Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Mediashifting.com + Rootkit ZeroAccess [РЕШЕН]

Papadopoulos
в Премахване на зловреден софтуер

Featured Replies

Ще продължим утре, защото заспивам...добра работа свършихме днес ! :) Лека нощ. :weather2:

  • Отговори 75
  • Прегледи 7,5k
  • Създадено
  • Последен отговор
  • Автор

Няма такова сканиране просто Публикувано изображение

Слагам като текст, защото не ми позволява да го кача

Gmer.log

Не можете да качвате такъв тип файл

Ето го:

GMER 1.0.15.15641 - http://www.gmer.net

Rootkit scan 2012-01-12 05:09:19

Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 TOSHIBA_MK8032GSX rev.AS112D

Running: gmer.exe; Driver: C:\DOCUME~1\Shushi\LOCALS~1\Temp\uxldapoc.sys

---- System - GMER 1.0.15 ----

SSDT spwy.sys ZwCreateKey [0xF745F0E0]

SSDT spwy.sys ZwEnumerateKey [0xF7477DA4]

SSDT spwy.sys ZwEnumerateValueKey [0xF7478132]

SSDT spwy.sys ZwOpenKey [0xF745F0C0]

SSDT spwy.sys ZwQueryKey [0xF747820A]

SSDT spwy.sys ZwQueryValueKey [0xF747808A]

SSDT spwy.sys ZwSetValueKey [0xF747829C]

INT 0x62 ? 86D67BF8

INT 0x74 ? 86BA1BF8

INT 0x82 ? 86D67BF8

INT 0x84 ? 86BA1BF8

INT 0x94 ? 86BA1BF8

---- Kernel code sections - GMER 1.0.15 ----

? spwy.sys The system cannot find the file specified. !

.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF61A9360, 0x212B5D, 0xE8000020]

.text USBPORT.SYS!DllUnload F613E8AC 5 Bytes JMP 86BA11D8

.text a11tfvju.SYS F6087386 35 Bytes [00, 00, 00, 00, 00, 00, 20, ...]

.text a11tfvju.SYS F60873AA 24 Bytes [00, 00, 00, 00, 00, 00, 00, ...]

.text a11tfvju.SYS F60873C4 3 Bytes [00, 80, 02]

.text a11tfvju.SYS F60873C9 1 Byte [30]

.text a11tfvju.SYS F60873C9 11 Bytes [30, 00, 00, 00, 5E, 02, 00, ...] {XOR [EAX], AL; ADD [EAX], AL; POP ESI; ADD AL, [EAX]; ADD [EAX], AL; ADD [EAX], AL}

.text ...

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Mozilla Firefox\firefox.exe[3556] ntdll.dll!LdrLoadDll 7C91632D 5 Bytes JMP 00401410 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)

.text C:\Program Files\Mozilla Firefox\plugin-container.exe[4048] USER32.dll!SetWindowLongA 7E42C29D 5 Bytes JMP 106AA2FB C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)

.text C:\Program Files\Mozilla Firefox\plugin-container.exe[4048] USER32.dll!SetWindowLongW 7E42C2BB 5 Bytes JMP 106AA28D C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)

.text C:\Program Files\Mozilla Firefox\plugin-container.exe[4048] USER32.dll!GetWindowInfo 7E42C49C 5 Bytes JMP 104B1BD2 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)

.text C:\Program Files\Mozilla Firefox\plugin-container.exe[4048] USER32.dll!TrackPopupMenu 7E46531E 5 Bytes JMP 104B219D C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 86D661F8

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0016415e6869

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0016415e6869@0016b88d93ee 0x6C 0x6A 0x5C 0xA5 ...

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 D:\Program Files\DAEMON Tools Lite\

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x47 0x98 0xD3 0x5D ...

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xEE 0xBD 0xDB 0xFC ...

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xFD 0x99 0xA2 0x76 ...

Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\0016415e6869 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\0016415e6869@0016b88d93ee 0x6C 0x6A 0x5C 0xA5 ...

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 D:\Program Files\DAEMON Tools Lite\

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x7D 0x19 0x40 0xE1 ...

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xEE 0xBD 0xDB 0xFC ...

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xFD 0x99 0xA2 0x76 ...

---- EOF - GMER 1.0.15 ----

Огромни благодарности за отделеното време и помощ :shy11:

Редактирано от Papadopoulos (преглед на промените)

И този лог файл е чист, но възнамерявам да направим още малко проверки, за да се уверя, че рууткита е заминал напълно.

СТЪПКА 1

  • Изтеглете DeFogger от тук и го запазете на десктопа.
  • Стартирайте DeFogger с двоен клик на иконата и натиснете бутона Disable, за да забраните временно CD емулиращите драйвери.
  • След въпроса дали искате да продължите, натиснете Yes.
  • Когато програмата завърши работата си, ще се появи надпис Finished!. Натиснете ОК за изход от програмата.
  • Ако CD емулиращите програми са забранени, ще бъде зададен въпрос за рестарт (reboot). Разрешете рестарта с ОК.

СТЪПКА 2

Моля, изтеглете aswMBR и го запазете на вашия десктоп.

  • Кликнете с двоен клин на мишката върху файла aswMBR.exe за да го стартирате.
  • Изчакайте да изтегли дефинициите на avast!
  • От падащото меню посочете дял C:\ както е на снимката:
Публикувано изображение
  • Изберете Scan бутона, за да започне проверката.
  • Когато проверката завърши, натиснете бутона save log, запазете съдържанието на лог файла на десктопа и публикувайте съдържанието му в следващия си коментар.
После кажете как е състоянието на машината.

СТЪПКА 3

Следвайте следната инструкция за работа с Rootkit UnHooker:

  • Изтеглете този файл на десктопа.
  • Разархивирайте архива и стартирайте RkU3.8.388.590.exe, отидете на Report и сложете всички отметки. Натиснете OK.
  • Изчакайте програмата да завърши работа. След това кликнете на File, после Save Report. Запазете (Save as) файла с име report.txt на десктопа.
  • Публикувайте съдържанието на файла report.txt в следващия си коментар.
  • Автор

Тъй като цял следобед съм на стъпка 2 и все още сканира, ще пусна лог-а от стъпка 1

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 14:31 on 12/01/2012 (Shushi)

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.

HKCU:DAEMON Tools Lite -> Removed

Checking for services/drivers...

Unable to read sptd.sys

SPTD -> Disabled (Service running -> reboot required)

-=E.O.F=-

Нормално ли е aswMBR да сканира толкова много часове? Иначе има доста червени редове, а на единият пише инфектед :(((

post-316482-0-60574700-1326382692_thumb.

Редактирано от Papadopoulos (преглед на промените)

можем да извършим проверката с aswMBR и без сканирането за вируси с avast! но така ще падне ефективността на инструмента. И от снимката няма място за притеснение - червените редове са от System Restore, а последния засечен файл е от Combofix (и е фалшива тревога)...

  • Автор

Видях, че този Пев фйл е създаден вчера и настръхнах,че може това да вируса . Сканирането най-накрая приключи! :) Стъпка 2 : aswMBR version 0.9.9.1297 Copyright© 2011 AVAST Software Run date: 2012-01-12 14:43:29 ----------------------------- 14:43:29.625 OS Version: Windows 5.1.2600 Service Pack 3 14:43:29.640 Number of processors: 2 586 0xE08 14:43:29.640 ComputerName: D820 UserName: 14:43:30.406 Initialize success 14:43:44.125 AVAST engine defs: 12011200 14:43:56.062 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 14:43:56.062 Disk 0 Vendor: TOSHIBA_MK8032GSX AS112D Size: 76319MB BusType: 3 14:43:56.093 Disk 0 MBR read successfully 14:43:56.093 Disk 0 MBR scan 14:43:56.156 Disk 0 Windows XP default MBR code 14:43:56.156 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 94 MB offset 63 14:43:56.171 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 29996 MB offset 192780 14:43:56.187 Disk 0 Partition - 00 0F Extended LBA 46226 MB offset 61625340 14:43:56.203 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 20002 MB offset 61625403 14:43:56.203 Disk 0 Partition - 00 05 Extended 16002 MB offset 102591090 14:43:56.218 Disk 0 Partition 4 00 07 HPFS/NTFS NTFS 16002 MB offset 102591153 14:43:56.234 Disk 0 Partition - 00 05 Extended 10221 MB offset 176329440 14:43:56.250 Disk 0 Partition 5 00 07 HPFS/NTFS NTFS 10221 MB offset 135363753 14:43:56.265 Disk 0 scanning sectors +156296385 14:43:56.328 Disk 0 scanning C:\WINDOWS\system32\drivers 14:44:08.921 Service scanning 14:44:10.187 Modules scanning 14:44:23.125 Disk 0 trace - called modules: 14:44:23.125 14:44:23.703 AVAST engine scan C:\ 14:47:56.390 File: C:\Documents and Settings\Shushi\Application Data\Sun\Java\Deployment\cache\6.0\27\1e1baa9b-629e003c **INFECTED** Win32:Malware-gen 14:47:58.140 File: C:\Documents and Settings\Shushi\Application Data\Sun\Java\Deployment\cache\6.0\40\22548ce8-1dfaf263 **INFECTED** Win32:Tiny-ALI [Trj] 14:50:23.703 File: C:\Documents and Settings\Shushi\Desktop\RK_Quarantine\balancerfc.exe.vir **INFECTED** Win32:Menti-G [Trj] 15:54:58.500 File: C:\Qoobox\Quarantine\C\Documents and Settings\Shushi\Local Settings\Application Data\d5201a33\U\[email protected] **INFECTED** Other:Malware-gen 15:54:59.015 File: C:\Qoobox\Quarantine\C\Documents and Settings\Shushi\Local Settings\Application Data\d5201a33\U\[email protected] **INFECTED** Win64:Sirefef-A [Trj] 15:54:59.406 File: C:\Qoobox\Quarantine\C\Documents and Settings\Shushi\Local Settings\Application Data\d5201a33\U\[email protected] **INFECTED** Win32:Sirefef-AO [Rtk] 15:54:59.671 File: C:\Qoobox\Quarantine\C\Documents and Settings\Shushi\Local Settings\Application Data\d5201a33\U\[email protected] **INFECTED** Win32:Trojan-gen 16:03:40.765 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP643\A0369751.sys **INFECTED** Win32:Zeroot-B [Rtk] 16:03:51.218 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP643\A0370751.sys **INFECTED** Win32:Zeroot-B [Rtk] 16:03:53.328 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP643\A0371751.sys **INFECTED** Win32:Zeroot-B [Rtk] 16:03:53.484 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP643\A0371752.ini **INFECTED** Win32:Malware-gen 16:03:54.531 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP643\A0372751.sys **INFECTED** Win32:Zeroot-B [Rtk] 16:03:54.703 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP643\A0372752.ini **INFECTED** Win32:Malware-gen 16:03:55.343 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP643\A0373751.sys **INFECTED** Win32:Zeroot-B [Rtk] 16:03:55.484 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP643\A0373752.ini **INFECTED** Win32:Malware-gen 16:03:56.343 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP643\A0374751.sys **INFECTED** Win32:Zeroot-B [Rtk] 16:03:56.484 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP643\A0374752.ini **INFECTED** Win32:Malware-gen 16:04:02.484 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP643\A0375751.sys **INFECTED** Win32:Zeroot-B [Rtk] 16:04:02.625 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP643\A0375752.ini **INFECTED** Win32:Malware-gen 16:04:03.734 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP643\A0376751.sys **INFECTED** Win32:Zeroot-B [Rtk] 16:04:03.875 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP643\A0376752.ini **INFECTED** Win32:Malware-gen 16:04:12.312 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP644\A0377759.sys **INFECTED** Win32:Zeroot-B [Rtk] 16:04:12.468 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP644\A0377760.ini **INFECTED** Win32:Malware-gen 16:04:14.609 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP645\A0378767.sys **INFECTED** Win32:Zeroot-B [Rtk] 16:04:14.750 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP645\A0378768.ini **INFECTED** Win32:Malware-gen 16:04:18.421 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP645\A0383775.exe **INFECTED** Win32:Patched-WQ [Trj] 16:04:31.343 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP645\A0383890.exe **INFECTED** Win32:Patched-WQ [Trj] 16:04:31.500 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP645\A0383891.ini **INFECTED** Win32:Malware-gen 16:06:39.265 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP645\A0384992.exe **INFECTED** Win32:Menti-G [Trj] 16:06:39.593 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP645\A0384994.exe **INFECTED** Win32:Menti-G [Trj] 16:06:58.625 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP646\A0385950.exe **INFECTED** Win32:Rootkit-gen [Rtk] 16:06:59.203 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP646\A0385951.exe **INFECTED** Win32:Rootkit-gen [Rtk] 16:07:28.765 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP647\A0386096.exe **INFECTED** Win32:Rootkit-gen [Rtk] 16:07:29.406 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP647\A0386097.exe **INFECTED** Win32:Rootkit-gen [Rtk] 16:07:53.953 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP647\A0386247.exe **INFECTED** Win32:Rootkit-gen [Rtk] 16:08:04.125 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP647\A0386318.exe **INFECTED** Win32:Rootkit-gen [Rtk] 16:08:25.000 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP647\A0386418.exe **INFECTED** Win32:Rootkit-gen [Rtk] 16:09:32.796 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP648\A0386689.exe **INFECTED** Win32:Rootkit-gen [Rtk] 16:09:41.953 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP648\A0386749.exe **INFECTED** Win32:Rootkit-gen [Rtk] 16:09:49.234 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP648\A0386791.exe **INFECTED** Win32:Rootkit-gen [Rtk] 16:09:58.921 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP648\A0386851.exe **INFECTED** Win32:Rootkit-gen [Rtk] 16:10:06.062 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP648\A0386888.exe **INFECTED** Win32:Rootkit-gen [Rtk] 16:10:16.015 File: C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP648\A0386947.exe **INFECTED** Win32:Rootkit-gen [Rtk] 17:14:06.515 File: C:\WINDOWS\PEV.exe **INFECTED** Win32:Rootkit-gen [Rtk] 17:58:49.421 Scan finished successfully 18:01:27.359 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Shushi\Desktop\MBR.dat" 18:01:27.406 The log file has been saved successfully to "C:\Documents and Settings\Shushi\Desktop\aswMBR.txt" Започвам стъпка 3

Какво стана със стъпка 3 ? :)

  • Стартирайте файла Публикувано изображение
  • Под Публикувано изображение с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):
:files
C:Documents and SettingsShushiApplication DataSunJavaDeploymentcache6.0271e1baa9b-629e003c
C:Documents and SettingsShushiApplication DataSunJavaDeploymentcache6.04022548ce8-1dfaf263
:commands
[reboot]
След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл - OTL fix log. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

  • Автор

Стъпка 3 е готова: RkU Version: 3.8.388.590, Type LE (SR2) ============================================== OS Name: Windows XP Version 5.1.2600 (Service Pack 3) Number of processors #2 ============================================== >SSDT State ============================================== ============================================== >Shadow ============================================== ============================================== >Processes ============================================== 0x86DC47C0 [4] System 0x82BB31D0 [244] C:\Program Files\Mozilla Firefox\plugin-container.exe (Mozilla Corporation, Plugin Container for Firefox) 0x868957E8 [312] C:\WINDOWS\system32\alg.exe (Microsoft Corporation, Application Layer Gateway Service) 0x86B32C30 [388] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services) 0x8675DDA0 [528] C:\WINDOWS\system32\wdfmgr.exe (Microsoft Corporation, Windows User Mode Driver Manager) 0x8682CC10 [560] C:\WINDOWS\system32\smss.exe (Microsoft Corporation, Windows NT Session Manager) 0x86B4B720 [608] C:\WINDOWS\system32\csrss.exe (Microsoft Corporation, Client Server Runtime Process) 0x86C6C578 [632] C:\WINDOWS\system32\winlogon.exe (Microsoft Corporation, Windows NT Logon Application) 0x86896DA0 [676] C:\WINDOWS\system32\services.exe (Microsoft Corporation, Services and Controller app) 0x86841158 [688] C:\WINDOWS\system32\lsass.exe (Microsoft Corporation, LSA Shell (Export Version)) 0x86840D78 [864] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services) 0x868B05A8 [908] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services) 0x8663DA88 [1000] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services) 0x86BCA270 [1076] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services) 0x868818D8 [1156] C:\WINDOWS\system32\wscntfy.exe (Microsoft Corporation, Windows Security Center Notification App) 0x86BCC7B0 [1192] C:\WINDOWS\explorer.exe (Microsoft Corporation, Windows Explorer) 0x868ADA48 [1204] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services) 0x86B12DA0 [1392] C:\WINDOWS\system32\spoolsv.exe (Microsoft Corporation, Spooler SubSystem App) 0x868509A0 [1444] C:\WINDOWS\system32\scardsvr.exe (Microsoft Corporation, Smart Card Resource Management Server) 0x866947E8 [1484] C:\WINDOWS\system32\rundll32.exe (Microsoft Corporation, Run a DLL as an App) 0x868D0DA0 [1572] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services) 0x86C892C8 [1608] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services) 0x8688FB60 [1620] C:\Program Files\Java\jre6\bin\jucheck.exe (Sun Microsystems, Inc., Java Update Checker) 0x868C65D0 [1672] C:\WINDOWS\system32\rundll32.exe (Microsoft Corporation, Run a DLL as an App) 0x82157940 [1684] C:\Documents and Settings\Shushi\Desktop\RkU3.8.388.590\MustBeRandomlyNamed\2bAorl1v.exe (UG North, RKULE, SR2 Normandy) 0x86832DA0 [1728] C:\WINDOWS\system32\nvsvc32.exe (NVIDIA Corporation, NVIDIA Driver Helper Service, Version 83.13) 0x86D82468 [1756] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd., Alps Pointing-device Driver) 0x86660848 [1776] C:\WINDOWS\stsystra.exe (SigmaTel, Inc., Sigmatel Audio system tray application) 0x86B5B020 [1792] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc., Logitech Webcam Software) 0x86B14DA0 [1820] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc., Java Platform SE binary) 0x86822550 [1832] C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation, SQL Browser Service EXE) 0x867F4410 [1904] C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation, SQL Server VSS Writer) 0x868E59B8 [1932] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG, Nero Home) 0x86B5C428 [1936] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Company, -) 0x867FD550 [1988] C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe (-, -) 0x868889A0 [2052] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation, CTF Loader) 0x866D17A0 [2124] C:\WINDOWS\STK02H\STK02HM.exe (Syntek Ltd., Syntek Monitor Application) 0x8684A580 [2172] C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (Nero AG, Nero Home) 0x8664D700 [2180] C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe (-, -) 0x86BB1908 [2236] C:\WINDOWS\STK02N\STK02NM.exe (Syntek Ltd., Syntek Monitor Application) 0x867F35C0 [2316] C:\Program Files\Apoint\hidfind.exe (Alps Electric Co., Ltd., Alps Pointing-device Driver) 0x867F5568 [2324] C:\Program Files\Apoint\ApntEx.exe (Alps Electric Co., Ltd., Alps Pointing-device Driver for Windows NT/2000/XP) 0x86654778 [2420] C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (Nero AG, Nero Home) 0x82D15DA0 [2732] C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE (Microsoft Corporation, Microsoft Office Word) 0x86867DA0 [2744] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services) 0x8582EA10 [3064] C:\WINDOWS\system32\mspaint.exe (Microsoft Corporation, Paint) 0x86838020 [3076] C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation, Firefox) 0x86C24980 [3656] C:\Program Files\Mozilla Firefox\plugin-container.exe (Mozilla Corporation, Plugin Container for Firefox) 0x864C14B8 [3728] C:\WINDOWS\system32\wuauclt.exe (Microsoft Corporation, Windows Update) 0x82D81020 [4032] C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE (Microsoft Corporation, Microsoft Office Outlook) ============================================== >Drivers ============================================== 0xBF012000 C:\WINDOWS\System32\nv4_disp.dll 3948544 bytes (NVIDIA Corporation, NVIDIA Compatible Windows 2000 Display driver, Version 83.13 ) 0xF5EF9000 C:\WINDOWS\system32\DRIVERS\nv4_mini.sys 3596288 bytes (NVIDIA Corporation, NVIDIA Compatible Windows 2000 Miniport Driver, Version 83.13 ) 0x804D7000 C:\WINDOWS\system32\ntkrnlpa.exe 2154496 bytes (Microsoft Corporation, NT Kernel & System) 0x804D7000 PnpManager 2154496 bytes 0x804D7000 RAW 2154496 bytes 0x804D7000 WMIxWDM 2154496 bytes 0xBF800000 Win32k 1859584 bytes 0xBF800000 C:\WINDOWS\System32\win32k.sys 1859584 bytes (Microsoft Corporation, Multi-User Win32 Driver) 0xF3A91000 C:\WINDOWS\system32\drivers\sthda.sys 1015808 bytes (SigmaTel, Inc., NDRC) 0xF393C000 C:\WINDOWS\system32\DRIVERS\HSX_DPV.sys 1011712 bytes (Conexant Systems, Inc., HSF_DP driver) 0xF3886000 C:\WINDOWS\system32\DRIVERS\HSX_CNXT.sys 745472 bytes (Conexant Systems, Inc., HSF_CNXT driver) 0xF73E7000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver) 0xF369F000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr) 0xF5D5A000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver) 0xF37D2000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver) 0xBA0EF000 C:\WINDOWS\system32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver) 0xBF3D6000 C:\WINDOWS\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver) 0xF35BC000 C:\WINDOWS\System32\Drivers\bthport.sys 274432 bytes (Microsoft Corporation, Bluetooth Bus Driver) 0xB9AF3000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack) 0xF3A33000 C:\WINDOWS\system32\DRIVERS\HSXHWAZL.sys 237568 bytes (Conexant Systems, Inc., HSF_HWAZL WDM driver) 0xF5DE0000 C:\WINDOWS\system32\DRIVERS\rdpdr.sys 196608 bytes (Microsoft Corporation, Microsoft RDP Device redirector) 0xF7523000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT) 0xBA16F000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr) 0xF73BA000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver) 0xA6094000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer) 0xF370F000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver) 0xF5EBD000 C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 163840 bytes (Windows ® Server 2003 DDK provider, High Definition Audio Bus Driver v1.0a) 0xF37AA000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver) 0xF3784000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator) 0xF3A6D000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices)) 0xF5E76000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver) 0xF5E9A000 C:\WINDOWS\system32\DRIVERS\b57xp32.sys 143360 bytes (Broadcom Corporation, Broadcom NetXtreme Gigabit Ethernet NDIS5.1 Driver.) 0xF5E38000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library) 0xF373A000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock) 0x806E5000 ACPI_HAL 134400 bytes 0x806E5000 C:\WINDOWS\system32\hal.dll 134400 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL) 0xF749D000 fltMgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager) 0xF74D5000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver) 0xF74F4000 pcmcia.sys 122880 bytes (Microsoft Corporation, PCMCIA Bus Driver) 0xF5E5B000 C:\WINDOWS\system32\DRIVERS\Apfiltr.sys 110592 bytes (Alps Electric Co., Ltd., Alps Touch Pad Driver) 0xF73A0000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver) 0xF35A3000 C:\WINDOWS\system32\DRIVERS\bthpan.sys 102400 bytes (Microsoft Corporation, Bluetooth Personal Area Networking) 0xF74BD000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver) 0xF3563000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes 0xF7474000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface) 0xF5E21000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption)) 0xBA482000 C:\WINDOWS\system32\DRIVERS\irda.sys 90112 bytes (Microsoft Corporation, IRDA Protocol Driver) 0xBA46C000 C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys 90112 bytes (Microsoft Corporation, NWLINK2 IPX Protocol Driver) 0xB9F9A000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper) 0xF5EE5000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver) 0xF382B000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver) 0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver) 0xF748B000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver) 0xF7512000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator) 0xF5E10000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler) 0xF7822000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver) 0xF68C9000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver) 0xBA5F0000 C:\WINDOWS\system32\DRIVERS\nwlnknb.sys 65536 bytes (Microsoft Corporation, NWLINK2 IPX Netbios Protocol Driver) 0xF7652000 ohci1394.sys 65536 bytes (Microsoft Corporation, 1394 OpenHCI Port Driver) 0xF68F9000 C:\WINDOWS\System32\Drivers\Serial.SYS 65536 bytes (Microsoft Corporation, Serial Device Driver) 0xF7752000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter) 0xF68B9000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver) 0xF77F2000 C:\WINDOWS\system32\DRIVERS\rfcomm.sys 61440 bytes (Microsoft Corporation, Bluetooth RFCOMM Driver) 0xBA1CC000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter) 0xF7772000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB) 0xF7662000 C:\WINDOWS\system32\DRIVERS\1394BUS.SYS 57344 bytes (Microsoft Corporation, 1394 Bus Device Driver) 0xBA5B0000 C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys 57344 bytes (Microsoft Corporation, NWLINK2 SPX Protocol Driver) 0xF76B2000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll) 0xF6909000 C:\WINDOWS\system32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver) 0xF76F2000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver) 0xF7692000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver) 0xF7712000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol) 0xF77E2000 C:\WINDOWS\system32\DRIVERS\usbccid.sys 49152 bytes (Microsoft Corporation, USB CCID Driver) 0xB7E8B000 C:\DOCUME~1\Shushi\LOCALS~1\Temp\aswMBR.sys 45056 bytes 0xF77C2000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver) 0xF68D9000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver) 0xF7682000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager) 0xF7702000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver) 0xF7802000 C:\WINDOWS\system32\DRIVERS\bthmodem.sys 40960 bytes (Microsoft Corporation, Bluetooth Communications Driver) 0xF7672000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver) 0xF7742000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy) 0xF76C2000 PxHelp20.sys 40960 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP) 0xF7732000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver) 0xF76A2000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver) 0xF77D2000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library) 0xF6919000 C:\WINDOWS\system32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver) 0xF7722000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier) 0xF77B2000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver) 0xA79A0000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver) 0xF68E9000 C:\WINDOWS\system32\DRIVERS\smcirda.sys 36864 bytes (SMC, SMC IrCC NDIS 5.0 IrDA FIR Device Driver) 0xF77A2000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver) 0xF79C2000 C:\WINDOWS\System32\Drivers\Modem.SYS 32768 bytes (Microsoft Corporation, Modem Device Driver) 0xF79FA000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver) 0xF798A000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver) 0xF7A12000 C:\WINDOWS\system32\DRIVERS\hidbth.sys 28672 bytes (Microsoft Corporation, Bluetooth Miniport Driver for HID Devices) 0xF79E2000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library) 0xF78D2000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension) 0xF799A000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver) 0xF7992000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver) 0xF7982000 C:\WINDOWS\system32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver) 0xF79EA000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver) 0xF7A0A000 C:\WINDOWS\system32\DRIVERS\BthEnum.sys 20480 bytes (Microsoft Corporation, Bluetooth Bus Extender) 0xF7A02000 C:\WINDOWS\System32\Drivers\BTHUSB.sys 20480 bytes (Microsoft Corporation, Bluetooth Miniport Driver) 0xF79F2000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver) 0xF78DA000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager) 0xF79B2000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library) 0xF79A2000 C:\WINDOWS\system32\DRIVERS\rasirda.sys 20480 bytes (Microsoft Corporation, IrDA WAN Miniport Driver) 0xF79BA000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver) 0xF79AA000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper) 0xF7A22000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver) 0xF7A6A000 C:\WINDOWS\system32\DRIVERS\BATTC.SYS 16384 bytes (Microsoft Corporation, Battery Class Driver) 0xF7378000 C:\WINDOWS\System32\Drivers\cdrbsdrv.SYS 16384 bytes (B.H.A Corporation, CD-ROM Filter Driver for Windows2000/xp) 0xF7B32000 C:\WINDOWS\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver) 0xBA324000 C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys 16384 bytes (Conexant, Diagnostic Interface DRIVER) 0xF7AEE000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver) 0xBA4F4000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver) 0xF7B4A000 C:\WINDOWS\system32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator) 0xF7B2E000 C:\WINDOWS\system32\DRIVERS\SMCLIB.SYS 16384 bytes (Microsoft Corporation, Smard Card Driver Library) 0xF7A62000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver) 0xF7A66000 compbatt.sys 12288 bytes (Microsoft Corporation, Composite Battery Driver) 0xF5DB8000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver) 0xF7B2A000 C:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices) 0xF7B4E000 C:\WINDOWS\system32\DRIVERS\irenum.sys 12288 bytes (Microsoft Corporation, Infra-Red Bus Enumerator) 0xF5DDC000 C:\WINDOWS\system32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver) 0xF736C000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver) 0xF626B000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver) 0xF7B0E000 C:\WINDOWS\System32\drivers\ws2ifsl.sys 12288 bytes (Microsoft Corporation, Winsock2 IFS Layer) 0xF7B84000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver) 0xF7B8E000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes 0xF7B82000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver) 0xF7B52000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL) 0xF7B86000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator) 0xF7B88000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport) 0xF7B7A000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator) 0xF7B80000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver) 0xF7B54000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll) 0xF7D41000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver) 0xF7C9F000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk) 0xF7CD0000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver) 0xF7C1A000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver) ============================================== >Stealth ============================================== ============================================== >Files ============================================== !-->[Hidden] C:\Documents and Settings\Shushi\Local Settings\Application Data\Mozilla\Firefox\Profiles\j1ok8789.default\Cache\6\D6\DA512d01 !-->[Hidden] C:\Documents and Settings\Shushi\Local Settings\Application Data\Mozilla\Firefox\Profiles\j1ok8789.default\Cache\8\54\64736d01 !-->[Hidden] C:\Documents and Settings\Shushi\Local Settings\Application Data\Mozilla\Firefox\Profiles\j1ok8789.default\Cache\8\F3\EC12Dd01 !-->[Hidden] C:\Documents and Settings\Shushi\Local Settings\Application Data\Mozilla\Firefox\Profiles\j1ok8789.default\Cache\B\4B\9ACDAd01 !-->[Hidden] C:\Documents and Settings\Shushi\Local Settings\Application Data\Mozilla\Firefox\Profiles\j1ok8789.default\Cache\B\76\5D66Ad01 !-->[Hidden] C:\Documents and Settings\Shushi\Local Settings\Application Data\Mozilla\Firefox\Profiles\j1ok8789.default\Cache\B\A7\8D2F4d01 !-->[Hidden] C:\Documents and Settings\Shushi\Local Settings\Application Data\Mozilla\Firefox\Profiles\j1ok8789.default\Cache\D\00\99FF6d01 !-->[Hidden] C:\Documents and Settings\Shushi\Local Settings\Application Data\Mozilla\Firefox\Profiles\j1ok8789.default\Cache\E\98\375DEd01 !-->[Hidden] C:\Documents and Settings\Shushi\Local Settings\Application Data\Mozilla\Firefox\Profiles\j1ok8789.default\Cache\F\CA\60330d01 !-->[Hidden] C:\Qoobox\BackEnv\AppData.folder.dat !-->[Hidden] C:\Qoobox\BackEnv\Cache.folder.dat !-->[Hidden] C:\Qoobox\BackEnv\Cookies.folder.dat !-->[Hidden] C:\Qoobox\BackEnv\Desktop.folder.dat !-->[Hidden] C:\Qoobox\BackEnv\Favorites.folder.dat !-->[Hidden] C:\Qoobox\BackEnv\History.folder.dat !-->[Hidden] C:\Qoobox\BackEnv\LocalAppData.folder.dat !-->[Hidden] C:\Qoobox\BackEnv\LocalSettings.folder.dat !-->[Hidden] C:\Qoobox\BackEnv\Music.folder.dat !-->[Hidden] C:\Qoobox\BackEnv\NetHood.folder.dat !-->[Hidden] C:\Qoobox\BackEnv\Personal.folder.dat !-->[Hidden] C:\Qoobox\BackEnv\Pictures.folder.dat !-->[Hidden] C:\Qoobox\BackEnv\PrintHood.folder.dat !-->[Hidden] C:\Qoobox\BackEnv\Profiles.Folder.dat !-->[Hidden] C:\Qoobox\BackEnv\Profiles.Folder.folder.dat !-->[Hidden] C:\Qoobox\BackEnv\Programs.folder.dat !-->[Hidden] C:\Qoobox\BackEnv\Recent.folder.dat !-->[Hidden] C:\Qoobox\BackEnv\SendTo.folder.dat !-->[Hidden] C:\Qoobox\BackEnv\SetPath.bat !-->[Hidden] C:\Qoobox\BackEnv\StartMenu.folder.dat !-->[Hidden] C:\Qoobox\BackEnv\StartUp.folder.dat !-->[Hidden] C:\Qoobox\BackEnv\SysPath.dat !-->[Hidden] C:\Qoobox\BackEnv\Templates.folder.dat !-->[Hidden] C:\Qoobox\BackEnv\VikPev00 !-->[Hidden] C:\System Volume Information\_restore{FD53617C-1BE7-4BA4-B533-968D01EFD2D4}\RP648\A0387029.lnk !-->[Hidden] C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb ============================================== >Hooks ============================================== ntkrnlpa.exe+0x0006ECEE, Type: Inline - RelativeJump 0x80545CEE-->80545CF5 [ntkrnlpa.exe] [1192]explorer.exe-->advapi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77DD1218-->00000000 [shimeng.dll] [1192]explorer.exe-->gdi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77F110B4-->00000000 [shimeng.dll] [1192]explorer.exe-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x01001268-->00000000 [shimeng.dll] [1192]explorer.exe-->shell32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7C9C15A4-->00000000 [shimeng.dll] [1192]explorer.exe-->user32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7E41133C-->00000000 [shimeng.dll] [1192]explorer.exe-->wininet.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x3D931480-->00000000 [shimeng.dll] [1192]explorer.exe-->ws2_32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x71AB109C-->00000000 [shimeng.dll] [3076]firefox.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->00000000 [firefox.exe] [3656]plugin-container.exe-->user32.dll-->GetWindowInfo, Type: Inline - RelativeJump 0x7E42C49C-->00000000 [xul.dll] [3656]plugin-container.exe-->user32.dll-->SetWindowLongA, Type: Inline - RelativeJump 0x7E42C29D-->00000000 [xul.dll] [3656]plugin-container.exe-->user32.dll-->SetWindowLongW, Type: Inline - RelativeJump 0x7E42C2BB-->00000000 [xul.dll] [3656]plugin-container.exe-->user32.dll-->TrackPopupMenu, Type: Inline - RelativeJump 0x7E46531E-->00000000 [xul.dll] Явно сме писали по едно и също време :))) Започвам по новите инструкции за ОТЛ. Дано стане бързичко, че доста време ви отнех и вече ми е гузно. ========== FILES ========== C:\Documents and Settings\Shushi\Application Data\Sun\Java\Deployment\cache\6.0\27\1e1baa9b-629e003c moved successfully. C:\Documents and Settings\Shushi\Application Data\Sun\Java\Deployment\cache\6.0\40\22548ce8-1dfaf263 moved successfully. ========== COMMANDS ========== OTL by OldTimer - Version 3.2.31.0 log created on 01122012_203303

На финалната права сме...следващата проверка е задължителна, но ще отнеме максимум 2-3 минути...

  • Изтеглете Malwarebytes' Anti-Malware оттук и я инсталирайте.
  • Стартирайте Malwarebytes' Anti-Malware и отидете на UPDATE и натиснете Check for updates.
  • След това се върнете на Scanner изберете Perform QUICK Scan, след това кликнете на Scan.
  • Сканирането ще отнеме малко време, затова моля бъдете търпеливи.
  • Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.
  • Уверете се, че на всички редове има отметки, и кликнете Remove Selected.
  • Когато всичко бъде премахнато, логът ще бъде отворен в Notepad. Копирайте лога и го публикувайте в следващия си коментар в темата.
Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

Ще пиша пак към 24.00, защото съм на работа, но предполагам днес ще завършим случая...вече останаха малко инструкции. :)

Как се държи системата в момента ? Наблюдавате ли някакви проблеми с Windows ?

  • Автор

Заемам се веднага. Честно казано, не забелязвам нещо различно или някакви проблеми, макар че моето мнение едва ли има значение. Отново големи благодарности за времето и указанията! Не ми се мислеше, какво би станало иначе и много се радвам, че явно всичко ще се оправи. След цяла година занимаване с глупости и за капак тези 2 вируса (или каквито са) накрая просто е кошмарно :( Ето и резултата: Malwarebytes Anti-Malware 1.60.0.1800 www.malwarebytes.org Database version: v2012.01.12.04 Windows XP Service Pack 3 x86 NTFS Internet Explorer 7.0.5730.13 Shushi :: D820 [administrator] 12.1.2012 г. 21:15:17 mbam-log-2012-01-12 (21-15-17).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 170743 Time elapsed: 7 minute(s), 23 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected)

Така и този излгежда наред.

Искам да повторим две бързи проверки преди финала.

СТЪПКА 1

  • Ако все още разполагате с файла Junction.exe в C:\Windows => отидете до Start => Run... => въведете командата отдолу с Copy/Paste и натиснете OK

    cmd /c junction -s c:\ >log.txt&log.txt& del log.txt

  • Изчакайте проверката да завърши и да се появи лог файла.
  • Копирайте съдържанието му в следващия си пост.

СТЪПКА 2

  • Изтеглете нова версия наПубликувано изображение и я запазете на вашия десктоп.
  • Стартирайте програмата и изберете 1. Натиснете Enter
  • Ще се появи лог файл с името RKreport[1].txt на вашия десктоп.
  • Копирайте съдържанието му в следващия си пост.
  • Автор

Заемам се :) Стъпка 1: Junction v1.06 - Windows junction creator and reparse point viewer Copyright © 2000-2010 Mark Russinovich Sysinternals - www.sysinternals.com Failed to open \\?\c:\\hiberfil.sys: The process cannot access the file because it is being used by another process. Failed to open \\?\c:\\pagefile.sys: The process cannot access the file because it is being used by another process. ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... . Failed to open \\?\c:\\Qoobox\BackEnv: Access is denied. .. ... ... ... ... .\\?\c:\\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a: JUNCTION Print Name : C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790 Substitute Name: C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790 .\\?\c:\\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a: JUNCTION Print Name : C:\WINDOWS\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e Substitute Name: C:\WINDOWS\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e . ... ... ...\\?\c:\\WINDOWS\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a: JUNCTION Print Name : C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492 Substitute Name: C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492 \\?\c:\\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35: JUNCTION Print Name : C:\WINDOWS\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5 Substitute Name: C:\WINDOWS\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5 ... ... ... ... ... ..\\?\c:\\_OTL\MovedFiles\01112012_161137\c_windows\$NtUninstallKB12524$\1670538081: SYMBOLIC LINK Print Name : c:\windows\system32\config Substitute Name: \systemroot\system32\config За стъпка 2 : Имам програмата на десктопа+папка RK_Quarantine+2 лога Как да процедирам?

Редактирано от Papadopoulos (преглед на промените)

Изтрийте вашата версия и изтеглете новата като кликнете на картинката (в предишния ми коментар). RK_Quarantine засега я оставете...имам нещо предвид. :)

  • Автор

Готово :) Ето лог-а: RogueKiller V6.2.4 [01/12/2012] by Tigzy mail: tigzyRK<at>gmail<dot>com Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/ Blog: http://tigzyrk.blogspot.com Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version Started in : Normal mode User: Shushi [Admin rights] Mode: Scan -- Date : 01/13/2012 01:01:43 ¤¤¤ Bad processes: 0 ¤¤¤ ¤¤¤ Registry Entries: 0 ¤¤¤ ¤¤¤ Particular Files / Folders: ¤¤¤ ¤¤¤ Driver: [LOADED] ¤¤¤ ¤¤¤ Infection : ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤ 127.0.0.1 localhost ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: +++++ --- User --- [MBR] dbc4ab13da5764983623fda5ebbf27ff [bSP] 11d467b9f31927f29d49c85858b51038 : Windows XP MBR Code Partition table: 0 - [XXXXXX] FAT16 [HIDDEN!] Offset (sectors): 63 | Size: 98 Mo 1 - [ACTIVE] NTFS [VISIBLE] Offset (sectors): 192780 | Size: 31453 Mo 2 - [XXXXXX] UNKNW [VISIBLE] Offset (sectors): 61625340 | Size: 48471 Mo User = LL1 ... OK! User = LL2 ... OK! Finished : << RKreport[3].txt >> RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt

Перфектно, мисля че сме готови !

Моля архивирайте папката RK_Quarantine и я качете на адрес http://file.bg/

Публикувайте линк за да я изтегля и след това я изтрийте (и архива и самата папка).

Изтрийте ги и от кошчето (Recycle Bin-a).

Инсталирайте следните актуализации за програмите:

Mozilla Firefox 9.0.1 Final за Windows на български

Java SE Runtime Environment 6 Update 30

Рестартирайте компютъра.

Да почистим използваните от нас неща:

Отворете Start Menu = Run => въведете командата Combofix /Uninstall (има празно място между Combofix и /Uninstall).

Натиснете Enter.

Това ще деинсталира Combofix, ще изтрие файловете асоциирани с инструмента, ще изтрие карантинната папка - C:\Qoobox и всички логове и накрая ще се самоизтрие.

По време на процеса ще почисти и старите точки на System Restore.

След това стартирайте OTL.exe още веднъж и натиснете бутона CleanUp!

Публикувано изображение

Рестартирайте компютъра, ако ви попита!

Изтрийте ръчно всички инструменти и логове и папки които не са се изтрили при по-горните процедури.

SystemLook, junction, aswMBR, TDSSKiller, RogueKiller, GrantPerm, GMER, Rootkit Unhooker деинсталирайте Erunt, стартирайте DeFogger и изберете Re-enable.

Оставете си Malwarebytes' Anti-Malware за профилактични проверки. Сега вече можете да преинсталирате антивирусната си програма avast! или друга която ви харесва (но само 1 на брой).

Добре е да смените всички налични пароли използвани на машината (пароли за ел.поща, за различни сайтове и форуми, потребителската парола на потребителския акаунт и т.н.) за всеки случай, защото не се знае каква информация е откраднал рууткита.

Беше ми изключително приятно да работя с вас. Публикувано изображение Перфектно се справихте с инструкциите и най-важното не се уморихте и отказахте да съдействате в малките часове на нощта. :)

Желая ви приятен weekend и безопасно сърфиране. Ще оставя още известно време темета с това заглавие в случай, че имате още въпроси...и след това ще я маркирам като [РЕШЕН]-a.

Лека Вечер ! :bye1:

  • Автор

Аз нямам думи просто! Дали има начин да ви пиша на ЛС или на мейл някакъв? Започвам с последните инструкции :) Линк към вируса :

Редактирано от B-boy[StyLe]
Премахната опасна папка. :) (преглед на промените)

Аз нямам думи просто! Дали има начин да ви пиша на ЛС или на мейл някакъв?

Разбира се, че можете...по всякакви въпроси, но по какъв повод ? :)

Благодаря за папката...ще я премахна за да не пострада някой...

  • Автор

Искам да попитам нещо лично, ако може... предполагам във форума има опция за лично съобщение?

  • Автор

Ей сега ще пиша, само да довърша със задачите от по-горе. Редакция: Стана нещо странно... :no-no: Имам C:\ComboFix , което е все едно My Computer Прикачвам 2 скриийншота.

post-316482-0-23258500-1326413547_thumb.

post-316482-0-54866600-1326413556_thumb.

Редактирано от Papadopoulos (преглед на промените)

Това се получава, когато Combofix не е завършил проверката си както трябва предишния път. Ако не ста качили все още avast! можете да изтеглите нова версия на Combofix и да стартирате проверката. След като тя завърши би трябвало този проблем да се реши и след това да можете да го деинсталирате по-описания по-горе начин...не го трийте ръчно, защото може да се създаде проблем. Направено е нарочно, но е тайна и не мога да кажа защо...

  • Автор

Започвам по инструкциите и ще пиша за резултата. Предполагам,че отново сканирането ще е дълго, така че ще помоля да не се заключва темата, за да мога да кажа какво е станало :)

  • Автор

Ето лог-а от новото сканиране: ComboFix 12-01-12.04 - Shushi 01.2012 г. 2:53.7.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.1022.373 [GMT -8:00] Running from: c:\documents and settings\Shushi\Desktop\ComboFix.exe . . ((((((((((((((((((((((((( Files Created from 2011-12-13 to 2012-01-13 ))))))))))))))))))))))))))))))) . . 2012-01-13 11:01 . 2012-01-13 11:01 -------- d-----w- c:\windows\LastGood 2012-01-13 09:40 . 2012-01-13 09:40 476904 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll 2012-01-13 09:40 . 2012-01-13 09:40 73728 ----a-w- c:\windows\system32\javacpl.cpl 2012-01-13 09:40 . 2012-01-13 09:40 472808 ----a-w- c:\windows\system32\deployJava1.dll 2012-01-13 09:35 . 2011-12-21 07:38 43992 ----a-w- c:\program files\Mozilla Firefox\mozutils.dll 2012-01-13 09:35 . 2011-12-21 04:29 626688 ----a-w- c:\program files\Mozilla Firefox\msvcr80.dll 2012-01-13 09:35 . 2011-12-21 04:29 548864 ----a-w- c:\program files\Mozilla Firefox\msvcp80.dll 2012-01-13 09:35 . 2011-12-21 04:29 479232 ----a-w- c:\program files\Mozilla Firefox\msvcm80.dll 2012-01-13 05:12 . 2011-12-10 23:24 20464 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-01-11 22:49 . 2010-09-07 23:39 150392 ----a-w- c:\windows\junction.exe 2012-01-11 00:49 . 2012-01-12 00:33 -------- d-----w- c:\program files\sms 2012-01-10 14:35 . 2012-01-13 09:03 111872 ----a-w- c:\windows\system32\drivers\TrueSight.sys . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-12-27 22:20 . 2008-04-14 00:45 64512 ----a-w- c:\windows\system32\drivers\serial.sys 2011-11-23 13:25 . 2008-04-14 01:00 1859584 ----a-w- c:\windows\system32\win32k.sys 2011-11-01 16:07 . 2008-04-14 05:42 1288704 ----a-w- c:\windows\system32\ole32.dll 2011-10-31 23:43 . 2008-04-23 11:39 832512 ----a-w- c:\windows\system32\wininet.dll 2011-10-31 23:43 . 2008-04-23 11:39 1830912 ----a-w- c:\windows\system32\inetcpl.cpl 2011-10-31 23:43 . 2008-04-23 11:38 78336 ----a-w- c:\windows\system32\ieencode.dll 2011-10-31 23:43 . 2008-04-23 11:38 17408 ----a-w- c:\windows\system32\corpol.dll 2011-10-28 05:31 . 2008-04-14 05:41 33280 ----a-w- c:\windows\system32\csrsrv.dll 2011-10-25 13:37 . 2008-04-14 00:54 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe 2011-10-25 12:52 . 2008-04-13 21:01 2027008 ----a-w- c:\windows\system32\ntkrnlpa.exe 2011-10-18 11:13 . 2008-04-14 05:41 186880 ----a-w- c:\windows\system32\encdec.dll 2011-12-21 07:38 . 2011-08-18 12:33 121816 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ------- Sigcheck ------- Note: Unsigned files aren't necessarily malware. . [-] 2008-04-23 . 362BC5AF8EAF712832C58CC13AE05750 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-04-19 484904] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-05-04 149040] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-08-18 39408] "DAEMON Tools Lite"="d:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-01-19 7401472] "nwiz"="nwiz.exe" [2006-01-19 1519616] "NVHotkey"="nvHotkey.dll" [2006-01-19 73728] "Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-07 176128] "SigmatelSysTrayApp"="stsystra.exe" [2005-11-16 397312] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-05-04 161328] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792] "LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2010-05-08 165208] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] . c:\documents and settings\All Users\Start Menu\Programs\Startup\ STK02H 2.3 PNP Monitor.lnk - c:\windows\STK02H\STK02HM.exe [2010-5-30 163840] STK02N 2.4 PNP Monitor.lnk - c:\windows\STK02N\STK02NM.exe [2010-5-30 163840] . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "d:\\Program Files\\WinHTTrack\\WinHTTrack.exe"= "c:\\Documents and Settings\\Shushi\\temp\\TeamViewer\\Version5\\TeamViewer.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "7001:TCP"= 7001:TCP:BitComet 7001 TCP "7001:UDP"= 7001:UDP:BitComet 7001 UDP . R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [07.11.2010 г. 11:00 691696] S0 Si3124;Si3124; [x] S0 Si3531;Si3531; [x] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 г. 12:16 130384] S3 camvid20;Philips ToUcam Camera; Video;c:\windows\system32\drivers\camdrv21.sys [03.5.2010 г. 19:46 223232] S3 Normandy;Normandy SR2; [x] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 г. 12:16 753504] . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2007-04-19 21:23 452136 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.bg/ uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Sothink SWF Catcher - c:\program files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm TCP: DhcpNameServer = 84.54.128.6 192.168.4.1 DPF: {CAFECAFE-0013-0001-0028-ABCDEFABCDEF} FF - ProfilePath - c:\documents and settings\Shushi\Application Data\Mozilla\Firefox\Profiles\j1ok8789.default\ FF - prefs.js: browser.startup.homepage - google.bg FF - prefs.js: keyword.URL - hxxp://www.google.com/search?sourceid=navclient&hl=bg&q= . - - - - ORPHANS REMOVED - - - - . AddRemove-{E1E502E2-C006-49DB-9C0C-F2196E51826F}_is1 - c:\documents and settings\Shushi\Desktop\RkU3.8.388.590\MustBeRandomlyNamed\unins000.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-01-13 03:01 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'explorer.exe'(3492) c:\windows\system32\WININET.dll c:\windows\system32\ieframe.dll . Completion time: 2012-01-13 03:05:30 ComboFix-quarantined-files.txt 2012-01-13 11:05 . Pre-Run: 5 571 600 384 bytes free Post-Run: 5 411 696 640 bytes free . - - End Of File - - B3506899BA470E5A74477D7FCFE98680 Сега ще деинсталирам комбофикс-а по указания начин и дано всичко е ОК :)

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.