Перейти к содержанию
Правила раздела
19 лет клубу! Встречаемся в офисе «Лаборатории Касперского»

несанкциорированно перезагружается компьютер

olegamber

Автор olegamber
в Помощь в удалении вирусов

 Поделиться

Рекомендуемые сообщения

olegamber Новичок

olegamber

Опубликовано
Опубликовано

Уважаемые товарищи. Прошу оказать содействие в очистке компьютера, При работе в браузере mozblla firefox систематически перезагружается компьтер.Проверил программой GMER. Лог скопировал и прилагаю.

 

Gmer:

GMER 2.1.19357 - http://www.gmer.net
Rootkit scan 2015-08-16 13:47:24
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-2 ST3160211AS rev.3.AAE 149,05GB
Running: hun99trg.exe; Driver: C:\Users\11\AppData\Local\Temp\axldqpow.sys


---- System - GMER 2.1 ----

SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwAdjustPrivilegesToken [0x91447AC6]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwClose [0x91448298]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwConnectPort [0x914486C0]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwCreateFile [0x9144C48C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwCreateNamedPipeFile [0x9144798C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwCreateSymbolicLinkObject [0x9144976E]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwCreateThread [0x9144803C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwDebugActiveProcess [0x914491A0]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwDeviceIoControlFile [0x91448492]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwDuplicateObject [0x91449BB0]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwFsControlFile [0x91448344]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwLoadDriver [0x91449232]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwOpenFile [0x9144C2D0]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwOpenProcess [0x91447CF6]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwOpenSection [0x91449798]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwOpenThread [0x91447BF8]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwQueueApcThread [0x914494C6]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwReplaceKey [0x91446E5C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwRequestWaitReplyPort [0x91449026]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwRestoreKey [0x91446FBE]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwResumeThread [0x91449A84]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwSaveKey [0x91446C5E]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwSecureConnectPort [0x91448582]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwSetContextThread [0x9144813C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwSetSecurityObject [0x9144932C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwSetSystemInformation [0x914497C2]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwSuspendProcess [0x914498A6]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwSuspendThread [0x91449962]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwSystemDebugControl [0x914490CC]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwTerminateProcess [0x91447E90]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwTerminateThread [0x91447DE6]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                                                                                                                                                                             ZwWriteVirtualMemory [0x91447F70]

---- Devices - GMER 2.1 ----

AttachedDevice  \Driver\tdx \Device\Tcp                                                                                                                                                                                                                                                                           kl1.sys
AttachedDevice  \Driver\tdx \Device\Udp                                                                                                                                                                                                                                                                           kl1.sys
AttachedDevice  \Driver\tdx \Device\RawIp                                                                                                                                                                                                                                                                         kl1.sys
AttachedDevice  \FileSystem\fastfat \Fat                                                                                                                                                                                                                                                                          fltmgr.sys

---- Registry - GMER 2.1 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@"\4C\4=\4=\0045\4;\4L\4=\4K\49\4 \0000\0044\0040\4?\4B\0045\4@\4 \0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0T\0e\0r\0e\0d\0o                                                                               1?
Reg             HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@\20\0044\0040\4?\4B\0045\4@\4 \0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0I\0S\0A\0T\0A\0P                                                                                                                  1?2?
Reg             HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@\32\4>\4=\4B\4@\4>\4;\4;\0045\4@\4 \0A\0t\0h\0e\0r\0o\0s\0 \0L\0001\0 \0G\0i\0g\0a\0b\0i\0t\0 \0E\0t\0h\0e\0r\0n\0e\0t\0 \0001\0000\0/\0001\0000\0000\0/\0001\0000\0000\0000\0B\0a\0s\0e\0-\0T  1?
Reg             HKLM\SYSTEM\ControlSet002\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@"\4C\4=\4=\0045\4;\4L\4=\4K\49\4 \0000\0044\0040\4?\4B\0045\4@\4 \0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0T\0e\0r\0e\0d\0o                                                                                   1?
Reg             HKLM\SYSTEM\ControlSet002\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@\20\0044\0040\4?\4B\0045\4@\4 \0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0I\0S\0A\0T\0A\0P                                                                                                                      1?2?
Reg             HKLM\SYSTEM\ControlSet002\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@\32\4>\4=\4B\4@\4>\4;\4;\0045\4@\4 \0A\0t\0h\0e\0r\0o\0s\0 \0L\0001\0 \0G\0i\0g\0a\0b\0i\0t\0 \0E\0t\0h\0e\0r\0n\0e\0t\0 \0001\0000\0/\0001\0000\0000\0/\0001\0000\0000\0000\0B\0a\0s\0e\0-\0T      1?
Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack@LastHeartBeatTime                                                                                                                                                                                                            0x08 0x62 0x99 0x0F ...
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v2.0.50727/mscorwks.dll                                                                                                                                                                       
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v2.0.50727/mscorwks.dll@\Device\HarddiskVolume1\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe                                                                                       0xEA 0xA2 0x79 0x5D ...
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v2.0.50727/mscorwks.dll@\Device\HarddiskVolume1\Windows\System32\sdiagnhost.exe                                                                                                               0xC2 0xF0 0xE6 0xC7 ...
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v2.0.50727/mscorwks.dll@\Device\HarddiskVolume1\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe                                                                                            0xD1 0x3D 0x6C 0xC8 ...
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v4.0.30319/clr.dll                                                                                                                                                                            
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v4.0.30319/clr.dll@\Device\HarddiskVolume1\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe                                                                                            0x6F 0x3E 0xA9 0x5D ...
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v4.0.30319/clr.dll@\Device\HarddiskVolume1\Windows\System32\msiexec.exe                                                                                                                       0x0F 0x53 0x3F 0xD5 ...
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v4.0.30319/clr.dll@\Device\HarddiskVolume1\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe                                                                                                0xAB 0x90 0x0C 0x83 ...
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v4.0.30319/clr.dll@\Device\HarddiskVolume1\Windows\System32\CompatTelRunner.exe                                                                                                               0xF7 0xF6 0x9E 0xB2 ...
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\System\Active                                                                                                                                                                                                                
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\System\Active@A2824A80                                                                                                                                                                                                       49

---- EOF - GMER 2.1 ----

 

 

Сообщение от модератора Mark D. Pearlstone
Отчёт спрятан под спойлер

 
Ссылка на комментарий
Поделиться на другие сайты

Пожалуйста, войдите, чтобы комментировать

Вы сможете оставить комментарий после входа в



Войти
 Поделиться
Перейти к списку тем

  • Похожий контент

    • Даниил.Б
      Проблемы с компьютером, зависает и перезагружается после установки нового SSD M2
      Автор Даниил.Б
      Купил новый SSD m2 kingston fury 1tb, поставил во второй слот на материнке, включаю, начались фризы. Виндовс может зависнуть и перезагрузить, либо просто зависнуть и черный экран. Иногда бывает, что включается, пользоваться можно но с фризами. Вытащил этот SSD, все так же осталось.

      Вытащил все диски кроме винды. Ставил все диски по очереди в разных комбинациях и в разные слоты. Дергал оперативку. Поставил новую винду 11, пробовал ставить на старый M2 и на новый M2. (НИЧЕГО ИЗ ЭТОГО НЕ ПОМОГЛО)

      В диспетчере все работает стабильно без скачков нагрева/перегрева и т.д.

      Компьютеру год, всё работало стабильно, в биосе только поднимал частоту оперативки с 4800 до 6000 при заявленной производителем 6400.

      В интернете тупо ничего про эту проблему.

      Материнская плата:MSI B760 gaming plus Wi-Fi

      Процессор: intel i7 12700kf

      Оперативная память: Gskill DDR5 32 6400 MHz

      Видеокарта: Gigabyte RTX 4060TI

      Накопители (HDD/SDD): HDD 1tb, SSD Samsung 250, MSI SSD m2 500, Kingston fury SSD m2 1tb

      Блок питания: gamemax 850 pro

      Сис-ма охлаждения: deep cool ag620 argb
    • Technician6
      Не переносятся компьютеры в группу.
      Автор Technician6
      Имеем корп сервер KSC14 - компьютеры видны, но в управляемых, когда переносишь их в нужную группу, они просто не переносятся и вываливается ошибка как на скрине.

       
      ни через веб интерфейс ни через консоль не переносится. Вопрос, как исправить?
    • Reshat
      Зашифровали компьютер
      Автор Reshat
      Добрый день!Зашифровали компьютер с файлами пишут:
      Hello my dear friend (Do not scan the files with antivirus in any case. In case of data loss, the consequences are yours)
      Your data is encrypted by KOZANOSTRA
      Your decryption ID is <ID>*KOZANOSTRA-<ID>
      Unfortunately for you, a major IT security weakness left you open to attack, your files have been encrypted
      The only method of recovering files is to purchase decrypt tool and unique key for you.
      If you want to recover your files, write us
      1) eMail - vancureez@tuta.io
      2) Telegram - @DataSupport911 or https://t.me/DataSupport911
      Attention!
      Do not rename encrypted files. 
      Do not try to decrypt your data using third party software - it may cause permanent data loss. 
      We are always ready to cooperate and find the best way to solve your problem. 
      The faster you write - the more favorable conditions will be for you. 
      Our company values its reputation. We give all guarantees of your files decryption.
       
      Файлы скана прикрепляю к сообщению.
      Addition.txt FRST.txt
    • 4tetree
      Зашифровали компьютер
      Автор 4tetree
      Добрый день!Зашифровали компьютер с файлами пишут:
       
      ссылка удалена ссылка на скачивание двух зараженных файлов
    • Jacket45
      При запуске компьютера и браузера самостоятельно скачивается ablock
      Автор Jacket45
      Проблему заметил вчера, в истории ютуба появились видео, которые я никогда не смотрел с 22 июня. Проверил пк drweb-ом, выявил один троян-удалил, поменял пароли, удалил устройство Android с Бангладеша. На протяжении около недели после запуска браузера он закрывался, сегодня заметил что он после закрытия устанавливал adblock, который я удалял. Проверил компьютер drweb-ом, на этот раз ничего не было выявлено. Не уверен что это будет полезно, но уже около полугода у меня запускалось окно cmd.exe и писало что программа успешно запущена. Антивирусники на постоянке никакие не включены, только скачиваю периодически бесплатный разовый drweb. 
      CollectionLog-2025.07.09-11.57.zip
×
×
  • Создать...