Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss
sos, win32.RLoader.a
65 views
Skip to first unread message
Yianni
Oct 26, 2011, 12:17:54 PM10/26/11
to
Το Kaspersky antivirus μου έβγαζε το αρχείο
c:/windows/system32/drivers/acpi.sys να έχει ιό (win32.RLoader.a). Σημείωση
στο σκανάρισμα τα βγάζει όλα εντάξει, (ακόμα και αυτό το αρχείο) αλλά μετά
από περίπου 10 λεπτά μου εμφανίζει παράθυρο ότι είναι μολυσμένο.
To περίεργο είναι πως στο virustotal μου το εμφάνιζε χωρίς προβλημα σε όλα
τα antivirus. Mε malwarebytes επίσης όλα εντάξει. Με τα
processexplorer/autorun επίσης δεν έβρισκα κάποια περίεργη εγγραφή.
Yπάρχει το TDSSKiller από kaspersky που υποτίθεται σβήνει τον ιό. Το έτρεξα
και υποτίθεται το καθάρισε (πώς όμως;). Τώρα δεν μου βγάζει το kaspersky
κανένα μήνυμα.
Σημείωση, αυτές τις μέρες που είχα τον ιό (στην αρχή νόμιζα ότι ήταν λάθος
ανεύρεση από Kaspersky), στο ίντερνετ έμπαινε παντού, εκτός από το google
κάποιες ώρες και τώρα που καθαρίστηκε κατάλαβα ότι μείωνε και την ταχύτητα
του ίντερνετ. Στην αρχή νόμιζα ότι το google είχε πρόβλημα, αλλά μετά
κατάλαβα ότι το πρόβλημα το είχα εγώ!!
Αυτό που με παραξενεύει είναι ότι γιατί για δεύτερη φορά κολλάω ιό παρόλο
που έχω το anti-virus? Και σε καμμιά σελίδα δεν πάτησα κάποιο οk, κλπ. Απλή
επίσκεψη σε μια σελίδα το προξένησε, και το κατάλαβα γιατί η συγκεκριμένη
σελίδα είχε ένα μήνυμα του τύπου "προσθέτουμε αλλαγές στο software, κλπ".
Αν κατάλαβα καλά, το συγκεκριμένο loader έκανε redirection κάποιες εργασίες
στο ίντερνετ και απ' ότι κατάλαβα σίγουρα του www.google.com . Αλλά ίσως και
άλλες (ή όλες;). Έψαξα αλλά δεν βρήκα τι είδους redirection κάνει, δηλαδή τι
πληροφορίες δίνει. Εκτός από τη διεύθυνση του google όπως είπα.
To TDSSKiller μου έβγαλε το παρακάτω log που δεν νομίζω να έχει και μεγάλη
σημασία.
04:37:18.0296 4032 TDSS rootkit removing tool 2.6.13.0 Oct 25 2011 13:56:21
04:37:18.0750 4032
============================================================
04:37:18.0750 4032 Current date / time: 2011/10/26 04:37:18.0750
04:37:18.0750 4032 SystemInfo:
04:37:18.0750 4032
04:37:18.0750 4032 OS Version: 5.1.2600 ServicePack: 3.0
04:37:18.0750 4032 Product type: Workstation
04:37:18.0750 4032 Windows directory: C:\WINDOWS
04:37:18.0750 4032 System windows directory: C:\WINDOWS
04:37:18.0750 4032 Processor architecture: Intel x86
04:37:18.0750 4032 Number of processors: 4
04:37:18.0750 4032 Page size: 0x1000
04:37:18.0750 4032 Boot type: Normal boot
04:37:18.0750 4032
============================================================
04:37:19.0968 4032 Initialize success
04:37:22.0031 0584
============================================================
04:37:22.0031 0584 Scan started
04:37:22.0031 0584 Mode: Manual;
04:37:22.0031 0584
============================================================
04:37:22.0906 0584 Abiosdsk - ok
04:37:22.0906 0584 abp480n5 - ok
04:37:22.0937 0584 ACPI (d8fb7d1c3f5bfa3f53fe9cc6367e9e99)
C:\WINDOWS\system32\DRIVERS\ACPI.sys
04:37:22.0968 0584 Suspicious file (Forged):
C:\WINDOWS\system32\DRIVERS\ACPI.sys. Real md5:
d8fb7d1c3f5bfa3f53fe9cc6367e9e99, Fake md5: 8fd99680a539792a30e97944fdaecf17
04:37:22.0968 0584 ACPI ( Virus.Win32.Rloader.a ) - infected
04:37:22.0968 0584 ACPI - detected Virus.Win32.Rloader.a (0)
04:37:23.0000 0584 ACPIEC (9859c0f6936e723e4892d7141b1327d5)
C:\WINDOWS\system32\drivers\ACPIEC.sys
04:37:23.0031 0584 ACPIEC - ok
04:37:23.0031 0584 adpu160m - ok
04:37:23.0046 0584 aec (8bed39e3c35d6a489438b8141717a557)
C:\WINDOWS\system32\drivers\aec.sys
04:37:23.0125 0584 aec - ok
04:37:23.0125 0584 AFD (7e775010ef291da96ad17ca4b17137d7)
C:\WINDOWS\System32\drivers\afd.sys
04:37:23.0156 0584 AFD - ok
04:37:23.0156 0584 Aha154x - ok
04:37:23.0171 0584 aic78u2 - ok
04:37:23.0171 0584 aic78xx - ok
04:37:23.0171 0584 AliIde - ok
04:37:23.0218 0584 Ambfilt (267fc636801edc5ab28e14036349e3be)
C:\WINDOWS\system32\drivers\Ambfilt.sys
04:37:23.0265 0584 Ambfilt - ok
04:37:23.0265 0584 amsint - ok
04:37:23.0281 0584 asc - ok
04:37:23.0281 0584 asc3350p - ok
04:37:23.0281 0584 asc3550 - ok
04:37:23.0296 0584 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc)
C:\WINDOWS\system32\DRIVERS\asyncmac.sys
04:37:23.0328 0584 AsyncMac - ok
04:37:23.0328 0584 atapi (9f3a2f5aa6875c72bf062c712cfa2674)
C:\WINDOWS\system32\DRIVERS\atapi.sys
04:37:23.0328 0584 atapi - ok
04:37:23.0343 0584 Atdisk - ok
04:37:23.0406 0584 ati2mtag (554e45746a2ff688af87282c4d742255)
C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
04:37:23.0453 0584 ati2mtag - ok
04:37:23.0484 0584 AtiHdmiService (590724416c5a6aa6fbc1f8ee75131afc)
C:\WINDOWS\system32\drivers\AtiHdmi.sys
04:37:23.0515 0584 AtiHdmiService - ok
04:37:23.0515 0584 Atmarpc (9916c1225104ba14794209cfa8012159)
C:\WINDOWS\system32\DRIVERS\atmarpc.sys
04:37:23.0671 0584 Atmarpc - ok
04:37:23.0703 0584 audstub (d9f724aa26c010a217c97606b160ed68)
C:\WINDOWS\system32\DRIVERS\audstub.sys
04:37:23.0734 0584 audstub - ok
04:37:23.0781 0584 Beep (da1f27d85e0d1525f6621372e7b685e9)
C:\WINDOWS\system32\drivers\Beep.sys
04:37:23.0796 0584 Beep - ok
04:37:23.0828 0584 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9)
C:\WINDOWS\system32\drivers\cbidf2k.sys
04:37:23.0843 0584 cbidf2k - ok
04:37:23.0843 0584 cd20xrnt - ok
04:37:23.0843 0584 Cdaudio (c1b486a7658353d33a10cc15211a873b)
C:\WINDOWS\system32\drivers\Cdaudio.sys
04:37:23.0875 0584 Cdaudio - ok
04:37:23.0890 0584 Cdfs (c885b02847f5d2fd45a24e219ed93b32)
C:\WINDOWS\system32\drivers\Cdfs.sys
04:37:23.0906 0584 Cdfs - ok
04:37:23.0921 0584 Cdrom (1f4260cc5b42272d71f79e570a27a4fe)
C:\WINDOWS\system32\DRIVERS\cdrom.sys
04:37:23.0937 0584 Cdrom - ok
04:37:23.0953 0584 CmdIde - ok
04:37:23.0953 0584 Cpqarray - ok
04:37:23.0968 0584 dac2w2k - ok
04:37:23.0968 0584 dac960nt - ok
04:37:23.0984 0584 Disk (044452051f3e02e7963599fc8f4f3e25)
C:\WINDOWS\system32\DRIVERS\disk.sys
04:37:24.0000 0584 Disk - ok
04:37:24.0015 0584 DLPortIO (1d95d36db805787d54eb50e45ed4af40)
C:\WINDOWS\system32\DRIVERS\DLPortIO.SYS
04:37:24.0062 0584 DLPortIO - ok
04:37:24.0078 0584 dmboot (d992fe1274bde0f84ad826acae022a41)
C:\WINDOWS\system32\drivers\dmboot.sys
04:37:24.0125 0584 dmboot - ok
04:37:24.0125 0584 dmio (7c824cf7bbde77d95c08005717a95f6f)
C:\WINDOWS\system32\drivers\dmio.sys
04:37:24.0156 0584 dmio - ok
04:37:24.0171 0584 dmload (e9317282a63ca4d188c0df5e09c6ac5f)
C:\WINDOWS\system32\drivers\dmload.sys
04:37:24.0203 0584 dmload - ok
04:37:24.0234 0584 DMusic (8a208dfcf89792a484e76c40e5f50b45)
C:\WINDOWS\system32\drivers\DMusic.sys
04:37:24.0265 0584 DMusic - ok
04:37:24.0265 0584 dpti2o - ok
04:37:24.0281 0584 drmkaud (8f5fcff8e8848afac920905fbd9d33c8)
C:\WINDOWS\system32\drivers\drmkaud.sys
04:37:24.0312 0584 drmkaud - ok
04:37:24.0328 0584 Fastfat (38d332a6d56af32635675f132548343e)
C:\WINDOWS\system32\drivers\Fastfat.sys
04:37:24.0375 0584 Fastfat - ok
04:37:24.0375 0584 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81)
C:\WINDOWS\system32\drivers\Fdc.sys
04:37:24.0406 0584 Fdc - ok
04:37:24.0406 0584 Fips (d45926117eb9fa946a6af572fbe1caa3)
C:\WINDOWS\system32\drivers\Fips.sys
04:37:24.0453 0584 Fips - ok
04:37:24.0453 0584 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0)
C:\WINDOWS\system32\drivers\Flpydisk.sys
04:37:24.0484 0584 Flpydisk - ok
04:37:24.0500 0584 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0)
C:\WINDOWS\system32\DRIVERS\fltMgr.sys
04:37:24.0515 0584 FltMgr - ok
04:37:24.0546 0584 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a)
C:\WINDOWS\system32\drivers\Fs_Rec.sys
04:37:24.0578 0584 Fs_Rec - ok
04:37:24.0593 0584 FTDIBUS (b7aa8283ec551d3a3b924e520e0621a7)
C:\WINDOWS\system32\drivers\ftdibus.sys
04:37:24.0625 0584 FTDIBUS - ok
04:37:24.0640 0584 Ftdisk (6ac26732762483366c3969c9e4d2259d)
C:\WINDOWS\system32\DRIVERS\ftdisk.sys
04:37:24.0671 0584 Ftdisk - ok
04:37:24.0687 0584 FTSER2K (596d31583ce332b5514520d74837f434)
C:\WINDOWS\system32\drivers\ftser2k.sys
04:37:24.0703 0584 FTSER2K - ok
04:37:24.0718 0584 gdrv (c6e3105b8c68c35cc1eb26a00fd1a8c6)
C:\WINDOWS\gdrv.sys
04:37:24.0796 0584 gdrv - ok
04:37:24.0843 0584 Gpc (0a02c63c8b144bd8c86b103dee7c86a2)
C:\WINDOWS\system32\DRIVERS\msgpc.sys
04:37:24.0875 0584 Gpc - ok
04:37:24.0921 0584 HDAudBus (573c7d0a32852b48f3058cfd8026f511)
C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
04:37:24.0968 0584 HDAudBus - ok
04:37:25.0046 0584 hpn - ok
04:37:25.0046 0584 HTTP (f6aacf5bce2893e0c1754afeb672e5c9)
C:\WINDOWS\system32\Drivers\HTTP.sys
04:37:25.0078 0584 HTTP - ok
04:37:25.0093 0584 i2omp - ok
04:37:25.0109 0584 i8042prt (4a0b06aa8943c1e332520f7440c0aa30)
C:\WINDOWS\system32\DRIVERS\i8042prt.sys
04:37:25.0156 0584 i8042prt - ok
04:37:25.0171 0584 Imapi (083a052659f5310dd8b6a6cb05edcf8e)
C:\WINDOWS\system32\DRIVERS\imapi.sys
04:37:25.0328 0584 Imapi - ok
04:37:25.0328 0584 ini910u - ok
04:37:25.0421 0584 IntcAzAudAddService (3af5d5cfd4dafa5dca3705813fd19b4b)
C:\WINDOWS\system32\drivers\RtkHDAud.sys
04:37:25.0484 0584 IntcAzAudAddService - ok
04:37:25.0484 0584 IntelIde - ok
04:37:25.0515 0584 intelppm (8c953733d8f36eb2133f5bb58808b66b)
C:\WINDOWS\system32\DRIVERS\intelppm.sys
04:37:25.0718 0584 intelppm - ok
04:37:25.0718 0584 Ip6Fw (3bb22519a194418d5fec05d800a19ad0)
C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
04:37:25.0750 0584 Ip6Fw - ok
04:37:25.0765 0584 IpFilterDriver (731f22ba402ee4b62748adaf6363c182)
C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
04:37:25.0812 0584 IpFilterDriver - ok
04:37:25.0812 0584 IpInIp (b87ab476dcf76e72010632b5550955f5)
C:\WINDOWS\system32\DRIVERS\ipinip.sys
04:37:25.0843 0584 IpInIp - ok
04:37:25.0843 0584 IpNat (cc748ea12c6effde940ee98098bf96bb)
C:\WINDOWS\system32\DRIVERS\ipnat.sys
04:37:25.0890 0584 IpNat - ok
04:37:25.0890 0584 IPSec (23c74d75e36e7158768dd63d92789a91)
C:\WINDOWS\system32\DRIVERS\ipsec.sys
04:37:25.0953 0584 IPSec - ok
04:37:25.0984 0584 IRENUM (c93c9ff7b04d772627a3646d89f7bf89)
C:\WINDOWS\system32\DRIVERS\irenum.sys
04:37:26.0015 0584 IRENUM - ok
04:37:26.0031 0584 isapnp (05a299ec56e52649b1cf2fc52d20f2d7)
C:\WINDOWS\system32\DRIVERS\isapnp.sys
04:37:26.0046 0584 isapnp - ok
04:37:26.0062 0584 Kbdclass (463c1ec80cd17420a542b7f36a36f128)
C:\WINDOWS\system32\DRIVERS\kbdclass.sys
04:37:26.0093 0584 Kbdclass - ok
04:37:26.0125 0584 kl1 (ce3958f58547454884e97bda78cd7040)
C:\WINDOWS\system32\drivers\kl1.sys
04:37:26.0156 0584 kl1 - ok
04:37:26.0187 0584 klbg (53eedab3f0511321ac3ae8bc968b158c)
C:\WINDOWS\system32\drivers\klbg.sys
04:37:26.0218 0584 klbg - ok
04:37:26.0234 0584 KLIF (439c778700fce23f2852535d6fa5996d)
C:\WINDOWS\system32\DRIVERS\klif.sys
04:37:26.0250 0584 KLIF - ok
04:37:26.0281 0584 klim5 (fbdc2034b58d2135d25fe99eb8b747c3)
C:\WINDOWS\system32\DRIVERS\klim5.sys
04:37:26.0359 0584 klim5 - ok
04:37:26.0359 0584 klmouflt (1f351c4ba53bfe58a1ca5fcdd11e1f81)
C:\WINDOWS\system32\DRIVERS\klmouflt.sys
04:37:26.0375 0584 klmouflt - ok
04:37:26.0406 0584 kmixer (692bcf44383d056aed41b045a323d378)
C:\WINDOWS\system32\drivers\kmixer.sys
04:37:26.0453 0584 kmixer - ok
04:37:26.0468 0584 KSecDD (c6ebf1d6ad71df30db49b8d3287e1368)
C:\WINDOWS\system32\drivers\KSecDD.sys
04:37:26.0515 0584 KSecDD - ok
04:37:26.0546 0584 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6)
C:\WINDOWS\system32\drivers\mnmdd.sys
04:37:26.0578 0584 mnmdd - ok
04:37:26.0593 0584 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1)
C:\WINDOWS\system32\drivers\Modem.sys
04:37:26.0609 0584 Modem - ok
04:37:26.0640 0584 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65)
C:\WINDOWS\system32\drivers\MODEMCSA.sys
04:37:26.0656 0584 MODEMCSA - ok
04:37:26.0703 0584 Monfilt (c7d9f9717916b34c1b00dd4834af485c)
C:\WINDOWS\system32\drivers\Monfilt.sys
04:37:26.0781 0584 Monfilt - ok
04:37:26.0812 0584 Mouclass (35c9e97194c8cfb8430125f8dbc34d04)
C:\WINDOWS\system32\DRIVERS\mouclass.sys
04:37:26.0859 0584 Mouclass - ok
04:37:26.0875 0584 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd)
C:\WINDOWS\system32\drivers\MountMgr.sys
04:37:26.0906 0584 MountMgr - ok
04:37:26.0906 0584 mraid35x - ok
04:37:26.0921 0584 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd)
C:\WINDOWS\system32\DRIVERS\mrxdav.sys
04:37:26.0953 0584 MRxDAV - ok
04:37:26.0953 0584 MRxSmb (60ae98742484e7ab80c3c1450e708148)
C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
04:37:26.0984 0584 MRxSmb - ok
04:37:26.0984 0584 Msfs (c941ea2454ba8350021d774daf0f1027)
C:\WINDOWS\system32\drivers\Msfs.sys
04:37:27.0015 0584 Msfs - ok
04:37:27.0031 0584 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1)
C:\WINDOWS\system32\drivers\MSKSSRV.sys
04:37:27.0046 0584 MSKSSRV - ok
04:37:27.0062 0584 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e)
C:\WINDOWS\system32\drivers\MSPCLOCK.sys
04:37:27.0078 0584 MSPCLOCK - ok
04:37:27.0078 0584 MSPQM (bad59648ba099da4a17680b39730cb3d)
C:\WINDOWS\system32\drivers\MSPQM.sys
04:37:27.0109 0584 MSPQM - ok
04:37:27.0125 0584 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136)
C:\WINDOWS\system32\DRIVERS\mssmbios.sys
04:37:27.0156 0584 mssmbios - ok
04:37:27.0171 0584 Mup (2f625d11385b1a94360bfc70aaefdee1)
C:\WINDOWS\system32\drivers\Mup.sys
04:37:27.0203 0584 Mup - ok
04:37:27.0203 0584 NDIS (1df7f42665c94b825322fae71721130d)
C:\WINDOWS\system32\drivers\NDIS.sys
04:37:27.0234 0584 NDIS - ok
04:37:27.0234 0584 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f)
C:\WINDOWS\system32\DRIVERS\ndistapi.sys
04:37:27.0250 0584 NdisTapi - ok
04:37:27.0265 0584 Ndisuio (f927a4434c5028758a842943ef1a3849)
C:\WINDOWS\system32\DRIVERS\ndisuio.sys
04:37:27.0296 0584 Ndisuio - ok
04:37:27.0296 0584 NdisWan (edc1531a49c80614b2cfda43ca8659ab)
C:\WINDOWS\system32\DRIVERS\ndiswan.sys
04:37:27.0312 0584 NdisWan - ok
04:37:27.0312 0584 NDProxy (6215023940cfd3702b46abc304e1d45a)
C:\WINDOWS\system32\drivers\NDProxy.sys
04:37:27.0343 0584 NDProxy - ok
04:37:27.0343 0584 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0)
C:\WINDOWS\system32\DRIVERS\netbios.sys
04:37:27.0359 0584 NetBIOS - ok
04:37:27.0375 0584 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d)
C:\WINDOWS\system32\DRIVERS\netbt.sys
04:37:27.0406 0584 NetBT - ok
04:37:27.0437 0584 Npfs (3182d64ae053d6fb034f44b6def8034a)
C:\WINDOWS\system32\drivers\Npfs.sys
04:37:27.0453 0584 Npfs - ok
04:37:27.0468 0584 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca)
C:\WINDOWS\system32\drivers\Ntfs.sys
04:37:27.0500 0584 Ntfs - ok
04:37:27.0531 0584 Null (73c1e1f395918bc2c6dd67af7591a3ad)
C:\WINDOWS\system32\drivers\Null.sys
04:37:27.0562 0584 Null - ok
04:37:27.0562 0584 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57)
C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
04:37:27.0609 0584 NwlnkFlt - ok
04:37:27.0625 0584 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9)
C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
04:37:27.0640 0584 NwlnkFwd - ok
04:37:27.0671 0584 Parport (5575faf8f97ce5e713d108c2a58d7c7c)
C:\WINDOWS\system32\DRIVERS\parport.sys
04:37:27.0687 0584 Parport - ok
04:37:27.0687 0584 PartMgr (beb3ba25197665d82ec7065b724171c6)
C:\WINDOWS\system32\drivers\PartMgr.sys
04:37:27.0734 0584 PartMgr - ok
04:37:27.0750 0584 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1)
C:\WINDOWS\system32\drivers\ParVdm.sys
04:37:27.0781 0584 ParVdm - ok
04:37:27.0796 0584 PCI (a219903ccf74233761d92bef471a07b1)
C:\WINDOWS\system32\DRIVERS\pci.sys
04:37:27.0828 0584 PCI - ok
04:37:27.0843 0584 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0)
C:\WINDOWS\system32\DRIVERS\pciide.sys
04:37:27.0890 0584 PCIIde - ok
04:37:27.0906 0584 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1)
C:\WINDOWS\system32\drivers\Pcmcia.sys
04:37:27.0921 0584 Pcmcia - ok
04:37:27.0921 0584 perc2 - ok
04:37:27.0937 0584 perc2hib - ok
04:37:27.0953 0584 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99)
C:\WINDOWS\system32\DRIVERS\raspptp.sys
04:37:27.0984 0584 PptpMiniport - ok
04:37:28.0000 0584 PSched (09298ec810b07e5d582cb3a3f9255424)
C:\WINDOWS\system32\DRIVERS\psched.sys
04:37:28.0015 0584 PSched - ok
04:37:28.0031 0584 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd)
C:\WINDOWS\system32\DRIVERS\ptilink.sys
04:37:28.0062 0584 Ptilink - ok
04:37:28.0062 0584 ql1080 - ok
04:37:28.0062 0584 Ql10wnt - ok
04:37:28.0078 0584 ql12160 - ok
04:37:28.0078 0584 ql1240 - ok
04:37:28.0078 0584 ql1280 - ok
04:37:28.0093 0584 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c)
C:\WINDOWS\system32\DRIVERS\rasacd.sys
04:37:28.0109 0584 RasAcd - ok
04:37:28.0125 0584 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6)
C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
04:37:28.0140 0584 Rasl2tp - ok
04:37:28.0156 0584 RasPppoe (5bc962f2654137c9909c3d4603587dee)
C:\WINDOWS\system32\DRIVERS\raspppoe.sys
04:37:28.0187 0584 RasPppoe - ok
04:37:28.0187 0584 Raspti (fdbb1d60066fcfbb7452fd8f9829b242)
C:\WINDOWS\system32\DRIVERS\raspti.sys
04:37:28.0218 0584 Raspti - ok
04:37:28.0234 0584 Rdbss (7ad224ad1a1437fe28d89cf22b17780a)
C:\WINDOWS\system32\DRIVERS\rdbss.sys
04:37:28.0250 0584 Rdbss - ok
04:37:28.0265 0584 RDPCDD (4912d5b403614ce99c28420f75353332)
C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
04:37:28.0281 0584 RDPCDD - ok
04:37:28.0312 0584 rdpdr (15cabd0f7c00c47c70124907916af3f1)
C:\WINDOWS\system32\DRIVERS\rdpdr.sys
04:37:28.0343 0584 rdpdr - ok
04:37:28.0359 0584 RDPWD (6728e45b66f93c08f11de2e316fc70dd)
C:\WINDOWS\system32\drivers\RDPWD.sys
04:37:28.0500 0584 RDPWD - ok
04:37:28.0515 0584 redbook (f828dd7e1419b6653894a8f97a0094c5)
C:\WINDOWS\system32\DRIVERS\redbook.sys
04:37:28.0546 0584 redbook - ok
04:37:28.0546 0584 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7)
C:\WINDOWS\system32\Drivers\RootMdm.sys
04:37:28.0562 0584 ROOTMODEM - ok
04:37:28.0593 0584 RTLE8023xp (839141088ad7ee90f5b441b2d1afd22c)
C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys
04:37:28.0656 0584 RTLE8023xp - ok
04:37:28.0687 0584 Secdrv (90a3935d05b494a5a39d37e71f09a677)
C:\WINDOWS\system32\DRIVERS\secdrv.sys
04:37:28.0718 0584 Secdrv - ok
04:37:28.0750 0584 serenum (0f29512ccd6bead730039fb4bd2c85ce)
C:\WINDOWS\system32\DRIVERS\serenum.sys
04:37:28.0796 0584 serenum - ok
04:37:28.0796 0584 Serial (cca207a8896d4c6a0c9ce29a4ae411a7)
C:\WINDOWS\system32\DRIVERS\serial.sys
04:37:28.0828 0584 Serial - ok
04:37:28.0843 0584 Sfloppy (8e6b8c671615d126fdc553d1e2de5562)
C:\WINDOWS\system32\drivers\Sfloppy.sys
04:37:28.0875 0584 Sfloppy - ok
04:37:28.0875 0584 Simbad - ok
04:37:28.0906 0584 smserial (2d97b7cc3f118620a704c5da138ca120)
C:\WINDOWS\system32\DRIVERS\smserial.sys
04:37:28.0937 0584 smserial - ok
04:37:28.0953 0584 Sparrow - ok
04:37:28.0984 0584 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f)
C:\WINDOWS\system32\drivers\splitter.sys
04:37:29.0015 0584 splitter - ok
04:37:29.0046 0584 sr (76bb022c2fb6902fd5bdd4f78fc13a5d)
C:\WINDOWS\system32\DRIVERS\sr.sys
04:37:29.0062 0584 sr - ok
04:37:29.0078 0584 Srv (3bb03f2ba89d2be417206c373d2af17c)
C:\WINDOWS\system32\DRIVERS\srv.sys
04:37:29.0109 0584 Srv - ok
04:37:29.0125 0584 swenum (3941d127aef12e93addf6fe6ee027e0f)
C:\WINDOWS\system32\DRIVERS\swenum.sys
04:37:29.0156 0584 swenum - ok
04:37:29.0171 0584 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01)
C:\WINDOWS\system32\drivers\swmidi.sys
04:37:29.0218 0584 swmidi - ok
04:37:29.0218 0584 symc810 - ok
04:37:29.0218 0584 symc8xx - ok
04:37:29.0234 0584 sym_hi - ok
04:37:29.0234 0584 sym_u3 - ok
04:37:29.0250 0584 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290)
C:\WINDOWS\system32\drivers\sysaudio.sys
04:37:29.0281 0584 sysaudio - ok
04:37:29.0296 0584 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d)
C:\WINDOWS\system32\DRIVERS\tcpip.sys
04:37:29.0328 0584 Tcpip - ok
04:37:29.0343 0584 TDPIPE (6471a66807f5e104e4885f5b67349397)
C:\WINDOWS\system32\drivers\TDPIPE.sys
04:37:29.0375 0584 TDPIPE - ok
04:37:29.0375 0584 TDTCP (c56b6d0402371cf3700eb322ef3aaf61)
C:\WINDOWS\system32\drivers\TDTCP.sys
04:37:29.0390 0584 TDTCP - ok
04:37:29.0421 0584 TermDD (88155247177638048422893737429d9e)
C:\WINDOWS\system32\DRIVERS\termdd.sys
04:37:29.0437 0584 TermDD - ok
04:37:29.0437 0584 TosIde - ok
04:37:29.0453 0584 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9)
C:\WINDOWS\system32\drivers\Udfs.sys
04:37:29.0484 0584 Udfs - ok
04:37:29.0500 0584 ultra - ok
04:37:29.0515 0584 Update (402ddc88356b1bac0ee3dd1580c76a31)
C:\WINDOWS\system32\DRIVERS\update.sys
04:37:29.0562 0584 Update - ok
04:37:29.0578 0584 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7)
C:\WINDOWS\system32\DRIVERS\usbehci.sys
04:37:29.0609 0584 usbehci - ok
04:37:29.0625 0584 usbhub (1ab3cdde553b6e064d2e754efe20285c)
C:\WINDOWS\system32\DRIVERS\usbhub.sys
04:37:29.0656 0584 usbhub - ok
04:37:29.0671 0584 usbprint (a717c8721046828520c9edf31288fc00)
C:\WINDOWS\system32\DRIVERS\usbprint.sys
04:37:29.0734 0584 usbprint - ok
04:37:29.0750 0584 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4)
C:\WINDOWS\system32\DRIVERS\usbscan.sys
04:37:29.0781 0584 usbscan - ok
04:37:29.0796 0584 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9)
C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
04:37:29.0843 0584 USBSTOR - ok
04:37:29.0843 0584 usbuhci (26496f9dee2d787fc3e61ad54821ffe6)
C:\WINDOWS\system32\DRIVERS\usbuhci.sys
04:37:29.0859 0584 usbuhci - ok
04:37:29.0890 0584 VgaSave (0d3a8fafceacd8b7625cd549757a7df1)
C:\WINDOWS\System32\drivers\vga.sys
04:37:29.0921 0584 VgaSave - ok
04:37:29.0921 0584 ViaIde - ok
04:37:29.0937 0584 VolSnap (4c8fcb5cc53aab716d810740fe59d025)
C:\WINDOWS\system32\drivers\VolSnap.sys
04:37:29.0953 0584 VolSnap - ok
04:37:29.0968 0584 Wanarp (e20b95baedb550f32dd489265c1da1f6)
C:\WINDOWS\system32\DRIVERS\wanarp.sys
04:37:29.0984 0584 Wanarp - ok
04:37:30.0000 0584 wdmaud (6768acf64b18196494413695f0c3a00f)
C:\WINDOWS\system32\drivers\wdmaud.sys
04:37:30.0031 0584 wdmaud - ok
04:37:30.0093 0584 WudfPf (f15feafffbb3644ccc80c5da584e6311)
C:\WINDOWS\system32\DRIVERS\WudfPf.sys
04:37:30.0171 0584 WudfPf - ok
04:37:30.0234 0584 WudfRd (28b524262bce6de1f7ef9f510ba3985b)
C:\WINDOWS\system32\DRIVERS\wudfrd.sys
04:37:30.0296 0584 WudfRd - ok
04:37:30.0312 0584 MBR (0x1B8) (8f558eb6672622401da993e1e865c861)
\Device\Harddisk0\DR0
04:37:30.0406 0584 \Device\Harddisk0\DR0 - ok
04:37:30.0406 0584 MBR (0x1B8) (5fb38429d5d77768867c76dcbdb35194)
\Device\Harddisk1\DR1
04:37:30.0406 0584 \Device\Harddisk1\DR1 - ok
04:37:30.0406 0584 Boot (0x1200) (c679b5255737934acbb6ffc7bb0e5de2)
\Device\Harddisk0\DR0\Partition0
04:37:30.0421 0584 \Device\Harddisk0\DR0\Partition0 - ok
04:37:30.0437 0584 Boot (0x1200) (a5de611fb86298a33b7fbf3a6ed9c39c)
\Device\Harddisk0\DR0\Partition1
04:37:30.0437 0584 \Device\Harddisk0\DR0\Partition1 - ok
04:37:30.0437 0584 Boot (0x1200) (bf4ea1bbac858ce6636cfcc0a410d09e)
\Device\Harddisk1\DR1\Partition0
04:37:30.0437 0584 \Device\Harddisk1\DR1\Partition0 - ok
04:37:30.0437 0584
============================================================
04:37:30.0437 0584 Scan finished
04:37:30.0437 0584
============================================================
04:37:30.0437 0460 Detected object count: 1
04:37:30.0437 0460 Actual detected object count: 1
04:37:46.0921 0460 Backup copy found, using it..
04:37:46.0968 0460 C:\WINDOWS\system32\DRIVERS\ACPI.sys - will be cured on
reboot
04:37:46.0968 0460 ACPI ( Virus.Win32.Rloader.a ) - User select action: Cure
04:37:52.0921 3940 Deinitialize success
c:/windows/system32/drivers/acpi.sys να έχει ιό (win32.RLoader.a). Σημείωση
στο σκανάρισμα τα βγάζει όλα εντάξει, (ακόμα και αυτό το αρχείο) αλλά μετά
από περίπου 10 λεπτά μου εμφανίζει παράθυρο ότι είναι μολυσμένο.
To περίεργο είναι πως στο virustotal μου το εμφάνιζε χωρίς προβλημα σε όλα
τα antivirus. Mε malwarebytes επίσης όλα εντάξει. Με τα
processexplorer/autorun επίσης δεν έβρισκα κάποια περίεργη εγγραφή.
Yπάρχει το TDSSKiller από kaspersky που υποτίθεται σβήνει τον ιό. Το έτρεξα
και υποτίθεται το καθάρισε (πώς όμως;). Τώρα δεν μου βγάζει το kaspersky
κανένα μήνυμα.
Σημείωση, αυτές τις μέρες που είχα τον ιό (στην αρχή νόμιζα ότι ήταν λάθος
ανεύρεση από Kaspersky), στο ίντερνετ έμπαινε παντού, εκτός από το google
κάποιες ώρες και τώρα που καθαρίστηκε κατάλαβα ότι μείωνε και την ταχύτητα
του ίντερνετ. Στην αρχή νόμιζα ότι το google είχε πρόβλημα, αλλά μετά
κατάλαβα ότι το πρόβλημα το είχα εγώ!!
Αυτό που με παραξενεύει είναι ότι γιατί για δεύτερη φορά κολλάω ιό παρόλο
που έχω το anti-virus? Και σε καμμιά σελίδα δεν πάτησα κάποιο οk, κλπ. Απλή
επίσκεψη σε μια σελίδα το προξένησε, και το κατάλαβα γιατί η συγκεκριμένη
σελίδα είχε ένα μήνυμα του τύπου "προσθέτουμε αλλαγές στο software, κλπ".
Αν κατάλαβα καλά, το συγκεκριμένο loader έκανε redirection κάποιες εργασίες
στο ίντερνετ και απ' ότι κατάλαβα σίγουρα του www.google.com . Αλλά ίσως και
άλλες (ή όλες;). Έψαξα αλλά δεν βρήκα τι είδους redirection κάνει, δηλαδή τι
πληροφορίες δίνει. Εκτός από τη διεύθυνση του google όπως είπα.
To TDSSKiller μου έβγαλε το παρακάτω log που δεν νομίζω να έχει και μεγάλη
σημασία.
04:37:18.0296 4032 TDSS rootkit removing tool 2.6.13.0 Oct 25 2011 13:56:21
04:37:18.0750 4032
============================================================
04:37:18.0750 4032 Current date / time: 2011/10/26 04:37:18.0750
04:37:18.0750 4032 SystemInfo:
04:37:18.0750 4032
04:37:18.0750 4032 OS Version: 5.1.2600 ServicePack: 3.0
04:37:18.0750 4032 Product type: Workstation
04:37:18.0750 4032 Windows directory: C:\WINDOWS
04:37:18.0750 4032 System windows directory: C:\WINDOWS
04:37:18.0750 4032 Processor architecture: Intel x86
04:37:18.0750 4032 Number of processors: 4
04:37:18.0750 4032 Page size: 0x1000
04:37:18.0750 4032 Boot type: Normal boot
04:37:18.0750 4032
============================================================
04:37:19.0968 4032 Initialize success
04:37:22.0031 0584
============================================================
04:37:22.0031 0584 Scan started
04:37:22.0031 0584 Mode: Manual;
04:37:22.0031 0584
============================================================
04:37:22.0906 0584 Abiosdsk - ok
04:37:22.0906 0584 abp480n5 - ok
04:37:22.0937 0584 ACPI (d8fb7d1c3f5bfa3f53fe9cc6367e9e99)
C:\WINDOWS\system32\DRIVERS\ACPI.sys
04:37:22.0968 0584 Suspicious file (Forged):
C:\WINDOWS\system32\DRIVERS\ACPI.sys. Real md5:
d8fb7d1c3f5bfa3f53fe9cc6367e9e99, Fake md5: 8fd99680a539792a30e97944fdaecf17
04:37:22.0968 0584 ACPI ( Virus.Win32.Rloader.a ) - infected
04:37:22.0968 0584 ACPI - detected Virus.Win32.Rloader.a (0)
04:37:23.0000 0584 ACPIEC (9859c0f6936e723e4892d7141b1327d5)
C:\WINDOWS\system32\drivers\ACPIEC.sys
04:37:23.0031 0584 ACPIEC - ok
04:37:23.0031 0584 adpu160m - ok
04:37:23.0046 0584 aec (8bed39e3c35d6a489438b8141717a557)
C:\WINDOWS\system32\drivers\aec.sys
04:37:23.0125 0584 aec - ok
04:37:23.0125 0584 AFD (7e775010ef291da96ad17ca4b17137d7)
C:\WINDOWS\System32\drivers\afd.sys
04:37:23.0156 0584 AFD - ok
04:37:23.0156 0584 Aha154x - ok
04:37:23.0171 0584 aic78u2 - ok
04:37:23.0171 0584 aic78xx - ok
04:37:23.0171 0584 AliIde - ok
04:37:23.0218 0584 Ambfilt (267fc636801edc5ab28e14036349e3be)
C:\WINDOWS\system32\drivers\Ambfilt.sys
04:37:23.0265 0584 Ambfilt - ok
04:37:23.0265 0584 amsint - ok
04:37:23.0281 0584 asc - ok
04:37:23.0281 0584 asc3350p - ok
04:37:23.0281 0584 asc3550 - ok
04:37:23.0296 0584 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc)
C:\WINDOWS\system32\DRIVERS\asyncmac.sys
04:37:23.0328 0584 AsyncMac - ok
04:37:23.0328 0584 atapi (9f3a2f5aa6875c72bf062c712cfa2674)
C:\WINDOWS\system32\DRIVERS\atapi.sys
04:37:23.0328 0584 atapi - ok
04:37:23.0343 0584 Atdisk - ok
04:37:23.0406 0584 ati2mtag (554e45746a2ff688af87282c4d742255)
C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
04:37:23.0453 0584 ati2mtag - ok
04:37:23.0484 0584 AtiHdmiService (590724416c5a6aa6fbc1f8ee75131afc)
C:\WINDOWS\system32\drivers\AtiHdmi.sys
04:37:23.0515 0584 AtiHdmiService - ok
04:37:23.0515 0584 Atmarpc (9916c1225104ba14794209cfa8012159)
C:\WINDOWS\system32\DRIVERS\atmarpc.sys
04:37:23.0671 0584 Atmarpc - ok
04:37:23.0703 0584 audstub (d9f724aa26c010a217c97606b160ed68)
C:\WINDOWS\system32\DRIVERS\audstub.sys
04:37:23.0734 0584 audstub - ok
04:37:23.0781 0584 Beep (da1f27d85e0d1525f6621372e7b685e9)
C:\WINDOWS\system32\drivers\Beep.sys
04:37:23.0796 0584 Beep - ok
04:37:23.0828 0584 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9)
C:\WINDOWS\system32\drivers\cbidf2k.sys
04:37:23.0843 0584 cbidf2k - ok
04:37:23.0843 0584 cd20xrnt - ok
04:37:23.0843 0584 Cdaudio (c1b486a7658353d33a10cc15211a873b)
C:\WINDOWS\system32\drivers\Cdaudio.sys
04:37:23.0875 0584 Cdaudio - ok
04:37:23.0890 0584 Cdfs (c885b02847f5d2fd45a24e219ed93b32)
C:\WINDOWS\system32\drivers\Cdfs.sys
04:37:23.0906 0584 Cdfs - ok
04:37:23.0921 0584 Cdrom (1f4260cc5b42272d71f79e570a27a4fe)
C:\WINDOWS\system32\DRIVERS\cdrom.sys
04:37:23.0937 0584 Cdrom - ok
04:37:23.0953 0584 CmdIde - ok
04:37:23.0953 0584 Cpqarray - ok
04:37:23.0968 0584 dac2w2k - ok
04:37:23.0968 0584 dac960nt - ok
04:37:23.0984 0584 Disk (044452051f3e02e7963599fc8f4f3e25)
C:\WINDOWS\system32\DRIVERS\disk.sys
04:37:24.0000 0584 Disk - ok
04:37:24.0015 0584 DLPortIO (1d95d36db805787d54eb50e45ed4af40)
C:\WINDOWS\system32\DRIVERS\DLPortIO.SYS
04:37:24.0062 0584 DLPortIO - ok
04:37:24.0078 0584 dmboot (d992fe1274bde0f84ad826acae022a41)
C:\WINDOWS\system32\drivers\dmboot.sys
04:37:24.0125 0584 dmboot - ok
04:37:24.0125 0584 dmio (7c824cf7bbde77d95c08005717a95f6f)
C:\WINDOWS\system32\drivers\dmio.sys
04:37:24.0156 0584 dmio - ok
04:37:24.0171 0584 dmload (e9317282a63ca4d188c0df5e09c6ac5f)
C:\WINDOWS\system32\drivers\dmload.sys
04:37:24.0203 0584 dmload - ok
04:37:24.0234 0584 DMusic (8a208dfcf89792a484e76c40e5f50b45)
C:\WINDOWS\system32\drivers\DMusic.sys
04:37:24.0265 0584 DMusic - ok
04:37:24.0265 0584 dpti2o - ok
04:37:24.0281 0584 drmkaud (8f5fcff8e8848afac920905fbd9d33c8)
C:\WINDOWS\system32\drivers\drmkaud.sys
04:37:24.0312 0584 drmkaud - ok
04:37:24.0328 0584 Fastfat (38d332a6d56af32635675f132548343e)
C:\WINDOWS\system32\drivers\Fastfat.sys
04:37:24.0375 0584 Fastfat - ok
04:37:24.0375 0584 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81)
C:\WINDOWS\system32\drivers\Fdc.sys
04:37:24.0406 0584 Fdc - ok
04:37:24.0406 0584 Fips (d45926117eb9fa946a6af572fbe1caa3)
C:\WINDOWS\system32\drivers\Fips.sys
04:37:24.0453 0584 Fips - ok
04:37:24.0453 0584 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0)
C:\WINDOWS\system32\drivers\Flpydisk.sys
04:37:24.0484 0584 Flpydisk - ok
04:37:24.0500 0584 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0)
C:\WINDOWS\system32\DRIVERS\fltMgr.sys
04:37:24.0515 0584 FltMgr - ok
04:37:24.0546 0584 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a)
C:\WINDOWS\system32\drivers\Fs_Rec.sys
04:37:24.0578 0584 Fs_Rec - ok
04:37:24.0593 0584 FTDIBUS (b7aa8283ec551d3a3b924e520e0621a7)
C:\WINDOWS\system32\drivers\ftdibus.sys
04:37:24.0625 0584 FTDIBUS - ok
04:37:24.0640 0584 Ftdisk (6ac26732762483366c3969c9e4d2259d)
C:\WINDOWS\system32\DRIVERS\ftdisk.sys
04:37:24.0671 0584 Ftdisk - ok
04:37:24.0687 0584 FTSER2K (596d31583ce332b5514520d74837f434)
C:\WINDOWS\system32\drivers\ftser2k.sys
04:37:24.0703 0584 FTSER2K - ok
04:37:24.0718 0584 gdrv (c6e3105b8c68c35cc1eb26a00fd1a8c6)
C:\WINDOWS\gdrv.sys
04:37:24.0796 0584 gdrv - ok
04:37:24.0843 0584 Gpc (0a02c63c8b144bd8c86b103dee7c86a2)
C:\WINDOWS\system32\DRIVERS\msgpc.sys
04:37:24.0875 0584 Gpc - ok
04:37:24.0921 0584 HDAudBus (573c7d0a32852b48f3058cfd8026f511)
C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
04:37:24.0968 0584 HDAudBus - ok
04:37:25.0046 0584 hpn - ok
04:37:25.0046 0584 HTTP (f6aacf5bce2893e0c1754afeb672e5c9)
C:\WINDOWS\system32\Drivers\HTTP.sys
04:37:25.0078 0584 HTTP - ok
04:37:25.0093 0584 i2omp - ok
04:37:25.0109 0584 i8042prt (4a0b06aa8943c1e332520f7440c0aa30)
C:\WINDOWS\system32\DRIVERS\i8042prt.sys
04:37:25.0156 0584 i8042prt - ok
04:37:25.0171 0584 Imapi (083a052659f5310dd8b6a6cb05edcf8e)
C:\WINDOWS\system32\DRIVERS\imapi.sys
04:37:25.0328 0584 Imapi - ok
04:37:25.0328 0584 ini910u - ok
04:37:25.0421 0584 IntcAzAudAddService (3af5d5cfd4dafa5dca3705813fd19b4b)
C:\WINDOWS\system32\drivers\RtkHDAud.sys
04:37:25.0484 0584 IntcAzAudAddService - ok
04:37:25.0484 0584 IntelIde - ok
04:37:25.0515 0584 intelppm (8c953733d8f36eb2133f5bb58808b66b)
C:\WINDOWS\system32\DRIVERS\intelppm.sys
04:37:25.0718 0584 intelppm - ok
04:37:25.0718 0584 Ip6Fw (3bb22519a194418d5fec05d800a19ad0)
C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
04:37:25.0750 0584 Ip6Fw - ok
04:37:25.0765 0584 IpFilterDriver (731f22ba402ee4b62748adaf6363c182)
C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
04:37:25.0812 0584 IpFilterDriver - ok
04:37:25.0812 0584 IpInIp (b87ab476dcf76e72010632b5550955f5)
C:\WINDOWS\system32\DRIVERS\ipinip.sys
04:37:25.0843 0584 IpInIp - ok
04:37:25.0843 0584 IpNat (cc748ea12c6effde940ee98098bf96bb)
C:\WINDOWS\system32\DRIVERS\ipnat.sys
04:37:25.0890 0584 IpNat - ok
04:37:25.0890 0584 IPSec (23c74d75e36e7158768dd63d92789a91)
C:\WINDOWS\system32\DRIVERS\ipsec.sys
04:37:25.0953 0584 IPSec - ok
04:37:25.0984 0584 IRENUM (c93c9ff7b04d772627a3646d89f7bf89)
C:\WINDOWS\system32\DRIVERS\irenum.sys
04:37:26.0015 0584 IRENUM - ok
04:37:26.0031 0584 isapnp (05a299ec56e52649b1cf2fc52d20f2d7)
C:\WINDOWS\system32\DRIVERS\isapnp.sys
04:37:26.0046 0584 isapnp - ok
04:37:26.0062 0584 Kbdclass (463c1ec80cd17420a542b7f36a36f128)
C:\WINDOWS\system32\DRIVERS\kbdclass.sys
04:37:26.0093 0584 Kbdclass - ok
04:37:26.0125 0584 kl1 (ce3958f58547454884e97bda78cd7040)
C:\WINDOWS\system32\drivers\kl1.sys
04:37:26.0156 0584 kl1 - ok
04:37:26.0187 0584 klbg (53eedab3f0511321ac3ae8bc968b158c)
C:\WINDOWS\system32\drivers\klbg.sys
04:37:26.0218 0584 klbg - ok
04:37:26.0234 0584 KLIF (439c778700fce23f2852535d6fa5996d)
C:\WINDOWS\system32\DRIVERS\klif.sys
04:37:26.0250 0584 KLIF - ok
04:37:26.0281 0584 klim5 (fbdc2034b58d2135d25fe99eb8b747c3)
C:\WINDOWS\system32\DRIVERS\klim5.sys
04:37:26.0359 0584 klim5 - ok
04:37:26.0359 0584 klmouflt (1f351c4ba53bfe58a1ca5fcdd11e1f81)
C:\WINDOWS\system32\DRIVERS\klmouflt.sys
04:37:26.0375 0584 klmouflt - ok
04:37:26.0406 0584 kmixer (692bcf44383d056aed41b045a323d378)
C:\WINDOWS\system32\drivers\kmixer.sys
04:37:26.0453 0584 kmixer - ok
04:37:26.0468 0584 KSecDD (c6ebf1d6ad71df30db49b8d3287e1368)
C:\WINDOWS\system32\drivers\KSecDD.sys
04:37:26.0515 0584 KSecDD - ok
04:37:26.0546 0584 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6)
C:\WINDOWS\system32\drivers\mnmdd.sys
04:37:26.0578 0584 mnmdd - ok
04:37:26.0593 0584 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1)
C:\WINDOWS\system32\drivers\Modem.sys
04:37:26.0609 0584 Modem - ok
04:37:26.0640 0584 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65)
C:\WINDOWS\system32\drivers\MODEMCSA.sys
04:37:26.0656 0584 MODEMCSA - ok
04:37:26.0703 0584 Monfilt (c7d9f9717916b34c1b00dd4834af485c)
C:\WINDOWS\system32\drivers\Monfilt.sys
04:37:26.0781 0584 Monfilt - ok
04:37:26.0812 0584 Mouclass (35c9e97194c8cfb8430125f8dbc34d04)
C:\WINDOWS\system32\DRIVERS\mouclass.sys
04:37:26.0859 0584 Mouclass - ok
04:37:26.0875 0584 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd)
C:\WINDOWS\system32\drivers\MountMgr.sys
04:37:26.0906 0584 MountMgr - ok
04:37:26.0906 0584 mraid35x - ok
04:37:26.0921 0584 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd)
C:\WINDOWS\system32\DRIVERS\mrxdav.sys
04:37:26.0953 0584 MRxDAV - ok
04:37:26.0953 0584 MRxSmb (60ae98742484e7ab80c3c1450e708148)
C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
04:37:26.0984 0584 MRxSmb - ok
04:37:26.0984 0584 Msfs (c941ea2454ba8350021d774daf0f1027)
C:\WINDOWS\system32\drivers\Msfs.sys
04:37:27.0015 0584 Msfs - ok
04:37:27.0031 0584 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1)
C:\WINDOWS\system32\drivers\MSKSSRV.sys
04:37:27.0046 0584 MSKSSRV - ok
04:37:27.0062 0584 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e)
C:\WINDOWS\system32\drivers\MSPCLOCK.sys
04:37:27.0078 0584 MSPCLOCK - ok
04:37:27.0078 0584 MSPQM (bad59648ba099da4a17680b39730cb3d)
C:\WINDOWS\system32\drivers\MSPQM.sys
04:37:27.0109 0584 MSPQM - ok
04:37:27.0125 0584 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136)
C:\WINDOWS\system32\DRIVERS\mssmbios.sys
04:37:27.0156 0584 mssmbios - ok
04:37:27.0171 0584 Mup (2f625d11385b1a94360bfc70aaefdee1)
C:\WINDOWS\system32\drivers\Mup.sys
04:37:27.0203 0584 Mup - ok
04:37:27.0203 0584 NDIS (1df7f42665c94b825322fae71721130d)
C:\WINDOWS\system32\drivers\NDIS.sys
04:37:27.0234 0584 NDIS - ok
04:37:27.0234 0584 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f)
C:\WINDOWS\system32\DRIVERS\ndistapi.sys
04:37:27.0250 0584 NdisTapi - ok
04:37:27.0265 0584 Ndisuio (f927a4434c5028758a842943ef1a3849)
C:\WINDOWS\system32\DRIVERS\ndisuio.sys
04:37:27.0296 0584 Ndisuio - ok
04:37:27.0296 0584 NdisWan (edc1531a49c80614b2cfda43ca8659ab)
C:\WINDOWS\system32\DRIVERS\ndiswan.sys
04:37:27.0312 0584 NdisWan - ok
04:37:27.0312 0584 NDProxy (6215023940cfd3702b46abc304e1d45a)
C:\WINDOWS\system32\drivers\NDProxy.sys
04:37:27.0343 0584 NDProxy - ok
04:37:27.0343 0584 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0)
C:\WINDOWS\system32\DRIVERS\netbios.sys
04:37:27.0359 0584 NetBIOS - ok
04:37:27.0375 0584 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d)
C:\WINDOWS\system32\DRIVERS\netbt.sys
04:37:27.0406 0584 NetBT - ok
04:37:27.0437 0584 Npfs (3182d64ae053d6fb034f44b6def8034a)
C:\WINDOWS\system32\drivers\Npfs.sys
04:37:27.0453 0584 Npfs - ok
04:37:27.0468 0584 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca)
C:\WINDOWS\system32\drivers\Ntfs.sys
04:37:27.0500 0584 Ntfs - ok
04:37:27.0531 0584 Null (73c1e1f395918bc2c6dd67af7591a3ad)
C:\WINDOWS\system32\drivers\Null.sys
04:37:27.0562 0584 Null - ok
04:37:27.0562 0584 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57)
C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
04:37:27.0609 0584 NwlnkFlt - ok
04:37:27.0625 0584 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9)
C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
04:37:27.0640 0584 NwlnkFwd - ok
04:37:27.0671 0584 Parport (5575faf8f97ce5e713d108c2a58d7c7c)
C:\WINDOWS\system32\DRIVERS\parport.sys
04:37:27.0687 0584 Parport - ok
04:37:27.0687 0584 PartMgr (beb3ba25197665d82ec7065b724171c6)
C:\WINDOWS\system32\drivers\PartMgr.sys
04:37:27.0734 0584 PartMgr - ok
04:37:27.0750 0584 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1)
C:\WINDOWS\system32\drivers\ParVdm.sys
04:37:27.0781 0584 ParVdm - ok
04:37:27.0796 0584 PCI (a219903ccf74233761d92bef471a07b1)
C:\WINDOWS\system32\DRIVERS\pci.sys
04:37:27.0828 0584 PCI - ok
04:37:27.0843 0584 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0)
C:\WINDOWS\system32\DRIVERS\pciide.sys
04:37:27.0890 0584 PCIIde - ok
04:37:27.0906 0584 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1)
C:\WINDOWS\system32\drivers\Pcmcia.sys
04:37:27.0921 0584 Pcmcia - ok
04:37:27.0921 0584 perc2 - ok
04:37:27.0937 0584 perc2hib - ok
04:37:27.0953 0584 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99)
C:\WINDOWS\system32\DRIVERS\raspptp.sys
04:37:27.0984 0584 PptpMiniport - ok
04:37:28.0000 0584 PSched (09298ec810b07e5d582cb3a3f9255424)
C:\WINDOWS\system32\DRIVERS\psched.sys
04:37:28.0015 0584 PSched - ok
04:37:28.0031 0584 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd)
C:\WINDOWS\system32\DRIVERS\ptilink.sys
04:37:28.0062 0584 Ptilink - ok
04:37:28.0062 0584 ql1080 - ok
04:37:28.0062 0584 Ql10wnt - ok
04:37:28.0078 0584 ql12160 - ok
04:37:28.0078 0584 ql1240 - ok
04:37:28.0078 0584 ql1280 - ok
04:37:28.0093 0584 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c)
C:\WINDOWS\system32\DRIVERS\rasacd.sys
04:37:28.0109 0584 RasAcd - ok
04:37:28.0125 0584 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6)
C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
04:37:28.0140 0584 Rasl2tp - ok
04:37:28.0156 0584 RasPppoe (5bc962f2654137c9909c3d4603587dee)
C:\WINDOWS\system32\DRIVERS\raspppoe.sys
04:37:28.0187 0584 RasPppoe - ok
04:37:28.0187 0584 Raspti (fdbb1d60066fcfbb7452fd8f9829b242)
C:\WINDOWS\system32\DRIVERS\raspti.sys
04:37:28.0218 0584 Raspti - ok
04:37:28.0234 0584 Rdbss (7ad224ad1a1437fe28d89cf22b17780a)
C:\WINDOWS\system32\DRIVERS\rdbss.sys
04:37:28.0250 0584 Rdbss - ok
04:37:28.0265 0584 RDPCDD (4912d5b403614ce99c28420f75353332)
C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
04:37:28.0281 0584 RDPCDD - ok
04:37:28.0312 0584 rdpdr (15cabd0f7c00c47c70124907916af3f1)
C:\WINDOWS\system32\DRIVERS\rdpdr.sys
04:37:28.0343 0584 rdpdr - ok
04:37:28.0359 0584 RDPWD (6728e45b66f93c08f11de2e316fc70dd)
C:\WINDOWS\system32\drivers\RDPWD.sys
04:37:28.0500 0584 RDPWD - ok
04:37:28.0515 0584 redbook (f828dd7e1419b6653894a8f97a0094c5)
C:\WINDOWS\system32\DRIVERS\redbook.sys
04:37:28.0546 0584 redbook - ok
04:37:28.0546 0584 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7)
C:\WINDOWS\system32\Drivers\RootMdm.sys
04:37:28.0562 0584 ROOTMODEM - ok
04:37:28.0593 0584 RTLE8023xp (839141088ad7ee90f5b441b2d1afd22c)
C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys
04:37:28.0656 0584 RTLE8023xp - ok
04:37:28.0687 0584 Secdrv (90a3935d05b494a5a39d37e71f09a677)
C:\WINDOWS\system32\DRIVERS\secdrv.sys
04:37:28.0718 0584 Secdrv - ok
04:37:28.0750 0584 serenum (0f29512ccd6bead730039fb4bd2c85ce)
C:\WINDOWS\system32\DRIVERS\serenum.sys
04:37:28.0796 0584 serenum - ok
04:37:28.0796 0584 Serial (cca207a8896d4c6a0c9ce29a4ae411a7)
C:\WINDOWS\system32\DRIVERS\serial.sys
04:37:28.0828 0584 Serial - ok
04:37:28.0843 0584 Sfloppy (8e6b8c671615d126fdc553d1e2de5562)
C:\WINDOWS\system32\drivers\Sfloppy.sys
04:37:28.0875 0584 Sfloppy - ok
04:37:28.0875 0584 Simbad - ok
04:37:28.0906 0584 smserial (2d97b7cc3f118620a704c5da138ca120)
C:\WINDOWS\system32\DRIVERS\smserial.sys
04:37:28.0937 0584 smserial - ok
04:37:28.0953 0584 Sparrow - ok
04:37:28.0984 0584 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f)
C:\WINDOWS\system32\drivers\splitter.sys
04:37:29.0015 0584 splitter - ok
04:37:29.0046 0584 sr (76bb022c2fb6902fd5bdd4f78fc13a5d)
C:\WINDOWS\system32\DRIVERS\sr.sys
04:37:29.0062 0584 sr - ok
04:37:29.0078 0584 Srv (3bb03f2ba89d2be417206c373d2af17c)
C:\WINDOWS\system32\DRIVERS\srv.sys
04:37:29.0109 0584 Srv - ok
04:37:29.0125 0584 swenum (3941d127aef12e93addf6fe6ee027e0f)
C:\WINDOWS\system32\DRIVERS\swenum.sys
04:37:29.0156 0584 swenum - ok
04:37:29.0171 0584 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01)
C:\WINDOWS\system32\drivers\swmidi.sys
04:37:29.0218 0584 swmidi - ok
04:37:29.0218 0584 symc810 - ok
04:37:29.0218 0584 symc8xx - ok
04:37:29.0234 0584 sym_hi - ok
04:37:29.0234 0584 sym_u3 - ok
04:37:29.0250 0584 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290)
C:\WINDOWS\system32\drivers\sysaudio.sys
04:37:29.0281 0584 sysaudio - ok
04:37:29.0296 0584 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d)
C:\WINDOWS\system32\DRIVERS\tcpip.sys
04:37:29.0328 0584 Tcpip - ok
04:37:29.0343 0584 TDPIPE (6471a66807f5e104e4885f5b67349397)
C:\WINDOWS\system32\drivers\TDPIPE.sys
04:37:29.0375 0584 TDPIPE - ok
04:37:29.0375 0584 TDTCP (c56b6d0402371cf3700eb322ef3aaf61)
C:\WINDOWS\system32\drivers\TDTCP.sys
04:37:29.0390 0584 TDTCP - ok
04:37:29.0421 0584 TermDD (88155247177638048422893737429d9e)
C:\WINDOWS\system32\DRIVERS\termdd.sys
04:37:29.0437 0584 TermDD - ok
04:37:29.0437 0584 TosIde - ok
04:37:29.0453 0584 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9)
C:\WINDOWS\system32\drivers\Udfs.sys
04:37:29.0484 0584 Udfs - ok
04:37:29.0500 0584 ultra - ok
04:37:29.0515 0584 Update (402ddc88356b1bac0ee3dd1580c76a31)
C:\WINDOWS\system32\DRIVERS\update.sys
04:37:29.0562 0584 Update - ok
04:37:29.0578 0584 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7)
C:\WINDOWS\system32\DRIVERS\usbehci.sys
04:37:29.0609 0584 usbehci - ok
04:37:29.0625 0584 usbhub (1ab3cdde553b6e064d2e754efe20285c)
C:\WINDOWS\system32\DRIVERS\usbhub.sys
04:37:29.0656 0584 usbhub - ok
04:37:29.0671 0584 usbprint (a717c8721046828520c9edf31288fc00)
C:\WINDOWS\system32\DRIVERS\usbprint.sys
04:37:29.0734 0584 usbprint - ok
04:37:29.0750 0584 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4)
C:\WINDOWS\system32\DRIVERS\usbscan.sys
04:37:29.0781 0584 usbscan - ok
04:37:29.0796 0584 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9)
C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
04:37:29.0843 0584 USBSTOR - ok
04:37:29.0843 0584 usbuhci (26496f9dee2d787fc3e61ad54821ffe6)
C:\WINDOWS\system32\DRIVERS\usbuhci.sys
04:37:29.0859 0584 usbuhci - ok
04:37:29.0890 0584 VgaSave (0d3a8fafceacd8b7625cd549757a7df1)
C:\WINDOWS\System32\drivers\vga.sys
04:37:29.0921 0584 VgaSave - ok
04:37:29.0921 0584 ViaIde - ok
04:37:29.0937 0584 VolSnap (4c8fcb5cc53aab716d810740fe59d025)
C:\WINDOWS\system32\drivers\VolSnap.sys
04:37:29.0953 0584 VolSnap - ok
04:37:29.0968 0584 Wanarp (e20b95baedb550f32dd489265c1da1f6)
C:\WINDOWS\system32\DRIVERS\wanarp.sys
04:37:29.0984 0584 Wanarp - ok
04:37:30.0000 0584 wdmaud (6768acf64b18196494413695f0c3a00f)
C:\WINDOWS\system32\drivers\wdmaud.sys
04:37:30.0031 0584 wdmaud - ok
04:37:30.0093 0584 WudfPf (f15feafffbb3644ccc80c5da584e6311)
C:\WINDOWS\system32\DRIVERS\WudfPf.sys
04:37:30.0171 0584 WudfPf - ok
04:37:30.0234 0584 WudfRd (28b524262bce6de1f7ef9f510ba3985b)
C:\WINDOWS\system32\DRIVERS\wudfrd.sys
04:37:30.0296 0584 WudfRd - ok
04:37:30.0312 0584 MBR (0x1B8) (8f558eb6672622401da993e1e865c861)
\Device\Harddisk0\DR0
04:37:30.0406 0584 \Device\Harddisk0\DR0 - ok
04:37:30.0406 0584 MBR (0x1B8) (5fb38429d5d77768867c76dcbdb35194)
\Device\Harddisk1\DR1
04:37:30.0406 0584 \Device\Harddisk1\DR1 - ok
04:37:30.0406 0584 Boot (0x1200) (c679b5255737934acbb6ffc7bb0e5de2)
\Device\Harddisk0\DR0\Partition0
04:37:30.0421 0584 \Device\Harddisk0\DR0\Partition0 - ok
04:37:30.0437 0584 Boot (0x1200) (a5de611fb86298a33b7fbf3a6ed9c39c)
\Device\Harddisk0\DR0\Partition1
04:37:30.0437 0584 \Device\Harddisk0\DR0\Partition1 - ok
04:37:30.0437 0584 Boot (0x1200) (bf4ea1bbac858ce6636cfcc0a410d09e)
\Device\Harddisk1\DR1\Partition0
04:37:30.0437 0584 \Device\Harddisk1\DR1\Partition0 - ok
04:37:30.0437 0584
============================================================
04:37:30.0437 0584 Scan finished
04:37:30.0437 0584
============================================================
04:37:30.0437 0460 Detected object count: 1
04:37:30.0437 0460 Actual detected object count: 1
04:37:46.0921 0460 Backup copy found, using it..
04:37:46.0968 0460 C:\WINDOWS\system32\DRIVERS\ACPI.sys - will be cured on
reboot
04:37:46.0968 0460 ACPI ( Virus.Win32.Rloader.a ) - User select action: Cure
04:37:52.0921 3940 Deinitialize success
Yianni
Nov 6, 2011, 7:03:58 PM11/6/11
to
Το πρόβλημα λύθηκε εδώ και μέρες με τη βοήθεια του TDSSKiller Κaspersky.
Ήταν περίεργο trozan γιατί το αρχείο δεν φαινόταν μολυσμένο από κανένα
antivirus, αλλά το kaspersky το έβρισκε μολυσμένο όχι στο σκανάρισμα αλλά
μετά από αρκετή ώρα (ίσως από κάποια διεργασία).
Ήταν περίεργο trozan γιατί το αρχείο δεν φαινόταν μολυσμένο από κανένα
antivirus, αλλά το kaspersky το έβρισκε μολυσμένο όχι στο σκανάρισμα αλλά
μετά από αρκετή ώρα (ίσως από κάποια διεργασία).
0 new messages