Ako moze log RootRepeal-a
1. Skinite sa http://rootrepeal.googlepages.com/RootRepeal.rar
2. Odradite sve kao na slici prateci postupke po broju

Hvala Dashkes. :) Uradicu i to.

Nego Nod mi je sada pronasao i ovo C:\System Volume Information\_restore{DCA7DF3A-F010-45F1-A76D-5679BA0F35D0}\RP517\A0209913.exe - Win32/Peerfrag.DW worm
Za ovih sat vremena koliko sam na netu jos mi nije otvarao te stranice, pa cemo vidjeti kako ce biti u narednom periodu.

Evo ga i RootRepeal

ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time: 2009/09/23 13:55
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP2
==================================================

Drivers
-------------------
Name: mchInjDrv.sys
Image Path: C:\WINDOWS\system32\Drivers\mchInjDrv.sys
Address: 0xF8C53000 Size: 2560 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xF3686000 Size: 49152 File Visible: No Signed: -
Status: -

Name: srescan.sys
Image Path: srescan.sys
Address: 0xF8340000 Size: 81920 File Visible: No Signed: -
Status: -

SSDT
-------------------
#: 041 Function Name: NtCreateKey
Status: Hooked by "PCTCore.sys" at address 0xf843d514

#: 047 Function Name: NtCreateProcess
Status: Hooked by "PCTCore.sys" at address 0xf842c282

#: 048 Function Name: NtCreateProcessEx
Status: Hooked by "PCTCore.sys" at address 0xf842c474

#: 063 Function Name: NtDeleteKey
Status: Hooked by "PCTCore.sys" at address 0xf843dd00

#: 065 Function Name: NtDeleteValueKey
Status: Hooked by "PCTCore.sys" at address 0xf843dfb8

#: 119 Function Name: NtOpenKey
Status: Hooked by "PCTCore.sys" at address 0xf843c3fa

#: 192 Function Name: NtRenameKey
Status: Hooked by "PCTCore.sys" at address 0xf843e422

#: 247 Function Name: NtSetValueKey
Status: Hooked by "PCTCore.sys" at address 0xf843d7d8

#: 257 Function Name: NtTerminateProcess
Status: Hooked by "PCTCore.sys" at address 0xf842bf32

==EOF==

_{[Ovu poruku je menjao Fitiljce dana 23.09.2009. u 14:14 GMT+1]}

Skini Gmer saovog linka na Desktop

http://www2.gmer.net/download.php

pokreni Gmer,sacekaj da se zavrsi uvodno skeniranje (ako se pojavi nekakva poruka idi na No)
idi na Scan i sacekaj da skeniranje bude zavrseno...klikni Save ...sacuvaj to kao GmerLog1

Klikni desnim tasterom na prozor programa Gmer i odaberi Options >> Only non MS files i klikni Scan
..napravice se novi log...taj log sacuvaj kao GmerLog2

Klikni taster >>> i izaberi Autostart karticu.
po zavrsetku skeniranja izaberi Copy,otvori novi notepad,izaberi Paste i taj log sacuvaj kao GmerLog3.


prikaci sva ta tri loga uz poruku kao attachment

Ako mozete fajl
C:\WINDOWS\system32\Drivers\mchInjDrv.sys
da zapakujete u ".rar"/".zip" sa password-om "virus", upload-ujete na Rapidshare i posaljete mi link preko PP.
Rekao bih da je rootkit. U RootRepeal-u (Tools > Wipe, Copy and Delete > C:\WINDOWS\system32\Drivers\mchInjDrv.sys) ga iskopirajte na Desktop.
Ako ste sigurni da je rootkit, izbrisite ga uz pomoc opcije Delete.

Prije nego sto uradim nesto od ovoga molim vas da pogledate i ovo. Svaki put kada skeniram sa Malware pojavi mi se ovaj Trojan.Agent za koji pise da je uspjesno obrisan ali sa svakim novim skeniranjem on je ponovo tu.

[att_img]http://img8.imageshack.us/i/malware1.jpg/[att_img]

Ako mozete da mi posaljete C:\WINDOWS\system32\Drivers\mchInjDrv.sys pa cemo videti sta dalje da se radi. :)