 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)

0xF7369000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)

0xF73C7000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)

0xF727E000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)

0xF7389000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)

0xF5EE8000 C:\WINDOWS\System32\Drivers\SCSIPORT.SYS 98304 bytes (Microsoft Corporation, SCSI Port Driver)

0xF7425000 C:\WINDOWS\System32\Drivers\SPTD0621.SYS 98304 bytes

0xB52C9000 C:\WINDOWS\system32\DRIVERS\avgntflt.sys 94208 bytes (Avira GmbH, Avira Minifilter Driver)

0xF7352000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)

0xF5E89000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))

0xB992A000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)

0xF5EA0000 C:\WINDOWS\system32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver)

0xF63F6000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)

0xF3F5F000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)

0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)

0xF73E6000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)

0xF5E78000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)

0xF76AF000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)

0xF682A000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)

0xF684A000 C:\WINDOWS\system32\DRIVERS\nic1394.sys 65536 bytes (Microsoft Corporation, IEEE1394 Ndis Miniport and Call Manager)

0xF753F000 ohci1394.sys 65536 bytes (Microsoft Corporation, 1394 OpenHCI Port Driver)

0xF680A000 C:\WINDOWS\system32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver)

0xF768F000 C:\WINDOWS\system32\DRIVERS\arp1394.sys 61440 bytes (Microsoft Corporation, IP/1394 Arp Client)

0xF685A000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)

0xF681A000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)

0xB9A93000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)

0xF763F000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)

0xF754F000 C:\WINDOWS\system32\DRIVERS\1394BUS.SYS 57344 bytes (Microsoft Corporation, 1394 Bus Device Driver)

0xF758F000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)

0xF67FA000 C:\WINDOWS\system32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver)

0xF67EA000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)

0xF756F000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)

0xF760F000 C:\WINDOWS\System32\Drivers\pcouffin.sys 49152 bytes (VSO Software, low level access layer for CD/DVD/BD devices)

0xF75EF000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)

0xF766F000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)

0xF683A000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)

0xF755F000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)

0xF67DA000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)

0xF75AF000 uagp35.sys 45056 bytes (Microsoft Corporation, MS AGPv3.5 Filter)

0xF686A000 C:\WINDOWS\system32\DRIVERS\amdk7.sys 40960 bytes (Microsoft Corporation, Processor Device Driver)

0xF752F000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)

0xF762F000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)

0xB9451000 C:\WINDOWS\system32\DRIVERS\secdrv.sys 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver)

0xF761F000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)

0xF757F000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)

0xF75FF000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)

0xF765F000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)

0xB995F000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)

0xF759F000 PxHelp20.sys 36864 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)

0xF767F000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)

0xF77E7000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)

0xF78CF000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)

0xF77BF000 videX32.sys 32768 bytes (VIA Technologies, Inc., VIA Generic PCI IDE Bus Driver)

0xF78D7000 C:\WINDOWS\system32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver)

0xF7927000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)

0xF77AF000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)

0xF77C7000 viaagp1.sys 28672 bytes (VIA Technologies, Inc., VIA NT AGP Filter)

0xF78E7000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)

0xF78DF000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)

0xF78BF000 C:\WINDOWS\system32\DRIVERS\RTL8139.SYS 24576 bytes (Realtek Semiconductor Corporation, Realtek RTL8139 NDIS 5.0 Driver)

0xF77EF000 C:\WINDOWS\system32\DRIVERS\ssmdrv.sys 24576 bytes (Avira GmbH, AVIRA SnapShot Driver)

0xF78C7000 C:\WINDOWS\system32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver)

0xF792F000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)

0xF7917000 C:\WINDOWS\system32\DRIVERS\flpydisk.sys 20480 bytes (Microsoft Corporation, Floppy Driver)

0xF7937000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)

0xF77B7000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)

0xF78F7000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)

0xF78FF000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver)

0xF78EF000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)

0xF77F7000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)

0xF71DA000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)

0xBA508000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)

0xF71FE000 C:\WINDOWS\system32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)

0xF793F000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)

0xB982C000 C:\WINDOWS\system32\drivers\CdaC15BA.SYS 12288 bytes (Macrovision Europe Ltd, Macrovision SECURITY Driver)

0xF720A000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)

0xF71FA000 C:\WINDOWS\system32\DRIVERS\gameenum.sys 12288 bytes (Microsoft Corporation, Game Port Enumerator)

0xF71F6000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)

0xF724E000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)

0xF68E6000 C:\WINDOWS\System32\Drivers\vulfntr.sys 12288 bytes (VIA Technologies, Inc., VIA USB Roothub Lower Filter Driver)

0xB92D5000 C:\WINDOWS\System32\drivers\ws2ifsl.sys 12288 bytes (Microsoft Corporation, Winsock2 IFS Layer)

0xF7A4B000 C:\Program Files\Avira\AntiVir Desktop\avgio.sys 8192 bytes (Avira GmbH, Avira AntiVir Support for Minifilter)

0xF7A59000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)

0xF7A35000 dmload.sys 8192 bytes (Microsoft Corp., Veritas Software., NT Disk Manager Startup Driver)

0xF7A57000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)

0xF7A2F000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)

0xF7A5B000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)

0xF7A95000 C:\WINDOWS\System32\Drivers\ParVdm.SYS 8192 bytes (Microsoft Corporation, VDM Parallel Driver)

0xF7A5D000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)

0xF7A53000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)

0xF7A55000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)

0xF7A33000 viaide.sys 8192 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)

0xF7A51000 C:\WINDOWS\System32\Drivers\vulfnth.sys 8192 bytes (VIA Technologies, Inc., VIA USB Host Controller Lower Filter Driver)

0xF7A31000 C:\WINDOWS\System32\Drivers\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)

0xF7C5D000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)

0xF7C70000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)

0xF7C5C000 C:\WINDOWS\system32\drivers\msmpu401.sys 4096 bytes (Microsoft Corporation, MPU401 Adapter Driver)

0xF7C03000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)

0x82B7E0E8 unknown_irp_handler 3864 bytes

0x827E52B8 unknown_irp_handler 3400 bytes

0x82FD8418 unknown_irp_handler 3048 bytes

0x82C41488 unknown_irp_handler 2936 bytes

0x82AFE578 unknown_irp_handler 2696 bytes

0x82C12648 unknown_irp_handler 2488 bytes

0x82CE4948 unknown_irp_handler 1720 bytes

0x82DAFA80 unknown_irp_handler 1408 bytes

0x82CB8BB8 unknown_irp_handler 1096 bytes

0x82F8AC78 unknown_irp_handler 904 bytes

0x82BBCD20 unknown_irp_handler 736 bytes

==============================================

>Stealth

==============================================

WARNING: File locked for read access [C:\WINDOWS\system32\drivers\dtscsi.sys]

0xF3D206D3 Unknown thread object [ ETHREAD 0x82C50020 ] , 600 bytes

0xB847D983 Unknown thread object [ ETHREAD 0x82A98870 ] , 600 bytes

WARNING: File locked for read access [C:\WINDOWS\system32\drivers\sptd.sys]

WARNING: File locked for read access [C:\WINDOWS\system32\drivers\sptd0621.sys]

==============================================

>Files

==============================================

>Hooks

==============================================

ftdisk.sys-->ntoskrnl.exe-->IofCallDriver, Type: IAT modification 0xF73C8C50-->F744C620 [sptd.sys]

ftdisk.sys-->ntoskrnl.exe-->IoGetAttachedDeviceReference, Type: IAT modification 0xF73C8AA4-->F744C550 [sptd.sys]

ftdisk.sys-->ntoskrnl.exe-->IoGetDeviceObjectPointer, Type: IAT modification 0xF73C8ADC-->F744C454 [sptd.sys]

ntoskrnl.exe+0x00004AA2, Type: Inline - RelativeJump 0x804DBAA2-->804DBAA9 [ntoskrnl.exe]

[1556]explorer.exe-->advapi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77DD1218-->00000000 [shimeng.dll]

[1556]explorer.exe-->gdi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77F110B4-->00000000 [shimeng.dll]

[1556]explorer.exe-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x01001268-->00000000 [shimeng.dll]

[1556]explorer.exe-->mswsock.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x71A51178-->00000000 [shimeng.dll]

[1556]explorer.exe-->shell32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7C9C15A4-->00000000 [shimeng.dll]

[1556]explorer.exe-->user32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7E41133C-->00000000 [shimeng.dll]

[1556]explorer.exe-->wininet.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x3D9314B8-->00000000 [shimeng.dll]

[1556]explorer.exe-->ws2_32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x71AB109C-->00000000 [shimeng.dll]

[3768]firefox.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C9163C3-->00000000 [firefox.exe]

Редактирано 29 юли 201115 г. от vratarqt (преглед на промените)

29 юли 201115 г.

Лог файла е чист....преди да сканирате с GMER обаче временно спрете защитана на Avira (защото това са фалшиви тревоги от програмата). Няма значение дали ще изберете Remove или не, драйвъра така или иначе ще се unload-не автоматично.

29 юли 201115 г.

Автор

Здравей отново!

Сканирането с GMER.exe отне повечко време. Ето лог файла : Вече да активирам антивирусната ?

GMER 1.0.15.15641 - http://www.gmer.net

Rootkit scan 2011-07-29 21:47:52

Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 ST3120022A rev.8.01

Running: Tool.exe; Driver: C:\DOCUME~1\VLADOK~1\LOCALS~1\Temp\uxtdypob.sys

---- System - GMER 1.0.15 ----

SSDT F7BACE14 ZwClose

SSDT F7BACDCE ZwCreateKey

SSDT F7BACE1E ZwCreateSection

SSDT F7BACDC4 ZwCreateThread

SSDT F7BACDD3 ZwDeleteKey

SSDT F7BACDDD ZwDeleteValueKey

SSDT F7BACE0F ZwDuplicateObject

SSDT sptd.sys ZwEnumerateKey [0xF7442D48]

SSDT sptd.sys ZwEnumerateValueKey [0xF74430C0]

SSDT F7BACDE2 ZwLoadKey

SSDT sptd.sys ZwOpenKey [0xF7442AE2]

SSDT F7BACDB0 ZwOpenProcess

SSDT F7BACDB5 ZwOpenThread

SSDT sptd.sys ZwQueryKey [0xF744318A]

SSDT sptd.sys ZwQueryValueKey [0xF7443022]

SSDT F7BACDEC ZwReplaceKey

SSDT F7BACDE7 ZwRestoreKey

SSDT F7BACE23 ZwSetContextThread

SSDT F7BACDD8 ZwSetValueKey

SSDT F7BACDBF ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

? C:\WINDOWS\system32\drivers\sptd.sys The process cannot access the file because it is being used by another process.

? C:\WINDOWS\System32\Drivers\SPTD0621.SYS The process cannot access the file because it is being used by another process.

.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF640A360, 0x24BB1D, 0xE8000020]

.text dtscsi.sys!A0DB34FC6FE35D429A28ADDE5467D4D7 F5F014D0 16 Bytes [C2, A2, CB, A3, 19, ED, 3C, ...]

.text dtscsi.sys!A0DB34FC6FE35D429A28ADDE5467D4D7 + 12 F5F014E2 30 Bytes [F0, F5, DD, 20, 22, 6C, 08, ...]

? C:\WINDOWS\System32\Drivers\dtscsi.sys The process cannot access the file because it is being used by another process.

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT pci.sys[ntoskrnl.exe!IoDetachDevice] [F744BF52] sptd.sys

IAT pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F7462658] sptd.sys

IAT ftdisk.sys[ntoskrnl.exe!IoGetAttachedDeviceReference] [F744C550] sptd.sys

IAT ftdisk.sys[ntoskrnl.exe!IoGetDeviceObjectPointer] [F744C454] sptd.sys

IAT ftdisk.sys[ntoskrnl.exe!IofCallDriver] [F744C620] sptd.sys

IAT dmio.sys[ntoskrnl.exe!IofCallDriver] [F744C620] sptd.sys

IAT dmio.sys[ntoskrnl.exe!IoGetAttachedDeviceReference] [F744C550] sptd.sys

IAT dmio.sys[ntoskrnl.exe!IoGetDeviceObjectPointer] [F744C454] sptd.sys

IAT PartMgr.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F7461F6C] sptd.sys

IAT PartMgr.sys[ntoskrnl.exe!IoDetachDevice] [F744C10E] sptd.sys

IAT atapi.sys[ntoskrnl.exe!IofCompleteRequest] [F7461BB0] sptd.sys

IAT atapi.sys[ntoskrnl.exe!IoConnectInterrupt] [F744BFA6] sptd.sys

IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F743EA32] sptd.sys

IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F743EB6E] sptd.sys

IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F743EAF6] sptd.sys

IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F743F6CC] sptd.sys

IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F743F5A2] sptd.sys

IAT disk.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F746279E] sptd.sys

IAT \WINDOWS\system32\DRIVERS\CLASSPNP.SYS[ntoskrnl.exe!IoDetachDevice] [F74511BA] sptd.sys

IAT \SystemRoot\system32\DRIVERS\USBPORT.SYS[ntoskrnl.exe!IofCompleteRequest] [F7461BB0] sptd.sys

IAT \SystemRoot\system32\DRIVERS\cdrom.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F746279E] sptd.sys

IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F7461BBC] sptd.sys

IAT \SystemRoot\system32\DRIVERS\rdbss.sys[ntoskrnl.exe!IofCallDriver] [F743E020] sptd.sys

IAT \SystemRoot\system32\DRIVERS\mrxsmb.sys[ntoskrnl.exe!IofCallDriver] [F743E020] sptd.sys

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 82F8AC78

Device \FileSystem\Fastfat \FatCdrom 82B7E0E8

Device \Driver\NetBT \Device\NetBT_Tcpip_{F64B2079-564D-4F25-A134-2B86EF6D6B09} 82CE4948

Device \Driver\NetBT \Device\NetBT_Tcpip_{DC13E36A-826C-45EE-9466-28CAB974A7DA} 82CE4948

Device \Driver\00000052 \Device\00000045 sptd.sys

Device \Driver\dmio \Device\DmControl\DmIoDaemon 82FD8418

Device \Driver\dmio \Device\DmControl\DmConfig 82FD8418

Device \Driver\dmio \Device\DmControl\DmPnP 82FD8418

Device \Driver\dmio \Device\DmControl\DmInfo 82FD8418

Device \Driver\Ftdisk \Device\HarddiskVolume1 82FD86D0

Device \Driver\Ftdisk \Device\HarddiskVolume2 82FD86D0

Device \Driver\Cdrom \Device\CdRom0 82DAFA80

Device \FileSystem\Rdbss \Device\FsWrap 82C12648

Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 [F7392B40] atapi.sys[unknown section] {MOV EAX, 0x82f8a008; XCHG [ESP], EAX; PUSH EAX; PUSH 0xf7453684; RET }

Device \Driver\atapi \Device\Ide\IdePort0 [F7392B40] atapi.sys[unknown section] {MOV EAX, 0x82f8a008; XCHG [ESP], EAX; PUSH EAX; PUSH 0xf7453684; RET }

Device \Driver\atapi \Device\Ide\IdePort1 [F7392B40] atapi.sys[unknown section] {MOV EAX, 0x82f8a008; XCHG [ESP], EAX; PUSH EAX; PUSH 0xf7453684; RET }

Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e [F7392B40] atapi.sys[unknown section] {MOV EAX, 0x82f8a008; XCHG [ESP], EAX; PUSH EAX; PUSH 0xf7453684; RET }

Device \Driver\Ftdisk \Device\HarddiskVolume3 82FD86D0

Device \Driver\Cdrom \Device\CdRom1 82DAFA80

Device \Driver\NetBT \Device\NetBt_Wins_Export 82CE4948

Device \Driver\NetBT \Device\NetbiosSmb 82CE4948

Device \Driver\Disk \Device\Harddisk0\DR0 82F8AEB0

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 82AFE578

Device \FileSystem\MRxSmb \Device\LanmanRedirector 82AFE578

Device \FileSystem\Npfs \Device\NamedPipe 827E52B8

Device \Driver\Ftdisk \Device\FtControl 82FD86D0

Device \FileSystem\Msfs \Device\Mailslot 82C41488

Device \Driver\dtscsi \Device\Scsi\dtscsi1Port2Path0Target0Lun0 82CB8BB8

Device \Driver\dtscsi \Device\Scsi\dtscsi1 82CB8BB8

Device \FileSystem\Fastfat \Fat 82B7E0E8

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \FileSystem\Cdfs \Cdfs 82BBCD20

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s0 -753534206

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 870386216

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 1110433763

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xCF 0x0D 0x43 0x97 ...

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x30 0xC7 0x07 0xA9 ...

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x07 0xC4 0x51 0xBC ...

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xCF 0x0D 0x43 0x97 ...

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x30 0xC7 0x07 0xA9 ...

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x47 0xEB 0xDD 0x51 ...

Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\

Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0

Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xCF 0x0D 0x43 0x97 ...

Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...

Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x30 0xC7 0x07 0xA9 ...

Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x07 0xC4 0x51 0xBC ...

---- EOF - GMER 1.0.15 ----

Редактирано 29 юли 201115 г. от vratarqt (преглед на промените)

29 юли 201115 г.

Всичко е чисто....изтрийте и последните инструменти които използвахте и включете антивирусната си програма. Добра работа ! Ако няма повече въпроси, маркирам случая като решен.

29 юли 201115 г.

Автор

Здравей!

Благодаря ти за всички положени усилия през свободното ти време , при това безвъзмездно! Благодаря отново за точните инструкции и за любезното отношение! Щастлив съм , че попаднах на човек като теб, който успя да реши проблема ми, без при това да ме накара да се чувствам неудобно от незнанието си.Благодаря!!!

Ами да, имам още един въпрос (съжалявам, ако съм досадил с многото си въпроси). От всички програми, които ми прати, мисля да оставя CCleaner и Malwarebytes' Anti-Malware. На компютъра имам още :Advanced SystemCare 4 и TuneUp Utilities 2008 . Мисля за в бъдеще да пускам тези програми през ден -два (наред веднъж седмично с Avira - сканиране), за изчистване на компютъра. Въпросът е : Смяташ ли ,че тези 5 програми са достатъчни за добра профилактика на компютъра ? Някой от тях препокриват ли се и съответно ще си пречат? И въобще , според теб , има ли някаква друга програма още, която да сваля за проверка и почистване, и въобще има ли нещо, което още трябва да правя/следя в бъдеще за да предпазя и навреме почистя компютъра?

29 юли 201115 г.

Здравейте отново,

Не сте ми досадили ни най-малко.

Аз не препоръчвам използването на системни оптимизатори (особено чистачи на регистрите). Има доста теми по-въпроса като например тази така че аз ви препоръчвам да деинсталирате TuneUp Utilities и Advanced SystemCare.

За профилактика вижте тази тема.

За предпазване на компютъра също има много писано по въпроса:

Някои важни акценти:

1. СПИРАНЕ НА AUTORUN/AUTOPLAY

Изтеглете, разархивирайте и стартирайте Panda USB Vaccine.

Нарочно ви качвам по-стара версия, която не се нуждае от инсталиране. Разархивирайте архива и стартирайте приложението. Натиснете Vaccinate Computer. Чак след това можете да ползвате отново флашките си, но не забравяйте да ги сканирате след като ги включите към компютъра си.

2.СПИРАНЕ НА FILE SHARING

Внимавайте с използването на шернати папки...ако не използвате (споделени файлове, папки и принтери) аз предлагам да спрете тази функционалност...

- от настройките на мрежовата карта (просто махнете тази отметка) - Control Panel => Network Connection => двукратен клик на мрежовия адаптер:

Публикувано изображение

- от десен бутон на My Computer => Manage => Shared Folders (изберете всичко едно по едно и натиснете Stop Sharing)

Публикувано изображение

(по-лесен начин е и спирането на Server услугата - Start => Run => напишете services.msc => натиснете Enter => намерете услугата Server => кликнете върху нея и я сложете на Disabled).

3.ИЗБЯГВАЙТЕ СЪМНИТЕЛНИТЕ САЙТОВЕ

Има си достатъчно на брой читави и безплатни алтернативи на повечето програми. Авторите на зловреден код обожават съмнителните сайтове и затова моят съвет е да стоите надалеч от тях или поне да проверявате резултатите на за всички изтеглени файлове (преди да ги инсталирате) на VirusTotal. Разбира се, не е задължително всички файлове оттам да са непременно зловредни, но ако не сте сигурни по-добре попитайте отколкото да рискувате.

4.АКТУАЛИЗИРАЙТЕ ИЗПОЛЗВАНИТЕ ПРОГРАМИ И САМАТА ОПЕРАЦИОННА СИСТЕМА

Винаги използвайте актуални версии на използвания софтуер. Може да използвате SECUNIA за да проверите коя програма има нужда от актуализация.

Поздрави !

30 юли 201115 г.

Автор

Здравей отново!

Така, TuneUp Utilities и Advanced SystemCare са вече деинсталирани, останаха ,освен Avira, CCleaner и Malwarebytes' Anti-Malware. Колко начесто е добре да се пускат последните две - на седмица по веднъж?

Изтеглих , Panda USB Vaccine и ваксинирах компютъра. Panda USB Vaccine изтривам ли я след това, или тя си остава?

2.СПИРАНЕ НА FILE SHARING

"-от настройките на мрежовата карта (просто махнете тази отметка) ...." така, това го направих , но следващото

"- от десен бутон на My Computer => Manage => Shared Folders (изберете всичко едно по едно и натиснете Stop Sharing)" - няма такава опция - виж снимката:

http://prikachi.com/...36/3627836q.png

"4.АКТУАЛИЗИРАЙТЕ ИЗПОЛЗВАНИТЕ ПРОГРАМИ И САМАТА ОПЕРАЦИОННА СИСТЕМА" - относно ОС - в Security Center на Control Panel съм спрял Automatic Updates, понеже преди време, доколкото един познат ми обясни, именно чрез тях ми се беше появила една икона като звезда до часовника(долу вдясно). Както приятелят ми каза, чрез тази звезда Microsoft разбрали, че Windows ми не е оригинален, и следователно му пращат файлове , които да го забавят(всъщност и в момента не знам Windows ми оригинален ли е или не )- действително тогава компютърът ми ставаше все по-бавен. Не помня как точно разкарахме звездата, но оттогава съм със спрени Automatic Updates.Да ги включа ли, за да се актуализира, както препоръчваш, ОС?

Изтеглих и инсталирах Secunia. Но когато пуснах да сканира излезе грешка. Виж:

http://prikachi.com/images/863/3627863Q.png

Повторих сканирането, същата грешка. Какво да направя?

Редактирано 30 юли 201115 г. от vratarqt (преглед на промените)

30 юли 201115 г.

Здрасти,

1. CCleaner е за всекидневна употреба...можете да си я стартирате всеки ден. MBAM може да си я пускате по веднъж на 2-3 дена, а Avira един път на две седмици мисля, че е достатъчно.

2. Panda USBVaccine, вече я изтрийте, да.

3. Спирането на Sharing-ите, може да стане и с изключване на Server услугата (както съм описал в горния си пост) и тогава няма нужда да се занимавате с My Computer => Manage => Shared Folder

4. Нелеганел Windows трудно се поддържа обновен (има програми, които сканират за актуализации, но после трябва да си ги теглите и инсталирате ръчно и не са подходящи за начинаещи потребители). По-добре се замислете занапред за ъпгрейд на хардуера (ако е много стар) и преминаване към Windows 7.

Не, не включвайте Automatic Updates, но ако ви се занимава ръчно пробвайте с това - Protector Plus - Windows Vulnerability Scanner

PS: Ами тогава деинсталирайте Secunia и просто ръчно проверявайте за обновления на използваните приложения. То има и други програми за проверка, но е излишно да товарим компютъра с глупости.

PS2: Не е зле да изключите и ненужните неща от => Start Menu => Run => напишете msconfig => натиснете Enter => отидете до Startup и махнете отметките на приложенията, които решите, че не са критично важни да зареждат с Операционната Система => накрая потвърдете с Apply.

Поздрави и успех !

30 юли 201115 г.

Автор

Здрасти отново,

"PS2: Не е зле да изключите и ненужните неща от => Start Menu => Run => напишете msconfig.........." - мисля, че всичко което е маркирано в момента, трябва да остане маркирано.Ето снимка :

http://prikachi.com/images/932/3627932r.png

Ако смяташ, че няма какво друго да се демаркира, то мисля , че с това приключвам с въпросите. :scared:

Благодаря още веднъж за цялата помощ от твоя страна !!! Установих, че форумът е богат на най- различна информация, така че за в бъдеще мисля да влизам и да чета различни теми - току виж съм научил нещо ново.

Благодаря , Поздрави и от мен и Успех със следващите случаи, с които имаш да се справяш! Публикувано изображение

30 юли 201115 г.

Ами аз бих премахнал следните отметки:

NvCPl

nwiz

NvMctray

Soundman

jusched

AdobeARM

Updater

PowerReg Scheduler

т.е. бих оставил само

avgnt

ctfmon

Но тук е въпрос на личен избор...все пак наистина ги мисля за безмислени процеси, които сигурно само ще товарят компютърчето.

Благодаря ти за добрите думи и приятни мигове из форумите на калдейта. :bye1:

Добре дошли!

Facebook вирусът --> Enhаnced Protection Mode на антивирусната

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)