Dali mi je sistem zarazen ?

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Uloguj se preko Facebooka da bi skinuo fajl:

Dragi prijatelji,posto odavno nisam proveravao dali mi je sistem čist od kojekakve infekcije,pa bih vas zamolio za proveru istog,posto mi ponekada sistem malo zasteka,skenirao sam ja njega ali bez vas slaba vajda pa da ja vama prilozim fajlove

DDS (Ver_2012-10-14.05) - NTFS_x86
Internet Explorer: 8.0.6001.18702
Run by Administrator at 21:00:26 on 2012-10-14
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.429 [GMT 2:00]
.
AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Avira Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
============== Running Processes ================
.
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\VMSnap3.exe
C:\WINDOWS\RTHDCPL.EXE
C:\program files\real\realplayer\update\realsched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MCShield\mcshieldrtm.exe
C:\Program Files\McAfee Security Scan\3.0.207\SSScheduler.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\Skype\Updater\Updater.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Web Assistant\ExtensionUpdaterService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k bthsvcs
C:\WINDOWS\system32\svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://home.sweetim.com/?st=1&crg=3.1010000.10002&barid={0DC38FBA-F5FB-11E1-9D78-001D92472BC2}
uWindow Title = Internet Explorer, optimized for Bing and MSN
uSearch Page = hxxp://www.google.com
uDefault_Page_URL = about:blank
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://home.sweetim.com/?st=1&crg=3.1010000.10002&barid={0DC38FBA-F5FB-11E1-9D78-001D92472BC2}
mDefault_Page_URL = hxxp://www.yahoo.com
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: FastestTubeBHO Class: {3E532CE8-C6D9-4A10-8ACE-4348C96E8B6A} - c:\program files\fastesttube\2.0.0\WombatBHO.dll
BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [MCShield Monitor] c:\program files\mcshield\mcshieldrtm.exe
uRun: [Google Update] "c:\documents and settings\administrator\local settings\application data\google\update\GoogleUpdate.exe" /c
mRun: [KernelFaultCheck] c:\windows\system32\dumprep 0 -k
mRun: [VMSnap3] c:\windows\VMSnap3.exe
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\admini~1\startm~1\programs\startup\yahoo!~1.lnk - c:\program files\yahoo!\widgets\YahooWidgets.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\3.0.207\SSScheduler.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:255
uPolicies-Explorer: NoDriveAutoRun = dword:67108863
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
mPolicies-Explorer: NoDriveTypeAutoRun = dword:255
mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - <no file>
IE: Free YouTube to MP3 Converter - c:\documents and settings\administrator\application data\dvdvideosoftiehelpers\freeyoutubetomp3converter.htm
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
.
INFO: HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1317104157750
TCP: Interfaces\{3318030E-D9FE-4743-86EB-1FC99D49B8CB} : NameServer = 194.247.192.33,194.247.192.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
Notify: AtiExtEvent - Ati2evxx.dll
.
============= SERVICES / DRIVERS ===============
.
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [2012-8-9 36000]
R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\avira\antivir desktop\sched.exe [2012-9-2 86224]
R2 AntiVirService;Avira Realtime Protection;c:\program files\avira\antivir desktop\avguard.exe [2012-9-2 110032]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2012-9-2 83392]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [2012-1-7 12184]
R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2012-10-9 399432]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-10-9 676936]
R2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-7-13 160944]
R2 Web Assistant Updater;Web Assistant Updater;c:\program files\web assistant\ExtensionUpdaterService.exe [2012-8-24 188760]
R3 gMouPS2;PS2 Scroll Mouse Device;c:\windows\system32\drivers\gMouPS2.sys [2012-2-29 17408]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-10-9 22856]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2009-12-1 34384]
R3 vvftav303;vvftav303;c:\windows\system32\drivers\vvftav303.sys [2011-8-28 480128]
R3 ZSMC0303;A4 TECH PC Camera H;c:\windows\system32\drivers\usbVM303.sys [2011-8-28 1472768]
S0 DwProt;DrWeb Protection;c:\windows\system32\drivers\dwprot.sys --> c:\windows\system32\drivers\dwprot.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-9-29 136176]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-20 250808]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2011-8-28 1691480]
S3 DrvAgent32;DrvAgent32;c:\windows\system32\drivers\DrvAgent32.sys [2012-1-8 23456]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-9-29 136176]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\3.0.207\McCHSvc.exe [2011-6-17 237008]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys --> e:\NTGLM7X.sys [?]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2004-8-4 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
2012-10-09 19:05:51 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-10-09 19:05:51 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-10-09 18:09:12 601088 ----a-w- c:\windows\system32\SET39.tmp
2012-10-09 18:08:21 177664 ----a-w- c:\windows\system32\SET25.tmp
2012-10-09 04:07:55 -------- d-----w- c:\program files\Spybot - Search & Destroy
2012-09-29 15:47:47 -------- d-----r- c:\program files\Skype
2012-09-26 17:32:39 -------- d-----w- c:\documents and settings\administrator\local settings\application data\APN
2012-09-26 17:32:15 -------- d-----w- c:\program files\common files\DVDVideoSoft
.
==================== Find3M ====================
.
2012-10-09 04:01:51 23624 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2012-10-08 18:59:29 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-10-08 18:59:29 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-28 15:14:53 916992 ----a-w- c:\windows\system32\wininet.dll
2012-08-28 15:14:53 43520 ------w- c:\windows\system32\licmgr10.dll
2012-08-28 15:14:52 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-08-28 12:07:15 385024 ------w- c:\windows\system32\html.iec
2012-08-21 13:33:26 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-08-21 12:58:09 2027520 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-08-07 15:31:24 81984 ----a-w- c:\windows\system32\bdod.bin
2012-07-22 18:45:36 12872 ----a-w- c:\windows\system32\bootdelete.exe
2012-07-22 16:16:51 558133 ----a-w- c:\windows\system32\sqlite3.dll
2012-07-18 16:05:10 83392 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-07-18 16:05:10 36000 ----a-w- c:\windows\system32\drivers\avkmgr.sys
.
============= FINISH: 21:01:09.57 ===============


https://www.mycity.rs/must-login.png

https://www.mycity.rs/must-login.png

https://www.mycity.rs/must-login.png

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Da uradimo jednu provjeru:

Preimenuj dds.scr u dds.exe.

Ukoliko vidiš samo dds u imenu fajla, uradi sljedeće. Idi u Control Panel -> Folder Options -> View i deštrikliraj Hide extensions for known filetypes. Nakon toga bi trebao biti u mogućnosti da preimenuješ dds.scr u dds.exe.
Ukoliko ni tad ne uspiješ, obriši DDS koji si skinuo i skini novi sa sljedećeg linka:

DDS

Pokreni dds.exe. Dobićeš prozor prikazan na slici:



Klikni na Options for dds.txt i štrikliraj Force scan all domains. Nakon toga, klikni na Start i sačekaj da DDS napravi izvještaje.

Kada se završi pravljenje izvještaja, prikači dds.txt uz poruku.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Uloguj se preko Facebooka da bi skinuo fajl:

Citat: Idi u Control Panel -> Folder Options -> View i deštrikliraj Hide extensions for known filetypes. Ovo sam odradio evo izvestaj koji sam sada uradio
https://www.mycity.rs/must-login.png

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Pročitaj uputstvo koje sam ti napisao i isprati ga.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Uloguj se preko Facebooka da bi skinuo fajl:

Nadam se da sam sada uspeo :
https://www.mycity.rs/must-login.png

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

U postavljenim izvještajima nema tragova malware-a. Takođe vidim da si zaštitni softver deinstalirao sa Revo Uninstaller programom što je definitivno pogrešna praksa. Antivirusne programe deinstaliraj isključivo kroz Control Panel ili pomoću njihovog službenog alata sa deinstalaciju. Third-party programe za deinstalaciju nemoj korisititi za deinstalaciju AV programa.
Vidim da imaš i instaliran program DriverAgent. Ukoliko si sa njim instlairao drajvere postoji vjerovatnoća da je instalirao pogrešan drajver i da zbog toga imaš problem. U svakom slučaju, otvori temu u Winodws forumu i tamo iznesi svoj problem.

http://www.mycity.rs/Windows/

Prije toga, uradi sljedeće:





Imaš ostatke Dr.Web antivirusa. Preuzmi:

http://people.drweb.com/people/yudin/remover/drw_remover-x86.exe
Nakon toga ga pokreni i prati korake. Nakon što program završi restartuj računar.





Posjeti temu Testirajte da li vam je pretraživač ranjiv, pročitaj i isprati link koji stoji u njoj.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Citat:Imaš ostatke Dr.Web antivirusa. Preuzmi:

http://people.drweb.com/people/yudin/remover/drw_remover-x86.exe
Nakon toga ga pokreni i prati korake. Nakon što program završi restartuj računar.

Ovde nemam na ovom linku nista da skinem,mrtav link

• 1Ovo se svidja korisniku: njuskalo75
  
  Registruj se da bi pohvalio/la poruku!

ftp://ftp.drweb.com/pub/drweb/tools/drw_remover.exe

Probaj odavde da preuzmeš alat za deinstalaciju.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Napisano: 15 Okt 2012 17:24

Ovo zadnje sam sada uspeo da odradim i proverio sam ranjivost sistema i to je sada reseno.E sada sta me zanima,kako da uklonim ostatke antivirusa i ovaj DriverAgent.

Dopuna: 15 Okt 2012 17:27

DriverAgent sam sada u kontrol panelu deinstalirao dali je to sve sto se toga tice ili tu ima jos nesta u vezi njega ?

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

njuskalo75 ::Ovo zadnje sam sada uspeo da odradim i proverio sam ranjivost sistema i to je sada reseno.E sada sta me zanima,kako da uklonim ostatke antivirusa i ovaj DriverAgent.

DriverAgent deisntaliraš kroz Add or Remove Programs u Control Panelu, a ostatke Dr.Web-a očistiš pomoću lata za koji sam ti dao link.