Странен проблем при XP ?!

[Иван Атанасов]

Разбрах, че не е вирус когато пуснах AV-ите да сканират, но за това което си написал от регистрите ще проверя и ще тествам по-късно защото в момента не съм у нас. Благодаря за съвета все пак, а резултата после

[лтрифонов]

Здравейте,
това което е показано на 1-вия пост, е някакъв дъмп на уиндоуса, със информация за работещи процеси.
текста е base64 decoded. (съставен е от текст със точно 64 символа на всеки ред)

разкодиране може да се направи и онлайн например от този сайт


при разкодирането се получи това:

Version: UUJdQ1BTVltETUNHQysoOSc5BwA6JT8+LW97Z2NrMCEjPyMkM0FxeHB0ZXM5
ImageBase: 07A30000
Eip: 659CEB0
Eax: 44B0000
Ecx: 0
Edx: 3D5A720
Ebx: 0
Esi: 65E7390
Edi: 3D30000
Ebp: 564E64C
Esp: 564E520
-1
Code = [204]
- 0
- 204
- 227
- 0
- []
> C:\WINDOWS\Explorer.EXE
> C:\WINDOWS\system32\ntdll.dll
> C:\WINDOWS\system32\kernel32.dll
> C:\WINDOWS\system32\ADVAPI32.dll
> C:\WINDOWS\system32\RPCRT4.dll
> C:\WINDOWS\system32\Secur32.dll
> C:\WINDOWS\system32\BROWSEUI.dll
> C:\WINDOWS\system32\GDI32.dll
> C:\WINDOWS\system32\USER32.dll
> C:\WINDOWS\system32\msvcrt.dll
> C:\WINDOWS\system32\ole32.dll
> C:\WINDOWS\system32\SHLWAPI.dll
> C:\WINDOWS\system32\OLEAUT32.dll
> C:\WINDOWS\system32\SHDOCVW.dll
> C:\WINDOWS\system32\CRYPT32.dll
> C:\WINDOWS\system32\MSASN1.dll
> C:\WINDOWS\system32\CRYPTUI.dll
> C:\WINDOWS\system32\NETAPI32.dll
> C:\WINDOWS\system32\VERSION.dll
> C:\WINDOWS\system32\WININET.dll
> C:\WINDOWS\system32\Normaliz.dll
> C:\WINDOWS\system32\urlmon.dll
> C:\WINDOWS\system32\iertutil.dll
> C:\WINDOWS\system32\WINTRUST.dll
> C:\WINDOWS\system32\IMAGEHLP.dll
> C:\WINDOWS\system32\WLDAP32.dll
> C:\WINDOWS\system32\SHELL32.dll
> C:\WINDOWS\system32\UxTheme.dll
> C:\WINDOWS\system32\ShimEng.dll
> C:\WINDOWS\AppPatch\AcGenral.DLL
> C:\WINDOWS\system32\WINMM.dll
> C:\WINDOWS\system32\MSACM32.dll
> C:\WINDOWS\system32\USERENV.dll
> C:\WINDOWS\system32\IMM32.DLL
> C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
> C:\WINDOWS\system32\comctl32.dll
> C:\WINDOWS\system32\msctfime.ime
> C:\WINDOWS\system32\appHelp.dll
> C:\WINDOWS\system32\CLBCATQ.DLL
> C:\WINDOWS\system32\COMRes.dll
> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
> C:\Program Files\Microsoft Office\Office12\GrooveUtil.DLL
> C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
> C:\Program Files\Microsoft Office\Office12\GrooveNew.DLL
> C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_473666fd\ATL80.DLL
> C:\WINDOWS\system32\rsaenh.dll
> C:\WINDOWS\system32\MSImg32.dll
> C:\WINDOWS\System32\cscui.dll
> C:\WINDOWS\System32\CSCDLL.dll
> C:\WINDOWS\system32\themeui.dll
> C:\WINDOWS\system32\xpsp2res.dll
> C:\WINDOWS\system32\msutb.dll
> C:\WINDOWS\system32\MSCTF.dll
> C:\WINDOWS\system32\SAMLIB.dll
> C:\WINDOWS\system32\LINKINFO.dll
> C:\WINDOWS\system32\ntshrui.dll
> C:\WINDOWS\system32\ATL.DLL
> C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
> C:\WINDOWS\system32\msxml3.dll
> C:\WINDOWS\system32\ieframe.dll
> C:\WINDOWS\system32\MLANG.dll
> C:\WINDOWS\system32\SETUPAPI.dll
> C:\WINDOWS\system32\msi.dll
> C:\WINDOWS\system32\NETSHELL.dll
> C:\WINDOWS\system32\credui.dll
> C:\WINDOWS\system32\dot3api.dll
> C:\WINDOWS\system32\rtutils.dll
> C:\WINDOWS\system32\dot3dlg.dll
> C:\WINDOWS\system32\OneX.DLL
> C:\WINDOWS\system32\WTSAPI32.dll
> C:\WINDOWS\system32\WINSTA.dll
> C:\WINDOWS\system32\eappcfg.dll
> C:\WINDOWS\system32\MSVCP60.dll
> C:\WINDOWS\system32\eappprxy.dll
> C:\WINDOWS\system32\iphlpapi.dll
> C:\WINDOWS\system32\WS2_32.dll
> C:\WINDOWS\system32\WS2HELP.dll
> C:\Program Files\Microsoft Office\Office12\GrooveMisc.dll
> C:\WINDOWS\system32\webcheck.dll
> C:\WINDOWS\system32\stobject.dll
> C:\WINDOWS\system32\BatMeter.dll
> C:\WINDOWS\system32\POWRPROF.dll
> C:\WINDOWS\system32\WPDShServiceObj.dll
> C:\WINDOWS\system32\WINHTTP.dll
> C:\WINDOWS\system32\mydocs.dll
> C:\WINDOWS\system32\PortableDeviceTypes.dll
> C:\WINDOWS\system32\PortableDeviceApi.dll
> C:\WINDOWS\system32\wdmaud.drv
> C:\WINDOWS\system32\msacm32.drv
> C:\WINDOWS\system32\midimap.dll
> C:\Program Files\WinRAR\rarext.dll

3.93.0.0
3.93.0.0

> C:\Program Files\ESET\ESET NOD32 An****rus\shellExt.dll

ESET
Shell Extension
4.2.64.12
shellExt.dll
Copyright (c) ESET 1992-2010. All rights reserved.
NOD, NOD32, AMON, ESET are registered trademarks of ESET.
shellExt.dll
4.2.64.12
ESET Smart Security

> C:\WINDOWS\system32\MPR.dll
> C:\WINDOWS\system32\WZCSAPI.DLL
> C:\WINDOWS\System32\drprov.dll
> C:\WINDOWS\System32\ntlanman.dll
> C:\WINDOWS\System32\NETUI0.dll
> C:\WINDOWS\System32\NETUI1.dll
> C:\WINDOWS\System32\NETRAP.dll
> C:\WINDOWS\System32\davclnt.dll
> C:\WINDOWS\system32\usbui.dll
> C:\Program Files\Microsoft Office\Office12\1033\GrooveIntlResource.dll
> C:\WINDOWS\system32\browselc.dll
> C:\WINDOWS\system32\MSFTEDIT.DLL
> C:\WINDOWS\system32\DUSER.dll
> C:\WINDOWS\system32\MSGINA.dll
> C:\WINDOWS\system32\ODBC32.dll
> C:\WINDOWS\system32\comdlg32.dll
> C:\WINDOWS\system32\odbcint.dll
> C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\gdiplus.dll
> C:\WINDOWS\system32\SXS.DLL
> C:\WINDOWS\system32\wmvcore.dll
> C:\WINDOWS\system32\WMASF.DLL
> C:\WINDOWS\system32\msdmo.dll

6.5.2600.5512
6.5.2600.5512

> C:\WINDOWS\system32\WINSPOOL.DRV
> C:\WINDOWS\system32\mscms.dll
> C:\WINDOWS\system32\NTMARTA.DLL
> C:\WINDOWS\system32\shdoclc.dll
> C:\WINDOWS\system32\icm32.dll

Microsoft Corporation
Microsoft Color Management Module (CMM)
5.1.2600.5512 (xpsp.080413-2105)
ICM32.DLL
Copyright ©1995-1997 Heidelberger Druckmaschinen AG
ICM32.DLL
5.1.2600.5512
Microsoft® Windows® Operating System

> C:\WINDOWS\system32\xpsp1res.dll
> C:\WINDOWS\system32\MFPlat.DLL
> C:\WINDOWS\system32\perfos.dll
> C:\WINDOWS\system32\wzcdlg.dll
> C:\WINDOWS\system32\xpsp3res.dll
> C:\WINDOWS\System32\xmlprovi.dll
> C:\WINDOWS\system32\msieftp.dll
> C:\WINDOWS\system32\RASAPI32.dll
> C:\WINDOWS\system32\rasman.dll
> C:\WINDOWS\system32\TAPI32.dll
> C:\WINDOWS\system32\msv1_0.dll
> C:\WINDOWS\system32\cryptdll.dll
> C:\WINDOWS\system32\sensapi.dll
> C:\WINDOWS\System32\mswsock.dll
> C:\WINDOWS\system32\DNSAPI.dll
> C:\WINDOWS\system32\rasadhlp.dll
> C:\WINDOWS\system32\hnetcfg.dll
> C:\WINDOWS\System32\wshtcpip.dll
> C:\WINDOWS\system32\pstorec.dll
> C:\WINDOWS\system32\shimgvw.dll
> C:\WINDOWS\system32\dxmasf.dll

6.4.9.1133
6.4.9.1133

> C:\WINDOWS\system32\DRMClien.DLL
> C:\WINDOWS\system32\RASDLG.dll
> C:\WINDOWS\system32\MPRAPI.dll
> C:\WINDOWS\system32\ACTIVEDS.dll
> C:\WINDOWS\system32\adsldpc.dll
> C:\WINDOWS\system32\netman.dll
> C:\WINDOWS\system32\WZCSvc.DLL
> C:\WINDOWS\system32\WMI.dll
> C:\WINDOWS\system32\DHCPCSVC.DLL
> C:\WINDOWS\system32\EapolQec.dll
> C:\WINDOWS\system32\QUtil.dll
> C:\WINDOWS\system32\ESENT.dll
> C:\WINDOWS\system32\Cabinet.dll
> C:\WINDOWS\system32\actxprxy.dll
> C:\Program Files\Microsoft Office\Office12\msohevi.dll
> C:\Program Files\Common Files\Microsoft Shared\OFFICE11\msxml5.dll
> C:\WINDOWS\system32\wmpshell.dll
> C:\WINDOWS\system32\shmedia.dll
> C:\WINDOWS\system32\MSVFW32.dll
> C:\WINDOWS\system32\AVIFIL32.dll
> C:\WINDOWS\system32\qedit.dll

6.5.2600.5512
6.5.2600.5512

> C:\WINDOWS\system32\quartz.dll

6.5.2600.5933
6.5.2600.5933

> C:\WINDOWS\system32\devenum.dll

6.5.2600.5512
6.5.2600.5512

> C:\Program Files\K-Lite Codec Pack\Filters\vsfilter.dll

Gabest
VobSub & TextSub filter for DirectShow/VirtualDub/Avisynth
2, 39, 5, 3
VSFilter
Copyright (C) 2001-2009 Gabest et. al.
VSFilter.DLL
2, 39, 5, 3
VSFilter

> C:\WINDOWS\system32\wmpasf.dll
> C:\Program Files\K-Lite Codec Pack\Filters\MP4Splitter.ax
http://sourceforge.net/projects/mpc-hc/
MPC-HC Team
MP4 Splitter
1, 4, 2507, 0
MP4 Splitter
Copyright (C) 2002-2010 see AUTHORS file
MP4Splitter.ax
1, 4, 2507, 0
MP4 Splitter

> C:\PROGRA~1\TOTALV~1\RealMediaSplitter.ax
http://gabest.org/
Gabest
RealMedia Splitter
1, 0, 1, 1
RealMedia Splitter
Copyright (C) 2003-2006
RealMediaSplitter.ax
1, 0, 1, 1
RealMedia Splitter

> C:\WINDOWS\system32\mpg2splt.ax

6.5.2600.5512
6.5.2600.5512

> C:\Program Files\K-Lite Codec Pack\Filters\FLVSplitter.ax
http://sourceforge.net/projects/mpc-hc/
MPC-HC Team
FLV Splitter
1, 4, 2507, 0
FLV Splitter
Copyright (C) 2002-2010 see AUTHORS file
FLVSplitter.ax
1, 4, 2507, 0
FLV Splitter

> C:\WINDOWS\system32\strmdll.dll
> C:\WINDOWS\system32\WSOCK32.dll
> C:\Program Files\Common Files\Ahead\DSFilter\NeVideo.ax

Nero AG
MPEG-1/2/4 & AVC video decoder w/ DxVA
3, 2, 0, 15b
Copyright (c) 1995-2005 Nero AG and its licensors
NeVideo.ax
2, 0, 2, 41
Nero ShowTime

> C:\WINDOWS\system32\ddraw.dll
> C:\WINDOWS\system32\DCIMAN32.dll

[Иван Атанасов]

Мерси за инфорамцията. Изобщо не ми е и минало през главата, че може да е кодиран в base64 текст, но за направед при появата на странен текст ще си имам едно на ум. Иначе въпросния дъмп сега престана да се появява, но както е тръгнало ще се наложи да пробвам да сложа една седмица, ако изобщо я подкара този слаб компютър.
Благодаря за мненията е помощта