Проблем със отваряне на теми в сайт

6 април 201313 г.

Автор

Както сами виждате логовете са чисти вече.

1. Засечените обекти от MBAM са просто за изключените предупреждения в Security Center-a (най-вероятно от вас), но тъй като MBAM няма как да знае дали не са изключени от зловреден код тя връща настройките им по-подразбиране. Нищо особено и опасно.

2. Засечентие неща от ESET - са или в System Restore (оттам не могат да навредят докато не се използва стара и инфектирана точка за възстановяване на системата)...след деинсталацията на Combofix - стартите точки за възстановяване ще бъдат почистени автоматично. Останалите обекти се намират в карантинните папки на Combofix - C:Qoobox и на OTL - C:_OTLMovedFiles.

Другите обекти са безобидни файлчета наблъскани със "екстри" при инсталиране, кракове, кейгенератори и прочие. Т.е. ако проблема продължава то, той не би трябвало да се дължи на зловреден софтуер. Но все пак да проверим още някои неща:

3. Занулихме hosts файла за всеки случай, премахнахме DNS кеша и оправихме winsock LSP Chains записите, почистихме и временните файлове натрупани от браузърите. Преди да ви насоча към по-крупни мерки като преинсталация на браузърите, разговор с доставчика ви за интернет, преинсталация на Операционната Система, нека да опитаме още някои неща:

СТЪПКА 1

Изтеглете Gmer

[*]Временно изключете интернет достъпа си, всички работещи програми (включително и антивирусната си програма и браузъра).

[*]Стартирайте програмата.

[*]След завършването на автоматичната проверка, махнете отметките от следните позиции:

- IAT/EAT

- Show all

- махнете отметките от всички локални дискове. Маркирайте само системния дял (обикновенно това е C: )

[*]Натиснете бутона Scan

[*]Изчакайте програмата да завърши сканирането,след което натиснете бутона Save и запишете (save as) резултатите на десктопа с име Gmer.log.

[*]Включете Интернета си и прикачете Gmer.log в следващия си коментар.

Забележка:

[*]Не предприемайте никакви действия върху редовете маркирани с "<--- ROOТKIT" ,защото това може да доведе до проблеми с Windows.

СТЪПКА 2

Моля изтеглете Farbar Service Scanner и я стартирайте.

Сложете всички отметки и натиснете бутона "Scan".

Ще се създаде лог файл с името (FSS.txt) в папката откъдето стартирате инструмента.

Прикачете лог файла в следващия си пост.

СТЪПКА 3

[*]Изтеглете MiniToolBox.exe и го запазете на десктопа.

[*]Сложете всички отметки и натиснете Go.

[*]Прикачете лог файла Result.txt в следващия си пост.

GMER 2.1.19163 - http://www.gmer.net

Rootkit scan 2013-04-06 07:45:10

Windows 5.1.2600 Service Pack 3 DeviceHarddisk0DR0 -> DeviceIdeIdeDeviceP2T0L0-5 ST1000DM005_HD103SJ rev.1AJ10001 931,51GB

Running: gmer.exe; Driver: C:DOCUME~1ADMINI~1LOCALS~1Tempfxndykog.sys

---- System - GMER 2.1 ----

SSDT SystemRootSystem32DriversaswSP.SYS ZwClose [0xB41306B8]

SSDT SystemRootSystem32DriversaswSP.SYS ZwCreateKey [0xB4130574]

SSDT SystemRootSystem32DriversaswSP.SYS ZwDeleteValueKey [0xB4130A52]

SSDT SystemRootSystem32DriversaswSP.SYS ZwDuplicateObject [0xB413014C]

SSDT SystemRootSystem32DriversaswSP.SYS ZwOpenKey [0xB413064E]

SSDT SystemRootSystem32DriversaswSP.SYS ZwOpenProcess [0xB413008C]

SSDT SystemRootSystem32DriversaswSP.SYS ZwOpenThread [0xB41300F0]

SSDT SystemRootSystem32DriversaswSP.SYS ZwQueryValueKey [0xB413076E]

SSDT SystemRootSystem32DriversaswSP.SYS ZwRestoreKey [0xB413072E]

SSDT SystemRootSystem32DriversaswSP.SYS ZwSetValueKey [0xB41308AE]

---- Kernel code sections - GMER 2.1 ----

.text C:WINDOWSsystem32DRIVERSnv4_mini.sys section is writeable [0xB6F553C0, 0x70A9FA, 0xE8000020]

---- Devices - GMER 2.1 ----

AttachedDevice FileSystemNtfs Ntfs aswMon2.SYS

AttachedDevice DriverTcpip DeviceIp aswTdi.SYS

---- Registry - GMER 2.1 ----

Reg HKLMSYSTEMCurrentControlSetControlVideo{9ADA122F-167B-4151-AF84-12CF75641A19}0000@D3D_x3332x3331 2089309684

Reg HKLMSYSTEMCurrentControlSetControlVideo{FBEF0777-8339-429B-A25E-830ACBA2E762}0000@D3D_x3332x3331 2089309684

Reg HKLMSYSTEMCurrentControlSetServicesBTHPORTParametersKeys013605219852

Reg HKLMSYSTEMCurrentControlSetServicesBTHPORTParametersKeys013605219852@00bd3a2d4e60 0xE6 0x9C 0xC0 0x85 ...

Reg HKLMSYSTEMCurrentControlSetServicesSharedAccessEpoch@Epoch 11504

Reg HKLMSYSTEMControlSet002ControlVideo{9ADA122F-167B-4151-AF84-12CF75641A19}0000@D3D_x3332x3331 2089309684

Reg HKLMSYSTEMControlSet002ControlVideo{FBEF0777-8339-429B-A25E-830ACBA2E762}0000@D3D_x3332x3331 2089309684

Reg HKLMSYSTEMControlSet002ServicesBTHPORTParametersKeys013605219852 (not active ControlSet)

Reg HKLMSYSTEMControlSet002ServicesBTHPORTParametersKeys013605219852@00bd3a2d4e60 0xE6 0x9C 0xC0 0x85 ...

---- EOF - GMER 2.1 ----

Farbar Service Scanner Version: 03-03-2013

Ran by Administrator (administrator) on 06-04-2013 at 07:48:18

Running from "C:Documents and SettingsAdministratorDesktop"

Microsoft Windows XP Service Pack 3 (X86)

Boot Mode: Normal

****************************************************************

Internet Services:

============

Connection Status:

==============

Localhost is accessible.

LAN connected.

Google IP is accessible.

Google.com is accessible.

Attempt to access Yahoo IP returned error. Yahoo IP is offline

Yahoo.com is accessible.

Windows Firewall:

=============

Firewall Disabled Policy:

==================

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfile]

"EnableFirewall"=DWORD:0

System Restore:

============

System Restore Disabled Policy:

========================

Security Center:

============

Windows Update:

============

Windows Autoupdate Disabled Policy:

============================

File Check:

========

C:WINDOWSsystem32dhcpcsvc.dll => MD5 is legit

C:WINDOWSsystem32Driversafd.sys => MD5 is legit

C:WINDOWSsystem32Driversnetbt.sys => MD5 is legit

C:WINDOWSsystem32Driverstcpip.sys => MD5 is legit

C:WINDOWSsystem32Driversipsec.sys => MD5 is legit

C:WINDOWSsystem32dnsrslvr.dll => MD5 is legit

C:WINDOWSsystem32ipnathlp.dll => MD5 is legit

C:WINDOWSsystem32netman.dll => MD5 is legit

C:WINDOWSsystem32wbemWMIsvc.dll => MD5 is legit

C:WINDOWSsystem32srsvc.dll => MD5 is legit

C:WINDOWSsystem32Driverssr.sys => MD5 is legit

C:WINDOWSsystem32wscsvc.dll => MD5 is legit

C:WINDOWSsystem32wbemWMIsvc.dll => MD5 is legit

C:WINDOWSsystem32wuauserv.dll

[2013-03-14 15:36] - [2008-04-14 15:00] - 0006656 ____A (Microsoft Corporation) 35321FB577CDC98CE3EB3A3EB9E4610A

C:WINDOWSsystem32qmgr.dll => MD5 is legit

C:WINDOWSsystem32es.dll => MD5 is legit

C:WINDOWSsystem32cryptsvc.dll => MD5 is legit

C:WINDOWSsystem32svchost.exe => MD5 is legit

C:WINDOWSsystem32rpcss.dll => MD5 is legit

C:WINDOWSsystem32services.exe

[2008-04-14 15:00] - [2009-02-06 14:11] - 0110592 ____A (Microsoft Corporation) 65DF52F5B8B6E9BBD183505225C37315

Extra List:

=======

aswTdi(9) Gpc(4) IPSec(6) NetBT(7) PSched(8) RFCOMM(3) Tcpip(5)

0x09000000060000000100000002000000030000000400000005000000090000000700000008000000

IpSec Tag value is correct.

**** End of log ****

MiniToolBox by Farbar Version:05-03-2013

Ran by Administrator (administrator) on 06-04-2013 at 07:49:16

Running from "C:Documents and SettingsAdministratorDesktop"

Microsoft Windows XP Service Pack 3 (X86)

Boot Mode: Normal

***************************************************************************

========================= Flush DNS: ===================================

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========================= IE Proxy Settings: ==============================

Proxy is not enabled.

No Proxy Server is set.

"Reset IE Proxy Settings": IE Proxy Settings were reset.

========================= FF Proxy Settings: ==============================

"Reset FF Proxy Settings": Firefox Proxy settings were reset.

========================= Hosts content: =================================

::1 localhost

127.0.0.1 localhost

========================= IP Configuration: ================================

Realtek RTL8168D(P)/8111D(P) PCI-E Gigabit Ethernet NIC = Local Area Connection (Connected)

Bluetooth Device (Personal Area Network) = Bluetooth мрежова връзка (Media disconnected)

# ----------------------------------

# Interface IP Configuration

# ----------------------------------

pushd interface ip

# Interface IP Configuration for "Bluetooth мрежова връзка"

set address name="Bluetooth мрежова връзка" source=dhcp

set dns name="Bluetooth мрежова връзка" source=dhcp register=PRIMARY

set wins name="Bluetooth мрежова връзка" source=dhcp

# Interface IP Configuration for "Local Area Connection"

set address name="Local Area Connection" source=static addr=10.1.33.26 mask=255.255.255.0

set address name="Local Area Connection" gateway=10.1.33.1 gwmetric=0

set dns name="Local Area Connection" source=static addr=10.0.0.100 register=PRIMARY

set wins name="Local Area Connection" source=static addr=none

popd

# End of interface IP configuration

Windows IP Configuration

Host Name . . . . . . . . . . . . : atakata-59c475e

Primary Dns Suffix . . . . . . . :

Node Type . . . . . . . . . . . . : Unknown

IP Routing Enabled. . . . . . . . : No

WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Bluetooth мрежова връзка:

Media State . . . . . . . . . . . : Media disconnected

Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network) #2

Physical Address. . . . . . . . . : 01-36-05-21-98-52

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : Realtek RTL8168D(P)/8111D(P) PCI-E Gigabit Ethernet NIC

Physical Address. . . . . . . . . : 00-25-22-EA-A7-0C

Dhcp Enabled. . . . . . . . . . . : No

IP Address. . . . . . . . . . . . : 10.1.33.26

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 10.1.33.1

DNS Servers . . . . . . . . . . . : 10.0.0.100

Server: UnKnown

Address: 10.0.0.100

Name: google.com

Addresses: 173.194.39.225, 173.194.39.224, 173.194.39.227, 173.194.39.228

173.194.39.238, 173.194.39.231, 173.194.39.226, 173.194.39.230, 173.194.39.229

173.194.39.232, 173.194.39.233

Pinging google.com [173.194.39.233] with 32 bytes of data:

Reply from 173.194.39.233: bytes=32 time=15ms TTL=57

Ping statistics for 173.194.39.233:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 15ms, Maximum = 15ms, Average = 15ms

Server: UnKnown

Address: 10.0.0.100

Name: yahoo.com

Addresses: 98.138.253.109, 98.139.183.24, 206.190.36.45

Pinging yahoo.com [206.190.36.45] with 32 bytes of data:

Reply from 206.190.36.45: bytes=32 time=219ms TTL=50

Reply from 206.190.36.45: bytes=32 time=253ms TTL=50

Ping statistics for 206.190.36.45:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 219ms, Maximum = 253ms, Average = 236ms

Pinging 127.0.0.1 with 32 bytes of data:

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Ping statistics for 127.0.0.1:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 0ms, Average = 0ms

===========================================================================

Interface List

0x1 ........................... MS TCP Loopback interface

0x10004 ...01 36 05 21 98 52 ...... Bluetooth Device (Personal Area Network) #2

0x30002 ...00 25 22 ea a7 0c ...... Realtek RTL8168D(P)/8111D(P) PCI-E Gigabit Ethernet NIC - Packet Scheduler Miniport

===========================================================================

Active Routes:

Network Destination Netmask Gateway Interface Metric

0.0.0.0 0.0.0.0 10.1.33.1 10.1.33.26 20

10.1.33.0 255.255.255.0 10.1.33.26 10.1.33.26 20

10.1.33.26 255.255.255.255 127.0.0.1 127.0.0.1 20

10.255.255.255 255.255.255.255 10.1.33.26 10.1.33.26 20

127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1

224.0.0.0 240.0.0.0 10.1.33.26 10.1.33.26 20

255.255.255.255 255.255.255.255 10.1.33.26 10.1.33.26 1

255.255.255.255 255.255.255.255 10.1.33.26 10004 1

Default Gateway: 10.1.33.1

===========================================================================

Persistent Routes:

None

========================= Winsock entries =====================================

Catalog5 01 C:WindowsSystem32mswsock.dll [245248] (Microsoft Corporation)

Catalog5 02 C:WindowsSystem32winrnr.dll [16896] (Microsoft Corporation)

Catalog5 03 C:WindowsSystem32mswsock.dll [245248] (Microsoft Corporation)

Catalog5 04 C:Windowssystem32wshbth.dll [108032] (Microsoft Corporation)

Catalog9 01 C:Windowssystem32mswsock.dll [245248] (Microsoft Corporation)

Catalog9 02 C:Windowssystem32mswsock.dll [245248] (Microsoft Corporation)

Catalog9 03 C:Windowssystem32mswsock.dll [245248] (Microsoft Corporation)

Catalog9 04 C:Windowssystem32mswsock.dll [245248] (Microsoft Corporation)

Catalog9 05 C:Windowssystem32mswsock.dll [245248] (Microsoft Corporation)

Catalog9 06 C:Windowssystem32mswsock.dll [245248] (Microsoft Corporation)

Catalog9 07 C:Windowssystem32mswsock.dll [245248] (Microsoft Corporation)

Catalog9 08 C:Windowssystem32mswsock.dll [245248] (Microsoft Corporation)

Catalog9 09 C:Windowssystem32mswsock.dll [245248] (Microsoft Corporation)

Catalog9 10 C:Windowssystem32mswsock.dll [245248] (Microsoft Corporation)

Catalog9 11 C:Windowssystem32mswsock.dll [245248] (Microsoft Corporation)

Catalog9 12 C:Windowssystem32mswsock.dll [245248] (Microsoft Corporation)

Catalog9 13 C:Windowssystem32mswsock.dll [245248] (Microsoft Corporation)

Catalog9 14 C:Windowssystem32mswsock.dll [245248] (Microsoft Corporation)

Catalog9 15 C:Windowssystem32mswsock.dll [245248] (Microsoft Corporation)

Catalog9 16 C:Windowssystem32mswsock.dll [245248] (Microsoft Corporation)

Catalog9 17 C:Windowssystem32rsvpsp.dll [92672] (Microsoft Corporation)

Catalog9 18 C:Windowssystem32rsvpsp.dll [92672] (Microsoft Corporation)

========================= Event log errors: ===============================

Application errors:

==================

Error: (04/05/2013 11:23:54 AM) (Source: Application Hang) (User: )

Description: Hanging application AIMP3.exe, version 3.5.0.1237, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (04/05/2013 08:29:22 AM) (Source: MsiInstaller) (User: ATAKATA-59C475E)

Description: Product: ICA -- Error 1706.No valid source could be found for product ICA. The Windows Installer cannot continue.

Error: (04/05/2013 08:29:22 AM) (Source: MsiInstaller) (User: ATAKATA-59C475E)

Description: Product: ISCOM -- Error 1706.No valid source could be found for product ISCOM. The Windows Installer cannot continue.

Error: (04/05/2013 08:29:21 AM) (Source: MsiInstaller) (User: ATAKATA-59C475E)

Description: Product: IPM_VS_Pro -- Error 1706.No valid source could be found for product IPM_VS_Pro. The Windows Installer cannot continue.

Error: (04/05/2013 08:29:21 AM) (Source: MsiInstaller) (User: ATAKATA-59C475E)

Description: Product: VSPro -- Error 1706.No valid source could be found for product VSPro. The Windows Installer cannot continue.

Error: (04/05/2013 08:29:21 AM) (Source: MsiInstaller) (User: ATAKATA-59C475E)

Description: Product: VSClassic -- Error 1706.No valid source could be found for product VSClassic. The Windows Installer cannot continue.

Error: (04/05/2013 08:29:21 AM) (Source: MsiInstaller) (User: ATAKATA-59C475E)

Description: Product: Contents -- Error 1706.No valid source could be found for product Contents. The Windows Installer cannot continue.

Error: (04/05/2013 08:29:21 AM) (Source: MsiInstaller) (User: ATAKATA-59C475E)

Description: Product: Share -- Error 1706.No valid source could be found for product Share. The Windows Installer cannot continue.

Error: (04/05/2013 08:29:20 AM) (Source: MsiInstaller) (User: ATAKATA-59C475E)

Description: Product: DeviceIO -- Error 1706.No valid source could be found for product DeviceIO. The Windows Installer cannot continue.

Error: (04/05/2013 08:29:20 AM) (Source: MsiInstaller) (User: ATAKATA-59C475E)

Description: Product: Common -- Error 1706.No valid source could be found for product Common. The Windows Installer cannot continue.

System errors:

=============

Error: (04/05/2013 01:07:07 PM) (Source: 0) (User: )