Добър вечер,

От вчерa рaзбрaх,че нa компютърa ми имa rootkit tdss v2,пробрaх с рaзлични прогрaми дa го премaхнa,но прогрaмите не могaт дa го изтрият,моля ви помогнете ми.

 

Като за начало посетете този форум и дайте нужните логове 

Системата ми е инфектирана - Какво да правя сега?

Сaмо дa кaжa,че е нaмерен от Pc tool spyware Doctor.

Уж го трие и след рестaртa нa системaтa при скaнирaне е пaк го нaмирa rootkit tdss v2

Ясно. Тоз инструмент отдавна май не съществува. И не беше нищо особено още навремето.

Знaчи,може би е фaлшивa тревогa?

 

Искате да се свърши работа или да си философствате?

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 01-01-2017
Ran by Lenovo (administrator) on LENOVO-M57 (03-01-2017 19:17:17)
Running from C:\Users\Lenovo\Desktop
Loaded Profiles: Lenovo &  (Available Profiles: Lenovo)
Platform: Microsoft Windows 7 Ultimate  Service Pack 1 (X86) Language: English (United States)
Internet Explorer Version 9 (Default browser not detected!)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
(Intel) C:\Program Files\Intel\AMT\LMS.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
(PC Tools) C:\Program Files\PC Tools Security\pctsAuxs.exe
(PC Tools) C:\Program Files\PC Tools Security\pctsSvc.exe
(Elaborate Bytes AG) C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Intel) C:\Program Files\Intel\AMT\UNS.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(PC Tools) C:\Program Files\PC Tools Security\pctsGui.exe
(© 2015 Microsoft Corporation) C:\Users\Lenovo\AppData\Local\Microsoft\BingSvc\BingSvc.exe
(BitTorrent Inc.) C:\Users\Lenovo\AppData\Roaming\uTorrent\uTorrent.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(BitTorrent Inc.) C:\Users\Lenovo\AppData\Roaming\uTorrent\updates\3.4.9_43085\utorrentie.exe
(BitTorrent Inc.) C:\Users\Lenovo\AppData\Roaming\uTorrent\updates\3.4.9_43085\utorrentie.exe
(Malwarebytes Corp.) C:\Users\Lenovo\Downloads\mbar-1.09.3.1001.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Malwarebytes) C:\Users\Lenovo\mbar\mbar.exe
(AO Kaspersky Lab) C:\Program Files\Kaspersky Lab\Kaspersky Secure Connection 1.0\ksde.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.32.7\GoogleCrashHandler.exe
(AO Kaspersky Lab) C:\Program Files\Kaspersky Lab\Kaspersky Secure Connection 1.0\ksdeui.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [VirtualCloneDrive] => C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [52168 2008-06-30] (Elaborate Bytes AG)
HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [31072 2008-10-25] (Microsoft Corporation)
HKLM\...\Run: [IntelliType Pro] => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1093232 2012-11-02] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [1668720 2012-11-02] (Microsoft Corporation)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2776528 2016-12-14] (Malwarebytes)
HKLM\...\Run: [ISTray] => C:\Program Files\PC Tools Security\pctsGui.exe [2659768 2012-02-24] (PC Tools)
HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\SCRNSAVE.EXE -> 
HKU\S-1-5-19\Control Panel\Desktop\\SCRNSAVE.EXE -> 
HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\SCRNSAVE.EXE -> 
HKU\S-1-5-20\Control Panel\Desktop\\SCRNSAVE.EXE -> 
HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\SCRNSAVE.EXE -> 
HKU\S-1-5-21-3177353502-1200057031-3452676348-1000\...\Run: [BingSvc] => C:\Users\Lenovo\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-11-05] (© 2015 Microsoft Corporation)
HKU\S-1-5-21-3177353502-1200057031-3452676348-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [6868696 2016-08-26] (Piriform Ltd)
HKU\S-1-5-21-3177353502-1200057031-3452676348-1000\...\Run: [uTorrent] => C:\Users\Lenovo\AppData\Roaming\uTorrent\uTorrent.exe [2237120 2016-12-24] (BitTorrent Inc.)
HKU\S-1-5-21-3177353502-1200057031-3452676348-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> 
HKU\S-1-5-21-3177353502-1200057031-3452676348-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [BingSvc] => C:\Users\Lenovo\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-11-05] (© 2015 Microsoft Corporation)
HKU\S-1-5-21-3177353502-1200057031-3452676348-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [6868696 2016-08-26] (Piriform Ltd)
HKU\S-1-5-21-3177353502-1200057031-3452676348-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [uTorrent] => C:\Users\Lenovo\AppData\Roaming\uTorrent\uTorrent.exe [2237120 2016-12-24] (BitTorrent Inc.)
HKU\S-1-5-21-3177353502-1200057031-3452676348-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\SCRNSAVE.EXE -> 
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE -> 

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{2CAD80F3-8458-4D63-B7C4-9FA04BAA64C3}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-3177353502-1200057031-3452676348-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-3177353502-1200057031-3452676348-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3177353502-1200057031-3452676348-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3177353502-1200057031-3452676348-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
URLSearchHook: HKU\S-1-5-21-3177353502-1200057031-3452676348-1000 - (No Name) - {472734EA-242A-422b-ADF8-83D1E48CC825} -  No File
URLSearchHook: HKU\S-1-5-21-3177353502-1200057031-3452676348-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 - (No Name) - {472734EA-242A-422b-ADF8-83D1E48CC825} -  No File
SearchScopes: HKU\S-1-5-21-3177353502-1200057031-3452676348-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3177353502-1200057031-3452676348-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12] (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO: No Name -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> No File
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2009-02-12] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Lenovo\AppData\Roaming\Mozilla\Firefox\Profiles\dprrhxmn.default-1477313755779 [2017-01-03]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_24_0_0_186.dll [2016-12-24] ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1224194.dll [2016-02-19] (Adobe Systems, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.17.2 -> C:\Windows\system32\npDeployJava1.dll [2016-10-15] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\3.0.40818.0\npctrl.dll [2009-08-17] ( Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-24] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-24] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-10-01] (Adobe Systems Inc.)

Chrome: 
=======
CHR Profile: C:\Users\Lenovo\AppData\Local\Google\Chrome\User Data\Default [2017-01-03]
CHR Extension: (Google Презентации) - C:\Users\Lenovo\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-10-11]
CHR Extension: (Google Документи) - C:\Users\Lenovo\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-10-11]
CHR Extension: (Google Диск) - C:\Users\Lenovo\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-10-11]
CHR Extension: (YouTube) - C:\Users\Lenovo\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-08-03]
CHR Extension: (Електронни таблици от Google) - C:\Users\Lenovo\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-08-03]
CHR Extension: (Google Документи офлайн) - C:\Users\Lenovo\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-08-03]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\Lenovo\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-08-03]
CHR Extension: (Gmail) - C:\Users\Lenovo\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-08-03]
CHR Extension: (Chrome Media Router) - C:\Users\Lenovo\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-12-24]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2241992 2016-12-14] (ESET)
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
R2 KSDE1.0.0; C:\Program Files\Kaspersky Lab\Kaspersky Secure Connection 1.0\ksde.exe [241544 2016-06-28] (AO Kaspersky Lab)
R2 LMS; C:\Program Files\Intel\AMT\LMS.exe [102400 2009-12-01] (Intel) [File not signed]
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [3381200 2016-12-14] (Malwarebytes)
R2 sdAuxService; C:\Program Files\PC Tools Security\pctsAuxs.exe [402336 2012-02-24] (PC Tools)
R2 sdCoreService; C:\Program Files\PC Tools Security\pctsSvc.exe [1117624 2012-02-24] (PC Tools)
S3 ThreatFire; C:\Program Files\PC Tools Security\TFEngine\TFService.exe [71008 2012-02-24] (PC Tools)
R2 UNS; C:\Program Files\Intel\AMT\UNS.exe [2519040 2009-12-01] (Intel) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
S3 DMZHF; C:\Users\Lenovo\AppData\Local\Temp\DMZHF.exe [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 ADIHdAudAddService; C:\Windows\System32\drivers\ADIHdAud.sys [381440 2009-08-05] (Analog Devices, Inc.) [File not signed]
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [113544 2016-12-13] (ESET)
R0 edevmon; C:\Windows\System32\DRIVERS\edevmon.sys [91104 2016-12-13] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [140984 2016-12-13] (ESET)
R1 ElbyCDIO; C:\Windows\System32\Drivers\ElbyCDIO.sys [24392 2008-07-21] (Elaborate Bytes AG)
R1 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [62528 2016-12-13] (ESET)
R3 HECI; C:\Windows\System32\DRIVERS\HECI.sys [45184 2009-09-18] (Intel Corporation) [File not signed]
R1 ISODrive; C:\Program Files\UltraISO\drivers\ISODrive.sys [82168 2013-11-21] (EZB Systems, Inc.)
R3 kltap; C:\Windows\System32\DRIVERS\kltap.sys [48056 2016-06-07] (The OpenVPN Project)
R3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [94936 2017-01-03] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [219072 2017-01-03] (Malwarebytes)
R0 PCTCore; C:\Windows\System32\drivers\PCTCore.sys [331880 2011-11-14] (PC Tools)
R0 pctDS; C:\Windows\System32\drivers\pctDS.sys [342168 2011-12-01] (PC Tools)
R0 pctEFA; C:\Windows\System32\drivers\pctEFA.sys [909728 2011-12-01] (PC Tools)
R1 PCTSD; C:\Windows\System32\Drivers\PCTSD.sys [185560 2012-02-24] (PC Tools)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [324152 2016-10-11] (Duplex Secure Ltd.)
R0 TfFsMon; C:\Windows\System32\drivers\TfFsMon.sys [54328 2012-02-24] (PC Tools)
S3 TfNetMon; C:\Windows\system32\drivers\TfNetMon.sys [35264 2012-02-24] (PC Tools)
R0 TFSysMon; C:\Windows\System32\drivers\TfSysMon.sys [574424 2012-02-24] (PC Tools)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [24688 2017-01-02] ()
U0 aswVmm; no ImagePath
S3 MFE_RR; \??\C:\Users\Lenovo\AppData\Local\Temp\mfe_rr.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-01-03 19:17 - 2017-01-03 19:18 - 00015689 _____ C:\Users\Lenovo\Desktop\FRST.txt
2017-01-03 19:16 - 2017-01-03 19:16 - 00011926 _____ C:\Users\Lenovo\Downloads\FRST.txt
2017-01-03 19:12 - 2017-01-03 19:16 - 00000000 ____D C:\FRST
2017-01-03 19:11 - 2017-01-03 19:11 - 01760256 _____ (Farbar) C:\Users\Lenovo\Desktop\FRST.exe
2017-01-03 19:02 - 2017-01-03 19:02 - 00784152 _____ (McAfee, Inc.) C:\Users\Lenovo\Downloads\rootkitremover.exe
2017-01-03 18:39 - 2017-01-03 18:43 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2017-01-03 18:38 - 2017-01-03 18:38 - 00094936 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2017-01-03 18:38 - 2017-01-03 18:38 - 00000000 ____D C:\Users\Lenovo\mbar
2017-01-03 18:31 - 2017-01-03 18:31 - 16563352 _____ (Malwarebytes Corp.) C:\Users\Lenovo\Downloads\mbar-1.09.3.1001.exe
2017-01-03 18:29 - 2017-01-03 18:29 - 00104960 _____ (GMER) C:\uxdcqaog.sys
2017-01-03 18:28 - 2017-01-03 18:28 - 00380928 _____ C:\Users\Lenovo\Downloads\z0qol426.exe
2017-01-03 18:20 - 2017-01-03 18:28 - 00889192 _____ C:\TDSSKiller.3.1.0.12_03.01.2017_18.20.08_log.txt
2017-01-03 17:57 - 2017-01-03 17:57 - 02653202 _____ C:\Users\Lenovo\Downloads\Непотвърдено 91775.crdownload
2017-01-03 17:56 - 2017-01-03 17:56 - 02653202 _____ C:\Users\Lenovo\Downloads\Непотвърдено 798396.crdownload
2017-01-03 17:56 - 2017-01-03 17:56 - 02653202 _____ C:\Users\Lenovo\Downloads\Непотвърдено 565688.crdownload
2017-01-03 17:55 - 2017-01-03 17:55 - 02653202 _____ C:\Users\Lenovo\Downloads\Непотвърдено 451583.crdownload
2017-01-03 16:32 - 2017-01-03 16:32 - 00194770 _____ C:\Users\Lenovo\Downloads\Непотвърдено 391847.crdownload
2017-01-03 16:31 - 2017-01-03 16:31 - 00194770 _____ C:\Users\Lenovo\Downloads\Непотвърдено 612432.crdownload
2017-01-03 15:58 - 2017-01-03 16:34 - 00611288 _____ C:\TDSSKiller.3.1.0.12_03.01.2017_15.58.19_log.txt
2017-01-03 15:54 - 2017-01-03 15:54 - 00000000 ____D C:\TDSSKiller_Quarantine
2017-01-03 15:49 - 2017-01-03 15:54 - 00407248 _____ C:\TDSSKiller.3.1.0.12_03.01.2017_15.49.01_log.txt
2017-01-03 15:46 - 2017-01-03 15:47 - 04747704 _____ (AO Kaspersky Lab) C:\Users\Lenovo\Downloads\tdsskiller.exe
2017-01-02 23:49 - 2017-01-02 23:49 - 00015970 _____ C:\ComboFix.txt
2017-01-02 23:21 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2017-01-02 23:21 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2017-01-02 23:21 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2017-01-02 23:21 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2017-01-02 23:21 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2017-01-02 23:21 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2017-01-02 23:21 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2017-01-02 23:21 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2017-01-02 23:19 - 2017-01-02 23:49 - 00000000 ____D C:\Qoobox
2017-01-02 23:04 - 2017-01-02 23:48 - 00000000 ____D C:\Windows\erdnt
2017-01-02 23:03 - 2017-01-02 23:20 - 00000000 ___SD C:\32788R22FWJFW
2017-01-02 22:53 - 2017-01-02 22:54 - 05659917 ____R (Swearware) C:\Users\Lenovo\Downloads\ComboFix.exe
2017-01-02 22:25 - 2012-02-24 09:16 - 00574424 ____S (PC Tools) C:\Windows\system32\Drivers\TfSysMon.sys
2017-01-02 22:25 - 2012-02-24 09:16 - 00054328 ____S (PC Tools) C:\Windows\system32\Drivers\TfFsMon.sys
2017-01-02 22:25 - 2012-02-24 09:16 - 00035264 ____S (PC Tools) C:\Windows\system32\Drivers\TfNetMon.sys
2017-01-02 22:10 - 2017-01-02 22:10 - 00002044 _____ C:\Users\Public\Desktop\PC Tools Spyware Doctor.lnk
2017-01-02 22:10 - 2017-01-02 22:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Tools Security
2017-01-02 22:10 - 2012-02-24 10:36 - 00185560 _____ (PC Tools) C:\Windows\system32\Drivers\PCTSD.sys
2017-01-02 22:10 - 2012-02-24 10:35 - 00017848 _____ (PC Tools) C:\Windows\system32\Drivers\pctBTFix.sys
2017-01-02 22:10 - 2012-02-24 10:31 - 00253352 _____ (PC Tools) C:\Windows\system32\Drivers\pctgntdi.sys
2017-01-02 22:10 - 2012-02-24 10:31 - 00107864 _____ (PC Tools) C:\Windows\system32\Drivers\pctwfpfilter.sys
2017-01-02 22:10 - 2011-12-01 16:07 - 00909728 _____ (PC Tools) C:\Windows\system32\Drivers\pctEFA.sys
2017-01-02 22:10 - 2011-12-01 16:07 - 00342168 _____ (PC Tools) C:\Windows\system32\Drivers\pctDS.sys
2017-01-02 22:10 - 2011-11-14 15:12 - 00331880 _____ (PC Tools) C:\Windows\system32\Drivers\PCTCore.sys
2017-01-02 22:10 - 2011-11-14 15:12 - 00162584 _____ (PC Tools) C:\Windows\system32\Drivers\PCTAppEvent.sys
2017-01-02 22:09 - 2017-01-03 18:54 - 00000000 ____D C:\Program Files\PC Tools Security
2017-01-02 22:09 - 2017-01-02 22:25 - 00000000 ____D C:\ProgramData\PC Tools
2017-01-02 22:09 - 2017-01-02 22:14 - 00000000 ____D C:\Program Files\Common Files\PC Tools
2017-01-02 22:09 - 2012-02-24 10:37 - 00070536 _____ (PC Tools) C:\Windows\system32\Drivers\pctplsg.sys
2017-01-02 22:03 - 2017-01-02 22:03 - 00000090 _____ C:\Users\Lenovo\Downloads\hhh.txt
2017-01-02 19:06 - 2017-01-02 19:44 - 00000000 ____D C:\Users\Lenovo\Downloads\PC Tools Spyware Doctor 9.0.0.912-Genial78
2017-01-02 19:05 - 2017-01-02 19:05 - 00014798 _____ C:\Users\Lenovo\Downloads\PC Tools Spyware Doctor 9.0.0.912-Genial78.torrent
2017-01-02 17:00 - 2017-01-02 17:10 - 83415452 _____ C:\Windows\system32\ZPVV
2017-01-01 23:55 - 2017-01-02 15:04 - 00024688 _____ C:\Windows\system32\Drivers\TrueSight.sys
2017-01-01 23:55 - 2017-01-02 00:37 - 00000000 ____D C:\ProgramData\RogueKiller
2017-01-01 22:39 - 2017-01-01 23:11 - 00000000 ____D C:\Users\Lenovo\Doctor Web
2017-01-01 22:17 - 2017-01-02 00:38 - 00000000 ____D C:\Program Files\DrWeb
2017-01-01 22:03 - 2017-01-02 00:38 - 00000000 ____D C:\ProgramData\Doctor Web
2017-01-01 21:40 - 2017-01-01 21:40 - 00028977 _____ C:\ProgramData\agent.1483299639.bdinstall.bin
2017-01-01 21:16 - 2017-01-01 21:16 - 00000000 ____D C:\Users\Lenovo\AppData\Roaming\QuickScan
2017-01-01 21:14 - 2017-01-01 21:15 - 00000000 ____D C:\ProgramData\BDLogging
2017-01-01 21:14 - 2017-01-01 21:14 - 00046479 _____ C:\ProgramData\agent.1483298073.bdinstall.bin
2017-01-01 21:14 - 2017-01-01 21:14 - 00000000 ____D C:\ProgramData\Bitdefender Agent
2017-01-01 19:12 - 2016-12-21 05:07 - 03882672 _____ (Terra Informatica Software, Inc.) C:\Users\Lenovo\AppData\Roaming\temp~cmdhtml.dll
2017-01-01 19:12 - 2016-12-21 05:06 - 02626976 _____ (COMODO) C:\Users\Lenovo\AppData\Roaming\temp~ccavstart.exe
2017-01-01 19:11 - 2017-01-01 20:04 - 00000000 ____D C:\Program Files\COMODO
2017-01-01 19:06 - 2017-01-01 20:04 - 00000000 ____D C:\ProgramData\COMODO
2017-01-01 17:23 - 2017-01-01 17:23 - 00000000 ____D C:\Users\Lenovo\AppData\Roaming\ESET
2017-01-01 17:14 - 2017-01-01 17:14 - 00000000 ____D C:\Users\Lenovo\AppData\Local\ESET
2017-01-01 16:58 - 2017-01-01 16:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
2017-01-01 16:58 - 2017-01-01 16:58 - 00000000 ____D C:\ProgramData\ESET
2017-01-01 16:58 - 2017-01-01 16:58 - 00000000 ____D C:\Program Files\ESET
2017-01-01 16:54 - 2017-01-01 16:54 - 00000000 ____D C:\Users\Lenovo\Downloads\ESET NOD32 Antivirus v10.0.386.4 Final (32bit & 64bit) BG
2017-01-01 15:08 - 2017-01-01 15:08 - 00001334 _____ C:\Users\Public\Desktop\Kaspersky Secure Connection.lnk
2017-01-01 15:08 - 2017-01-01 15:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Secure Connection
2017-01-01 15:04 - 2017-01-03 18:39 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2017-01-01 15:04 - 2017-01-01 16:56 - 00000000 ____D C:\Program Files\Kaspersky Lab
2017-01-01 14:50 - 2017-01-01 16:41 - 00000000 ____D C:\ProgramData\Kaspersky Lab Setup Files
2016-12-28 22:12 - 2017-01-03 18:37 - 00219072 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-12-28 22:11 - 2017-01-03 18:39 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-12-28 22:11 - 2016-12-28 22:11 - 00002026 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2016-12-28 22:11 - 2016-12-28 22:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2016-12-28 22:11 - 2016-12-28 22:11 - 00000000 ____D C:\Program Files\Malwarebytes
2016-12-28 22:11 - 2016-12-14 12:55 - 00059968 _____ C:\Windows\system32\Drivers\mbae.sys
2016-12-28 18:43 - 2016-12-28 18:43 - 00000000 ____D C:\Users\Lenovo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2016-12-28 17:52 - 2016-12-28 17:52 - 00000565 _____ C:\Users\Lenovo\Desktop\Play Star Wars Battlefront II.lnk
2016-12-28 17:51 - 2016-12-28 17:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LucasArts
2016-12-28 17:14 - 2016-12-28 17:16 - 00000000 ____D C:\Users\Lenovo\Downloads\Star Wars BattleFront II
2016-12-28 16:38 - 2016-12-28 16:39 - 00000000 ____D C:\Users\Lenovo\Downloads\STARWARS_BF_2
2016-12-28 16:10 - 2017-01-03 18:35 - 00001792 _____ C:\Windows\setupact.log
2016-12-28 16:10 - 2017-01-02 23:58 - 00706534 _____ C:\Windows\PFRO.log
2016-12-28 16:10 - 2016-12-28 16:10 - 00000000 _____ C:\Windows\setuperr.log
2016-12-27 23:09 - 2016-12-27 23:09 - 00000000 ____D C:\Program Files\LucasArts
2016-12-27 20:53 - 2017-01-02 23:59 - 01829004 _____ C:\Windows\system32\Drivers\Cat.DB
2016-12-27 20:52 - 2017-01-03 18:56 - 00000000 ____D C:\ProgramData\TEMP
2016-12-27 16:45 - 2016-12-27 16:45 - 00000000 ____D C:\found.001
2016-12-27 15:48 - 2017-01-03 12:38 - 02064971 ____H C:\Users\Lenovo\AppData\Local\IconCache.db
2016-12-26 15:35 - 2016-12-26 15:35 - 00000000 _____ C:\Users\Lenovo\Documents\cheat.db.txt
2016-12-25 17:09 - 2016-12-25 17:09 - 00000000 ____D C:\Users\Lenovo\AppData\Local\Chromium
2016-12-25 16:53 - 2016-12-25 16:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\(Default)
2016-12-24 19:12 - 2017-01-02 16:11 - 00000000 ____D C:\Downloads
2016-12-24 17:54 - 2016-12-24 19:09 - 00000000 ____D C:\Users\Lenovo\Downloads\Yu-Gi-Oh! 5D's
2016-12-24 17:17 - 2016-12-24 17:17 - 00002608 _____ C:\Users\Lenovo\Desktop\µTorrent.lnk
2016-12-24 17:17 - 2016-12-24 17:17 - 00002608 _____ C:\Users\Lenovo\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk
2016-12-24 17:15 - 2017-01-03 19:18 - 00000000 ____D C:\Users\Lenovo\AppData\Roaming\uTorrent
2016-12-14 16:45 - 2016-12-14 16:46 - 00000000 _____ C:\Users\Lenovo\AppData\Local\{760854B5-FE1E-41E5-9F09-BDC81C1FC831}
2016-12-13 17:11 - 2016-12-13 17:11 - 00140984 _____ (ESET) C:\Windows\system32\Drivers\ehdrv.sys
2016-12-13 17:11 - 2016-12-13 17:11 - 00113544 _____ (ESET) C:\Windows\system32\Drivers\eamonm.sys
2016-12-13 17:11 - 2016-12-13 17:11 - 00091104 _____ (ESET) C:\Windows\system32\Drivers\edevmon.sys
2016-12-13 17:11 - 2016-12-13 17:11 - 00062528 _____ (ESET) C:\Windows\system32\Drivers\epfwwfpr.sys
2016-12-10 19:13 - 2016-12-10 19:13 - 00000000 _____ C:\Users\Lenovo\AppData\Local\{2E251E5E-2EE8-4C0D-BDA4-5B5662C3230C}

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-01-03 19:06 - 2016-08-02 17:57 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2017-01-03 18:45 - 2009-07-14 06:34 - 00026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-01-03 18:45 - 2009-07-14 06:34 - 00026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-01-03 18:38 - 2016-08-01 16:13 - 00000000 ____D C:\Users\Lenovo
2017-01-03 18:36 - 2016-11-15 14:20 - 00000000 ____D C:\Users\Lenovo\AppData\LocalLow\uTorrent
2017-01-03 18:36 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-01-02 23:46 - 2009-07-14 04:04 - 00000215 _____ C:\Windows\system.ini
2017-01-01 20:51 - 2010-11-20 23:01 - 00882242 _____ C:\Windows\system32\PerfStringBackup.INI
2017-01-01 20:51 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\inf
2017-01-01 20:09 - 2016-10-08 12:23 - 00000000 ____D C:\Users\Lenovo\AppData\Local\ElevatedDiagnostics
2017-01-01 18:53 - 2016-09-27 19:33 - 00000000 ____D C:\Program Files\Driver Genius
2017-01-01 16:55 - 2016-08-28 15:31 - 00000000 ____D C:\Program Files\Common Files\AV
2017-01-01 16:16 - 2016-08-28 15:28 - 00000000 ____D C:\ProgramData\AVAST Software
2016-12-28 18:43 - 2016-08-01 16:13 - 00000000 ___RD C:\Users\Lenovo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
2016-12-28 17:52 - 2016-11-20 20:01 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2016-12-28 15:55 - 2016-09-27 19:57 - 00000000 ____D C:\Windows\Logs
2016-12-27 22:42 - 2016-08-03 14:53 - 00000000 ____D C:\Program Files\Common Files\InstallShield
2016-12-27 20:56 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\winsxs
2016-12-27 15:43 - 2016-08-04 19:48 - 00000618 _____ C:\Users\Lenovo\Desktop\Router Settings.txt
2016-12-27 14:30 - 2009-07-14 04:03 - 00262144 ____H C:\Windows\system32\config\SYSTEM.LOG2
2016-12-26 15:45 - 2016-11-13 14:43 - 00000000 ____D C:\Users\Lenovo\Downloads\ppsspp
2016-12-26 15:36 - 2016-08-01 16:13 - 00000000 ___RD C:\Users\Lenovo\Documents
2016-12-25 17:09 - 2016-11-11 19:46 - 00000000 ____D C:\Users\Lenovo\AppData\Local\Steam
2016-12-25 17:09 - 2016-08-06 11:18 - 00000000 ____D C:\Program Files\Common Files\Steam
2016-12-24 19:07 - 2016-08-02 17:57 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2016-12-24 19:07 - 2016-08-02 17:57 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2016-12-24 19:07 - 2016-08-02 17:57 - 00000000 ____D C:\Windows\system32\Macromed
2016-12-24 15:53 - 2016-10-11 13:30 - 00002141 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-12-24 15:53 - 2016-10-11 13:30 - 00002129 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-12-24 15:41 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Tasks
2016-12-24 12:08 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\config\RegBack
2016-12-24 11:18 - 2009-07-14 06:53 - 00032582 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-12-23 20:36 - 2016-08-02 17:01 - 00000000 ____D C:\Users\Lenovo\AppData\Roaming\vlc
2016-12-23 20:18 - 2016-08-01 16:14 - 00000000 ___RD C:\Users\Lenovo\Contacts
2016-12-23 20:16 - 2016-08-01 16:13 - 00000000 ___RD C:\Users\Lenovo\Videos
2016-12-23 19:39 - 2016-08-30 13:39 - 00000000 ____D C:\Users\Lenovo\AppData\Roaming\dvdcss
2016-12-22 23:49 - 2016-10-19 15:57 - 00000000 ____D C:\Users\Lenovo\Documents\Visual Studio 2010
2016-12-22 23:43 - 2009-07-14 06:52 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2016-12-14 20:54 - 2016-11-12 19:32 - 00000000 ____D C:\Users\Lenovo\Downloads\Pro Evolution Soccer 2013 PSP

==================== Files in the root of some directories =======

2017-01-01 19:12 - 2016-12-21 05:06 - 2626976 _____ (COMODO) C:\Users\Lenovo\AppData\Roaming\temp~ccavstart.exe
2017-01-01 19:12 - 2016-12-21 05:07 - 3882672 _____ (Terra Informatica Software, Inc.) C:\Users\Lenovo\AppData\Roaming\temp~cmdhtml.dll
2016-08-07 00:14 - 2016-08-07 00:14 - 0000017 _____ () C:\Users\Lenovo\AppData\Local\resmon.resmoncfg
2016-12-10 19:13 - 2016-12-10 19:13 - 0000000 _____ () C:\Users\Lenovo\AppData\Local\{2E251E5E-2EE8-4C0D-BDA4-5B5662C3230C}
2016-12-14 16:45 - 2016-12-14 16:46 - 0000000 _____ () C:\Users\Lenovo\AppData\Local\{760854B5-FE1E-41E5-9F09-BDC81C1FC831}
2016-09-13 19:26 - 2016-09-13 19:26 - 0000000 _____ () C:\Users\Lenovo\AppData\Local\{CA712677-8B1E-4FAB-AB9F-CB72E76F2B5C}
2017-01-01 21:14 - 2017-01-01 21:14 - 0046479 _____ () C:\ProgramData\agent.1483298073.bdinstall.bin
2017-01-01 21:40 - 2017-01-01 21:40 - 0028977 _____ () C:\ProgramData\agent.1483299639.bdinstall.bin

Some files in TEMP:
====================
C:\Users\Lenovo\AppData\Local\temp\catchme.dll

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-12-23 18:46

==================== End of FRST.txt ===============

Addition.txt

Здравейте,

Логовете изглеждат чисти. Все пак би било добре да видя какво толкова е засякла Spyware Doctor. Като цяло PCTools бяха закупени от Symantec мисля, че през далечната 2008-ма година. TDSSv2 бе един от първите през 2009-та някъде, но вече се почиства от всички налични инструменти (а гледам, че сте пускали и Combofix, TDSSKiller, mcafee rootkit remover, RogueKiller, Malwarebytes Anti-Malware ако е била сложена отметката за сканиране за рууткити, Gmer, aswMBR) и т.н. Би било доста необичайно ако са го пропуснали...Най-вероятно става дума за фалшива тревога.

Поздрави!

 

Благодаря ви на всички

Бихте ли ми кaзaли друг тaкъв скенер против рууткит?

По време нa скaнирaне компютърa цепи.

Мерси предвaрително зa отговорите

Честитa Новa Годинa дa сте живи и здрaви и много късмет през новaтa годинa.

 

преди 11 часа, B-boy/StyLe/ написа:

Malwarebytes Anti-Malware ако е била сложена отметката за сканиране за рууткити, Gmer, aswMBR)

 

преди 13 часа, Conquer681 написа:

Благодаря ви на всички

Все пак ще покажете ли резултата от PCTools?

Сега сканирам с Касперски и дотам

Аз какво пиша, вие какво си правите....Да не говорим, че сканирането с Kaspersky е излишно, щом сте минали с другия им инструмент TDSSKiller. Маркирам темата като приключена!

Лека вечер!