Проблем с инсталацията на SUPERAntiSpyware

Night_Raven · Януари 16, 2009

Не мисля, че е необходимо да сканираш с други програми. Проблемът не е бързото сканиране. То дори е за предпочитане пред пълното. Проблемът беше, че не беше задал на програмата да премахне това, което е открила.

B-boy/StyLe/ · Януари 17, 2009

Аз пък ще поискам лог от Combofix за да проверя/им за остатъци:

1. Спри System Restore:

Десен бутон на My Computer => Properties => System Restore => слагаш отметка пред Turn Off System Restore

Start => run => cleanmgr => More Options => System Restore => Clean UP

2. Спри защитата в реално време на антивирусната си програма.

Изтегли Combofix:

Запази го на десктопа.

Веведи следната команда:

http://img.photobucket.com/albums/v624/29wood/ka.png

"%userprofile%\desktop\combofix.exe" /killall

Копирай съдържанието на лог файла в следващия си пост.

mavro · Януари 17, 2009

Аз пък ще поискам лог от Combofix за да проверя/им за остатъци:

Ето логфайла:

ComboFix 09-01-16.03 - Administrator 2009-01-17 15:18:36.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.511.238 [GMT 2:00]

Running from: c:\documents and settings\Administrator\desktop\combofix.exe

Command switches used :: /killall

AV: avast! antivirus 4.8.1296 [VPS 090116-1] *On-access scanning disabled* (Updated)

AV: ThreatFire *On-access scanning disabled* (Updated)

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_TDSSSERV.SYS

((((((((((((((((((((((((( Files Created from 2008-12-17 to 2009-01-17 )))))))))))))))))))))))))))))))

.

2009-01-17 13:54 . 2009-01-17 13:54 <DIR> d-------- c:\program files\Snap Clipboard

2009-01-17 13:54 . 2009-01-17 13:54 <DIR> d-------- c:\documents and settings\Administrator\Application Data\snapclipboard

2009-01-15 21:36 . 2009-01-15 21:36 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware

2009-01-15 21:36 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2009-01-15 21:36 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2009-01-15 21:34 . 2009-01-16 18:19 <DIR> d-------- c:\program files\SUPERAntiSpyware

2009-01-15 21:34 . 2009-01-15 21:34 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard

2009-01-15 19:08 . 2009-01-15 19:25 <DIR> d-------- c:\program files\Folder Guide

2009-01-15 19:04 . 2009-01-15 19:14 <DIR> d-------- c:\program files\ThreatFire

2009-01-15 19:04 . 2009-01-17 15:21 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP

2009-01-15 19:04 . 2009-01-15 19:04 <DIR> d-------- c:\documents and settings\All Users\Application Data\PC Tools

2009-01-15 19:04 . 2008-11-17 13:05 51,488 --a------ c:\windows\system32\drivers\TfFsMon.sys

2009-01-15 19:04 . 2008-11-17 13:05 39,200 --a------ c:\windows\system32\drivers\TfSysMon.sys

2009-01-15 19:04 . 2008-11-17 13:05 33,056 --a------ c:\windows\system32\drivers\TfNetMon.sys

2009-01-15 19:04 . 2008-11-17 13:05 12,576 --a------ c:\windows\system32\drivers\TfKbMon.sys

2009-01-14 18:00 . 2009-01-14 18:00 54,156 --ah----- c:\windows\QTFont.qfn

2009-01-14 18:00 . 2009-01-14 18:00 1,409 --a------ c:\windows\QTFont.for

2009-01-13 19:27 . 2009-01-13 19:27 <DIR> d-------- c:\documents and settings\All Users\Application Data\Raxco

2009-01-13 19:27 . 2009-01-05 14:16 71,184 -ra------ c:\windows\system32\drivers\DefragFS.sys

2009-01-13 19:26 . 2009-01-13 19:30 <DIR> d-------- c:\program files\Raxco

2009-01-11 21:03 . 2009-01-11 21:03 <DIR> d-------- c:\documents and settings\All Users\Application Data\FLEXnet

2009-01-11 20:53 . 2009-01-11 20:53 <DIR> d-------- c:\program files\Bonjour

2009-01-11 20:43 . 2009-01-11 20:43 <DIR> d-------- c:\program files\Common Files\Macrovision Shared

2009-01-11 11:33 . 2009-01-11 11:33 <DIR> d---s---- c:\documents and settings\Administrator\UserData

2009-01-10 14:36 . 2009-01-10 14:36 <DIR> d-------- c:\program files\Skype

2009-01-10 14:36 . 2009-01-10 14:36 <DIR> d-------- c:\program files\Common Files\Skype

2009-01-06 00:33 . 2009-01-06 00:33 3,751,995 --a------ c:\windows\system32\GPhotos.scr

2009-01-04 16:31 . 2009-01-04 16:32 <DIR> d-------- c:\program files\Microsoft Virtual PC

2009-01-04 11:45 . 2009-01-04 11:45 <DIR> d-------- c:\program files\K-Lite Codec Pack

2009-01-04 11:45 . 2008-09-19 23:57 3,596,288 --a------ c:\windows\system32\qt-dx331.dll

2009-01-04 11:45 . 2008-09-24 20:41 839,680 --a------ c:\windows\system32\lameACM.acm

2009-01-04 11:45 . 2008-12-07 20:08 795,648 --a------ c:\windows\system32\xvidcore.dll

2009-01-04 11:45 . 2008-10-29 00:35 684,032 --a------ c:\windows\system32\divx.dll

2009-01-04 11:45 . 2004-01-25 18:18 217,088 --a------ c:\windows\system32\yv12vfw.dll

2009-01-04 11:45 . 2008-09-16 21:23 168,448 --a------ c:\windows\system32\unrar.dll

2009-01-04 11:45 . 2008-12-07 20:08 130,048 --a------ c:\windows\system32\xvidvfw.dll

2009-01-04 11:45 . 2007-09-21 02:52 118,784 --a------ c:\windows\system32\ac3acm.acm

2009-01-04 11:45 . 2008-09-25 10:03 81,920 --a------ c:\windows\system32\dpl100.dll

2009-01-04 11:45 . 2008-12-08 13:53 57,344 --a------ c:\windows\system32\ff_vfw.dll

2009-01-04 11:45 . 2007-07-10 18:10 547 --a------ c:\windows\system32\ff_vfw.dll.manifest

2009-01-04 11:45 . 2008-10-03 14:30 414 --a------ c:\windows\system32\lame_acm.xml

2009-01-03 13:26 . 2009-01-03 13:26 <DIR> d-------- c:\documents and settings\All Users\Application Data\TuneUp Software

2009-01-03 13:26 . 2009-01-03 13:26 <DIR> d-------- c:\documents and settings\Administrator\Application Data\TuneUp Software

2009-01-03 13:26 . 2009-01-03 13:26 603,904 --a------ c:\windows\system32\TUProgSt.exe

2009-01-03 13:25 . 2009-01-10 14:42 <DIR> d--hs---- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}

2009-01-03 12:07 . 2009-01-04 20:46 <DIR> d-------- c:\documents and settings\LogMeInRemoteUser

2009-01-03 12:06 . 2009-01-03 12:06 1,126 --a------ c:\windows\mozver.dat

2009-01-03 12:01 . 2009-01-17 10:59 <DIR> d-------- c:\program files\LogMeIn

2009-01-03 12:01 . 2009-01-03 12:01 <DIR> d-------- c:\documents and settings\All Users\Application Data\LogMeIn

2009-01-03 12:01 . 2008-10-16 20:35 87,352 --a------ c:\windows\system32\LMIinit.dll

2009-01-03 12:01 . 2008-10-16 20:35 83,288 --a------ c:\windows\system32\LMIRfsClientNP.dll

2009-01-03 12:01 . 2008-07-24 18:46 47,640 --a------ c:\windows\system32\drivers\LMIRfsDriver.sys

2009-01-03 12:01 . 2008-10-16 20:35 28,984 --a------ c:\windows\system32\LMIport.dll

2008-12-31 16:46 . 2008-12-31 16:46 <DIR> d-------- c:\windows\solcache

2008-12-31 16:35 . 1999-06-17 10:49 1,204,224 --a------ c:\windows\system32\SierraNW.DLL

2008-12-31 16:35 . 1999-06-17 10:49 233,472 --a------ c:\windows\system32\SNWValid.dll

2008-12-31 16:35 . 1995-08-09 23:07 149,504 --a------ c:\windows\system32\MFCANS32.DLL

2008-12-31 16:35 . 1995-01-13 14:10 108,032 --a------ c:\windows\system32\MFCUIA32.DLL

2008-12-31 16:35 . 1999-06-15 15:05 44,544 --a------ c:\windows\system32\gif89.dll

2008-12-31 16:35 . 2008-12-31 17:12 683 --a------ c:\windows\SIERRA.INI

2008-12-31 16:23 . 2008-12-31 16:23 <DIR> d-------- c:\documents and settings\Administrator\Application Data\DAEMON Tools Pro

2008-12-31 16:23 . 2008-12-31 16:23 <DIR> d-------- c:\documents and settings\Administrator\Application Data\DAEMON Tools

2008-12-31 16:22 . 2008-12-31 16:22 <DIR> d-------- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite

2008-12-31 16:21 . 2008-12-31 16:22 <DIR> d-------- c:\program files\DAEMON Tools Lite

2008-12-31 16:10 . 2008-12-31 16:29 <DIR> d-------- c:\documents and settings\Administrator\Application Data\DAEMON Tools Lite

2008-12-31 16:10 . 2008-12-31 16:10 717,296 --a------ c:\windows\system32\drivers\sptd.sys

2008-12-31 15:09 . 2008-12-31 15:11 <DIR> d-------- c:\program files\The KMPlayer

2008-12-31 15:03 . 2008-12-31 15:05 5,423 --a------ c:\windows\BricoPackFoldersDelete.cmd

2008-12-31 14:29 . 2008-12-31 14:29 <DIR> d-------- c:\program files\Common Files\Adobe AIR

2008-12-31 13:12 . 2008-12-31 13:12 230,664 --a------ c:\windows\system32\PDBoot.exe

2008-12-31 12:29 . 2008-12-31 12:29 <DIR> d-------- c:\program files\Toshiba

2008-12-31 12:29 . 2008-12-31 12:29 <DIR> d-------- c:\documents and settings\Administrator\Application Data\TOSHIBA

2008-12-31 11:59 . 2008-12-31 11:59 <DIR> d-------- c:\windows\system32\Backup

2008-12-31 11:59 . 2008-12-31 11:59 60,357 --a------ c:\windows\system32\uninstWMPbg.exe

2008-12-31 11:59 . 2008-12-31 11:59 49 --a------ c:\windows\system32\Български интерфейс за Windows Media Player.url

2008-12-31 10:58 . 1999-12-17 10:13 86,016 --a------ c:\windows\unvise32.exe

2008-12-31 10:58 . 2008-12-31 10:58 658 --a------ c:\windows\AutumnLeaves.HLP.lnk

2008-12-30 19:51 . 2008-12-30 19:51 <DIR> d-------- c:\documents and settings\Administrator\.dvdcss

2008-12-30 14:54 . 2008-12-30 14:54 <DIR> d--h----- c:\windows\PIF

2008-12-29 17:46 . 2008-12-31 12:29 <DIR> d----c--- c:\windows\system32\DRVSTORE

2008-12-29 17:46 . 2008-12-29 17:46 <DIR> d-------- c:\documents and settings\All Users\Application Data\Logishrd

2008-12-29 10:48 . 2009-01-17 15:22 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Skype

2008-12-28 21:48 . 2007-10-12 03:57 195,096 --a------ c:\windows\system32\lvci1150.dll

2008-12-28 21:47 . 2008-12-28 21:47 <DIR> d-------- c:\program files\Logitech

2008-12-28 21:47 . 2008-12-29 17:46 <DIR> d-------- c:\program files\Common Files\LogiShrd

2008-12-28 19:13 . 2008-12-28 19:18 8,192 --a------ c:\windows\system32\edb.chk

2008-12-28 17:27 . 2008-12-28 17:33 <DIR> d-------- c:\windows\system32\NtmsData

2008-12-28 14:26 . 2008-12-28 14:26 <DIR> d-------- c:\program files\Opera 10 Preview

2008-12-28 12:25 . 2008-12-28 12:25 <DIR> d-------- c:\program files\Yamicsoft

2008-12-28 12:13 . 2008-12-28 12:13 <DIR> d-------- c:\program files\UseNeXT

2008-12-28 12:13 . 2009-01-14 19:10 <DIR> d-------- c:\documents and settings\Administrator\Application Data\UseNeXT

2008-12-27 13:13 . 2008-12-27 13:23 <DIR> d-------- c:\program files\uTorrent

2008-12-27 13:13 . 2009-01-17 15:05 <DIR> d-------- c:\documents and settings\Administrator\Application Data\uTorrent

2008-12-27 12:01 . 2008-12-31 15:26 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Software Informer

2008-12-25 19:13 . 2008-12-25 19:13 13,416,432 --a------ c:\windows\system32\xa11737843.exe

2008-12-25 19:13 . 2008-12-25 19:13 13,416,432 --a------ c:\windows\system32\xa11737359.exe

2008-12-25 13:15 . 2008-12-25 13:15 0 --a------ c:\windows\system32\_r_a_p_.tmp

2008-12-24 16:38 . 2009-01-11 20:53 <DIR> d-------- c:\program files\Common Files\Adobe

2008-12-24 11:44 . 2008-12-24 11:45 <DIR> d-------- c:\program files\Winamp

2008-12-24 11:44 . 2008-12-24 11:46 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Winamp

2008-12-22 18:26 . 2008-12-22 18:26 <DIR> d-------- c:\documents and settings\Administrator\Application Data\JLC's Software

2008-12-21 19:23 . 2008-12-21 19:23 16,332 --ah----- c:\windows\system32\mlfcache.dat

2008-12-21 15:07 . 2008-12-21 15:07 <DIR> d-------- c:\documents and settings\Administrator\Application Data\UpdateStar

2008-12-21 14:05 . 2008-12-21 14:18 <DIR> d-------- c:\program files\Microsoft Bootvis

2008-12-20 17:45 . 2009-01-05 18:11 <DIR> d-------- c:\documents and settings\All Users\Application Data\HDD Thermometer

2008-12-20 17:45 . 2009-01-05 18:11 <DIR> d-------- c:\documents and settings\Administrator\Application Data\HDD Thermometer

2008-12-19 20:42 . 2008-12-19 20:42 <DIR> d-------- c:\program files\TVUPlayer

2008-12-19 20:41 . 2008-12-19 20:41 <DIR> d-------- c:\documents and settings\All Users\Application Data\TVU Networks

2008-12-19 20:41 . 2008-12-19 20:41 <DIR> d-------- c:\documents and settings\Administrator\LocalLow

2008-12-18 20:32 . 2009-01-10 14:41 1,908 --a------ c:\windows\diagwrn.xml

2008-12-18 20:32 . 2009-01-10 14:41 1,908 --a------ c:\windows\diagerr.xml

2008-12-17 21:13 . 2008-12-25 13:14 <DIR> d-------- c:\windows\Downloaded Installations

2008-12-17 21:11 . 1996-05-21 18:13 374,784 --a------ c:\windows\3dg32.dll

2008-12-17 21:05 . 2008-12-17 21:05 <DIR> d--hs---- c:\windows\ftpcache

2008-12-17 21:02 . 2008-12-17 21:02 <DIR> d-------- c:\documents and settings\All Users\Application Data\Protexis

2008-12-17 21:00 . 2008-12-17 21:00 <DIR> d-------- c:\documents and settings\Administrator\Application Data\OpenOffice.org

2008-12-17 20:58 . 2008-12-17 20:58 <DIR> d-------- c:\program files\OpenOffice.org 3

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-01-17 08:59 --------- d-----w c:\documents and settings\Administrator\Application Data\skypePM

2009-01-15 20:37 --------- d-----w c:\program files\Alwil Software

2009-01-15 17:22 --------- d--h--w c:\program files\InstallShield Installation Information

2009-01-11 11:57 --------- d-----w c:\program files\Unlocker

2009-01-10 12:36 --------- d-----w c:\documents and settings\All Users\Application Data\Skype

2009-01-04 14:28 --------- d-----w c:\program files\Gadwin Systems

2009-01-04 09:43 --------- d-----w c:\program files\DivX

2008-12-31 17:39 --------- d-----w c:\documents and settings\Administrator\Application Data\LGAAS

2008-12-31 17:37 --------- d-----w c:\program files\LG PC Suite II

2008-12-31 13:05 71,502 ----a-w c:\windows\BricoPackUninst.cmd

2008-12-31 11:14 --------- d-----w c:\program files\Notepad++

2008-12-29 15:46 --------- d-----w c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com

2008-12-29 15:46 --------- d-----w c:\documents and settings\Administrator\Application Data\Desktopicon

2008-12-28 19:59 --------- d-----w c:\program files\Common Files\Logitech

2008-12-28 18:59 141 --sh--w c:\program files\desktop.ini

2008-12-28 17:31 --------- d-----w c:\program files\Windows Media Connect 2

2008-12-26 17:19 --------- d-----w c:\program files\Common Files\ACD Systems

2008-12-26 09:03 --------- d-----w c:\program files\Google

2008-12-24 18:24 --------- d-----w c:\program files\IObit

2008-12-15 16:37 --------- d-----w c:\documents and settings\Administrator\Application Data\ACD Systems

2008-12-14 17:54 --------- d-----w c:\program files\EasyBiorhythmCalculator

2008-12-14 17:53 --------- d-----w c:\program files\Natural Biorhythms

2008-12-14 16:51 --------- d-----w c:\documents and settings\Administrator\Application Data\Notepad++

2008-12-14 16:41 --------- d-----w c:\documents and settings\Administrator\Application Data\IObit

2008-12-12 16:24 --------- d-----w c:\documents and settings\All Users\Application Data\QuickTime

2008-12-11 17:25 410,984 ----a-w c:\windows\system32\deploytk.dll

2008-12-11 17:25 --------- d-----w c:\program files\Java

2008-12-11 16:30 --------- d-----w c:\documents and settings\Administrator\Application Data\ooVoo Details

2008-12-11 16:29 --------- d-----w c:\program files\ooVoo

2008-12-11 16:26 --------- d-----w c:\program files\Paint.NET

2008-12-10 19:29 --------- d-----w c:\program files\Sweet Home 3D

2008-12-09 17:05 --------- d-----w c:\documents and settings\Administrator\Application Data\eTeks

2008-12-07 18:54 --------- d-----w c:\program files\ProgDVB

2008-12-07 18:04 --------- d-----w c:\documents and settings\Administrator\Application Data\ImgBurn

2008-12-07 17:17 --------- d-----w c:\program files\ImgBurn

2008-12-07 12:32 --------- d-----w c:\program files\Polyglot7

2008-12-07 10:49 --------- d-----w c:\program files\SMPlayer

2008-12-06 06:35 218,624 ----a-w c:\windows\system32\uxtheme.dll

2008-12-05 08:36 --------- d-----w c:\program files\filehippo.com

2008-12-05 03:57 --------- d-----w c:\program files\Lavalys

2008-12-05 03:46 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes

2008-12-05 03:46 --------- d-----w c:\documents and settings\Administrator\Application Data\Malwarebytes

2008-12-05 03:37 --------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2008-12-04 07:31 --------- d-----w c:\documents and settings\Administrator\Application Data\LG Electronics

2008-12-04 05:50 --------- d-----w c:\program files\LG Electronics

2008-12-04 05:50 --------- d-----w c:\documents and settings\Administrator\Application Data\VSRevoGroup

2008-12-03 05:37 --------- d-----w c:\documents and settings\Administrator\Application Data\DivX

2008-12-03 05:33 --------- d-----w c:\documents and settings\All Users\Application Data\OLYMPUS

2008-12-03 05:32 --------- d-----w c:\program files\OLYMPUS

2008-12-03 04:05 --------- d-----w c:\documents and settings\All Users\Application Data\Logitech

2008-12-03 03:53 --------- d-----w c:\documents and settings\Administrator\Application Data\InstallShield

2008-12-02 08:47 --------- d-----w c:\documents and settings\Administrator\Application Data\Ashampoo

2008-12-02 08:46 --------- d-----w c:\documents and settings\All Users\Application Data\ashampoo

2008-12-02 05:49 --------- d-----w c:\program files\GRETECH

2008-12-02 05:49 --------- d-----w c:\documents and settings\All Users\Application Data\GRETECH

2008-12-02 05:49 --------- d-----w c:\documents and settings\Administrator\Application Data\GRETECH

2008-12-01 11:56 --------- d-----w c:\program files\Realtek

2008-12-01 11:48 --------- d-----w c:\program files\VIA

2008-12-01 11:47 --------- d-----w c:\program files\Common Files\InstallShield

2008-12-01 11:41 --------- d-----w c:\documents and settings\All Users\Application Data\ATI

2008-12-01 11:41 --------- d-----w c:\documents and settings\Administrator\Application Data\ATI

2008-12-01 11:39 --------- d-----w c:\program files\ATI Technologies

2008-12-01 10:38 --------- d-----w c:\program files\microsoft frontpage

2008-12-01 08:20 --------- d-----w c:\program files\MLocator

2008-12-01 07:47 --------- d-----w c:\program files\VS Revo Group

2008-10-29 02:23 425,984 ----a-w c:\windows\system32\ATIDEMGX.dll

2008-10-29 02:22 314,880 ----a-w c:\windows\system32\ati2dvag.dll

2008-10-29 02:11 43,520 ----a-w c:\windows\system32\ati2edxx.dll

2008-10-29 02:11 26,112 ----a-w c:\windows\system32\Ati2mdxx.exe

2008-10-29 02:11 188,416 ----a-w c:\windows\system32\atipdlxx.dll

2008-10-29 02:11 147,456 ----a-w c:\windows\system32\Oemdspif.dll

2008-10-29 02:10 143,360 ----a-w c:\windows\system32\ati2evxx.dll

2008-10-29 02:10 10,973,184 ----a-w c:\windows\system32\atioglxx.dll

2008-10-29 02:09 585,728 ----a-w c:\windows\system32\ati2evxx.exe

2008-10-29 02:07 53,248 ----a-w c:\windows\system32\ATIDDC.DLL

2008-10-29 01:57 4,041,472 ----a-w c:\windows\system32\ati3duag.dll

2008-10-29 01:49 307,200 ----a-w c:\windows\system32\atiiiexx.dll

2008-10-29 01:41 2,472,832 ----a-w c:\windows\system32\ativvaxx.dll

2008-10-29 01:25 48,640 ----a-w c:\windows\system32\amdpcom32.dll

2008-10-29 01:21 389,120 ----a-w c:\windows\system32\atikvmag.dll

2008-10-29 01:19 44,032 ----a-w c:\windows\system32\atiadlxx.dll

2008-10-29 01:19 17,408 ----a-w c:\windows\system32\atitvo32.dll

2008-10-29 01:18 253,952 ----a-w c:\windows\system32\atiok3x2.dll

2008-10-29 01:12 577,536 ----a-w c:\windows\system32\ati2cqag.dll

2008-10-28 19:05 593,920 ------w c:\windows\system32\ati2sgag.exe

2008-10-21 17:51 118,784 ----a-w c:\windows\system32\atibrtmon.exe

2007-08-06 10:07 8,784 ----a-w c:\program files\mozilla firefox\plugins\ractrlkeyhook.dll

2007-07-18 12:54 245,408 ----a-w c:\program files\mozilla firefox\plugins\unicows.dll

2008-12-17 22:17 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll

2008-12-17 22:17 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll

2008-12-17 22:17 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll

2008-12-17 22:17 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll

2008-12-17 22:17 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll

.

------- Sigcheck -------

2008-04-14 14:00 699904 8a513e79e7980018daedca586b866bc3 c:\windows\system32\wininet.dll

2008-04-14 14:00 699904 8a513e79e7980018daedca586b866bc3 c:\windows\system32\dllcache\wininet.dll

2008-04-14 14:00 975872 561a50497324f378e30f55d09b4e1258 c:\windows\explorer.exe

2008-04-14 14:00 975872 561a50497324f378e30f55d09b4e1258 c:\windows\system32\dllcache\explorer.exe

2008-04-14 14:00 100864 bd0d8a40d28a07db96913d6da2e6b5a3 c:\windows\system32\wuauclt.exe

2008-04-14 14:00 100864 bd0d8a40d28a07db96913d6da2e6b5a3 c:\windows\system32\dllcache\wuauclt.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RocketDock"="c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" [2007-03-19 630784]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"Gadwin PrintScreen"="c:\program files\Gadwin Systems\PrintScreen\PrintScreen.exe" [2008-12-09 495616]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-09-23 21755688]

"Snap Clipboard"="c:\program files\Snap Clipboard\SnapClipboard.exe" [2009-01-15 264704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RaidTool"="c:\program files\VIA\RAID\raid_tool.exe" [2005-11-23 1060864]

"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]

"MouseLocator"="c:\program files\MLocator\MLocator.exe" [2006-02-08 241152]

"ThreatFire"="c:\program files\ThreatFire\TFTray.exe" [2008-11-17 263456]

"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]

"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 c:\windows\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]

2008-10-16 20:35 87352 c:\windows\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.divxa32"= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ PDBoot.exe\0autocheck autochk *\0autocheck OODBS

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\ooVoo\\ooVoo.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=

"c:\\Program Files\\Microsoft Virtual PC\\Virtual PC.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"443:TCP"= 443:TCP:*:Disabled:ooVoo TCP порт 443

"443:UDP"= 443:UDP:*:Disabled:ooVoo UDP порт 443

"37674:TCP"= 37674:TCP:*:Disabled:ooVoo TCP порт 37674

"37674:UDP"= 37674:UDP:*:Disabled:ooVoo UDP порт 37674

"37675:UDP"= 37675:UDP:*:Disabled:ooVoo UDP порт 37675

R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2009-01-15 51488]

R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2009-01-15 39200]

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-01-15 111184]

R1 eusk2par;EUTRON SmartKey Parallel Driver;c:\windows\system32\drivers\eusk2par.sys [2008-12-07 24786]

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-12-22 8944]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-12-22 55024]

R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2009-01-15 33056]

R4 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-01-15 20560]

R4 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [2008-07-24 12856]

R4 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2009-01-03 47640]

R4 PD91Agent;PD91Agent;c:\program files\Raxco\PerfectDisk2008\PD91Agent.exe [2008-12-31 693512]

R4 ThreatFire;ThreatFire;c:\program files\ThreatFire\TFService.exe service --> c:\program files\ThreatFire\TFService.exe service [?]

S3 aswArKrn;aswArKrn;\??\c:\docume~1\ADMINI~1\LOCALS~1\Temp\aswArKrn.sys --> c:\docume~1\ADMINI~1\LOCALS~1\Temp\aswArKrn.sys [?]

S3 eusk3usb;SmartKey 3 USB;c:\windows\system32\drivers\eusk3usb.sys [2008-12-07 45534]

S3 PD91Engine;PD91Engine;c:\program files\Raxco\PerfectDisk2008\PD91Engine.exe [2008-12-31 910600]

S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-22 7408]

S4 LMIRfsClientNP;LMIRfsClientNP; [x]

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv

.

Contents of the 'Scheduled Tasks' folder

2009-01-14 c:\windows\Tasks\AWC AutoCare.job

- c:\program files\IObit\Advanced SystemCare 3\AutoCare.exe [2009-01-06 11:32]

2009-01-14 c:\windows\Tasks\AWC AutoCare.job

- c:\program files\IObit\Advanced SystemCare 3\ [2009-01-14 19:16]

2009-01-17 c:\windows\Tasks\AWC AutoSweep.job

- c:\program files\IObit\Advanced SystemCare 3\AutoSweep.exe [2009-01-06 11:32]

2009-01-16 c:\windows\Tasks\AWC Update.job

- c:\program files\IObit\Advanced SystemCare 3\IObitUpdate.exe [2009-01-06 11:37]

2009-01-16 c:\windows\Tasks\AWC Update.job

- c:\program files\IObit\Advanced SystemCare 3\ [2009-01-14 19:16]

.

- - - - ORPHANS REMOVED - - - -

WebBrowser-{A057A204-BACC-4D26-8087-36EE87E26986} - (no file)

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.daemon-search.com/startpage

uInternet Settings,ProxyOverride = *.local

IE: &Search

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

TCP: {C18B9571-BD33-483A-8853-1C0694BC14FB} = 80.72.72.9

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-01-17 15:22:33

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Snap Clipboard = c:\program files\Snap Clipboard\SnapClipboard.exe????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]

"OODEFRAG11.00.00.01WORKSTATION"="5BBA0537D93D9687D6F8C9B02BD17300462E84D617C2103CA95546D8F1EEAB0803B94C2E437

C2C095BD7CA3768D1589B22538EE31D8DD14BCC026371CD19F3CF57005131AF4273A40AD1AFE638EE

D3280E2477B0DB57ACCE5E0BF8029B5939E4755852AFEB50C7666108BD085D0B61D712B0327F24435

541880EC6E8E433902DCC14F8C0D3AC3ABA3719310C2ACC2CC0FEBC9E127BECC74CFEBC9E127BECC7

4CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC793

3A6A0AC4980AC79339DB7CE019D40AA5CA6171C11EC38DE3DF380745CF23F7557698506D066EA5524

73DC3D1507D6734B056EAC0ACCBAB8591EC19662CC54141818296C00218F70B1BC763ADA334AF7E1A

CBFC47A4520263A1CB41185D54CB071D88D2C574F143A4B227645AE87C55686521D2062944C5C6056

444D3265C491A7F86C371EBBB617DFF608FE50E4CA31F16CC32C1ACE1EDCEF09DBA1FAE51F34E6190

3F33EC67AA0C261D97B25BF9B5FBF4673499E1FBBDBEBC1EBDE95D400C9BC2D13BD476324242BDA1E

41B3203E6CF0FEEDCC11428CBDBFE5E945DBC550B51A7EE2E46D19BEA4B5B00B4EA8A200956A89FBF

E3789BCA0B7AD4D8CCBDCBD90D72ABB2B050397D5DF845C11D3766D4DF2AA6A1FF7D83C530624145D

0757B927AFA06AC70ACF42220ECDD0EEA860DB3B38FE87DBE02C3FD93F29BE555380787A3F2742669

C4494288854A93EBFB962394BF4265BA48E3EEADC70D0879B3CF33F895517A57DB5A737F8B62FCCD4

EDDA559FCF9F3795A2F5F13C82537A6C00685CF419431995115A5670E5AB5AC67DE4D30CA54EFAAE9

CE40F9F3A54A6795758704B33A5C5EDD34EBE61A96B1A9A7BE32950E013280BC64F952B47E1FA965F

884ABC389EA83793EADDA299C4347891FD808AC151356DFC3F8D692D93D9BECA81EE599013B0C375D

855F0A40CC42BFBA039BE59EF09B9B17F31C7C57F9810DF109718F96EC00937077AEA8C1D5CA38AF8

65570FDB02F8E920F196BA4481CC79463055831D2FA4A5285794E6D57D74227ACA9F9D03F0D63F76F

18C8D81D2D80579D8CC131347532431A8541E19A257B9DC64C7945A9926DE1A8841105B3E4084C1E7

2261C1C8F8AB5D5F766ECCB527DF9B6164D559B75B09E5C2346AFB69300F7DE35C7B26E49B46A9A3A

96ADC18E3B274A3ED187BF50F15FADEC41A8FEFF9CECD896541BDC46715594C0278B61D30E6EA42C0

673FF5FEE93ECFBAECC55E9482954B8A6989032AC871E876D14E0D56C548879E212A4D8A86D63FBD8

854B6197B014B7FF90D2ED72A3DB863059A24412A95F029F8C304B67B3107DBE2F26FC59F7B63DAD1

D5C80613CA3386F114918005A1326AF41698AD6DFDB605C85FF27C6B372096216F4A7075EB8204D03

AF948DB80B1CFEFB2FA3C97301390"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(860)

c:\program files\SUPERAntiSpyware\SASWINLO.dll

c:\windows\system32\Ati2evxx.dll

c:\windows\system32\LMIinit.dll

c:\windows\system32\LMIRfsClientNP.dll

c:\program files\ThreatFire\TFWAH.dll

c:\program files\ThreatFire\TFNI.dll

- - - - - - - > 'lsass.exe'(916)

c:\program files\ThreatFire\TFWAH.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\ati2evxx.exe

c:\program files\Alwil Software\Avast4\aswUpdSv.exe

c:\program files\Alwil Software\Avast4\ashServ.exe

c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\LogMeIn\x86\ramaint.exe

c:\program files\LogMeIn\x86\LogMeIn.exe

c:\program files\LogMeIn\x86\LMIGuardian.exe

c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

c:\program files\ThreatFire\TFService.exe

c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

.

**************************************************************************

.

Completion time: 2009-01-17 15:25:02 - machine was rebooted

ComboFix-quarantined-files.txt 2009-01-17 13:24:58

Pre-Run: 44 887 310 336 bytes free

Post-Run: 44,855,484,416 bytes free

380

Night_Raven · Януари 17, 2009

Упорита гадинка.

Изтегли The Avenger и я стартирай.

Копирай следния текст (Ctrl+C и го пейстни в полето на The Avenger - Ctrl+V):

Files to delete:
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\SYSTEM32\TDSSixgp.dll
C:\WINDOWS\SYSTEM32\TDSSproc.log
C:\WINDOWS\SYSTEM32\TDSSwkod.log
C:\Documents and Settings\Chelsea\Local Settings\Temp\TDSSe8db.tmp
c:\windows\system32\drivers\msqpdxserv.sys
C:\resycled
D:\resycled
e:\resycled
f:\resycled
g:\resycled
c:\windows\system32\TDSSweat.dat
C:\WINDOWS\system32\drivers\TDSSmqlt.sys
C:\windows\system32\drivers\tdssserv.sys
C:\WINDOWS\system32\drivers\TDSSmact.sys
C:\WINDOWS\system32\TDSSfpmp.dll
C:\WINDOWS\system32\TDSSwpyd.dat
C:\WINDOWS\system32\TDSStkdv.log
C:\WINDOWS\system32\TDSSotxb.dll
C:\WINDOWS\system32\TDSScrrn.dll
C:\WINDOWS\system32\TDSSbvqh.dll
C:\WINDOWS\system32\TDSSjnmx.dll
c:\windows\system32\TDSShrxr.dll
c:\windows\system32\TDSSkkbi.log
c:\windows\system32\TDSSlrvd.dat
c:\windows\system32\TDSSlxwp.dll
c:\windows\system32\TDSSnmxh.log
c:\windows\system32\TDSSoiqt.dll
c:\windows\system32\TDSSrhyp.log
c:\windows\system32\TDSSrtqp.dll
c:\windows\system32\TDSSsihc.dll
c:\windows\system32\TDSSxfum.dll
c:\windows\system32\TDSSmtve.dat
c:\windows\system32\TDSSnirj.dat

Drivers to delete:
tdss
tdssserv
TDSSserv.SYS
Service_TDSSSERV.SYS
Legacy_TDSSSERV.SYS
msqpdxserv.sys
msqpdxserv

Registry keys to delete:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TDSSserv.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TDSSserv.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\tdssserv
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdssserv
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata
HKEY_LOCAL_MACHINE\SOFTWARE\tdss
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\tdssserv.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\tdssserv.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tdssserv
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TDSSSERV

Кликни бутон Execute и потвърди с Yes на всички въпроси.

Ако системата забие на син екран след рестарта, това е нормално в случая. Просто я рестартирай, ако тя не се рестартира автоматично.

След като Windows зареди. Обнови дефинициите на SUPERAntiSpyware и Malwarebytes' Anti-Malware и сканирай още веднъж, като после пусни логовете.

mavro · Януари 17, 2009

Това нормално ли е ?

Logfile of The Avenger Version 2.0, © by Swandog46

http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.

Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

No rootkits found!

Error: file "C:\WINDOWS\system32\brsvc01a.exe" not found!

Deletion of file "C:\WINDOWS\system32\brsvc01a.exe" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\WINDOWS\system32\brss01a.exe" not found!

Deletion of file "C:\WINDOWS\system32\brss01a.exe" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\WINDOWS\SYSTEM32\TDSSixgp.dll" not found!

Deletion of file "C:\WINDOWS\SYSTEM32\TDSSixgp.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\WINDOWS\SYSTEM32\TDSSproc.log" not found!

Deletion of file "C:\WINDOWS\SYSTEM32\TDSSproc.log" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\WINDOWS\SYSTEM32\TDSSwkod.log" not found!

Deletion of file "C:\WINDOWS\SYSTEM32\TDSSwkod.log" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: could not open file "C:\Documents and Settings\Chelsea\Local Settings\Temp\TDSSe8db.tmp"

Deletion of file "C:\Documents and Settings\Chelsea\Local Settings\Temp\TDSSe8db.tmp" failed!

Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)

--> bad path / the parent directory does not exist

Error: file "c:\windows\system32\drivers\msqpdxserv.sys" not found!

Deletion of file "c:\windows\system32\drivers\msqpdxserv.sys" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\resycled" not found!

Deletion of file "C:\resycled" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "D:\resycled" not found!

Deletion of file "D:\resycled" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: could not open file "e:\resycled"

Deletion of file "e:\resycled" failed!

Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)

--> bad path / the parent directory does not exist

Error: could not open file "f:\resycled"

Deletion of file "f:\resycled" failed!

Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)

--> bad path / the parent directory does not exist

Error: could not open file "g:\resycled"

Deletion of file "g:\resycled" failed!

Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)

--> bad path / the parent directory does not exist

Error: file "c:\windows\system32\TDSSweat.dat" not found!

Deletion of file "c:\windows\system32\TDSSweat.dat" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\WINDOWS\system32\drivers\TDSSmqlt.sys" not found!

Deletion of file "C:\WINDOWS\system32\drivers\TDSSmqlt.sys" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\windows\system32\drivers\tdssserv.sys" not found!

Deletion of file "C:\windows\system32\drivers\tdssserv.sys" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\WINDOWS\system32\drivers\TDSSmact.sys" not found!

Deletion of file "C:\WINDOWS\system32\drivers\TDSSmact.sys" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\WINDOWS\system32\TDSSfpmp.dll" not found!

Deletion of file "C:\WINDOWS\system32\TDSSfpmp.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\WINDOWS\system32\TDSSwpyd.dat" not found!

Deletion of file "C:\WINDOWS\system32\TDSSwpyd.dat" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\WINDOWS\system32\TDSStkdv.log" not found!

Deletion of file "C:\WINDOWS\system32\TDSStkdv.log" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\WINDOWS\system32\TDSSotxb.dll" not found!

Deletion of file "C:\WINDOWS\system32\TDSSotxb.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\WINDOWS\system32\TDSScrrn.dll" not found!

Deletion of file "C:\WINDOWS\system32\TDSScrrn.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\WINDOWS\system32\TDSSbvqh.dll" not found!

Deletion of file "C:\WINDOWS\system32\TDSSbvqh.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\WINDOWS\system32\TDSSjnmx.dll" not found!

Deletion of file "C:\WINDOWS\system32\TDSSjnmx.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\TDSShrxr.dll" not found!

Deletion of file "c:\windows\system32\TDSShrxr.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\TDSSkkbi.log" not found!

Deletion of file "c:\windows\system32\TDSSkkbi.log" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\TDSSlrvd.dat" not found!

Deletion of file "c:\windows\system32\TDSSlrvd.dat" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\TDSSlxwp.dll" not found!

Deletion of file "c:\windows\system32\TDSSlxwp.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\TDSSnmxh.log" not found!

Deletion of file "c:\windows\system32\TDSSnmxh.log" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\TDSSoiqt.dll" not found!

Deletion of file "c:\windows\system32\TDSSoiqt.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\TDSSrhyp.log" not found!

Deletion of file "c:\windows\system32\TDSSrhyp.log" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\TDSSrtqp.dll" not found!

Deletion of file "c:\windows\system32\TDSSrtqp.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\TDSSsihc.dll" not found!

Deletion of file "c:\windows\system32\TDSSsihc.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\TDSSxfum.dll" not found!

Deletion of file "c:\windows\system32\TDSSxfum.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\TDSSmtve.dat" not found!

Deletion of file "c:\windows\system32\TDSSmtve.dat" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\TDSSnirj.dat" not found!

Deletion of file "c:\windows\system32\TDSSnirj.dat" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\tdss" not found!

Deletion of driver "tdss" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\tdssserv" not found!

Deletion of driver "tdssserv" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\TDSSserv.SYS" not found!

Deletion of driver "TDSSserv.SYS" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\Service_TDSSSERV.SYS" not found!

Deletion of driver "Service_TDSSSERV.SYS" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\Legacy_TDSSSERV.SYS" not found!

Deletion of driver "Legacy_TDSSSERV.SYS" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\msqpdxserv.sys" not found!

Deletion of driver "msqpdxserv.sys" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\msqpdxserv" not found!

Deletion of driver "msqpdxserv" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TDSSserv.sys" not found!

Deletion of registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TDSSserv.sys" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TDSSserv.sys" not found!

Deletion of registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TDSSserv.sys" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\tdssserv" not found!

Deletion of registry key "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\tdssserv" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdssserv" not found!

Deletion of registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdssserv" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\tdssserv.sys" not found!

Deletion of registry key "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\tdssserv.sys" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\tdssserv.sys" not found!

Deletion of registry key "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\tdssserv.sys" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tdssserv" not found!

Deletion of registry key "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tdssserv" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV" not found!

Deletion of registry key "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TDSSSERV" not found!

Deletion of registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TDSSSERV" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata" not found!

Deletion of registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "HKEY_LOCAL_MACHINE\SOFTWARE\tdss" not found!

Deletion of registry key "HKEY_LOCAL_MACHINE\SOFTWARE\tdss" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Completed script processing.

*******************

Finished! Terminate.

B-boy/StyLe/ · Януари 17, 2009

Да скрипта на Night_Raven не беше лош за прочистване на TDSS/SENEKA rootkit (и аз имам една подобна заготовка взета назаем от форма на MBAM)

Отвори Notepad и въведи:

Killall::

File::
c:\windows\QTFont.qfn
c:\windows\QTFont.for
c:\windows\system32\xa11737843.exe
c:\windows\system32\xa11737359.exe
c:\windows\system32\_r_a_p_.tmp
c:\windows\system32\mlfcache.dat
c:\windows\3dg32.dll
C:\WINDOWS\system32\drivers\mchInjDrv.sys

Driver::
mchInjDrv

Dirlook::
c:\windows\Downloaded Installations

sysrst::

Запази файла с име CFScript.txt и го провлачи с мишката в иконата на Combofix:

http://img522.imageshack.us/img522/482/cfscriptyr1.gif

Копирай лога в следващия си пост.

Между другото Combo е свършил доста добра работа:

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_TDSSSERV.SYS

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv

- - - - ORPHANS REMOVED - - - -

WebBrowser-{A057A204-BACC-4D26-8087-36EE87E26986} - (no file)

Night_Raven · Януари 17, 2009

Това нормално ли е ?

Да, всичко е в реда на нещата.

mavro · Януари 17, 2009

Да скрипта на Night_Raven не беше лош за прочистване на TDSS/SENEKA rootkit (и аз имам една подобна заготовка взета назаем от форма на MBAM)

Отвори Notepad и въведи:
Killall::

File::
c:\windows\QTFont.qfn
c:\windows\QTFont.for
c:\windows\system32\xa11737843.exe
c:\windows\system32\xa11737359.exe
c:\windows\system32\_r_a_p_.tmp
c:\windows\system32\mlfcache.dat
c:\windows\3dg32.dll
C:\WINDOWS\system32\drivers\mchInjDrv.sys

Driver::
mchInjDrv

Dirlook::
c:\windows\Downloaded Installations

sysrst::
Запази файла с име CFScript.txt и го провлачи с мишката в иконата на Combofix:

http://img522.imageshack.us/img522/482/cfscriptyr1.gif

Копирай лога в следващия си пост.

Между другото Combo е свършил доста добра работа:
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_TDSSSERV.SYS

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv

- - - - ORPHANS REMOVED - - - -

WebBrowser-{A057A204-BACC-4D26-8087-36EE87E26986} - (no file)

ComboFix 09-01-16.04 - Administrator 2009-01-17 18:38:21.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.511.103 [GMT 2:00]

Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt

AV: avast! antivirus 4.8.1296 [VPS 090117-0] *On-access scanning disabled* (Updated)

AV: ThreatFire *On-access scanning disabled* (Updated)

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::

c:\windows\3dg32.dll

c:\windows\QTFont.for

c:\windows\QTFont.qfn

c:\windows\system32\_r_a_p_.tmp

c:\windows\system32\drivers\mchInjDrv.sys

c:\windows\system32\mlfcache.dat

c:\windows\system32\xa11737359.exe

c:\windows\system32\xa11737843.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\3dg32.dll

c:\windows\QTFont.for

c:\windows\QTFont.qfn

c:\windows\system32\_r_a_p_.tmp

c:\windows\system32\mlfcache.dat

c:\windows\system32\xa11737359.exe

c:\windows\system32\xa11737843.exe

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_MCHINJDRV