MyCity » Ambulanta -> Arhiva Ambulante » Hidden & system neizbrisivi fajl gde mu nije mesto

Hidden & system neizbrisivi fajl gde mu nije mesto

Napisano na dan: 10.8.2008

Hidden & system neizbrisivi fajl gde mu nije mesto
Sledeća strana Pagination

Idi na vrh

Poslao: 10 Avg 2008 14:46
Idi na vrh
offline
  • Pridružio: 10 Okt 2005
  • Poruke: 13526
  • Gde živiš: Beograd

U folderu koji sam ja kreirao, i koji mi služi za download, nalazi se fajl koji ne mogu da obrišem, a ima atribute hidden i system.

Win je XP sa SP2, ADSL 512 konekcija.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:40:28, on 10-Aug-08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Sloba\Desktop\New Folder\TR3.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = [Link mogu videti samo ulogovani korisnici]
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - C:\Program Files\Desktop Sidebar\sbhelp.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {C2A1C5CB-C0EF-4689-9436-F62CCA1C5383} - (no file)
O3 - Toolbar: (no name) - {81705D67-3F73-4983-859B-97D0922E5ABE} - (no file)
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Total Commander.lnk = C:\Program Files\Total Commander\Totalcmd.exe
O8 - Extra context menu item: &Download by Orbit - [Link mogu videti samo ulogovani korisnici]\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - [Link mogu videti samo ulogovani korisnici]\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - [Link mogu videti samo ulogovani korisnici]\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - [Link mogu videti samo ulogovani korisnici]\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Prevedi sa Di recnikom - C:\Program Files\Di recnik\diie.htm
O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Program Files\Desktop Sidebar\sbhelp.dll
O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Program Files\Desktop Sidebar\sbhelp.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - [Link mogu videti samo ulogovani korisnici] (file missing)
O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - [Link mogu videti samo ulogovani korisnici] (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Ad-Aware 2007\aawservice.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 6346 bytes



Poslao: 10 Avg 2008 15:00
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Poz...


Citat:U folderu koji sam ja kreirao, i koji mi služi za download, nalazi se fajl koji ne mogu da obrišem, a ima atribute hidden i system.

Lokacija/naziv file-a je?


Da li je to jedini problem?



Poslao: 10 Avg 2008 15:07
Idi na vrh
offline
  • Pridružio: 10 Okt 2005
  • Poruke: 13526
  • Gde živiš: Beograd

Lokacija i ime fajla:
c:\Documents and Settings\Sloba\My Documents\Downloads\On my way to...

Jedini problem koji ja primećujem je što ne mogu da ga obrišem. Commander mi kaže "not found", a ja ga vidim. Zato i sumnjam na neku infekciju.

Poslao: 10 Avg 2008 15:33
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Uhh... Zašto mi se čini da znam odakle taj file tu?



Postoje ovde i neki tragovi malware-a - uklonićemo to i usput i problematični file.

Isprazni iz tog Downloads foldera sve što ti je bitno, pošto ćemo ga kompletnog obrisati...


Skini ComboFix sa jedne od sledecih adresa na Desktop:
[Link mogu videti samo ulogovani korisnici]
[Link mogu videti samo ulogovani korisnici]
[Link mogu videti samo ulogovani korisnici]

Startuj ga i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu. Kada zavrsi pojavice se log (C:\ComboFix.txt) koji ces nam ovde iskopirati.

Poslao: 11 Avg 2008 01:36
Idi na vrh
offline
  • Pridružio: 10 Okt 2005
  • Poruke: 13526
  • Gde živiš: Beograd

Prvo, izvinjavam se što nisam ranije odgovorio na uputstva, zezao je Telekomov ADSL celo popodne.
A sad, evo teksta:

ComboFix 08-08-10.02 - Sloba 2008-08-11 1:19:32.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.431 [GMT 2:00]
Running from: C:\Documents and Settings\Sloba\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DVD 2\Util\TC Install\Desktop_.ini
.
---- Previous Run -------
.
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.url
C:\Documents and Settings\All Users\Start Menu\Security Troubleshooting.url
C:\WINDOWS\system32\eWebControl.dll
C:\WINDOWS\system32\redirect.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Service_NPF


((((((((((((((((((((((((( Files Created from 2008-07-10 to 2008-08-10 )))))))))))))))))))))))))))))))
.

2008-08-10 15:25 . 2008-08-10 15:26 <DIR> d-------- C:\WINDOWS\system32\Adobe
2008-08-10 14:55 . 2008-08-10 14:55 <DIR> d-------- C:\Program Files\Common Files\SWF Studio
2008-08-10 14:55 . 2008-08-11 00:44 45,056 --a------ C:\WINDOWS\NCUNINST.EXE
2008-08-10 13:23 . 2008-08-10 23:59 <DIR> d-------- C:\Flash Games
2008-08-10 12:45 . 2008-08-10 13:20 <DIR> d-------- C:\Documents and Settings\Sloba\Application Data\Eltima Software
2008-08-10 12:39 . 2008-08-10 12:39 <DIR> d--h----- C:\Documents and Settings\Sloba\Application Data\IFViewer
2008-08-10 12:39 . 2008-08-10 12:39 <DIR> d--h----- C:\Documents and Settings\Sloba\Application Data\FVSTemp
2008-08-10 12:38 . 2008-08-10 13:17 <DIR> d-------- C:\Program Files\Flash EXE Builder 1.0
2008-08-09 23:43 . 1998-06-24 00:00 198,456 --a------ C:\WINDOWS\system32\MCI32.OCX
2008-08-09 23:37 . 2008-08-09 23:37 10 --a------ C:\WINDOWS\popcinfo.dat
2008-08-08 23:15 . 2008-08-08 23:16 <DIR> d-------- C:\Program Files\911 CD Builder
2008-08-08 02:38 . 2008-06-29 14:15 109,333 --a------ C:\Temp\Favorites20.06.2008.zip
2008-08-07 13:55 . 2008-08-07 14:44 <DIR> d-------- C:\Documents and Settings\Sloba\Application Data\CDRoller
2008-08-06 22:04 . 2008-08-06 22:04 <DIR> d-------- C:\XHME3DCD
2008-08-05 22:27 . 2008-08-05 22:32 <DIR> d-------- C:\Program Files\FreeCommander
2008-08-05 16:40 . 2008-08-05 16:40 <DIR> d-------- C:\Documents and Settings\Sale
2008-08-02 22:21 . 2003-05-29 12:52 53,760 --------- C:\WINDOWS\uninstyler.exe
2008-08-02 21:35 . 2008-08-02 21:44 <DIR> d-------- C:\Program Files\World Atlas
2008-08-02 21:18 . 2008-08-02 21:18 1,409 --a------ C:\WINDOWS\mostxser.for
2008-08-02 21:18 . 2008-08-02 21:18 1,409 --a------ C:\WINDOWS\mostx.for
2008-08-02 21:18 . 2008-08-02 21:18 1,409 --a------ C:\WINDOWS\mostserf.for
2008-08-02 21:18 . 2008-08-02 21:18 1,409 --a------ C:\WINDOWS\most.for
2008-08-02 21:18 . 2008-08-02 21:18 1,409 --a------ C:\WINDOWS\lgot.for
2008-08-02 21:18 . 2008-08-02 21:18 1,409 --a------ C:\WINDOWS\cyrillic.for
2008-08-02 15:32 . 2008-08-02 15:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\3DWA_L
2008-08-02 00:46 . 2008-07-22 20:46 <DIR> d-------- C:\Documents and Settings\Sloba\Mosby's Medical Encyclopedia
2008-08-01 21:47 . 2008-08-03 13:41 <DIR> d-------- C:\Program Files\Multimedia
2008-08-01 19:39 . 2008-08-02 12:11 <DIR> d-a------ C:\Monitor Test
2008-07-31 22:00 . 2008-07-31 22:00 55,808 --a------ C:\WINDOWS\system32\DevCon.exe
2008-07-31 22:00 . 2008-07-31 22:00 24,576 --a------ C:\WINDOWS\NOCLOSE.PIF
2008-07-31 22:00 . 2008-07-31 22:00 545 --a------ C:\WINDOWS\UC.PIF
2008-07-31 22:00 . 2008-07-31 22:00 545 --a------ C:\WINDOWS\RAR.PIF
2008-07-31 22:00 . 2008-07-31 22:00 545 --a------ C:\WINDOWS\PKZIP.PIF
2008-07-31 22:00 . 2008-07-31 22:00 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2008-07-31 22:00 . 2008-07-31 22:00 545 --a------ C:\WINDOWS\LHA.PIF
2008-07-31 22:00 . 2008-07-31 22:00 545 --a------ C:\WINDOWS\ARJ.PIF
2008-07-30 22:52 . 2008-07-30 22:52 0 --a------ C:\WINDOWS\BeoINFO.INI
2008-07-30 22:41 . 2008-07-31 00:49 <DIR> d-------- C:\Program Files\BeoINFO
2008-07-30 22:41 . 1996-12-16 18:30 1,039,360 -ra------ C:\WINDOWS\system32\msjet35.dll
2008-07-30 22:41 . 1999-10-26 23:00 929,844 --a------ C:\WINDOWS\system32\Mfc42d.dll
2008-07-30 22:41 . 1999-10-26 23:00 798,773 --a------ C:\WINDOWS\system32\Mfco42d.dll
2008-07-30 22:41 . 2000-03-06 23:00 434,252 --a------ C:\WINDOWS\system32\Msvcrtd.dll
2008-07-30 22:41 . 1999-10-26 23:00 274,485 --a------ C:\WINDOWS\system32\Mfcd42d.dll
2008-07-30 22:41 . 1996-12-02 18:44 251,664 -ra------ C:\WINDOWS\system32\msrd2x35.dll
2008-07-30 22:41 . 1997-01-13 17:18 37,136 -ra------ C:\WINDOWS\system32\msjint35.dll
2008-07-30 22:41 . 1996-12-02 18:44 24,336 -ra------ C:\WINDOWS\system32\msjter35.dll
2008-07-30 18:16 . 2008-07-30 18:16 76,043 --a------ C:\Norton Removal Tool.pdf
2008-07-24 01:40 . 2008-07-24 23:36 <DIR> d-------- C:\Program Files\PE Explorer
2008-07-24 01:40 . 2008-07-24 01:40 <DIR> d-------- C:\Documents and Settings\Sloba\Application Data\PE Explorer
2008-07-21 01:01 . 2008-07-21 01:01 2,568,242 --a------ C:\Booklet.pdf
2008-07-18 01:00 . 2008-07-18 01:00 <DIR> d-------- C:\Documents and Settings\Sloba\.thumbnails
2008-07-16 21:32 . 2008-07-16 21:32 <DIR> d-------- C:\Program Files\Any Password
2008-07-12 23:12 . 2008-07-12 23:12 41 --a------ C:\WINDOWS\KWSW98.DAT
2008-07-11 20:32 . 2008-08-11 01:25 10,328,096 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-07-11 20:32 . 2008-08-11 01:11 123,956 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-07-11 20:28 . 2008-07-11 20:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-10 23:13 6,201,400 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2008-08-10 12:56 1,388,544 ----a-w C:\WINDOWS\system32\MSVBVM60.DLL
2008-08-10 11:02 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-10 10:43 --------- d-----w C:\Program Files\TC UP
2008-08-08 13:02 --------- d-----w C:\Documents and Settings\Sloba\Application Data\Orbit
2008-08-07 13:07 --------- d-----w C:\Documents and Settings\Sloba\Application Data\Desktop Sidebar
2008-08-06 19:42 --------- d-----w C:\Documents and Settings\Sloba\Application Data\uTorrent
2008-08-06 10:41 --------- d-----w C:\Program Files\Microsoft Virtual PC
2008-08-06 09:23 --------- d-----w C:\Program Files\Windows Tools
2008-08-02 19:43 2,828 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2008-08-02 12:36 --------- d-----w C:\Documents and Settings\Sloba\Application Data\XnView
2008-08-02 12:00 --------- d-----w C:\Program Files\PhotoScape
2008-07-30 22:52 --------- d-----w C:\Program Files\Graphic
2008-07-30 22:43 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-07-30 20:41 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-27 19:53 --------- d-----w C:\Documents and Settings\Sloba\Application Data\Winamp
2008-07-27 18:30 --------- d-----w C:\Program Files\Di recnik
2008-07-21 15:38 --------- d-----w C:\Program Files\Internet Tools
2008-07-20 22:24 --------- d-----w C:\Program Files\CD Tools
2008-07-17 23:55 --------- d-----w C:\Program Files\Players
2008-07-15 16:02 537,088 ----a-w C:\WINDOWS\Internet Logs\xDB6.tmp
2008-07-09 21:06 --------- d-----w C:\Program Files\intocartoonpro
2008-07-09 21:01 --------- d-----w C:\Documents and Settings\Sloba\Application Data\Real Desktop
2008-07-09 19:16 --------- d-----w C:\Program Files\WinHTTrack
2008-07-09 19:02 51,712 ----a-w C:\WINDOWS\wc98pp.dll
2008-07-09 07:05 75,248 ----a-w C:\WINDOWS\zllsputility.exe
2008-07-09 07:05 1,086,952 ----a-w C:\WINDOWS\system32\zpeng24.dll
2008-07-02 21:27 --------- d-----w C:\Program Files\Motherboard Monitor 5
2008-06-30 23:11 --------- d-----w C:\Program Files\Desktop Sidebar
2008-06-30 19:26 --------- d-----w C:\Program Files\TuneUp Utilities 2007
2008-06-30 19:26 --------- d-----w C:\Documents and Settings\Sloba\Application Data\TuneUp Software
2008-06-30 19:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-06-21 20:32 --------- d-----w C:\Program Files\ATI Technologies
2008-06-18 15:29 32,256 ----a-w C:\WINDOWS\system32\bbcap.dll
2008-06-18 15:29 3,584 ----a-w C:\WINDOWS\system32\bbchlp.dll
2008-06-18 15:27 --------- d-----w C:\Documents and Settings\Sloba\Application Data\Thinstall
2008-06-09 15:55 17,634,981 ----a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2008_06_09_17_53_07_full.dmp.zip
2008-05-25 19:10 2,521,088 ----a-w C:\WINDOWS\Internet Logs\xDB5.tmp
2008-05-07 15:13 2 --shatr C:\WINDOWS\winstart.bat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 13:24 167368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-17 22:42 266497]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 09:05 919016]
"Tweak UI"="TWEAKUI.CPL" [2000-06-18 15:03 106544 C:\WINDOWS\system32\tweakui.cpl]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:56 15360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyDocs"= 01000000
"NoSMMyPictures"= 01000000

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Di dictionary]
C:\Program Files\Di recnik [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-05-11 04:06 40048 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
--a------ 2006-01-02 16:41 45056 C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2004-08-12 22:10 339968 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
--a------ 2008-04-26 01:23 288576 C:\Program Files\DNA\btdna.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2005-08-11 16:30 249856 C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2005-08-11 16:30 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs---- 2008-01-28 12:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-06-14 19:32 132760 C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualDiskAutomount]
--a------ 2006-05-28 04:28 139264 C:\Program Files\TC UP\PLUGINS\wfx\VirtualDisk\VirtualDisk.wfx

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
-ra------ 2002-10-16 12:24 47104 C:\WINDOWS\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"C:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Windows Peer-to-Peer Grouping
"3540:UDP"= 3540:UDP:Peer Name Resolution Protocol (PNRP)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 VD_FileDisk;VD_FileDisk;C:\WINDOWS\system32\drivers\VD_FileDisk.sys [2006-01-13 15:00]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 00:56]
S0 Partizan;Partizan;C:\WINDOWS\system32\drivers\Partizan.sys []
S3 KS-959;Kingsun KS-959 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\KS-959.sys [2005-10-20 15:50]
S3 mpr_freader;MPR FileReader Driver;C:\DOCUME~1\Sloba\LOCALS~1\Temp\RarSFX0\mpr_freader.sys []
S3 p2pgasvc;Peer Networking Group Authentication;C:\WINDOWS\system32\svchost.exe [2004-08-04 00:56]
S3 p2pimsvc;Peer Networking Identity Manager;C:\WINDOWS\system32\svchost.exe [2004-08-04 00:56]
S3 p2psvc;Peer Networking;C:\WINDOWS\system32\svchost.exe [2004-08-04 00:56]
S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\system32\svchost.exe [2004-08-04 00:56]
S3 RegGuard;RegGuard;C:\WINDOWS\system32\Drivers\regguard.sys [2008-05-07 18:01]
S3 WEBNTACCESS;WEBNTACCESS;C:\WINDOWS\system32\NTACCESS.SYS [2008-04-13 11:21]
S3 Winpooch;Winpooch kernel spy;C:\Install\USB_swiss-army-knife\files\X-Winpooch_0.6.6_rev3\Bin\Winpooch\Winpooch.sys []

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder

2008-07-25 C:\WINDOWS\Tasks\1-Click Maintenance.job
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe [2007-08-02 19:35]
.
- - - - ORPHANS REMOVED - - - -

ShellExecuteHooks-{F552DDE6-2090-4bf4-B924-6141E87789A5} - (no file)
MSConfigStartUp-Adobe Photo Downloader - C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
MSConfigStartUp-EVEREST AutoStart - C:\Everest Ultimate Edition 4.50.1380 [Link mogu videti samo ulogovani korisnici]\everest.exe
MSConfigStartUp-WinampAgent - C:\Program Files\Winamp\winampa.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Sloba\Application Data\Mozilla\Firefox\Profiles\shvhjj1b.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - [Link mogu videti samo ulogovani korisnici]
FF -: plugin - C:\Program Files\DNA\plugins\npbtdna.dll


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2008-08-11 01:25:06
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-11 1:29:56
ComboFix-quarantined-files.txt 2008-08-10 23:29:49

Pre-Run: 4,850,319,360 bytes free
Post-Run: 4,822,392,832 bytes free

227

Poslao: 11 Avg 2008 16:46
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Upload-uj sledeći file na proveru: C:\WINDOWS\uninstyler.exe

preko ovog linka: [Link mogu videti samo ulogovani korisnici]


Jesi li ispraznio folder Downloads? Sada ćemo ga obrisati...


Otvoriti Notepad i iskopirati sledeci tekst:

Folder::
C:\Documents and Settings\Sloba\My Documents\Downloads

FileLook::
C:\WINDOWS\system32\DevCon.exe


Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

Poslao: 11 Avg 2008 22:21
Idi na vrh
offline
  • Pridružio: 10 Okt 2005
  • Poruke: 13526
  • Gde živiš: Beograd

Traženi fajl (C:\WINDOWS\uninstyler.exe) uploadovan.

Combofix log fajl :

ComboFix 08-08-10.02 - Sloba 2008-08-11 22:06:27.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.434 [GMT 2:00]
Running from: C:\Documents and Settings\Sloba\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Sloba\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\Documents and Settings\Sloba\My Documents\Downloads
C:\Documents and Settings\Sloba\My Documents\Downloads\On my way to school...

.
((((((((((((((((((((((((( Files Created from 2008-07-11 to 2008-08-11 )))))))))))))))))))))))))))))))
.

2008-08-11 21:50 . 2003-05-29 12:52 53,760 --a------ C:\uninstyler.exe
2008-08-10 15:25 . 2008-08-10 15:26 <DIR> d-------- C:\WINDOWS\system32\Adobe
2008-08-10 14:55 . 2008-08-10 14:55 <DIR> d-------- C:\Program Files\Common Files\SWF Studio
2008-08-10 14:55 . 2008-08-11 00:44 45,056 --a------ C:\WINDOWS\NCUNINST.EXE
2008-08-10 13:23 . 2008-08-10 23:59 <DIR> d-------- C:\Flash Games
2008-08-10 12:45 . 2008-08-10 13:20 <DIR> d-------- C:\Documents and Settings\Sloba\Application Data\Eltima Software
2008-08-10 12:39 . 2008-08-10 12:39 <DIR> d--h----- C:\Documents and Settings\Sloba\Application Data\IFViewer
2008-08-10 12:39 . 2008-08-10 12:39 <DIR> d--h----- C:\Documents and Settings\Sloba\Application Data\FVSTemp
2008-08-10 12:38 . 2008-08-10 13:17 <DIR> d-------- C:\Program Files\Flash EXE Builder 1.0
2008-08-09 23:43 . 1998-06-24 00:00 198,456 --a------ C:\WINDOWS\system32\MCI32.OCX
2008-08-09 23:37 . 2008-08-09 23:37 10 --a------ C:\WINDOWS\popcinfo.dat
2008-08-08 23:15 . 2008-08-08 23:16 <DIR> d-------- C:\Program Files\911 CD Builder
2008-08-08 02:38 . 2008-06-29 14:15 109,333 --a------ C:\Temp\Favorites20.06.2008.zip
2008-08-07 13:55 . 2008-08-07 14:44 <DIR> d-------- C:\Documents and Settings\Sloba\Application Data\CDRoller
2008-08-06 22:04 . 2008-08-06 22:04 <DIR> d-------- C:\XHME3DCD
2008-08-05 22:27 . 2008-08-05 22:32 <DIR> d-------- C:\Program Files\FreeCommander
2008-08-05 16:40 . 2008-08-05 16:40 <DIR> d-------- C:\Documents and Settings\Sale
2008-08-02 22:21 . 2003-05-29 12:52 53,760 --------- C:\WINDOWS\uninstyler.exe
2008-08-02 21:35 . 2008-08-02 21:44 <DIR> d-------- C:\Program Files\World Atlas
2008-08-02 21:18 . 2008-08-02 21:18 1,409 --a------ C:\WINDOWS\mostxser.for
2008-08-02 21:18 . 2008-08-02 21:18 1,409 --a------ C:\WINDOWS\mostx.for
2008-08-02 21:18 . 2008-08-02 21:18 1,409 --a------ C:\WINDOWS\mostserf.for
2008-08-02 21:18 . 2008-08-02 21:18 1,409 --a------ C:\WINDOWS\most.for
2008-08-02 21:18 . 2008-08-02 21:18 1,409 --a------ C:\WINDOWS\lgot.for
2008-08-02 21:18 . 2008-08-02 21:18 1,409 --a------ C:\WINDOWS\cyrillic.for
2008-08-02 15:32 . 2008-08-02 15:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\3DWA_L
2008-08-02 00:46 . 2008-07-22 20:46 <DIR> d-------- C:\Documents and Settings\Sloba\Mosby's Medical Encyclopedia
2008-08-01 21:47 . 2008-08-03 13:41 <DIR> d-------- C:\Program Files\Multimedia
2008-08-01 19:39 . 2008-08-02 12:11 <DIR> d-a------ C:\Monitor Test
2008-07-31 22:00 . 2008-07-31 22:00 55,808 --a------ C:\WINDOWS\system32\DevCon.exe
2008-07-31 22:00 . 2008-07-31 22:00 24,576 --a------ C:\WINDOWS\NOCLOSE.PIF
2008-07-31 22:00 . 2008-07-31 22:00 545 --a------ C:\WINDOWS\UC.PIF
2008-07-31 22:00 . 2008-07-31 22:00 545 --a------ C:\WINDOWS\RAR.PIF
2008-07-31 22:00 . 2008-07-31 22:00 545 --a------ C:\WINDOWS\PKZIP.PIF
2008-07-31 22:00 . 2008-07-31 22:00 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2008-07-31 22:00 . 2008-07-31 22:00 545 --a------ C:\WINDOWS\LHA.PIF
2008-07-31 22:00 . 2008-07-31 22:00 545 --a------ C:\WINDOWS\ARJ.PIF
2008-07-30 22:52 . 2008-07-30 22:52 0 --a------ C:\WINDOWS\BeoINFO.INI
2008-07-30 22:41 . 2008-07-31 00:49 <DIR> d-------- C:\Program Files\BeoINFO
2008-07-30 22:41 . 1996-12-16 18:30 1,039,360 -ra------ C:\WINDOWS\system32\msjet35.dll
2008-07-30 22:41 . 1999-10-26 23:00 929,844 --a------ C:\WINDOWS\system32\Mfc42d.dll
2008-07-30 22:41 . 1999-10-26 23:00 798,773 --a------ C:\WINDOWS\system32\Mfco42d.dll
2008-07-30 22:41 . 2000-03-06 23:00 434,252 --a------ C:\WINDOWS\system32\Msvcrtd.dll
2008-07-30 22:41 . 1999-10-26 23:00 274,485 --a------ C:\WINDOWS\system32\Mfcd42d.dll
2008-07-30 22:41 . 1996-12-02 18:44 251,664 -ra------ C:\WINDOWS\system32\msrd2x35.dll
2008-07-30 22:41 . 1997-01-13 17:18 37,136 -ra------ C:\WINDOWS\system32\msjint35.dll
2008-07-30 22:41 . 1996-12-02 18:44 24,336 -ra------ C:\WINDOWS\system32\msjter35.dll
2008-07-30 18:16 . 2008-07-30 18:16 76,043 --a------ C:\Norton Removal Tool.pdf
2008-07-24 01:40 . 2008-07-24 23:36 <DIR> d-------- C:\Program Files\PE Explorer
2008-07-24 01:40 . 2008-07-24 01:40 <DIR> d-------- C:\Documents and Settings\Sloba\Application Data\PE Explorer
2008-07-21 01:01 . 2008-07-21 01:01 2,568,242 --a------ C:\Booklet.pdf
2008-07-18 01:00 . 2008-07-18 01:00 <DIR> d-------- C:\Documents and Settings\Sloba\.thumbnails
2008-07-16 21:32 . 2008-07-16 21:32 <DIR> d-------- C:\Program Files\Any Password
2008-07-12 23:12 . 2008-07-12 23:12 41 --a------ C:\WINDOWS\KWSW98.DAT
2008-07-11 20:32 . 2008-08-11 22:12 10,473,504 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-07-11 20:32 . 2008-08-11 21:59 125,660 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-07-11 20:28 . 2008-07-11 20:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-10 23:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-10 23:13 6,201,400 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2008-08-10 12:56 1,388,544 ----a-w C:\WINDOWS\system32\MSVBVM60.DLL
2008-08-10 11:02 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-10 10:43 --------- d-----w C:\Program Files\TC UP
2008-08-08 13:02 --------- d-----w C:\Documents and Settings\Sloba\Application Data\Orbit
2008-08-07 13:07 --------- d-----w C:\Documents and Settings\Sloba\Application Data\Desktop Sidebar
2008-08-06 19:42 --------- d-----w C:\Documents and Settings\Sloba\Application Data\uTorrent
2008-08-06 10:41 --------- d-----w C:\Program Files\Microsoft Virtual PC
2008-08-06 09:23 --------- d-----w C:\Program Files\Windows Tools
2008-08-02 19:43 2,828 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2008-08-02 12:36 --------- d-----w C:\Documents and Settings\Sloba\Application Data\XnView
2008-08-02 12:00 --------- d-----w C:\Program Files\PhotoScape
2008-07-30 22:52 --------- d-----w C:\Program Files\Graphic
2008-07-30 22:43 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-07-30 20:41 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-27 19:53 --------- d-----w C:\Documents and Settings\Sloba\Application Data\Winamp
2008-07-27 18:30 --------- d-----w C:\Program Files\Di recnik
2008-07-21 15:38 --------- d-----w C:\Program Files\Internet Tools
2008-07-20 22:24 --------- d-----w C:\Program Files\CD Tools
2008-07-17 23:55 --------- d-----w C:\Program Files\Players
2008-07-15 16:02 537,088 ----a-w C:\WINDOWS\Internet Logs\xDB6.tmp
2008-07-09 21:06 --------- d-----w C:\Program Files\intocartoonpro
2008-07-09 21:01 --------- d-----w C:\Documents and Settings\Sloba\Application Data\Real Desktop
2008-07-09 19:16 --------- d-----w C:\Program Files\WinHTTrack
2008-07-09 19:02 51,712 ----a-w C:\WINDOWS\wc98pp.dll
2008-07-09 07:05 75,248 ----a-w C:\WINDOWS\zllsputility.exe
2008-07-09 07:05 1,086,952 ----a-w C:\WINDOWS\system32\zpeng24.dll
2008-07-02 21:27 --------- d-----w C:\Program Files\Motherboard Monitor 5
2008-06-30 23:11 --------- d-----w C:\Program Files\Desktop Sidebar
2008-06-30 19:26 --------- d-----w C:\Program Files\TuneUp Utilities 2007
2008-06-30 19:26 --------- d-----w C:\Documents and Settings\Sloba\Application Data\TuneUp Software
2008-06-30 19:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-06-21 20:32 --------- d-----w C:\Program Files\ATI Technologies
2008-06-18 15:29 32,256 ----a-w C:\WINDOWS\system32\bbcap.dll
2008-06-18 15:29 3,584 ----a-w C:\WINDOWS\system32\bbchlp.dll
2008-06-18 15:27 --------- d-----w C:\Documents and Settings\Sloba\Application Data\Thinstall
2008-06-09 15:55 17,634,981 ----a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2008_06_09_17_53_07_full.dmp.zip
2008-05-25 19:10 2,521,088 ----a-w C:\WINDOWS\Internet Logs\xDB5.tmp
2008-05-07 15:13 2 --shatr C:\WINDOWS\winstart.bat
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.


---- C:\WINDOWS\system32\DevCon.exe ----
Company: Microsoft Corporation
File Description: Windows Setup API
File Version: 5.2.3718.0 (dnsrv.021114-1947)
Product Name: Microsoftr Windowsr Operating System
Copyright: c Microsoft Corporation. All rights reserved.
Original file name: SETUPAPI.DLL
MD5: c4b470269324517ee838789c7cf5e606


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 13:24 167368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-17 22:42 266497]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 09:05 919016]
"Tweak UI"="TWEAKUI.CPL" [2000-06-18 15:03 106544 C:\WINDOWS\system32\tweakui.cpl]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:56 15360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyDocs"= 01000000
"NoSMMyPictures"= 01000000

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Di dictionary]
C:\Program Files\Di recnik [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-05-11 04:06 40048 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
--a------ 2006-01-02 16:41 45056 C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2004-08-12 22:10 339968 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
--a------ 2008-04-26 01:23 288576 C:\Program Files\DNA\btdna.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2005-08-11 16:30 249856 C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2005-08-11 16:30 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs---- 2008-01-28 12:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-06-14 19:32 132760 C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualDiskAutomount]
--a------ 2006-05-28 04:28 139264 C:\Program Files\TC UP\PLUGINS\wfx\VirtualDisk\VirtualDisk.wfx

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
-ra------ 2002-10-16 12:24 47104 C:\WINDOWS\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"C:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Windows Peer-to-Peer Grouping
"3540:UDP"= 3540:UDP:Peer Name Resolution Protocol (PNRP)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 VD_FileDisk;VD_FileDisk;C:\WINDOWS\system32\drivers\VD_FileDisk.sys [2006-01-13 15:00]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 00:56]
S0 Partizan;Partizan;C:\WINDOWS\system32\drivers\Partizan.sys []
S3 KS-959;Kingsun KS-959 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\KS-959.sys [2005-10-20 15:50]
S3 mpr_freader;MPR FileReader Driver;C:\DOCUME~1\Sloba\LOCALS~1\Temp\RarSFX0\mpr_freader.sys []
S3 p2pgasvc;Peer Networking Group Authentication;C:\WINDOWS\system32\svchost.exe [2004-08-04 00:56]
S3 p2pimsvc;Peer Networking Identity Manager;C:\WINDOWS\system32\svchost.exe [2004-08-04 00:56]
S3 p2psvc;Peer Networking;C:\WINDOWS\system32\svchost.exe [2004-08-04 00:56]
S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\system32\svchost.exe [2004-08-04 00:56]
S3 RegGuard;RegGuard;C:\WINDOWS\system32\Drivers\regguard.sys [2008-05-07 18:01]
S3 WEBNTACCESS;WEBNTACCESS;C:\WINDOWS\system32\NTACCESS.SYS [2008-04-13 11:21]
S3 Winpooch;Winpooch kernel spy;C:\Install\USB_swiss-army-knife\files\X-Winpooch_0.6.6_rev3\Bin\Winpooch\Winpooch.sys []

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder

2008-07-25 C:\WINDOWS\Tasks\1-Click Maintenance.job
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe [2007-08-02 19:35]
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2008-08-11 22:11:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-11 22:16:59
ComboFix-quarantined-files.txt 2008-08-11 20:16:44
ComboFix2.txt 2008-08-10 23:29:58

Pre-Run: 5,901,832,192 bytes free
Post-Run: 5,871,812,608 bytes free

224

Poslao: 11 Avg 2008 22:46
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Ok, file je legitman a mi smo ovde gotovi.

Odradi još sledeće:


Klikni START a zatim RUN
U liniju za unos teksta ukucaj Combofix /u i klikni OK





Sačekaj da se proces deinstalacije završi
Gornja procedura će:
Obrisati sledeće:
ComboFix i njegove file-ove i foldere
VundoFix Backups folder, ako postoji
C:\Deckard folder, ako postoji
C:\OtMoveIt folder, ako postoji
Resetovati podešavanja sata na kompjuteru
Sakriti ekstenzije file-ova, ako je potrebno
Sakriti sistemske/skrivene file-ove/foldere, ako je potrebno
Resetovati System Restore

Poslao: 11 Avg 2008 22:52
Idi na vrh
offline
  • Pridružio: 10 Okt 2005
  • Poruke: 13526
  • Gde živiš: Beograd

Odrađeno sve po uputstvu.
Hvala onoliko na trudu, i pohvale za entuzijazam i poznavanje materije.

MyCity » Ambulanta -> Arhiva Ambulante » Hidden & system neizbrisivi fajl gde mu nije mesto

Ko je trenutno na forumu
 

Ukupno su 1047 korisnika na forumu :: 191 registrovanih, 16 sakrivenih i 840 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 15694 - dana 01 Feb 2026 12:23

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 015, 1MAP, A.R.Chafee.Jr., acov34, Alen-Delon-u-boji, alternator, Arhiv, Atomski čoban, Bane5, Bbbggg1979, Betta, bigbear, blue, Boban0312, bobo85, Borski1977, borya90, bounty hunters, brandža84, BSD, BZ, celt, chichabg, CrveniSolaris, cuvarkuca, dan, dane007, Darko Jovanovic, dejan1972, delboy, Denaya, Df410, djboj, djonsule, djordjemiklusev, DJUNTA, dnr, dolinalima, draganl, drimer, Duce, dusan.l, dushan, Dzigy, Electron, ElGenius, ElvisP, entriun, famoso, FileFinder, Fog of War, FOX, gagidjuric, GazdaDjoka, Georgius, Geran136, glisok, Grochow, Hardenberg, ILGromovnik, IQ116, ItsMarinko, ivan979, j-22orao, jalos, jodzula, JohnDoe, Jonbonjovi, Još malo pa deda, Kajzer Soze, Kajzer_Soze, kdor ma cajta, Kichma, Kobalt01, Koce, Koser, kovacicbozo, kozhedub, krasta, krca73, Kure126-7, kybonacci, lacko, Lance Guest, Lobo, Lotus, madza, Malahit, Marko Marković, marko.markovic, marsi, marsovac 2, MaschinenPistole, medaTT, mercedesamg, metallac777, micke83, Mig 29, Might is Right, Miki281, milanpb, Miler88, Milos ZA, Milos1987, Mićko, monomah, mrm, mrvica78, Mzee, Naum T, naunwzbn, Ne doznajem se u oružje, Nebojsa81, neko_drugi, NemanjaCG, nemkea71, Neutral, Njubara, Ns1975, nuke92, Obrenovic, Ognjen D., pablojepao, paja69, pein, Permaldar, Perudin_92, Pilence, Plavi1, Povratak1912, Prašinar, precan, Prečanin30, proka1ng, proka89, Pururin, PuškeiPlavuše, rambod, Razdroid, razumihin, royst33, sabros, Sale0501, Samo gledam, Sass Drake, Savantije, silikon, simicnenadbg, singa, Sinisa76, skylab1111, spektorsky, stalja, stefanmpurtic, stegonosa, strn, superwhy, t84dar, Tajpan, tamno.nebo, tmanda323, tomigun, toni061, travisrise, Trpe Grozni, tubular, Tumansky, ulogovan, Valter071, Vanderx, Veless, vladaa012, vladas87, VPV, vuksa72, vzd1389, wizzardone, xAlex2, zeka013, Zeljo980, ZetaMan, zil10, ZlatniRez, zmajbre, zokizemun, zule2, zvomar, zziko, |_MeD_|, Đak 22, 787