- This topic has 25 ответов, 2 участника, and was last updated 16 years назад by
.
-
Сообщения
-
значит так скачал эту программу код она не запрашивала и Delete не писалось потом проверил комбофиксом опять идет сбой
значит так пишет вот что копирую:PEV.cfxxe — обнаружена ошибка. Приложение будет закрыто. Приносим извинения за неудобства.Передайте Microsoft сведения об ошибке.
Кликните Пуск, Выполнить, введите notepad и нажмите enter.
Откроется Блокнот.
Вставьте в него следующий текст:@echo off
gmer -killall
gmer -del reg HKCUSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{421C8D71-3C14-6E74-E561-F063A86477E0}
gmer -rebootКликните Файл, Записать как.
Введите в качестве имени файла fix.bat
При этом в поле Тип файла, выберите Все файлы.
Запустите этот файл.Просканируйте компьютер снова программой GMER и лог вставьте в ваше следующее сообщение.
GMER 1.0.15.15086 — http://www.gmer.net
Rootkit scan 2009-09-26 14:39:28
Windows 5.1.2600 Service Pack 2
Running: gmer.exe—- Registry — GMER 1.0.15 —-
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 ?4;0404=484@4>0424I484:0404 ?0404:0454B4>0424 1?2?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (L002TP) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPTP) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPPoE) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@374@4O4494 ?0404@0404;4;0454;4L4=4K494 ?4>4@4B4 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (IP) 1?
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@s1 771343423
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@s2 285507792
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@h0 2
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04@p0 D:????????????????Alcohol 120
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04@h0 1
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D04@ujdew 0x48 0x36 0xDE 0x13 …
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001@ujdew 0xCB 0xF0 0xC0 0x97 …
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40
Reg HKLMSYSTEMCurrentControlSetServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40@ujdew 0x88 0x18 0x13 0x11 …
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA4
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA4@khjeh 0x4B 0xA9 0x92 0xA6 …
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA4@p0 D:DAEMON Tools
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA40000001
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA40000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA40000001@khjeh 0x3A 0x34 0x5B 0x3D …
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA40000001Jf40
Reg HKLMSYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA40000001Jf40@khjeh 0x9A 0xA5 0x28 0xC1 …
Reg HKLMSYSTEMCurrentControlSetServicesSysmonLogLog Queries{15086684-e3c6-4f13-8d27-1bb70a69ec48}@204B4@480414C4B4K4 E4@0404=0454=484O4 0040404=4=4K4E4 33
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04 (not active ControlSet)
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04@p0 D:????????????????Alcohol 120
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04@h0 1
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D04@ujdew 0x48 0x36 0xDE 0x13 …
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001 (not active ControlSet)
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@ujdew 0xCB 0xF0 0xC0 0x97 …
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40 (not active ControlSet)
Reg HKLMSYSTEMControlSet002ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40@ujdew 0x88 0x18 0x13 0x11 …
Reg HKLMSYSTEMControlSet002ServicessptdCfg19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLMSYSTEMControlSet002ServicessptdCfg19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLMSYSTEMControlSet002ServicessptdCfg19659239224E364682FA4BAF72C53EA4@khjeh 0x4B 0xA9 0x92 0xA6 …
Reg HKLMSYSTEMControlSet002ServicessptdCfg19659239224E364682FA4BAF72C53EA4@p0 D:DAEMON Tools
Reg HKLMSYSTEMControlSet002ServicessptdCfg19659239224E364682FA4BAF72C53EA40000001 (not active ControlSet)
Reg HKLMSYSTEMControlSet002ServicessptdCfg19659239224E364682FA4BAF72C53EA40000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLMSYSTEMControlSet002ServicessptdCfg19659239224E364682FA4BAF72C53EA40000001@khjeh 0x3A 0x34 0x5B 0x3D …
Reg HKLMSYSTEMControlSet002ServicessptdCfg19659239224E364682FA4BAF72C53EA40000001Jf40 (not active ControlSet)
Reg HKLMSYSTEMControlSet002ServicessptdCfg19659239224E364682FA4BAF72C53EA40000001Jf40@khjeh 0x9A 0xA5 0x28 0xC1 …
Reg HKLMSYSTEMControlSet002ServicesSysmonLogLog Queries{15086684-e3c6-4f13-8d27-1bb70a69ec48}@204B4@480414C4B4K4 E4@0404=0454=484O4 0040404=4=4K4E4 33
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D04 (not active ControlSet)
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D04@p0 D:????????????????Alcohol 120
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D04@h0 1
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D04@ujdew 0x48 0x36 0xDE 0x13 …
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001 (not active ControlSet)
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@ujdew 0xCB 0xF0 0xC0 0x97 …
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40 (not active ControlSet)
Reg HKLMSYSTEMControlSet003ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40@ujdew 0x88 0x18 0x13 0x11 …
Reg HKLMSYSTEMControlSet003ServicessptdCfg19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLMSYSTEMControlSet003ServicessptdCfg19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLMSYSTEMControlSet003ServicessptdCfg19659239224E364682FA4BAF72C53EA4@khjeh 0x4B 0xA9 0x92 0xA6 …
Reg HKLMSYSTEMControlSet003ServicessptdCfg19659239224E364682FA4BAF72C53EA4@p0 D:DAEMON Tools
Reg HKLMSYSTEMControlSet003ServicessptdCfg19659239224E364682FA4BAF72C53EA40000001 (not active ControlSet)
Reg HKLMSYSTEMControlSet003ServicessptdCfg19659239224E364682FA4BAF72C53EA40000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLMSYSTEMControlSet003ServicessptdCfg19659239224E364682FA4BAF72C53EA40000001@khjeh 0x3A 0x34 0x5B 0x3D …
Reg HKLMSYSTEMControlSet003ServicessptdCfg19659239224E364682FA4BAF72C53EA40000001Jf40 (not active ControlSet)
Reg HKLMSYSTEMControlSet003ServicessptdCfg19659239224E364682FA4BAF72C53EA40000001Jf40@khjeh 0x9A 0xA5 0x28 0xC1 …
Reg HKLMSYSTEMControlSet003ServicesSysmonLogLog Queries{15086684-e3c6-4f13-8d27-1bb70a69ec48}@204B4@480414C4B4K4 E4@0404=0454=484O4 0040404=4=4K4E4 33
Reg HKLMSYSTEMControlSet004ServicessptdCfgD79C293C1ED61418462E24595C90D04 (not active ControlSet)
Reg HKLMSYSTEMControlSet004ServicessptdCfgD79C293C1ED61418462E24595C90D04@p0 D:????????????????Alcohol 120
Reg HKLMSYSTEMControlSet004ServicessptdCfgD79C293C1ED61418462E24595C90D04@h0 1
Reg HKLMSYSTEMControlSet004ServicessptdCfgD79C293C1ED61418462E24595C90D04@ujdew 0x48 0x36 0xDE 0x13 …
Reg HKLMSYSTEMControlSet004ServicessptdCfgD79C293C1ED61418462E24595C90D040000001 (not active ControlSet)
Reg HKLMSYSTEMControlSet004ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLMSYSTEMControlSet004ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@ujdew 0xCB 0xF0 0xC0 0x97 …
Reg HKLMSYSTEMControlSet004ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40 (not active ControlSet)
Reg HKLMSYSTEMControlSet004ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40@ujdew 0x88 0x18 0x13 0x11 …
Reg HKLMSYSTEMControlSet004ServicessptdCfg19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLMSYSTEMControlSet004ServicessptdCfg19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLMSYSTEMControlSet004ServicessptdCfg19659239224E364682FA4BAF72C53EA4@khjeh 0x4B 0xA9 0x92 0xA6 …
Reg HKLMSYSTEMControlSet004ServicessptdCfg19659239224E364682FA4BAF72C53EA4@p0 D:DAEMON Tools
Reg HKLMSYSTEMControlSet004ServicessptdCfg19659239224E364682FA4BAF72C53EA40000001 (not active ControlSet)
Reg HKLMSYSTEMControlSet004ServicessptdCfg19659239224E364682FA4BAF72C53EA40000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLMSYSTEMControlSet004ServicessptdCfg19659239224E364682FA4BAF72C53EA40000001@khjeh 0x3A 0x34 0x5B 0x3D …
Reg HKLMSYSTEMControlSet004ServicessptdCfg19659239224E364682FA4BAF72C53EA40000001Jf40 (not active ControlSet)
Reg HKLMSYSTEMControlSet004ServicessptdCfg19659239224E364682FA4BAF72C53EA40000001Jf40@khjeh 0x9A 0xA5 0x28 0xC1 …
Reg HKLMSYSTEMControlSet004ServicesSysmonLogLog Queries{15086684-e3c6-4f13-8d27-1bb70a69ec48}@204B4@480414C4B4K4 E4@0404=0454=484O4 0040404=4=4K4E4 33
Reg HKLMSYSTEMControlSet005ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 ?4;0404=484@4>0424I484:0404 ?0404:0454B4>0424 1?2?
Reg HKLMSYSTEMControlSet005ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (L002TP) 1?
Reg HKLMSYSTEMControlSet005ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPTP) 1?
Reg HKLMSYSTEMControlSet005ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (PPPoE) 1?
Reg HKLMSYSTEMControlSet005ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@374@4O4494 ?0404@0404;4;0454;4L4=4K494 ?4>4@4B4 1?
Reg HKLMSYSTEMControlSet005ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 WAN (IP) 1?
Reg HKLMSYSTEMControlSet005ServicessptdCfgD79C293C1ED61418462E24595C90D04 (not active ControlSet)
Reg HKLMSYSTEMControlSet005ServicessptdCfgD79C293C1ED61418462E24595C90D04@p0 D:????????????????Alcohol 120
Reg HKLMSYSTEMControlSet005ServicessptdCfgD79C293C1ED61418462E24595C90D04@h0 1
Reg HKLMSYSTEMControlSet005ServicessptdCfgD79C293C1ED61418462E24595C90D04@ujdew 0x48 0x36 0xDE 0x13 …
Reg HKLMSYSTEMControlSet005ServicessptdCfgD79C293C1ED61418462E24595C90D040000001 (not active ControlSet)
Reg HKLMSYSTEMControlSet005ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLMSYSTEMControlSet005ServicessptdCfgD79C293C1ED61418462E24595C90D040000001@ujdew 0xCB 0xF0 0xC0 0x97 …
Reg HKLMSYSTEMControlSet005ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40 (not active ControlSet)
Reg HKLMSYSTEMControlSet005ServicessptdCfgD79C293C1ED61418462E24595C90D040000001jdgg40@ujdew 0x88 0x18 0x13 0x11 …
Reg HKLMSYSTEMControlSet005ServicessptdCfg19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLMSYSTEMControlSet005ServicessptdCfg19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLMSYSTEMControlSet005ServicessptdCfg19659239224E364682FA4BAF72C53EA4@khjeh 0x4B 0xA9 0x92 0xA6 …
Reg HKLMSYSTEMControlSet005ServicessptdCfg19659239224E364682FA4BAF72C53EA4@p0 D:DAEMON Tools
Reg HKLMSYSTEMControlSet005ServicessptdCfg19659239224E364682FA4BAF72C53EA40000001 (not active ControlSet)
Reg HKLMSYSTEMControlSet005ServicessptdCfg19659239224E364682FA4BAF72C53EA40000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLMSYSTEMControlSet005ServicessptdCfg19659239224E364682FA4BAF72C53EA40000001@khjeh 0x3A 0x34 0x5B 0x3D …
Reg HKLMSYSTEMControlSet005ServicessptdCfg19659239224E364682FA4BAF72C53EA40000001Jf40 (not active ControlSet)
Reg HKLMSYSTEMControlSet005ServicessptdCfg19659239224E364682FA4BAF72C53EA40000001Jf40@khjeh 0x9A 0xA5 0x28 0xC1 …
Reg HKLMSYSTEMControlSet005ServicesSysmonLogLog Queries{15086684-e3c6-4f13-8d27-1bb70a69ec48}@204B4@480414C4B4K4 E4@0404=0454=484O4 0040404=4=4K4E4 33
Reg HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows@DeviceNotSelectedTimeout 15
Reg HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows@GDIProcessHandleQuota 10000
Reg HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows@Spooler yes
Reg HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows@swapdisk
Reg HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows@TransmissionRetryTimeout 90
Reg HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows@USERProcessHandleQuota 10000
Reg HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows@LoadAppInit_DLLs 1
Reg HKLMSOFTWAREClassesCLSID{421C8D71-3C14-6E74-E561-F063A86477E0}InProcServer32
Reg HKLMSOFTWAREClassesCLSID{421C8D71-3C14-6E74-E561-F063A86477E0}InProcServer32@kx20acpphooofadgpcihmbbfmd 0x62 0x00 0x70
Reg HKCUSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{421C8D71-3C14-6E74-E561-F063A86477E0}
Reg HKCUSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{421C8D71-3C14-6E74-E561-F063A86477E0}@jajpeaoihiifjoklhdjj 0x62 0x61 0x6E 0x63 …
Reg HKCUSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{421C8D71-3C14-6E74-E561-F063A86477E0}@jajpeaoihiifjoklhdnp 0x62 0x61 0x68 0x62 …
Reg HKCUSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved{421C8D71-3C14-6E74-E561-F063A86477E0}@iajcjpnfgppmoipigc 0x6B 0x61 0x6D 0x63 …—- Files — GMER 1.0.15 —-
File C:WINDOWStempHTT14A.tmp 0 bytes
—- EOF — GMER 1.0.15 —-
Заражённый ключ реестра остался на месте.
Прочитайте описание программы Malwarebytes Anti-malware (MBAM).
Скачайте и выполните сканирование вашего компьютера. Удалите всё что будет найдено. В конце работы будет показан лог. Сохраните его на ваш рабочий стол.Скачайте RootRepeal кликнув по этой ссылке и распакуйте на ваш рабочий стол.
Кликните по файлу RootRepeal.exe для запуска программы.
Откройте вкладку Report, затем кликните Scan. Откроется окно с запросом что включать в лог, выберите пункты перечисленные ниже и кликните OK.
* Drivers
* Files
* Processes
* SSDT
* Stealth Objects
* Hidden Services
На следующем этапе появится запрос о том, какой диск сканировать, выберите C: и кликните OK снова, после этого запустится процесс сканирования. Когда сканирование закончится кликните Save Report для сохранения лога.Жду от вас содержимое получившегося лога + MBAM лог.
ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time: 2009/09/30 07:18
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP2
==================================================Drivers
Name: dump_atapi.sys
Image Path: C:windowsSystem32Driversdump_atapi.sys
Address: 0xB53DA000 Size: 98304 File Visible: No Signed: —
Status: —Name: dump_WMILIB.SYS
Image Path: C:windowsSystem32Driversdump_WMILIB.SYS
Address: 0xBADD6000 Size: 8192 File Visible: No Signed: —
Status: —Name: PCI_PNP3540
Image Path: DriverPCI_PNP3540
Address: 0x00000000 Size: 0 File Visible: No Signed: —
Status: —Name: rootrepeal.sys
Image Path: C:windowssystem32driversrootrepeal.sys
Address: 0xB2237000 Size: 49152 File Visible: No Signed: —
Status: —Name: spel.sys
Image Path: spel.sys
Address: 0xBA6A7000 Size: 1048576 File Visible: No Signed: —
Status: —Name: sptd
Image Path: Driversptd
Address: 0x00000000 Size: 0 File Visible: No Signed: —
Status: —Hidden/Locked Files
Path: C:hiberfil.sys
Status: Locked to the Windows API!SSDT
#: 019 Function Name: NtAssignProcessToJobObject
Status: Hooked by «» at address 0x899f78b0#: 025 Function Name: NtClose
Status: Hooked by «C:windowsSystem32DriversaswSP.SYS» at address 0xb54226b8#: 041 Function Name: NtCreateKey
Status: Hooked by «C:windowsSystem32DriversaswSP.SYS» at address 0xb5422574#: 065 Function Name: NtDeleteValueKey
Status: Hooked by «C:windowsSystem32DriversaswSP.SYS» at address 0xb5422a52#: 068 Function Name: NtDuplicateObject
Status: Hooked by «C:windowsSystem32DriversaswSP.SYS» at address 0xb542214c#: 071 Function Name: NtEnumerateKey
Status: Hooked by «spel.sys» at address 0xba6c6ca2#: 073 Function Name: NtEnumerateValueKey
Status: Hooked by «spel.sys» at address 0xba6c7030#: 119 Function Name: NtOpenKey
Status: Hooked by «C:windowsSystem32DriversaswSP.SYS» at address 0xb542264e#: 122 Function Name: NtOpenProcess
Status: Hooked by «C:windowsSystem32DriversaswSP.SYS» at address 0xb542208c#: 128 Function Name: NtOpenThread
Status: Hooked by «C:windowsSystem32DriversaswSP.SYS» at address 0xb54220f0#: 160 Function Name: NtQueryKey
Status: Hooked by «spel.sys» at address 0xba6c7108#: 177 Function Name: NtQueryValueKey
Status: Hooked by «C:windowsSystem32DriversaswSP.SYS» at address 0xb542276e#: 204 Function Name: NtRestoreKey
Status: Hooked by «C:windowsSystem32DriversaswSP.SYS» at address 0xb542272e#: 247 Function Name: NtSetValueKey
Status: Hooked by «C:windowsSystem32DriversaswSP.SYS» at address 0xb54228ae#: 253 Function Name: NtSuspendProcess
Status: Hooked by «» at address 0x899f76e0#: 254 Function Name: NtSuspendThread
Status: Hooked by «» at address 0x899f7500#: 257 Function Name: NtTerminateProcess
Status: Hooked by «» at address 0x899f6f10#: 258 Function Name: NtTerminateThread
Status: Hooked by «» at address 0x899f7330Stealth Objects
Object: Hidden Code [ETHREAD: 0x8a230900]
Process: System Address: 0x899f5970 Size: 1000Object: Hidden Code [Driver: Ntfs, IRP_MJ_CREATE]
Process: System Address: 0x8a5621f8 Size: 121Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLOSE]
Process: System Address: 0x8a5621f8 Size: 121Object: Hidden Code [Driver: Ntfs, IRP_MJ_READ]
Process: System Address: 0x8a5621f8 Size: 121Object: Hidden Code [Driver: Ntfs, IRP_MJ_WRITE]
Process: System Address: 0x8a5621f8 Size: 121Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x8a5621f8 Size: 121Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x8a5621f8 Size: 121Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_EA]
Process: System Address: 0x8a5621f8 Size: 121Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_EA]
Process: System Address: 0x8a5621f8 Size: 121Object: Hidden Code [Driver: Ntfs, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x8a5621f8 Size: 121Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x8a5621f8 Size: 121Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_VOLUME_INFORMATION]
Process: System Address: 0x8a5621f8 Size: 121Object: Hidden Code [Driver: Ntfs, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x8a5621f8 Size: 121Object: Hidden Code [Driver: Ntfs, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x8a5621f8 Size: 121Object: Hidden Code [Driver: Ntfs, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8a5621f8 Size: 121Object: Hidden Code [Driver: Ntfs, IRP_MJ_SHUTDOWN]
Process: System Address: 0x8a5621f8 Size: 121Object: Hidden Code [Driver: Ntfs, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x8a5621f8 Size: 121Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLEANUP]
Process: System Address: 0x8a5621f8 Size: 121Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_SECURITY]
Process: System Address: 0x8a5621f8 Size: 121Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_SECURITY]
Process: System Address: 0x8a5621f8 Size: 121Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_QUOTA]
Process: System Address: 0x8a5621f8 Size: 121Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_QUOTA]
Process: System Address: 0x8a5621f8 Size: 121Object: Hidden Code [Driver: Ntfs, IRP_MJ_PNP]
Process: System Address: 0x8a5621f8 Size: 121Object: Hidden Code [Driver: atapi, IRP_MJ_CREATE]
Process: System Address: 0x8a5631f8 Size: 121Object: Hidden Code [Driver: atapi, IRP_MJ_CLOSE]
Process: System Address: 0x8a5631f8 Size: 121Object: Hidden Code [Driver: atapi, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8a5631f8 Size: 121Object: Hidden Code [Driver: atapi, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x8a5631f8 Size: 121Object: Hidden Code [Driver: atapi, IRP_MJ_POWER]
Process: System Address: 0x8a5631f8 Size: 121Object: Hidden Code [Driver: atapi, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x8a5631f8 Size: 121Object: Hidden Code [Driver: atapi, IRP_MJ_PNP]
Process: System Address: 0x8a5631f8 Size: 121Object: Hidden Code [Driver: Cdrom, IRP_MJ_CREATE]
Process: System Address: 0x8a3a81f8 Size: 121Object: Hidden Code [Driver: Cdrom, IRP_MJ_CLOSE]
Process: System Address: 0x8a3a81f8 Size: 121Object: Hidden Code [Driver: Cdrom, IRP_MJ_READ]
Process: System Address: 0x8a3a81f8 Size: 121Object: Hidden Code [Driver: Cdrom, IRP_MJ_WRITE]
Process: System Address: 0x8a3a81f8 Size: 121Object: Hidden Code [Driver: Cdrom, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x8a3a81f8 Size: 121Object: Hidden Code [Driver: Cdrom, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8a3a81f8 Size: 121Object: Hidden Code [Driver: Cdrom, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x8a3a81f8 Size: 121Object: Hidden Code [Driver: Cdrom, IRP_MJ_SHUTDOWN]
Process: System Address: 0x8a3a81f8 Size: 121Object: Hidden Code [Driver: Cdrom, IRP_MJ_POWER]
Process: System Address: 0x8a3a81f8 Size: 121Object: Hidden Code [Driver: Cdrom, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x8a3a81f8 Size: 121Object: Hidden Code [Driver: Cdrom, IRP_MJ_PNP]
Process: System Address: 0x8a3a81f8 Size: 121Object: Hidden Code [Driver: dmio, IRP_MJ_CREATE]
Process: System Address: 0x8a5d21f8 Size: 121Object: Hidden Code [Driver: dmio, IRP_MJ_CLOSE]
Process: System Address: 0x8a5d21f8 Size: 121Object: Hidden Code [Driver: dmio, IRP_MJ_READ]
Process: System Address: 0x8a5d21f8 Size: 121Object: Hidden Code [Driver: dmio, IRP_MJ_WRITE]
Process: System Address: 0x8a5d21f8 Size: 121Object: Hidden Code [Driver: dmio, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x8a5d21f8 Size: 121Object: Hidden Code [Driver: dmio, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8a5d21f8 Size: 121Object: Hidden Code [Driver: dmio, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x8a5d21f8 Size: 121Object: Hidden Code [Driver: dmio, IRP_MJ_SHUTDOWN]
Process: System Address: 0x8a5d21f8 Size: 121Object: Hidden Code [Driver: dmio, IRP_MJ_POWER]
Process: System Address: 0x8a5d21f8 Size: 121Object: Hidden Code [Driver: dmio, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x8a5d21f8 Size: 121Object: Hidden Code [Driver: dmio, IRP_MJ_PNP]
Process: System Address: 0x8a5d21f8 Size: 121Object: Hidden Code [Driver: usbohci, IRP_MJ_CREATE]
Process: System Address: 0x8a38c1f8 Size: 121Object: Hidden Code [Driver: usbohci, IRP_MJ_CLOSE]
Process: System Address: 0x8a38c1f8 Size: 121Object: Hidden Code [Driver: usbohci, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8a38c1f8 Size: 121Object: Hidden Code [Driver: usbohci, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x8a38c1f8 Size: 121Object: Hidden Code [Driver: usbohci, IRP_MJ_POWER]
Process: System Address: 0x8a38c1f8 Size: 121Object: Hidden Code [Driver: usbohci, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x8a38c1f8 Size: 121Object: Hidden Code [Driver: usbohci, IRP_MJ_PNP]
Process: System Address: 0x8a38c1f8 Size: 121Object: Hidden Code [Driver: Ftdisk, IRP_MJ_CREATE]
Process: System Address: 0x8a5641f8 Size: 121Object: Hidden Code [Driver: Ftdisk, IRP_MJ_READ]
Process: System Address: 0x8a5641f8 Size: 121Object: Hidden Code [Driver: Ftdisk, IRP_MJ_WRITE]
Process: System Address: 0x8a5641f8 Size: 121Object: Hidden Code [Driver: Ftdisk, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x8a5641f8 Size: 121Object: Hidden Code [Driver: Ftdisk, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8a5641f8 Size: 121Object: Hidden Code [Driver: Ftdisk, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x8a5641f8 Size: 121Object: Hidden Code [Driver: Ftdisk, IRP_MJ_SHUTDOWN]
Process: System Address: 0x8a5641f8 Size: 121Object: Hidden Code [Driver: Ftdisk, IRP_MJ_CLEANUP]
Process: System Address: 0x8a5641f8 Size: 121Object: Hidden Code [Driver: Ftdisk, IRP_MJ_POWER]
Process: System Address: 0x8a5641f8 Size: 121Object: Hidden Code [Driver: Ftdisk, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x8a5641f8 Size: 121Object: Hidden Code [Driver: Ftdisk, IRP_MJ_PNP]
Process: System Address: 0x8a5641f8 Size: 121Object: Hidden Code [Driver: NetBT, IRP_MJ_CREATE]
Process: System Address: 0x8a1f9500 Size: 121Object: Hidden Code [Driver: NetBT, IRP_MJ_CLOSE]
Process: System Address: 0x8a1f9500 Size: 121Object: Hidden Code [Driver: NetBT, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8a1f9500 Size: 121Object: Hidden Code [Driver: NetBT, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x8a1f9500 Size: 121Object: Hidden Code [Driver: NetBT, IRP_MJ_CLEANUP]
Process: System Address: 0x8a1f9500 Size: 121Object: Hidden Code [Driver: NetBT, IRP_MJ_PNP]
Process: System Address: 0x8a1f9500 Size: 121Object: Hidden Code [Driver: usbehci, IRP_MJ_CREATE]
Process: System Address: 0x8a3541f8 Size: 121Object: Hidden Code [Driver: usbehci, IRP_MJ_CLOSE]
Process: System Address: 0x8a3541f8 Size: 121Object: Hidden Code [Driver: usbehci, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8a3541f8 Size: 121Object: Hidden Code [Driver: usbehci, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x8a3541f8 Size: 121Object: Hidden Code [Driver: usbehci, IRP_MJ_POWER]
Process: System Address: 0x8a3541f8 Size: 121Object: Hidden Code [Driver: usbehci, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x8a3541f8 Size: 121Object: Hidden Code [Driver: usbehci, IRP_MJ_PNP]
Process: System Address: 0x8a3541f8 Size: 121Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE]
Process: System Address: 0x8a1ef500 Size: 121Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE_NAMED_PIPE]
Process: System Address: 0x8a1ef500 Size: 121Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CLOSE]
Process: System Address: 0x8a1ef500 Size: 121Object: Hidden Code [Driver: MRxSmb, IRP_MJ_READ]
Process: System Address: 0x8a1ef500 Size: 121Object: Hidden Code [Driver: MRxSmb, IRP_MJ_WRITE]
Process: System Address: 0x8a1ef500 Size: 121Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x8a1ef500 Size: 121Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x8a1ef500 Size: 121Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_EA]
Process: System Address: 0x8a1ef500 Size: 121Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_EA]
Process: System Address: 0x8a1ef500 Size: 121Object: Hidden Code [Driver: MRxSmb, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x8a1ef500 Size: 121Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x8a1ef500 Size: 121Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_VOLUME_INFORMATION]
Process: System Address: 0x8a1ef500 Size: 121Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x8a1ef500 Size: 121Object: Hidden Code [Driver: MRxSmb, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x8a1ef500 Size: 121Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8a1ef500 Size: 121Object: Hidden Code [Driver: MRxSmb, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x8a1ef500 Size: 121Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SHUTDOWN]
Process: System Address: 0x8a1ef500 Size: 121Object: Hidden Code [Driver: MRxSmb, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x8a1ef500 Size: 121Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CLEANUP]
Process: System Address: 0x8a1ef500 Size: 121Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE_MAILSLOT]
Process: System Address: 0x8a1ef500 Size: 121Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_SECURITY]
Process: System Address: 0x8a1ef500 Size: 121Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_SECURITY]
Process: System Address: 0x8a1ef500 Size: 121Object: Hidden Code [Driver: MRxSmb, IRP_MJ_POWER]
Process: System Address: 0x8a1ef500 Size: 121Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x8a1ef500 Size: 121Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DEVICE_CHANGE]
Process: System Address: 0x8a1ef500 Size: 121Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_QUOTA]
Process: System Address: 0x8a1ef500 Size: 121Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_QUOTA]
Process: System Address: 0x8a1ef500 Size: 121Object: Hidden Code [Driver: MRxSmb, IRP_MJ_PNP]
Process: System Address: 0x8a1ef500 Size: 121Object: Hidden Code [Driver: Cdfsఈ䵃慖, IRP_MJ_CREATE]
Process: System Address: 0x8a1e4500 Size: 121Object: Hidden Code [Driver: Cdfsఈ䵃慖, IRP_MJ_CLOSE]
Process: System Address: 0x8a1e4500 Size: 121Object: Hidden Code [Driver: Cdfsఈ䵃慖, IRP_MJ_READ]
Process: System Address: 0x8a1e4500 Size: 121Object: Hidden Code [Driver: Cdfsఈ䵃慖, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x8a1e4500 Size: 121Object: Hidden Code [Driver: Cdfsఈ䵃慖, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x8a1e4500 Size: 121Object: Hidden Code [Driver: Cdfsఈ䵃慖, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x8a1e4500 Size: 121Object: Hidden Code [Driver: Cdfsఈ䵃慖, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x8a1e4500 Size: 121Object: Hidden Code [Driver: Cdfsఈ䵃慖, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x8a1e4500 Size: 121Object: Hidden Code [Driver: Cdfsఈ䵃慖, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8a1e4500 Size: 121Object: Hidden Code [Driver: Cdfsఈ䵃慖, IRP_MJ_SHUTDOWN]
Process: System Address: 0x8a1e4500 Size: 121Object: Hidden Code [Driver: Cdfsఈ䵃慖, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x8a1e4500 Size: 121Object: Hidden Code [Driver: Cdfsఈ䵃慖, IRP_MJ_CLEANUP]
Process: System Address: 0x8a1e4500 Size: 121Object: Hidden Code [Driver: Cdfsఈ䵃慖, IRP_MJ_PNP]
Process: System Address: 0x8a1e4500 Size: 121==EOF==Malwarebytes’ Anti-Malware 1.41
Версия базы данных: 2874
Windows 5.1.2600 Service Pack 230.09.2009 7:11:26
mbam-log-2009-09-30 (07-11-23).txtТип проверки: Быстрая
Проверено объектов: 96058
Прошло времени: 4 minute(s), 18 second(s)Заражено процессов в памяти: 0
Заражено модулей в памяти: 0
Заражено ключей реестра: 0
Заражено значений реестра: 0
Заражено параметров реестра: 1
Заражено папок: 0
Заражено файлов: 0Заражено процессов в памяти:
(Вредоносные программы не обнаружены)Заражено модулей в памяти:
(Вредоносные программы не обнаружены)Заражено ключей реестра:
(Вредоносные программы не обнаружены)Заражено значений реестра:
(Вредоносные программы не обнаружены)Заражено параметров реестра:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterUpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.Заражено папок:
(Вредоносные программы не обнаружены)Заражено файлов:
(Вредоносные программы не обнаружены)Возможно в вашем случае это действительно проще.
Троян создал ключ реестра который стандартными методами удалить нельзя, а нестандартные не работают, возможно наложился эффект от заражения другого трояна.
- Для ответа в этой теме необходимо авторизоваться.
