![]() |
|
#1
| |||
| |||
| Hi, my computer, šķiet, ir kāda malware, ka es atklāju tad, kad mans tēvocis, kas saistīti savā USB atslēgu. Avast scan atrasti daži sīkumi, bet nevarēja tīru / noņemt. Defender skenēšanas būtu jāiesaldē pēc apmēram 7 minūtēm. Un MBAM pilnu skenēšanas arī iesaldēja apmēram pēc 5 minūtēm, bet ātrs bija ok. Šeit logs: Avast: 18/06/2009 11:07:37 lietotājs 3.652 zīme "Win32: UPS [Cryp]" ir atrastas "D: \ pārstrādātāji \ S-1-5-21-1214440339-602162358-839522115-1003 \ Dd16 \ Outlook.pst \ Personal Folders \ Top personisko mapju \ Inbox \ UPS Tracking Number 7124353990 \ UPS_INVOICE_978172.zip \ UPS_INVOICE_9781 72.exe "failu. 18/06/2009 11:06:59 lietotājs 3.652 zīme "Win32: UPS [Cryp]" ir atrastas "D: \ pārstrādātāji \ S-1-5-21-1214440339-602162358-839522115-1003 \ Dd16 \ Outlook.pst \ Personal Folders \ Top personisko mapju \ Izdzēstie vienumi \ UPS Tracking Number 7124353990 \ UPS_INVOICE_978172.zip \ UPS_INVOICE_9781 72.exe "failu. 18/06/2009 11:06:59 lietotājs 3.652 zīme "Win32: UPS [Cryp]" ir atrastas "D: \ pārstrādātāji \ S-1-5-21-1214440339-602162358-839522115-1003 \ Dd16 \ Outlook.pst \ Personal Folders \ Top personisko mapju \ Izdzēstie vienumi \ UPS Tracking Number 0762005263 \ invoice_8712.zip \ INVOICE_8712.exe "failu. 18/06/2009 11:06:58 lietotājs 3.652 zīme "Win32: Agent-AAPS [Trj]" ir atrastas "D: \ pārstrādātāji \ S-1-5-21-1214440339-602162358-839522115-1003 \ Dd16 \ Outlook.pst \ Personal Folders \ Top personisko mapju \ Izdzēstie vienumi \ UPS Tracking Number 3508422599 \ ups_invoice.zip \ ups_invoice.exe "failu. 18/06/2009 10:42:55 lietotājs 3.652 zīme "Win32: Trojan-gen (Citas)" konstatēts "C: \ Documents and Settings \ lietotājs \ Local Settings \ Application Data \ Microsoft \ Outlook \ Outlookinfo @ fcagroup.com (IMAP)-00000005.pst \ info@fcagroup.com \ Top personisko mapju \ [Gmail] \ Visi Mail \ Really cool photos \ pussy.zip \ pussy.exe "failu. 18/06/2009 10:42:41 lietotājs 3.652 zīme "Win32: UPS [Cryp]" konstatēts "C: \ Documents and Settings \ lietotājs \ Local Settings \ Application Data \ Microsoft \ Outlook \ Outlookinfo @ fcagroup . com (IMAP)-00000005.pst \ info@fcagroup.com \ Top personisko mapju \ [Gmail] \ Visi Mail \ UPS Jūsu Tracking # 358.010.698.330 \ PDF76512.zip \ PDF76512.exe "failu. 18/06/2009 10:42:41 lietotājs 3.652 zīme "Win32: UPS [Cryp]" konstatēts "C: \ Documents and Settings \ lietotājs \ Local Settings \ Application Data \ Microsoft \ Outlook \ Outlookinfo @ fcagroup . com (IMAP)-00000005.pst \ info@fcagroup.com \ Top personisko mapju \ [Gmail] \ Visi Mail \ UPS Jūsu Tracking # 145.132.932.471 \ PDF76512.zip \ PDF76512.exe "failu. 18/06/2009 10:42:23 lietotājs 3.652 zīme "Win32: UPS [Cryp]" konstatēts "C: \ Documents and Settings \ lietotājs \ Local Settings \ Application Data \ Microsoft \ Outlook \ Outlookinfo @ fcagroup . com (IMAP)-00000005.pst \ info@fcagroup.com \ Top personisko mapju \ [Gmail] \ Visi Mail \ UPS Jūsu Tracking # 239.293.259.082 \ EXL6512721.zip \ EXL6512721.exe "failu. 17/06/2009 5:36:18 SISTĒMAS 1.328 zīme "BV: Autorun-T [Wrm]" ir atrastas "F: \ Autorun.inf" failu. SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 06/19/2009 at 10:43 Application Version: 4.26.1004 Core Noteikumi Database Version: 3.947 Trace Noteikumi Database Version: 1889 Scan type: Complete Scan Kopā Scan Time: 00:36:36 Atmiņas vienības skenēts: 631 Memory draudiem detected: 0 Reģistra vienības skenēts: 6.110 Reģistrs draudiem detected: 0 File preces skenēts: 46.796 File draudiem detected: 9 Adware.Tracking Cookie C: \ Documents and Settings \ lietotājs \ Cookies \ lietotājs @ xiti [1]. Txt C: \ Documents and Settings \ lietotājs \ Cookies \ lietotājs @ revsci [2]. Txt C: \ Documents and Settings \ lietotājs \ Cookies \ lietotājs @ tribalfusion [2]. Txt C: \ Documents and Settings \ lietotājs \ Cookies \ lietotājs @ realmedia [2]. Txt C: \ Documents and Settings \ lietotājs \ Cookies \ user@microsoftwindows.112.2o 7 [1]. Txt C: \ Documents and Settings \ lietotājs \ Cookies \ user@pandasoftware.112.2o7 [1]. Txt C: \ Documents and Settings \ lietotājs \ Cookies \ user@adopt.euroclick [2]. Txt C: \ Documents and Settings \ lietotājs \ Cookies \ lietotājs @ specificclick [2]. Txt C: \ Documents and Settings \ lietotājs \ Cookies \ lietotājs @ 247realmedia [1]. Txt Malwarebytes "Anti-Malware 1,38 Database version: 2.308 Windows 5.1.2600 Service Pack 3 19/06/2009 11:01:44 mbam-log-2009-06-19 (11-01-44). txt Scan type: Quick Scan Objekti skenēts: 87.063 Pagājušo laiku: 2 minūte (s), 24 second (s) Memory Processes Inficētie: 0 Memory Modules Inficētie: 0 Registry Keys Inficētie: 0 Reģistra vērtības Inficētie: 0 Registry Data Items Infected: 0 Mapes Inficētie: 0 Faili Inficētie: 0 Atmiņas procesi Inficētie: (No ļaunprātīgs preces konstatētas) Memory Modules Inficētie: (No ļaunprātīgs preces konstatētas) Registry Keys Inficētie: (No ļaunprātīgs preces konstatētas) Reģistra vērtības Inficētie: (No ļaunprātīgs preces konstatētas) Registry Data Items Infected: (No ļaunprātīgs preces konstatētas) Mapes Inficētie: (No ļaunprātīgs preces konstatētas) Faili Inficētie: (No ļaunprātīgs preces konstatētas) Logfile of Trend Micro HijackThis v2.0.2 Scan saglabāts 11:04:24, uz 19/06/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running procesiem: C: \ WINDOWS \ System32 \ Smss.exe C: \ WINDOWS \ system32 \ winlogon.exe C: \ WINDOWS \ system32 \ services.exe C: \ WINDOWS \ system32 \ lsass.exe C: \ WINDOWS \ system32 \ svchost.exe C: \ Program Files \ Windows Defender \ MsMpEng.exe C: \ WINDOWS \ System32 \ svchost.exe C: \ WINDOWS \ system32 \ ZoneLabs \ vsmon.exe C: \ Program Files \ Alwil Software \ Avast4 \ aswUpdSv.exe C: \ Program Files \ Alwil Software \ Avast4 \ ashServ.exe C: \ WINDOWS \ system32 \ Spoolsv.exe C: \ WINDOWS \ system32 \ cisvc.exe C: \ Program Files \ Diskeeper Corporation \ Diskeeper \ DkService.exe C: \ Program Files \ Hamachi \ hamachi.exe C: \ WINDOWS \ system32 \ cidaemon.exe C: \ Program Files \ Java \ jre6 \ bin \ jqs.exe C: \ Program Files \ Common Files \ Microsoft Shared \ VS7DEBUG \ MDM.EXE C: \ WINDOWS \ system32 \ nvsvc32.exe C: \ Windows \ Explorer.exe C: \ Program Files \ Pervasive Software \ PSQL \ bin \ w3dbsmgr.exe C: \ WINDOWS \ system32 \ svchost.exe C: \ WINDOWS \ system32 \ SearchIndexer.exe C: \ WINDOWS \ system32 \ fxssvc.exe C: \ Program Files \ Alwil Software \ Avast4 \ ashMaiSv.exe C: \ Program Files \ Alwil Software \ Avast4 \ ashWebSv.exe C: \ WINDOWS \ RTHDCPL.EXE C: \ PROGRA ~ 1 \ ALWILS ~ 1 \ Avast4 \ ashDisp.exe C: \ Program Files \ Zone Labs \ ZoneAlarm \ zlclient.exe C: \ WINDOWS \ Siemens \ PanelMgr \ SSMMgr.exe C: \ WINDOWS \ Twain_32 \ Siemens \ SCX4x28 \ Scan2pc.exe C: \ Program Files \ Java \ jre6 \ bin \ jusched.exe C: \ WINDOWS \ system32 \ ctfmon.exe C: \ WINDOWS \ System32 \ svchost.exe C: \ Program Files \ Skype \ Phone \ Skype.exe C: \ Program Files \ Windows Desktop Search \ WindowsSearch.exe C: \ Program Files \ Hamachi \ hamachi.exe C: \ Program Files \ 2BrightSparks \ SyncBack \ SyncBack.exe C: \ Program Files \ Skype \ Plugin Manager \ skypePM.exe C: \ WINDOWS \ system32 \ taskmgr.exe C: \ Program Files \ SUPERAntiSpyware \ SUPERAntiSpyware.exe C: \ WINDOWS \ system32 \ NOTEPAD.EXE C: \ Program Files \ Mozilla Firefox \ firefox.exe C: \ WINDOWS \ system32 \ SearchProtocolHost.exe C: \ Program Files \ Trend Micro \ HijackThis \ sniper.exe R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://www.dhl.ca/ca/wfHomeLoggedIn.aspx F2 - REG: SYSTEM.INI: Userinit = C: \ WINDOWS \ system32 \ userinit.exe, Userinit. Exe O1 - Hosts: 66.98.148.65 auto.search.msn.com O1 - Hosts: 66.98.148.65 auto.search.msn.es O2 - BHO: Spybot-S & D IE Protection - (53.707.962-6F74-2D53-2.644-206D7942484F) - C: \ PROGRA ~ 1 \ Spybot ~ 1 \ SDHelper.dll O2 - BHO: Java (tm) Plug-In 2 SSV Helper - (DBC80044-A445-435b-BC74-9C25C1C588A9) - C: \ Program Files \ Java \ jre6 \ bin \ jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - (E7E6F031-17CE-4C07-BC86-EABFE594F69C) - C: \ Program Files \ Java \ jre6 \ lib \ izvietot \ jqs \ ti \ jqs_plugin.dll O4 - HKLM \ .. \ Run: [NvCplDaemon] RUNDLL32.EXE C: \ WINDOWS \ system32 \ NvCpl.dll, NvStartup O4 - HKLM \ .. \ Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM \ .. \ Run: [Alcmtr] ALCMTR.EXE O4 - HKLM \ .. \ Run: [DiskeeperSystray] "C: \ Program Files \ Diskeeper Corporation \ Diskeeper \ DkIcon.exe" O4 - HKLM \ .. \ Run: [Avast!] C: \ PROGRA ~ 1 \ ALWILS ~ 1 \ Avast4 \ ashDisp.exe O4 - HKLM \ .. \ Run: [Windows Defender] "C: \ Program Files \ Windows Defender \ MSASCui.exe"-hide O4 - HKLM \ .. \ Run: [ZoneAlarm Klientu] "C: \ Program Files \ Zone Labs \ ZoneAlarm \ zlclient.exe" O4 - HKLM \ .. \ Run: [Samsung PanelMgr] C: \ WINDOWS \ Siemens \ PanelMgr \ SSMMgr.exe / Autorun O4 - HKLM \ .. \ Run: [4x28 Scan2PC] "C: \ WINDOWS \ Twain_32 \ Siemens \ SCX4x28 \ Scan2pc.e XE" O4 - HKLM \ .. \ Run: [SunJavaUpdateSched] "C: \ Program Files \ Java \ jre6 \ bin \ jusched.exe" O4 - HKLM \ .. \ RunOnce: [Malwarebytes "Anti-Malware] C: \ Program Files \ Malwarebytes" Anti-Malware \ mbamgui.exe / install / kluss O4 - HKCU \ .. \ Run: [CTFMON.EXE] C: \ WINDOWS \ system32 \ ctfmon.exe O4 - HKCU \ .. \ Run: [Skype] "C: \ Program Files \ Skype \ Phone \ Skype.exe" / nosplash / minimāla O4 - HKUS \ S-1-5-19 \ .. \ Run: [CTFMON.EXE] C: \ WINDOWS \ system32 \ CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS \ S-1-5-20 \ .. \ Run: [CTFMON.EXE] C: \ WINDOWS \ system32 \ CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS \ S-1-5-18 \ .. \ Run: [CTFMON.EXE] C: \ WINDOWS \ system32 \ CTFMON.EXE (User "SISTĒMA") O4 - HKUS \. DEFAULT \ .. \ Run: [CTFMON.EXE] C: \ WINDOWS \ system32 \ CTFMON.EXE (User 'Default user') O4 - Startup: hamachi.lnk = C: \ Program Files \ Hamachi \ hamachi.exe O4 - Startup: saīsni Map Drive.lnk = C: \ Documents and Settings \ lietotājs \ Desktop \ Map Drive.bat O4 - Startup: SyncBack.lnk = C: \ Program Files \ 2BrightSparks \ SyncBack \ SyncBack.exe O4 - Global Startup: Windows Search.lnk = C: \ Program Files \ Windows Desktop Search \ WindowsSearch.exe Ø8 - ārpus konteksta menu item: E & ksportēt uz Microsoft Excel - res: / / C: \ PROGRA ~ 1 \ Micros ~ 2 \ Office11 \ EXCEL.EXE/3000 Ø8 - ārpus konteksta izvēlnes vienums: Web Capture - C: \ Program Files \ SmarThru Office \ WebCapture.dll Ø9 - Extra button: Research - (92780B25-18CC-41C8-B9BE-3C9C571A8263) - C: \ PROGRA ~ 1 \ Micros ~ 2 \ Office11 \ REFIEBAR.DLL Ø9 - Extra button: (no name) - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ PROGRA ~ 1 \ Spybot ~ 1 \ SDHelper.dll Ø9 - Extra 'Tools' MENUITEM: Spybot - Search & Destroy Configuration - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ PROGRA ~ 1 \ Spybot ~ 1 \ SDHelper.dll Ø9 - Extra button: (no name) - (e2e2dd38-d088-4.134-82b7-f2ba38496583) - C: \ WINDOWS \ Network Diagnostic \ xpnetdiag.exe Ø9 - Extra 'Tools' MENUITEM: @ xpsp3res.dll, -20.001 - (e2e2dd38-d088-4.134-82b7-f2ba38496583) - C: \ WINDOWS \ Network Diagnostic \ xpnetdiag.exe Ø9 - Extra button: Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe Ø9 - Extra 'Tools' MENUITEM: Windows Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe Ø16 - DPF: (56762DEC-6B0D-4AB4-A8AD-989993B5D08B) -- http://www.eset.eu/buxus/docs/OnlineScanner.cab Ø16 - DPF: (6414512B-B978-451D-A0D8-FCFDF33E833C) (WUWebControl klase) -- http://www.update.microsoft.com/wind...?1203273577140 O18 - Protocol: skype4com - (FFC8B962-9B40-4DFF-9.458-1830C7DD7F5D) - C: \ PROGRA ~ 1 \ Common ~ 1 \ Skype \ SKYPE4 ~ 1.DLL Ø20 - Winlogon Paziņot:! SASWinLogon - C: \ Program Files \ SUPERAntiSpyware \ SASWINLO.dll O23 - Service: Adobe LM Service - Unknown īpašnieks - C: \ Program Files \ Common Files \ Adobe Systems Shared \ Service \ Adobelmsvc.exe O23 - Service: Avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C: \ Program Files \ Alwil Software \ Avast4 \ aswUpdSv.exe O23 - Service: Avast! Antivirus - ALWIL Software - C: \ Program Files \ Alwil Software \ Avast4 \ ashServ.exe O23 - Service: Avast! Mail Scanner - ALWIL Software - C: \ Program Files \ Alwil Software \ Avast4 \ ashMaiSv.exe O23 - Service: Avast! Web Scanner - ALWIL Software - C: \ Program Files \ Alwil Software \ Avast4 \ ashWebSv.exe O23 - Service: Diskeeper - Diskeeper Corporation - C: \ Program Files \ Diskeeper Corporation \ Diskeeper \ DkService.exe O23 - Service: Hamachi Service (HamachiService) - LogMeIn Inc - C: \ Program Files \ Hamachi \ hamachi.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc - C: \ Program Files \ Java \ jre6 \ bin \ jqs.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C: \ WINDOWS \ system32 \ nvsvc32.exe O23 - Service: Pervasive PSQL Workgroup Engine (psqlWGE) - Pervasive Software Inc - C: \ Program Files \ Pervasive Software \ PSQL \ bin \ w3dbsmgr.exe O23 - Service: TrueVector Interneta Monitor (vsmon) - Check Point Software Technologies LTD - C: \ WINDOWS \ system32 \ ZoneLabs \ vsmon.exe -- End of failu - 7.353 bytes |
|
#2
| ||||||||||||
| ||||||||||||
| Howdy tur un laipni aicināti Computer Sulas I'm Steve un es palīdzu jums thoughout šo labojumu. Pirms noteikt, lasot šo amatu pilnībā. Ja tur ir kaut kas, kas jūs nesaprotat, lūdzam jūsu jautājumiem pirms turpināt. Ir svarīgi, lai Jūs nepalaistu garām solis. Lūdzu, veic visu pareizā secībā / secību. Mēs sāksim ar ComboFix.exe. Lūdzu, apmeklējiet šo interneta lapu download saites un norādījumi par darba rīku: http://www.bleepingcomputer.com/comb...o-use-combofix Nodrošināt jums ir invalīds visi pret vīrusu un pret ļaunprātīgu programmatūru programmām, lai tās netraucē darbību ComboFix. Lūdzu, iekļaujiet C: \ ComboFix.txt jūsu nākamajā atbildē uz papildu pārskatīšana.
__________________
__________________
Lepoties biedrs ASAP & UNITE Mana sistēma: Steves Urbšanas
|
|
#3
| |||
| |||
| Hey, paldies par palīdzību. Šeit ir žurnāls: ComboFix 09-06-21.01 - lietotājs 22/06/2009 10:29.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1511 [GMT -4:00] Sākot no: c: \ Documents and Settings \ lietotājs \ Desktop \ ComboFix.exe AV: Avast! antivīruss 4.8.1335 [VPS 090.621-0] * On-access skenēšana invalīdu * (papildināts) (7591DB91-41F0-48A3-B128-1A293FD8233D) FW: ZoneAlarm Firewall * invalīdiem * (829BDA32-94B3-44F4-8.446-F8FCFF809F8B) . ((((((((((((((((((((((((((((((((((((((( Citi Svītrojumi ))))))))) )))))))))))))))))))))))))))))))))))))))) . c: \ windows \ system32 \ winsusrm.dll . ((((((((((((((((((((((((( Faili Created no 2009/05/22 līdz 2009/06/22 ))))))))))) )))))))))))))))))))) . 2009/06/19 15:34. 2009/06/19 15:34 -------- d ----- w C: \ Program Files \ Microsoft ActiveSync 2009/06/19 14:07. 2009/06/19 14:07 -------- d ----- w C: \ Documents and Settings \ lietotājs \ Application Data \ Malwarebytes 2009/06/19 14:07. 2009/06/17 15:27 38.160 ---- aw-c: \ windows \ system32 \ drivers \ mbamswissarmy.sys 2009/06/19 14:07. 2009/06/19 14:07 -------- d ----- w C: \ Program Files \ Malwarebytes "Anti-Malware 2009/06/19 14:07. 2009/06/19 14:07 -------- d ----- w C: \ Documents and Settings \ All Users \ Application Data \ Malwarebytes 2009/06/19 14:07. 2009/06/17 15:27 19.096 ---- aw-c: \ windows \ system32 \ drivers \ mbam.sys 2009/06/19 13:58. 2009/06/19 13:58 117.760 ---- aw-c: \ Documents and Settings \ lietotājs \ Application Data \ SUPERAntiSpyware.com \ SUPERAntiSpyware \ SDDLLS \ UIREPAIR.DLL 2009/06/19 13:57. 2009/06/19 13:57 -------- d ----- w C: \ Documents and Settings \ All Users \ Application Data \ SUPERAntiSpyware.com 2009/06/19 13:57. 2009/06/19 13:57 -------- d ----- w C: \ Program Files \ SUPERAntiSpyware 2009/06/19 13:57. 2009/06/19 13:57 -------- d ----- w C: \ Documents and Settings \ lietotājs \ Application Data \ SUPERAntiSpyware.com 2009/06/19 13:57. 2009/06/19 13:57 -------- d ----- w C: \ Program Files \ Common Files \ Wise Installation Wizard 2009/06/10 17:39. 2009/06/10 17:39 152.576 ---- aw-c: \ Documents and Settings \ lietotājs \ Application Data \ Sun \ Java \ jre1.6.0_14 \ lzma.dll 2009/06/10 00:53. 2009/06/10 00:53 -------- d ----- w C: \ Documents and Settings \ All Users \ Application Data \ NCH Software 2009/05/29 11:46. 2008/04/14 09:42 26.624 ---- aw-c: \ Documents and Settings \ LocalService \ Application Data \ Microsoft \ UPnP Device Host \ upnphost \ udhisapi.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Ziņojums )))))))) )))))))))))))))))))))))))))))))))))))))))))) . 2009/06/22 14:22. 2009/04/28 15:03 -------- d ----- w C: \ Documents and Settings \ lietotājs \ Application Data \ Skype 2009/06/22 13:56. 2008/02/17 21:01 -------- d ----- w C: \ Documents and Settings \ lietotājs \ Application Data \ Hamachi 2009/06/22 12:02. 2009/04/28 15:18 -------- d ----- w C: \ Documents and Settings \ lietotājs \ Application Data \ skypePM 2009/06/19 13:35. 2008/02/17 22:39 -------- d ----- w C: \ Documents and Settings \ All Users \ Application Data \ Spybot - Search & Destroy 2009/06/18 19:10. 2008/06/19 15:20 31.703.397 ---- aw-c: \ windows \ Internet Baļķi \ tvDebug.zip 2009/06/12 07:08. 2008/12/03 14:46 -------- d ----- w C: \ Program Files \ Windows Desktop Search 2009/06/10 17:39. 2009/03/26 15:12 -------- d ----- w C: \ Program Files \ Java 2009/06/10 16:58. 2008/12/30 17:22 -------- d ----- w C: \ Documents and Settings \ lietotājs \ Application Data \ FileZilla 2009/05/30 21:05. 2008/08/28 17:15 -------- d ----- w C: \ Program Files \ MK PowerTools 2009/05/25 04:24. 2008/05/27 03:18 350.208 ---- aw-c: \ windows \ system32 \ mssph.dll 2009/05/21 15:33. 2008/12/06 16:44 410.984 ---- aw-c: \ windows \ system32 \ deploytk.dll 2009/05/12 19:12. 2008/02/17 18:05 26.144 ---- aw-c: \ windows \ system32 \ spupdsvc.exe 2009/05/07 15:32. 2004/08/03 16:56 345.600 ---- aw-c: \ windows \ system32 \ localspl.dll 2009/05/01 16:37. 2009/02/07 19:53 -------- d ----- w C: \ Documents and Settings \ lietotājs \ Application Data \ Unyte 2009/04/29 04:46. 2004/08/03 16:56 666.624 ---- aw-c: \ windows \ system32 \ Wininet.dll 2009/04/29 04:46. 2004/08/03 16:56 81.920 ---- aw-c: \ windows \ system32 \ ieencode.dll 2009/04/28 15:18. 2009/04/28 15:18 56 --- ha-w-c: \ windows \ system32 \ ezsidmv.dat 2009/04/28 15:02. 2009/04/28 15:02 -------- d ----- w C: \ Program Files \ Common Files \ Skype 2009/04/28 15:02. 2009/04/28 15:02 -------- d ----- r-c: \ Program Files \ Skype 2009/04/28 15:02. 2009/04/28 15:02 -------- d ----- w C: \ Documents and Settings \ All Users \ Application Data \ Skype 2009/04/17 12:26. 2004/08/03 15:17 1.847.168 ---- aw-c: \ windows \ system32 \ win32k.sys 2009/04/15 14:51. 2004/08/03 16:56 585.216 ---- aw-c: \ windows \ system32 \ rpcrt4.dll 2009/04/09 02:09. 2009/04/09 02:04 664 ---- aw-c: \ windows \ system32 \ d3d9caps.dat 2009/04/01 21:57. 2008/02/17 22:30 4.212 --- ha-w-c: \ windows \ system32 \ zllictbl.dat 2009/04/01 21:21. 2009/04/01 21:21 152.576 ---- aw-c: \ Documents and Settings \ lietotājs \ Application Data \ Sun \ Java \ jre1.6.0_13 \ lzma.dll 2009/03/31 21:41. 2009/03/31 21:41 0 ---- aw-c: \ windows \ system32 \ WSSPOOL.TMP 2009/03/26 15:11. 2009/03/26 15:11 152.576 ---- aw-c: \ Documents and Settings \ lietotājs \ Application Data \ Sun \ Java \ jre1.6.0_12 \ lzma.dll 2008/06/23 22:36. 2008/06/23 22:36 0 ---- aw-c: \ Program Files \ gditst 2008/05/22 20:04. 2008/05/22 20:04 190 ---- aw-c: \ Program Files \ Common Files \ psasetup.log . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))) )))))))))))))))))))))))))))))))))))))))) . . * Piezīme * tukši ieraksti & legit default ieraksti netiek parādīti REGEDIT4 [HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ Curre ntVersion \ Run] "CTFMON.EXE" = "C: \ Windows \ system32 \ ctfmon.exe" [2008/04/14 15.360] "Skype" = "C: \ Program Files \ Skype \ Phone \ Skype.exe" [2009/04/21 24.264.488] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Run] "NvCplDaemon" = "C: \ Windows \ system32 \ NvCpl.dll" [2007/09/17 8.491.008] "DiskeeperSystray" = "C: \ Program Files \ Diskeeper Corporation \ Diskeeper \ DkIcon.exe" [2006/10/04 163.840] "Avast!" = "C: \ PROGRA ~ 1 \ ALWILS ~ 1 \ Avast4 \ ashDisp. exe" [2009/02/05 81.000] "ZoneAlarm Client" = "C: \ Program Files \ Zone Labs \ ZoneAlarm \ zlclient.exe" [2009/02/16 981.384] "Samsung PanelMgr" = "c: \ windows \ Siemens \ PanelMgr \ SSMMgr.exe" [2008/07/31 536.576] "4x28 Scan2PC" = "c: \ windows \ Twain_32 \ Siemens \ SCX4x28 \ Scan 2pc.exe" [2008/09/29 495.616] "SunJavaUpdateSched" = "C: \ Program Files \ Java \ jre6 \ bin \ jusched.exe" [2009/05/21 148.888] "RTHDCPL" = "RTHDCPL.EXE" - c: \ windows \ RTHDCPL.exe [2007/04/26 16.132.608] [HKEY_USERS \. DEFAULT \ Software \ Microsoft \ Windows \ Cur rentVersion \ Run] "CTFMON.EXE" = "C: \ Windows \ system32 \ CTFMON.EXE" [2008/04/14 15.360] c: \ Documents and Settings \ lietotājs \ Start Menu \ Programs \ Startup \ hamachi.lnk - c: \ Program Files \ Hamachi \ hamachi.exe [2008/2/17 625.952] Saīsni Map Drive.lnk - c: \ Documents and Settings \ lietotājs \ Desktop \ Map Drive.bat [2008/7/30 42] SyncBack.lnk - c: \ Program Files \ 2BrightSparks \ SyncBack \ SyncBack.exe [2008/11/15 2.936.064] c: \ Documents and Settings \ All Users \ Start Menu \ Programs \ Startup \ Logi Search.lnk - c: \ Program Files \ Windows Desktop Search \ WindowsSearch.exe [2008/5/26 123.904] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entversion \ Explorer \ ShellExecuteHooks] "(56F9679E-7.826-4C84-81F3-532071A8BCC5)" = "C: \ Program Files \ Windows Desktop Search \ MSNLNamespaceMgr.dll" [2009/05/25 304.128] "(5AE067D3-9AFB-48E0-853A-EBB7F4A000DA)" = "C: \ Program Files \ SUPERAntiSpyware \ SASSEH.DLL" [2008/05/13 77.824] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon \ paziņot \! SASWinLogon] 2008/12/22 16:05 356.352 ---- aw-c: \ Program Files \ SUPERAntiSpyware \ SASWINLO.dll [HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ contro l \ SafeBoot \ Minimal \ WinDefend] @ = "Service" [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Security center \ Monitoring \ ZoneLabsFirewall] "DisableMonitoring" = DWORD: 00000001 [HKLM \ ~ \ Services \ sharedaccess \ Parameters \ firewallpo licy \ standardprofile] "EnableFirewall" = 0 (0x0) [HKLM \ ~ \ Services \ sharedaccess \ Parameters \ firewallpo licy \ standardprofile \ AuthorizedApplications \ List] "% windir% \ \ system32 \ \ sessmgr.exe" = "% windir% \ \ Network Diagnostic \ \ xpnetdiag.exe" = "c: \ \ WINDOWS \ \ system32 \ \ fxsclnt.exe" = "C: \ \ Program Files \ \ Pervasive Software \ \ PSQL \ \ bin \ \ w3dbsmgr.exe" = "c: \ \ WINDOWS \ \ twain_32 \ \ Siemens \ \ ScanMgr.exe" = "c: \ \ WINDOWS \ \ twain_32 \ \ Siemens \ \ SCX4x28 \ \ Scan2Pc. exe" = "c: \ \ WINDOWS \ \ twain_32 \ \ Siemens \ \ SCX4x28 \ \ Sscan2io. exe" = "C: \ \ Program Files \ \ Skype \ \ Phone \ \ Skype.exe" = [HKLM \ ~ \ Services \ sharedaccess \ Parameters \ firewallpo licy \ standardprofile \ GloballyOpenPorts \ List] "3.389: TCP" = 3.389: TCP: @ xpsp2res.dll, -22.009 R1 aswSP; Avast! Self aizsardzību; c: \ windows \ system32 \ drivers \ aswSP.sys [07/04/2008 10:44 114.768] R1 SASDIFSV; SASDIFSV c: \ Program Files \ SUPERAntiSpyware \ sasdifsv.sys [26/05/2009 10:05 9.968] R1 SASKUTIL; SASKUTIL c: \ Program Files \ SUPERAntiSpyware \ SASKUTIL.SYS [26/05/2009 10:05 72.944] R2 aswFsBlk; aswFsBlk c: \ windows \ system32 \ drivers \ aswF sBlk.sys [07/04/2008 10:44 20.560] R2 HamachiService; Hamachi dienests c: \ Program Files \ Hamachi \ hamachi.exe [17/02/2008 5:01 625.952] R2 psqlWGE; Pervasive PSQL Workgroup Dzinējs: c: \ Program Files \ Pervasive Software \ PSQL \ bin \ w3dbsmgr.exe [06/06/2008 1:03 435.488] R2 WinDefend, Windows Defender, c: \ Program Files \ Windows Defender \ MsMpEng.exe [03/11/2006 8:19 13.592] R3 SASENUM; SASENUM c: \ Program Files \ SUPERAntiSpyware \ SASENUM.SYS [26/05/2009 10:05 7.408] S1 KPSYSDRV; KPSYSDRV c: \ windows \ system32 \ drivers \ Kpsy sdrv.sys [23/06/2008 6:36 17.016] S2 BulkUsb; Genesys Logic USB Controller NT 5.0; c: \ windows \ system32 \ drivers \ usbprn.sys [23/06/2008 6:27 7.552] S2 SSPORT; SSPORT; \? \ C: \ Windows \ System32 \ Drivers \ SSPO RT.sys -> C: \ Windows \ System32 \ Drivers \ SSPORT.sys [?] S3 Moarer; Moarer; [x] --- Citi pakalpojumi / Drivers atmiņa --- * NewlyCreated * - SASDIFSV * NewlyCreated * - SASENUM * NewlyCreated * - SASKUTIL . Saturs "Scheduled Tasks" mape 2009/06/22 c: \ windows \ Uzdevumi \ MP Scheduled Scan.job - C: \ Program Files \ Windows Defender \ MpCmdRun.exe [2006/11/04 00:20] 2009/06/22 c: \ windows \ Uzdevumi \ SyncBack Outlook.job - C: \ Program Files \ 2BrightSparks \ SyncBack \ SyncBack.exe [2008/11/15 16:19] . . ------- Papildu Scan ------- . uStart Page = hxxp: / / www.dhl.ca / ca / wfHomeLoggedIn.aspx IE: E & ksportēt uz Microsoft Excel - c: \ PROGRA ~ 1 \ Micros ~ 2 \ Office11 \ EXCEL.EXE/3000 IE: Web Capture - C: \ Program Files \ SmarThru Office \ WebCapture.dll FF - ProfilePath -- . ************************************************** ************************ catchme 0.3.1398 W2K/XP/Vista - rootkit / Stealth malware detektoru, ar Gmer, http://www.gmer.net Rootkit scan 2009/06/22 10:31 Windows 5.1.2600 Service Pack 3 NTFS skenēšana slēptās procesi ... skenēšana slēptās palaišana ieraksti ... skenēšana slēptos failus ... scan sekmīgi pabeigta slēptos failus: 0 ************************************************** ************************ . --------------------- Bloķēt reģistra atslēgas --------------------- [HKEY_LOCAL_MACHINE \ SOFTWARE \ Pervasive Software \ PSQL] @ Denied:) (ikviens) @ = "" . Pabeigšanas laiks: 2009/06/22 10:32 ComboFix-karantīnā-files.txt 2009/06/22 14:32 Pre-Run: 32245211136 bytes free Post-Run: 32239325184 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout = 2 default = multi (0) disk (0) rdisk (0) partition (1) \ WINDOW S [operating systems] c: \ cmdcons \ BOOTSECT.DAT = "Microsoft Windows Recovery Console" / cmdcons multi (0) disk (0) rdisk (0) partition (1) \ WINDOWS = "Micro soft Windows XP Professional" / noexecute = optin / fastdetect 164 --- EOF --- 2009/06/18 19:28 |
|
#4
| |||
| |||
| Howdy tur Šajā nākamajā amatā es gribu palaist online virus scan, vispirms ļauj atcelt dažas nevēlamas junk .... Lūdzu, download ATF Apkopēja by Atribune. Šī programma ir XP un Windows tikai 2000 Veiciet dubultklikšķi uz ATF-Cleaner.exe palaist programmu. Zem Galvenais izvēlas: Atlasīt visu Click Empty Selected pogu. Ja izmantojat Firefox pārlūkprogrammā Click Firefox uz augšu un izvēlieties: Atlasīt visu Click Empty Selected pogu. PIEZĪME: Ja vēlaties, lai jūsu saglabātās paroles, lūdzu, noklikšķiniet uz Nē par ātru. Ja Jūs lietojat Opera pārlūku Click Opera uz augšu un izvēlieties: Atlasīt visu Click Empty Selected pogu. PIEZĪME: Ja vēlaties, lai jūsu saglabātās paroles, lūdzu, noklikšķiniet uz Nē par ātru. Click Iziet uz Main menu lai aizvērtu programmu. Dēļ Tehniskais atbalsts, Veiciet dubultklikšķi uz e-pasta adresi, kas atrodas apakšā katrā izvēlni. Izveidotu interneta savienojumu un veikt online scan ar Internet Explorer pie Kaspersky Online Scanner. ** Vista lietotājiem - tiesības uz IE / Firefox ikonas un darbojas kā administrators Click Accept, Kad tiek piedāvāts lejupielādēt un instalēt programmu failus un datu bāzes ļaunprātīgas programmatūras definīciju.
Šī animācija vadīs jūs cauri procesam: ![]() ** Piezīme ** Lai optimizētu skenēšanas laiku un uzrādīt saprātīgāku ziņojumu par pārskatu: Aizveriet visas atvērtās programmas Izslēgt reālā laikā skenera jebkuru esošo antivīrusu programmu, veicot tiešsaistes skenēšanu. Jūs varat atvienoties no interneta, kad jūs sākat skenēšanu. Atzīmēt Internet Explorer 7 lietotāji: Ja kādā brīdī jums ir problēmas skatīšanās pieņemt pogu licenci, noklikšķiniet uz Tālummaiņa rīks, kas atrodas labajā apakšējā IE logu un noteikt palielinājumu 75%. Tiklīdz licence apstiprināta, reset līdz 100%. Post atpakaļ ar no Kasperksy rezultātiem, arī jāatjaunina man par to, kā lietas darbojas
__________________ Lepoties biedrs ASAP & UNITE |
|
#5
| |||
| |||
| http://www.dhl.ca/ca/wfHomeLoggedIn.aspx R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 http://www.eset.eu/buxus/docs/OnlineScanner.cab Ø16 - DPF: (6414512B-B978-451D-A0D8-FCFDF33E833C) (WUWebControl klase) -- http://www.update.microsoft.com/wind...?1203273577140 O18 - Protocol: skype4com - (FFC8B962-9B40-4DFF-9.458-1830C7DD7F5D) - C: \ PROGRA ~ 1 \ Common ~ 1 \ Skype \ SKYPE4 ~ 1.DLL Ø20 - Winlogon Paziņot:! SASWinLogon - C: \ Program Files \ SUPERAntiSpyware \ SASWINLO.dll O23 - Service: Adobe LM Service - Unknown īpašnieks - C: \ Program Files \ Common Files \ Adobe Systems Shared \ Service \ Adobelmsvc.exe O23 - Service: Avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C: \ Program Files \ Alwil Software \ Avast4 \ aswUpdSv.exe O23 - Service: Avast! Antivirus - ALWIL Software - C: \ Program Files \ Alwil Software \ Avast4 \ ashServ.exe O23 - Service: Avast! Mail Scanner - ALWIL Software - C: \ Program Files \ Alwil Software \ Avast4 \ ashMaiSv.exe O23 - Service: Avast! Web Scanner - ALWIL Software - C: \ Program Files \ Alwil Software \ Avast4 \ ashWebSv.exe O23 - Service: Diskeeper - Diskeeper Corporation - C: \ Program Files \ Diskeeper Corporation \ Diskeeper \ DkService.exe O23 - Service: Hamachi Service ( HamachiService) - LogMeIn Inc - C: \ Program Files \ Hamachi \ hamachi.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc - C: \ Program Files \ Java \ jre6 \ bin \ jqs.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C: \ WINDOWS \ system32 \ nvsvc32.exe O23 - Service: Pervasive PSQL Workgroup Engine (psqlWGE) - Pervasive Software Inc - C: \ Program Files \ Pervasive Software \ PSQL \ bin \ w3dbsmgr.exe O23 - Service: TrueVector Interneta Monitor (vsmon) - Check Point Software Technologies LTD - C: \ WINDOWS \ system32 \ ZoneLabs \ vsmon.exe - beigas failu - 7.090 bytes |
|
#6
| |||
| |||
| Hi there Mums tiešām ir nepieciešams palaist pilnu sistēmas skenēšanu uz diska, lai pārliecinātos, nekas nav atliekas. Viena lieta man tiek paziņots, ka tiešsaistes skenera palielinājies par Phishing scam e-pastu. Tas nenozīmē, paziņojiet mums tieši tā, kurš no tā ir, bet tas mums stāsta, ka tas ir jūsu iesūtnē. Pikšķerēšanas izkrāpšanu mēģinājums pievilinātājs tevi nodot savus datus vērā vietu, lai noziedznieki pēc tam var iegūt informāciju un izmantot to savā labā. Lai iegūtu vairāk informācijas par pikšķerēšanu lasīt šo rakstu šeit. Attiecīgo e-pastu var izskatīties līdzīgi kā tas bija no jūsu bankas vai citas finanšu iestādes, un pat veikt logotipi nozagta no sākotnējās vietas. Nekad ieiet jebkurā bankas darba vietas vai jebkuru citu lapu no saitēm no e-pastiem. Vienmēr iet uz mājas lapu un log in to. Es ieteiktu, ka jūs iztukšot mapi Izdzēstie vienumi līdzās citiem aizdomīgiem e-pastiem. Ļauj izmēģināt pilnu skenēšanas, izmantojot dažādus skeneris. Veikt online scan ar Panda ActiveScan
* Izslēdziet reālā laikā skenera jebkuru esošo antivīrusu programmu, veicot tiešsaistes skenēšanu. Avast lietotājiem, ievērojiet: Lūdzu, turpiniet online scan at Panda ja saņemat brīdinājumu. Tas ir viltus pozitīvi vērtējams no Avast jo Panda Antivirus nav šifrētu savu vīrusu datubāzi. Kādu iemeslu dēļ HJT log jūsu iesniegto lasāma, tā vietā, es ilgojos, lai jūs pēc dažāda tipa log Lūdzu, download DDS un saglabājiet to savā datorā.
Post gan žurnālos atpakaļ savā nākamajā atbildē Arī panda skenēšanas rezultātus un regulāri mani atjaunina jūsu sistēmas statusu
__________________ Lepoties biedrs ASAP & UNITE |
![]() |
|
| Bookmarks |
Similar Threads | ||||
| Pavediens | Thread Starter | Forums | Replies | Last Post |
| Panda USB un Autorun Vaccine 1.0.0.19 Beta | evilfantasy | Vīrusu, spiegprogrammatūru un drošība | 0 | 7 marts 2009 12:47 |
| CD Autorun | severntales | Drives & Removable Media | 2 | 13 decembris 2008 00:28 |
| Driver cd nebūs Autorun, lai vadītu mani caur setup | P5200 | General Software Čats | 8 | Septembris 4, 2008 08:30 |
| Autorun Problem | Zephiron | Vīrusu, spiegprogrammatūru un drošība | 10 | 17 februāris 2008 14:28 |
| CD nav Autorun / palaišana | rigisme | Drives & Removable Media | 11 | 18 decembris 2007 14:37 |
| Thread Tools | |
| |