Wykryto wyłączony javascript

Aktualnie masz wyłączony javascript. Kilka funkcji może nie działać. Włącz ponownie javascript, aby korzystać z pełnej funkcjonalności.

Logi - Trojan w Autostarcie

Rozpoczęty przez Golima , 11 07 2010 13:38

Temat jest zamknięty

3 odpowiedzi w tym temacie

#1 Golima

Obserwator

7 postów

Napisano 11 07 2010 - 13:38

Witam
Oto logi:

ComboFix 10-07-09.02 - Golima1 2010-07-11  12:24:45.1.2 - x86

Microsoft Windows XP Professional  5.1.2600.2.1250.48.1045.18.1023.756 [GMT 2:00]

Uruchomiony z: J:\ComboFix.exe

.



(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))

.



c:\documents and

 settings\Golima1\Dane aplikacji\avdrn.dat

c:\documents and settings\Golima1\Menu Start\Programy\Autostart\siszpe32.exe

c:\windows\OPTIONS\CABS\_desktop.ini

d:\muzyka\PO FORMACIE\01 SKŁADANKI\001 RMF FM\VA-To_Jest_Maxxx_The_Best_Of_RMF_Maxxx_Vol.6-2CD-2009-BFHMP3\kzklogo\Desktop_.ini



.

(((((((((((((((((((((((((   Pliki utworzone od 2010-06-11 do 2010-07-11  )))))))))))))))))))))))))))))))

.



2010-07-11 10:36 . 2010-07-11 10:36	--------	d-----w-	c:\windows\system32\xircom

2010-07-11 10:36 . 2010-07-11 10:36	--------	d-----w-	c:\windows\system32\wbem\snmp

2010-07-11 10:36 . 2010-07-11 10:36	--------	d-----w-	c:\program files\microsoft frontpage

2010-07-10 14:25 . 2010-07-11 10:37	540672	----a-w-	c:\windows\system32\drivers\jsrhg.sys

2010-07-03 14:21 . 2010-07-03 14:21	--------	d-----w-	c:\program files\Lavalys

2010-06-30 11:24 . 1998-11-26 17:00	497664	------w-	c:\windows\system32\1602Unst.exe

2010-06-29 20:50 . 2010-06-29 20:50	--------	d-----w-	c:\program files\Sierra On-Line

2010-06-29 20:50 . 2010-06-29 20:50	--------	d-----w-	C:\Impressions Games

2010-06-24 19:17 . 2010-06-24 19:17	95024	----a-w-	c:\windows\system32\drivers\SBREDrv.sys

2010-06-24 19:06 . 2010-07-05 10:31	--------	d-----w-	c:\documents and settings\All Users\Dane aplikacji\Lavasoft

2010-06-15 15:43 . 2010-06-15 15:43	54272	----a-w-	c:\documents and settings\Golima1\Dane aplikacji\GanymedeNet\Online Games\Common\ielauncher.exe

2010-06-15 15:43 . 2010-06-15 15:43	4	----a-w-	c:\windows\system32\proc625010911.bin



.

((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-07-11 10:35 . 2009-11-14 10:07	532112	----a-w-	c:\documents and settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat

2010-07-10 14:50 . 2009-10-22 17:00	--------	d-----w-	c:\program files\SpeedFan

2010-07-10 14:25 . 2010-06-23 12:45	16	----a-w-	c:\documents and settings\NetworkService\Dane aplikacji\qcopjv.dat

2010-07-07 16:57 . 2010-01-10 14:56	--------	d-----w-	c:\documents and settings\Golima1\Dane aplikacji\BESTplayer

2010-06-30 08:57 . 2009-10-22 16:09	--------	d--h--w-	c:\program files\InstallShield Installation Information

2010-06-25 12:46 . 2010-01-30 12:02	--------	d-----w-	c:\documents and settings\Golima1\Dane aplikacji\Skype

2010-06-22 21:15 . 2010-06-22 21:15	8	----a-w-	c:\documents and settings\Golima1\Dane aplikacji\qcopjv.dat

2010-06-17 14:02 . 2010-01-01 20:45	--------	d-----w-	c:\documents and settings\Golima1\Dane aplikacji\Gadu-Gadu 10

2010-06-15 15:43 . 2009-12-15 21:04	--------	d-----w-	c:\documents and settings\Golima1\Dane aplikacji\GanymedeNet

2010-06-11 17:50 . 2010-02-24 20:13	--------	d-----w-	c:\documents and settings\Golima1\Dane aplikacji\Ventrilo

2010-06-10 11:52 . 2009-11-04 16:24	--------	d-----w-	c:\documents and settings\Golima1\Dane aplikacji\BitTorrent

2010-06-07 16:01 . 2009-11-04 16:24	--------	d-----w-	c:\program files\Ask.com

2010-06-07 11:59 . 2010-06-07 11:59	2944904	----a-w-	c:\documents and settings\Golima1\Dane aplikacji\Mozilla\Firefox\Profiles\kja8u8zl.default\extensions\toolbar@ask.com\chrome\temp\askToolbar.exe

2010-05-19 13:30 . 2009-10-22 17:30	--------	d-----w-	c:\documents and settings\All Users\Dane aplikacji\Microsoft Help

2010-05-17 18:16 . 2010-05-17 18:16	--------	d-----w-	c:\documents and settings\All Users\Dane aplikacji\NVIDIA

2010-05-15 11:49 . 2010-01-31 16:45	--------	d-----w-	c:\documents and settings\All Users\Dane aplikacji\Gadu-Gadu 10

2010-05-15 11:49 . 2010-01-01 20:45	--------	d-----w-	c:\program files\Gadu-Gadu 10

2010-05-04 14:05 . 2010-05-04 14:05	42080	----a-w-	c:\documents and settings\All Users\Dane aplikacji\Gadu-Gadu 10\_userdata\ggbho.2.dll

2010-05-04 14:05 . 2010-05-04 14:05	11776	----a-w-	c:\documents and settings\All Users\Dane aplikacji\Gadu-Gadu 10\_userdata\npgg.2.dll

.



(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane  

REGEDIT4



[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]



[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]



[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]

2010-05-26 13:23	1385864	----a-w-	c:\program files\Ask.com\GenericAskToolbar.dll



[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]



[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]



[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]



[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]



[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"TuneUp MemOptimizer"="c:\program files\TuneUp Utilities 2009\MemOptimizer.exe" [2009-11-16 163144]

"Gadu-Gadu 10"="c:\program files\Gadu-Gadu 10\gg.exe" [2010-05-04 11981408]



[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Gainward"="c:\program files\XpertVision\TBPanel.exe" [2006-08-02 2146304]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-01 7618560]

"nwiz"="nwiz.exe" [2006-06-01 1519616]

"NvMediaCenter"="NvMCTray.dll" [2006-06-01 86016]

"RTHDCPL"="RTHDCPL.EXE" [2006-04-17 16143872]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]

"BigDog303"="c:\windows\VM303_STI.EXE" [2005-10-25 61440]



[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]



c:\documents and settings\Golima1\Menu Start\Programy\Autostart\

CurseClientStartup.ccip [2010-1-30 0]



c:\documents and settings\All Users\Menu Start\Programy\Autostart\

Wireless Utility.lnk - c:\program files\EDIMAX\Common\RaUI.exe [2010-1-30 716800]



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ALLUpdate]

2009-06-04 20:56	869888	----a-w-	c:\program files\ALLPlayer\ALLUpdate.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]

2009-11-11 09:57	1451520	----a-w-	c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]

2009-07-27 02:37	180224	----a-w-	c:\program files\PowerISO\PWRISOVM.EXE



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RaidTool]

2005-11-23 02:12	1060864	----a-r-	c:\program files\VIA\RAID\raid_tool.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2009-10-11 03:17	149280	----a-w-	c:\program files\Java\jre6\bin\jusched.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]

2009-07-01 16:37	37888	----a-w-	c:\program files\Winamp\winampa.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"wuauserv"=2 (0x2)



[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"



[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)



[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Program Files\\BitTorrent\\bittorrent.exe"=

"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\Gadu-Gadu 10\\gg.exe"=

"c:\\WINDOWS\\system32\\services.exe"=



S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2009-11-22 136704]



--- Inne Usługi/Sterowniki w Pamięci ---



*Deregistered* - jsrhg



HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

UxTuneUp

.

Zawartość folderu 'Zaplanowane zadania'



2010-07-11 c:\windows\Tasks\Konserwacja 1 kliknięciem.job

- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-11-16 16:49]



2010-07-11 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job

- c:\program files\Ask.com\UpdateTask.exe [2010-05-26 13:23]

.

.

------- Skan uzupełniający -------

.

uStart Page = hxxp://www.ask.com?o=14978&l=dis

IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000

TCP: {8EADA1B6-C447-49B1-9096-3C01EF43E6C1} = 217.30.129.149 217.30.137.200

FF - ProfilePath - c:\documents and settings\Golima1\Dane aplikacji\Mozilla\Firefox\Profiles\kja8u8zl.default\

FF - prefs.js: browser.search.selectedEngine - Ask.com

FF - prefs.js: browser.startup.homepage - hxxp://www.google.pl

FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=BT3&o=14979&locale=en_US&apn_uid=316D992F-EEE0-4CBF-8598-14B9929CBA4C&apn_ptnrs=J7&apn_sauid=7D23DF43-11D9-49A3-B285-91137060511C&apn_dtid=&q=

FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll

FF - plugin: c:\documents and settings\All Users\Dane aplikacji\Gadu-Gadu 10\_userdata\npgg.2.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPCARDS.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npganymedenet.dll



---- FIREFOX - SPOSÓB POSTĘPOWANIA ----

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: nglayout.initialpaint.delay - 600

FF - user.js: content.notify.interval - 600000

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.switch.threshold - 600000

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); 

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type",                  5);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

.

- - - - USUNIĘTO PUSTE WPISY - - - -



AddRemove-Frets on Fire - d:\frets on fire\Uninstall.exe







**************************************************************************



catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-07-11 12:37

Windows 5.1.2600 Dodatek Service Pack 2 NTFS



skanowanie ukrytych procesów ...  



skanowanie ukrytych wpisów autostartu ... 



HKLM\Software\Microsoft\Windows\CurrentVersion\Run

  BigDog303 = c:\windows\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)????????????????0?????????@?????????????? 



skanowanie ukrytych plików ...  



skanowanie pomyślnie ukończone

ukryte pliki: 0



**************************************************************************



[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\jsrhg]



.

--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------



[HKEY_USERS\S-1-5-21-789336058-1580436667-725345543-1003\Software\Microsoft\SystemCertificates\AddressBook*]

@Allowed: (Read) (RestrictedCode)

@Allowed: (Read) (RestrictedCode)

.

------------------------ Pozostałe uruchomione procesy ------------------------

.

c:\program files\Java\jre6\bin\jqs.exe

c:\windows\system32\nvsvc32.exe

c:\windows\System32\TUProgSt.exe

c:\windows\system32\wdfmgr.exe

c:\windows\system32\wscntfy.exe

c:\windows\system32\RunDLL32.exe

c:\windows\RTHDCPL.EXE

c:\windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe

.

**************************************************************************

.

Czas ukończenia: 2010-07-11  12:39:27 - komputer został uruchomiony ponownie

ComboFix-quarantined-files.txt  2010-07-11 10:39



Przed: 775*016*448 bajtów wolnych

Po: 2*555*129*856 bajtów wolnych



WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /TUTag=RVYAB0 /Kernel=TUKernel.exe

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional (TuneUp Backup)" /noexecute=optin /fastdetect /TUTag=RVYAB0-BAK



- - End Of File - - C9F56519DAD9DF17C6710CC8BEDBD15C

Mam internet 8mb, a chodzi jakbym miał 128kb strony ładują się minutami, potężne pingi... Nie wiem co się dzieje, czy to wina dostawcy, czy jakiś złośliwy wirus... Proszę o jak najszybszą pomoc.

Użytkownik Katarina edytował ten post 19 07 2010 - 22:15

0

Do góry

#2 ordynat

Zaawansowany użytkownik

804 postów

Napisano 11 07 2010 - 14:21

1) Użyj TDSKiller >http://support.kaspersky.com/pl/faq/?qid=208280681
jeśli narzędzie poda komunikat "Hidden Service detected" wpisz delete i wciśnij ENTER,
Po zakończeniu działania na dysku C:\ będzie będzie plik TDSSKiller.txt - pokaż tego loga w swojej odpowiedzi.

2) Ściągnij -->Avenger.
wklej do niego ten tekst:

Files to delete:
c:\windows\system32\drivers\jsrhg.sys
c:\documents and settings\NetworkService\Dane aplikacji\qcopjv.dat

Folders to delete:
c:\program files\Ask.com
c:\documents and settings\Golima1\Dane aplikacji\Mozilla\Firefox\Profiles\kja8u8zl.default\extensions\toolbar@ask.com

Registry keys to delete:
HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}
HKEY\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}
HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1
HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd

Registry values to delete: 
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | gsiarg
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks | {00000000-6E41-4FD3-8538-502F5495E5FC}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar | {D4027C7F-154A-4066-A1AD-4243D8127440}
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser | {D4027C7F-154A-4066-A1AD-4243D8127440}

Drivers to delete:
jsrhg

Kliknij w "Execute" i zatwierdź restart komputera.
Zrestartuj komputer.
Daj Raport z Avengera z C:\avenger.txt.
.

0

Do góry

#3 Golima

Obserwator

7 postów

Napisano 11 07 2010 - 15:36

TDSS Killer:

15:41:37:281 3056	TDSS rootkit removing tool 2.3.2.2 Jun 30 2010 17:23:49

15:41:37:281 3056	================================================================================

15:41:37:281 3056	SystemInfo:



15:41:37:281 3056	OS Version: 5.1.2600 ServicePack: 2.0

15:41:37:281 3056	Product type: Workstation

15:41:37:281 3056	ComputerName: GOLIMA

15:41:37:281 3056	UserName: Golima1

15:41:37:281 3056	Windows directory: C:\WINDOWS

15:41:37:281 3056	System windows directory: C:\WINDOWS

15:41:37:281 3056	Processor architecture: Intel x86

15:41:37:281 3056	Number of processors: 2

15:41:37:281 3056	Page size: 0x1000

15:41:37:281 3056	Boot type: Normal boot

15:41:37:281 3056	================================================================================

15:41:37:968 3056	Initialize success

15:41:37:968 3056	

15:41:37:968 3056	Scanning	Services ...

15:41:38:812 3056	Raw services enum returned 344 services

15:41:38:843 3056	Suspicious serv jsrhg (h: 0, b: 1)

15:41:38:843 3056	

15:41:38:843 3056	Hidden service detected!

15:41:38:843 3056	Service name:	jsrhg

15:41:38:843 3056	Image path:	

15:41:38:843 3056	Type "delete" (without quotes) to delete it: 15:41:50:403 3056	

15:41:50:403 3056	By user detect jsrhg

15:41:50:403 3056	RegNode HKLM\SYSTEM\ControlSet001\services\jsrhg infected by TDSS rootkit ... 15:41:50:403 3056	will be deleted on reboot

15:41:50:403 3056	RegNode HKLM\SYSTEM\ControlSet002\services\jsrhg infected by TDSS rootkit ... 15:41:50:403 3056	will be deleted on reboot

15:41:50:403 3056	File C:\WINDOWS\system32\drivers\jsrhg.sys infected by TDSS rootkit ... 15:41:50:403 3056	will be deleted on reboot

15:41:50:403 3056	

15:41:50:403 3056	Scanning	Drivers ...

15:41:50:903 3056	ACPI            (a966410ecf83b81f3b0b8e07a71957d4) C:\WINDOWS\system32\DRIVERS\ACPI.sys

15:41:50:934 3056	ACPIEC          (66a42b7db194e24b973bbcce840a0f3f) C:\WINDOWS\system32\drivers\ACPIEC.sys

15:41:50:981 3056	aec             (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys

15:41:51:027 3056	AegisP          (023867b6606fbabcdd52e089c4a507da) C:\WINDOWS\system32\DRIVERS\AegisP.sys

15:41:51:043 3056	AFD             (5ac495f4cb807b2b98ad2ad591e6d92e) C:\WINDOWS\System32\drivers\afd.sys

15:41:51:137 3056	AsyncMac        (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

15:41:51:137 3056	atapi           (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys

15:41:51:184 3056	atksgt          (6e996cf8459a2594e0e9609d0e34d41f) C:\WINDOWS\system32\DRIVERS\atksgt.sys

15:41:51:199 3056	Atmarpc         (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

15:41:51:246 3056	audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

15:41:51:277 3056	Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

15:41:51:293 3056	BrScnUsb        (92a964547b96d697e5e9ed43b4297f5a) C:\WINDOWS\system32\DRIVERS\BrScnUsb.sys

15:41:51:340 3056	Cardex          (175418424b0973ae9004257ebc60431c) C:\WINDOWS\system32\drivers\TBPANEL.SYS

15:41:51:356 3056	cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

15:41:51:387 3056	CCDECODE        (6163ed60b684bab19d3352ab22fc48b2) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys

15:41:51:402 3056	Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

15:41:51:402 3056	Cdfs            (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys

15:41:51:434 3056	Cdrom           (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys

15:41:51:480 3056	Disk            (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys

15:41:51:527 3056	dmboot          (3b809ffad55dcebdb156d5ca1bd3da65) C:\WINDOWS\system32\drivers\dmboot.sys

15:41:51:559 3056	dmio            (27725b6501201c3080ba73048bce389a) C:\WINDOWS\system32\drivers\dmio.sys

15:41:51:590 3056	dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

15:41:51:621 3056	DMusic          (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys

15:41:51:637 3056	drmkaud         (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys

15:41:51:668 3056	EL90X           (a13fcb59030b6cbbb17128f4b7549f80) C:\WINDOWS\system32\DRIVERS\el90xnd5.sys

15:41:51:684 3056	Fastfat         (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys

15:41:51:699 3056	Fdc             (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys

15:41:51:715 3056	FETNDIS         (e9648254056bce81a85380c0c3647dc4) C:\WINDOWS\system32\DRIVERS\fetnd5.sys

15:41:51:746 3056	FETNDISB        (b7186b33b6cf3a23841015531e6e7d68) C:\WINDOWS\system32\DRIVERS\fetnd5b.sys

15:41:51:762 3056	Fips            (c5fb298257c0a6514ea17835e774ea0a) C:\WINDOWS\system32\drivers\Fips.sys

15:41:51:762 3056	Flpydisk        (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\DRIVERS\flpydisk.sys

15:41:51:793 3056	FltMgr          (5a85cd3d07273e3f6fe72ee9c6431632) C:\WINDOWS\system32\DRIVERS\fltMgr.sys

15:41:51:809 3056	Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

15:41:51:824 3056	Ftdisk          (ed6d921d8ab423138fb35beee6d6a6cb) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

15:41:51:840 3056	gameenum        (5f92fd09e5610a5995da7d775eadcd12) C:\WINDOWS\system32\DRIVERS\gameenum.sys

15:41:51:855 3056	giveio          (77ebf3e9386daa51551af429052d88d0) C:\WINDOWS\system32\giveio.sys

15:41:51:902 3056	Gpc             (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys

15:41:51:934 3056	HDAudBus        (3fcc124b6e08ee0e9351f717dd136939) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys

15:41:51:965 3056	HidUsb          (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys

15:41:51:996 3056	HTTP            (909d110c9634b0f1487eaaea837317d9) C:\WINDOWS\system32\Drivers\HTTP.sys

15:41:52:043 3056	i8042prt        (2656fdfe0a7916c3a16f374454c55dd9) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

15:41:52:058 3056	Imapi           (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys

15:41:52:183 3056	IntcAzAudAddService (71ae838a88b07268d732f596fc17ced5) C:\WINDOWS\system32\drivers\RtkHDAud.sys

15:41:52:230 3056	intelppm        (78a353438791c6d04c64013a5abec6bd) C:\WINDOWS\system32\DRIVERS\intelppm.sys

15:41:52:246 3056	Ip6Fw           (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys

15:41:52:277 3056	IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

15:41:52:293 3056	IpInIp          (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys

15:41:52:308 3056	IpNat           (472c75f85e631f8aa87d21c9fee6238d) C:\WINDOWS\system32\DRIVERS\ipnat.sys

15:41:52:324 3056	IPSec           (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys

15:41:52:355 3056	IRENUM          (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys

15:41:52:402 3056	isapnp          (01a9e68528f4f34e5702123d27c67bd4) C:\WINDOWS\system32\DRIVERS\isapnp.sys

15:41:52:449 3056	jsrhg           (47b8e27fe5b8d5e82b2827ad1400deb3) C:\WINDOWS\system32\drivers\jsrhg.sys

15:41:52:449 3056	Suspicious file (NoAccess): C:\WINDOWS\system32\drivers\jsrhg.sys. md5: 47b8e27fe5b8d5e82b2827ad1400deb3

15:41:52:480 3056	Kbdclass        (cc13db862f929ae33f64c3bedc01cd31) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

15:41:52:511 3056	kbdhid          (831be9197bdace6bdcac1bfdbe1c380f) C:\WINDOWS\system32\DRIVERS\kbdhid.sys

15:41:52:527 3056	klmd23          (316353165feba3d0538eaa9c2f60c5b7) C:\WINDOWS\system32\drivers\klmd.sys

15:41:52:574 3056	kmixer          (8531438246ce9474e41ee1599904c0c7) C:\WINDOWS\system32\drivers\kmixer.sys

15:41:52:590 3056	KSecDD          (eb7ffe87fd367ea8fca0506f74a87fbb) C:\WINDOWS\system32\drivers\KSecDD.sys

15:41:52:636 3056	lirsgt          (975b6cf65f44e95883f3855bae8cecaf) C:\WINDOWS\system32\DRIVERS\lirsgt.sys

15:41:52:652 3056	mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

15:41:52:683 3056	Modem           (15f33d12d604d0198ce5561f102cd9c5) C:\WINDOWS\system32\drivers\Modem.sys

15:41:52:699 3056	Mouclass        (69c12b99ae8b6b99ec314e9b99833728) C:\WINDOWS\system32\DRIVERS\mouclass.sys

15:41:52:699 3056	mouhid          (ecec1e6cd558ab80f944f31326e9d3b5) C:\WINDOWS\system32\DRIVERS\mouhid.sys

15:41:52:715 3056	MountMgr        (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys

15:41:52:746 3056	MRxDAV          (46edcc8f2db2f322c24f48785cb46366) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

15:41:52:777 3056	MRxSmb          (3ecc5f53a627b28a23aa7cc8c9376db4) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

15:41:52:793 3056	Msfs            (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys

15:41:52:824 3056	MSKSSRV         (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys

15:41:52:840 3056	MSPCLOCK        (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

15:41:52:855 3056	MSPQM           (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys

15:41:52:886 3056	mssmbios        (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

15:41:52:902 3056	MSTEE           (bf13612142995096ab084f2db7f40f77) C:\WINDOWS\system32\drivers\MSTEE.sys

15:41:52:918 3056	Mup             (f66b6b1cddee6ca87cefc016eb7a0d8e) C:\WINDOWS\system32\drivers\Mup.sys

15:41:52:933 3056	NABTSFEC        (5c8dc6429c43dc6177c1fa5b76290d1a) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys

15:41:52:949 3056	NDIS            (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys

15:41:52:964 3056	NdisIP          (520ce427a8b298f54112857bcf6bde15) C:\WINDOWS\system32\DRIVERS\NdisIP.sys

15:41:52:996 3056	NdisTapi        (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

15:41:53:011 3056	Ndisuio         (8d3ce6b579cde8d37acc690b67dc2106) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

15:41:53:027 3056	NdisWan         (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

15:41:53:043 3056	NDProxy         (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys

15:41:53:058 3056	NetBIOS         (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys

15:41:53:074 3056	NetBT           (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys

15:41:53:105 3056	nmwcd           (357ddb51e03cae598c096d95497373d0) C:\WINDOWS\system32\drivers\ccdcmb.sys

15:41:53:121 3056	nmwcdc          (7cd443f9d36c80e152fadb274089577a) C:\WINDOWS\system32\drivers\ccdcmbo.sys

15:41:53:152 3056	nmwcdnsu        (02120406f27f5895dfce4c640e6ee237) C:\WINDOWS\system32\drivers\nmwcdnsu.sys

15:41:53:168 3056	Npfs            (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys

15:41:53:199 3056	Ntfs            (b78be402c3f63dd55521f73876951cdd) C:\WINDOWS\system32\drivers\Ntfs.sys

15:41:53:230 3056	NTSIM           (a568b9a9ffe2d9387222a5c90f86d731) C:\WINDOWS\system32\ntsim.sys

15:41:53:261 3056	Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

15:41:53:386 3056	nv              (2282ad3b19b00967c6e48531c25bfe01) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys

15:41:53:480 3056	NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

15:41:53:496 3056	NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

15:41:53:542 3056	Parport         (2ff48d8fdc815a8492fb2bd81e6999c2) C:\WINDOWS\system32\DRIVERS\parport.sys

15:41:53:558 3056	PartMgr         (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys

15:41:53:574 3056	ParVdm          (453ec2c2a20a1382f564541918520eeb) C:\WINDOWS\system32\drivers\ParVdm.sys

15:41:53:605 3056	pccsmcfd        (fd2041e9ba03db7764b2248f02475079) C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys

15:41:53:636 3056	PCI             (5fd05c92ec56f696eaa50b68cef1b84a) C:\WINDOWS\system32\DRIVERS\pci.sys

15:41:53:667 3056	Pcmcia          (2849812217ecec059cb45f80eb6e52d4) C:\WINDOWS\system32\drivers\Pcmcia.sys

15:41:53:730 3056	PptpMiniport    (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys

15:41:53:746 3056	PSched          (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys

15:41:53:761 3056	Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

15:41:53:792 3056	PxHelp20        (153d02480a0a2f45785522e814c634b6) C:\WINDOWS\system32\Drivers\PxHelp20.sys

15:41:53:839 3056	RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

15:41:53:855 3056	Rasl2tp         (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

15:41:53:855 3056	RasPppoe        (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

15:41:53:871 3056	Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

15:41:53:902 3056	Rdbss           (ed375ce745c42a14f10753f7022ecd6a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

15:41:53:917 3056	RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

15:41:53:949 3056	rdpdr           (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

15:41:53:980 3056	RDPWD           (047bea21274c8a4a233674a76c958c2c) C:\WINDOWS\system32\drivers\RDPWD.sys

15:41:53:995 3056	redbook         (bddcece9acdad26841c987d10376f6f7) C:\WINDOWS\system32\DRIVERS\redbook.sys

15:41:54:027 3056	rspndr          (a3b23fb3f295694091f51865f98588b2) C:\WINDOWS\system32\DRIVERS\rspndr.sys

15:41:54:074 3056	RT73            (c7bcf9808e2a1b4cabe16ff7fbce5fab) C:\WINDOWS\system32\DRIVERS\rt73.sys

15:41:54:089 3056	RTL8023xp       (911e07056b865760c0762f6221145999) C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys

15:41:54:120 3056	rtl8139         (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS

15:41:54:152 3056	SCDEmu          (23aa53256ce05b975398b78a33474265) C:\WINDOWS\system32\drivers\SCDEmu.sys

15:41:54:183 3056	Secdrv          (f376a1580204e47f37a721e1cbc5582a) C:\WINDOWS\system32\DRIVERS\secdrv.sys

15:41:54:199 3056	serenum         (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys

15:41:54:214 3056	Serial          (859bc6f8c3d58cfda9181e9926c7ddb9) C:\WINDOWS\system32\DRIVERS\serial.sys

15:41:54:261 3056	sfdrv01         (4c0d673281178cb496011a2e28571fc8) C:\WINDOWS\system32\drivers\sfdrv01.sys

15:41:54:292 3056	sfhlp02         (15be2b5e4dc5b8623cf167720682abc9) C:\WINDOWS\system32\drivers\sfhlp02.sys

15:41:54:308 3056	Sfloppy         (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys

15:41:54:339 3056	sfvfs02         (d5a7e09d2c6a702809e49190d52adc9f) C:\WINDOWS\system32\drivers\sfvfs02.sys

15:41:54:370 3056	SLIP            (5caeed86821fa2c6139e32e9e05ccdc9) C:\WINDOWS\system32\DRIVERS\SLIP.sys

15:41:54:402 3056	speedfan        (5d6401db90ec81b71f8e2c5c8f0fef23) C:\WINDOWS\system32\speedfan.sys

15:41:54:433 3056	splitter        (9bb1dd670cb7505a90fc4e61d4aa8227) C:\WINDOWS\system32\drivers\splitter.sys

15:41:54:449 3056	sr              (6145ca23bccda679a772ec0af42d6eb5) C:\WINDOWS\system32\DRIVERS\sr.sys

15:41:54:495 3056	Srv             (5230953c21c811b5fc1ff31ae2b48097) C:\WINDOWS\system32\DRIVERS\srv.sys

15:41:54:511 3056	streamip        (284c57df5dc7abca656bc2b96a667afb) C:\WINDOWS\system32\DRIVERS\StreamIP.sys

15:41:54:527 3056	swenum          (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys

15:41:54:542 3056	swmidi          (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys

15:41:54:589 3056	sysaudio        (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys

15:41:54:620 3056	TBPanel         (175418424b0973ae9004257ebc60431c) C:\WINDOWS\system32\drivers\TBPanel.sys

15:41:54:652 3056	Tcpip           (b2220c618b42a2212a59d91ebd6fc4b4) C:\WINDOWS\system32\DRIVERS\tcpip.sys

15:41:54:683 3056	TDPIPE          (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys

15:41:54:698 3056	TDTCP           (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys

15:41:54:730 3056	TermDD          (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys

15:41:54:745 3056	uagp35          (49c805d42d75eddc9b6a7130999c9054) C:\WINDOWS\system32\DRIVERS\uagp35.sys

15:41:54:761 3056	Udfs            (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys

15:41:54:808 3056	Update          (a4815a4884898f355a3513e60843a4fd) C:\WINDOWS\system32\DRIVERS\update.sys

15:41:54:839 3056	upperdev        (15629e4d65f97ab5432d6d9597cf6a33) C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys

15:41:54:870 3056	usbccgp         (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

15:41:54:886 3056	usbehci         (a45ea1550ea4b368c4fba7ca9d056bc9) C:\WINDOWS\system32\DRIVERS\usbehci.sys

15:41:54:902 3056	usbhub          (6d46b1f89134892a862ac56b00ac11fe) C:\WINDOWS\system32\DRIVERS\usbhub.sys

15:41:54:917 3056	usbprint        (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINDOWS\system32\DRIVERS\usbprint.sys

15:41:54:948 3056	usbser          (49106ee29074e6a3d3ac9e24c6d791d8) C:\WINDOWS\system32\drivers\usbser.sys

15:41:54:964 3056	UsbserFilt      (5c17e6a11aa8be53f79fd364ba19f0ce) C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys

15:41:54:964 3056	usbstor         (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

15:41:54:980 3056	usbuhci         (0ee1925590ba1abec14254d54d9870f4) C:\WINDOWS\system32\DRIVERS\usbuhci.sys

15:41:54:995 3056	VgaSave         (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys

15:41:55:011 3056	ViaIde          (59cb1338ad3654417bea49636457f65d) C:\WINDOWS\system32\DRIVERS\viaide.sys

15:41:55:026 3056	viamraid        (fbf18f9f5fb852c2976723587b44f346) C:\WINDOWS\system32\DRIVERS\viamraid.sys

15:41:55:042 3056	VolSnap         (ecd173739b8ec10a814cc18653df5a36) C:\WINDOWS\system32\drivers\VolSnap.sys

15:41:55:058 3056	Wanarp          (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys

15:41:55:089 3056	Wdf01000        (bbcfeab7e871cddac2d397ee7fa91fdc) C:\WINDOWS\system32\Drivers\wdf01000.sys

15:41:55:136 3056	wdmaud          (0bfa8203b8148fb4e54bc212c41ce497) C:\WINDOWS\system32\drivers\wdmaud.sys

15:41:55:183 3056	WSTCODEC        (d5842484f05e12121c511aa93f6439ec) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS

15:41:55:214 3056	ZSMC303         (07f90a3574769a28ad3f45ccc61394ec) C:\WINDOWS\system32\Drivers\usbVM303.sys

15:41:55:230 3056	Reboot required for cure complete..

15:41:55:542 3056	Cure on reboot scheduled successfully

15:41:55:542 3056	

15:41:55:542 3056	Completed

15:41:55:542 3056	

15:41:55:542 3056	Results:

15:41:55:542 3056	Registry objects infected / cured / cured on reboot:	2 / 0 / 2

15:41:55:542 3056	File objects infected / cured / cured on reboot:	1 / 0 / 1

15:41:55:542 3056	

15:41:55:542 3056	KLMD(ARK) unloaded successfully

A avenger pokazuje error jak wklejam ten code co podałeś.

Użytkownik Katarina edytował ten post 19 07 2010 - 22:16

0

Do góry

#4 ordynat

Zaawansowany użytkownik

804 postów

Napisano 11 07 2010 - 16:22

Files to delete:
c:\windows\system32\drivers\jsrhg.sys
c:\documents and settings\NetworkService\Dane aplikacji\qcopjv.dat

Folders to delete:
c:\program files\Ask.com
c:\documents and settings\Golima1\Dane aplikacji\Mozilla\Firefox\Profiles\kja8u8zl.default\extensions\toolbar@ask.com

Registry keys to delete:
HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}
HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1
HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd

Registry values to delete: 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar | {D4027C7F-154A-4066-A1AD-4243D8127440}

Drivers to delete:
jsrhg

Spróbuj teraz.
Bez względu na to, czy Avenger wykona tym razem swoje zadanie, czy nie, to dasz jeszcze log albo z OTL, albo z ComboFixa.
.

Użytkownik ordynat edytował ten post 11 07 2010 - 16:22