MyCity » Ambulanta -> Arhiva Ambulante » Hitno potrebna pomoc

Hitno potrebna pomoc

Napisano na dan: 18.3.2009
1

Hitno potrebna pomoc
Sledeća strana Pagination

Idi na vrh

Poslao: 18 Mar 2009 12:20
Idi na vrh
offline
  • Pridružio: 28 Feb 2009
  • Poruke: 190
  • Gde živiš: Beograd

Koristim AVG i prijavio mi je prijavio sledece:
1)
File: C:\RECYCLER\S-1-5-21-1957994488-362288127-682003330-1003\Dc611.rar
Infection: Potentially harmful program RemoteAdmin.BX
Result: Potentially dangerous object

2)
File: C:\RECYCLER\S-1-5-21-195799488-362288127-682003330-1033\Dc611.rar:\Cryptload_1.1.6\Router\FRITZ!\Box\nc.exe
Infection: Potentially harmful program RemoteAdmin.BX
Result: Potentially dangerous object

Result overview:

spyware
found: 2
removed and healed: 0
not removed or healed: 2

Napominjem da mi je posle ovoga adsl konekcija drasticno opala.U proseku se kretala oko 1000/90 kb/s dok je sada samo 350/90 kb/s.

Sta bi trebao da uradim da bih resio ovaj problem?



Poslao: 18 Mar 2009 12:27
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje

Nov si na forumu, procitaj ovo
[Link mogu videti samo ulogovani korisnici]



Poslao: 18 Mar 2009 12:44
Idi na vrh
offline
  • Pridružio: 28 Feb 2009
  • Poruke: 190
  • Gde živiš: Beograd

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:39:01 PM, on 3/18/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AskBarDis\bar\bin\AskService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Raketa Krstarice\raketa-core.exe
C:\Program Files\Raketa Krstarice\raketa-veza.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Raketa Krstarice\raketa.exe
C:\PROGRA~1\Magentic\bin\MgApp.exe
C:\Program Files\IncrediMail\bin\ImApp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Eggiz\Meteo Fusion\Meteo Fusion.exe
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Milan\Desktop\Pomoc\TR3.exe..exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = [Link mogu videti samo ulogovani korisnici]
R3 - URLSearchHook: ToggleEN Toolbar - {038cb5c7-48ea-4af9-94e0-a1646542e62b} - C:\Program Files\ToggleEN\tbTog1.dll
O2 - BHO: ToggleEN Toolbar - {038cb5c7-48ea-4af9-94e0-a1646542e62b} - C:\Program Files\ToggleEN\tbTog1.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live pomagac za prijavljivanje - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: NOW!Imaging - {9AA2F14F-E956-44B8-8694-A5B615CDF341} - C:\Program Files\Raketa Krstarice\components\NOWImaging.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Raketa Krstarice - {8B79EE88-E62D-4AA8-B530-CC357BA112B7} - C:\Program Files\Raketa Krstarice\Toolband.dll
O3 - Toolbar: ToggleEN Toolbar - {038cb5c7-48ea-4af9-94e0-a1646542e62b} - C:\Program Files\ToggleEN\tbTog1.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SlipStream] "C:\Program Files\Raketa Krstarice\raketa-core.exe"
O4 - HKLM\..\Run: [Raketa-veza] C:\Program Files\Raketa Krstarice\raketa-veza.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S
O4 - HKCU\..\Run: [Magentic] C:\PROGRA~1\Magentic\bin\Magentic.exe /c
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Raketa Krstarice.lnk = C:\Program Files\Raketa Krstarice\raketa.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - [Link mogu videti samo ulogovani korisnici]
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - [Link mogu videti samo ulogovani korisnici]
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - [Link mogu videti samo ulogovani korisnici]
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: ASKService - Unknown owner - C:\Program Files\AskBarDis\bar\bin\AskService.exe
O23 - Service: ASKUpgrade - Unknown owner - C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Google Update Service (gupdate1c98d25e3423983) (gupdate1c98d25e3423983) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 8670 bytes

Poslao: 18 Mar 2009 13:00
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje


Pokrenite Spybot S&D
Kliknite Mode stavku u meniju
Odaberite Advance Mode
Na traci levo kliknite na Tools
Kliknite na Resident
Destiklirajte Resident Tea-Timer
Zatvorite Spybot S&D
Restartujte kompjuter.
- Zatim skinuti program sa ovog linka na Desktop.
- Pokrenuti ga dvoklikom i ispratiti uputstva.

Nemojte zaboraviti da ponovo ukljucite ove opcije kada zavrsimo ciscenje.


* Klikni desnim tasterom miša na AVG ikonicu ( ) u donjem, desnom uglu ekrana.
* Kada se pokrene AVG Control Center, dvoklikni na AVG Resident Shield komponentu.
* U prozoru koji se otvori, deštikliraj opciju Turn on AVG Resident Shield i klikni OK.

Napomena: Ne zaboravi da uključiš ovu opciju po završetku čišćenja.


Skini ComboFix sa jedne od sledecih adresa na Desktop:
[Link mogu videti samo ulogovani korisnici]
[Link mogu videti samo ulogovani korisnici]
[Link mogu videti samo ulogovani korisnici]

Startuj ga i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu. Kada zavrsi pojavice se log (C:\ComboFix.txt) koji ces nam ovde iskopirati.

Poslao: 18 Mar 2009 13:21
Idi na vrh
offline
  • Pridružio: 28 Feb 2009
  • Poruke: 190
  • Gde živiš: Beograd

kada odem u mode jel treba da ostane stiklirana opcija advanced mode?

Poslao: 18 Mar 2009 13:27
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje

Ne znam ne koristim taj program, ne diraj nista sto ne pise u uputstvu, znaci striktno kako pise.

Poslao: 18 Mar 2009 13:42
Idi na vrh
offline
  • Pridružio: 28 Feb 2009
  • Poruke: 190
  • Gde živiš: Beograd

ok.sad kad sam otvorio AVG Control Center, dvokliknuo na AVG Resident Shield komponentu, nema mi opcije Turn on AVG Resident Shield. Ima samo:
Resident Shield active
Remove all threats automatically
Ask me before removing threats
Scan for tracking Cookies.

Sta sad?

Poslao: 18 Mar 2009 14:15
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje

Decekiraj Resident Shield active

Poslao: 18 Mar 2009 14:15
Idi na vrh
offline
  • Pridružio: 28 Feb 2009
  • Poruke: 190
  • Gde živiš: Beograd

ComboFix 09-03-15.01 - Milan 2009-03-18 14:06:27.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.557 [GMT 1:00]
Running from: c:\documents and settings\Milan\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-02-18 to 2009-03-18 )))))))))))))))))))))))))))))))
.

2009-03-18 00:05 . 2009-03-18 00:05 <DIR> d-------- c:\documents and settings\Milan\Application Data\MxBoost
2009-03-18 00:04 . 2009-03-18 00:06 <DIR> d-------- c:\program files\Maxthon2
2009-03-18 00:03 . 2009-03-18 00:03 <DIR> d-------- c:\program files\Maxton
2009-03-16 19:41 . 2009-03-16 19:41 <DIR> d-------- c:\program files\Readon Technology
2009-03-16 16:02 . 2009-03-16 16:04 <DIR> d-------- c:\program files\Eggiz
2009-03-15 20:59 . 2009-03-15 17:51 33,556 --a------ C:\midnightexpress.jpg
2009-03-15 20:50 . 2009-03-15 18:17 35,551 --a------ C:\1234024115_me_myself_and_irene_posters.jpg
2009-03-15 20:47 . 2009-03-15 18:10 22,696 --a------ C:\Mean_Machine_poster.jpg
2009-03-15 20:44 . 2009-03-15 17:54 18,844 --a------ C:\Theoneposter.jpg
2009-03-15 20:38 . 2009-03-15 20:38 37,860 --a------ C:\1172603115_city_of_angels.jpg
2009-03-15 20:32 . 2009-03-15 15:29 502,803 --a------ C:\Sahara.jpg
2009-03-15 15:07 . 2009-03-15 14:52 91,640 --a------ C:\legally_blonde.jpg
2009-03-15 15:07 . 2009-03-15 15:01 78,739 --a------ C:\legally_blonde_two.jpg
2009-03-13 01:16 . 2009-03-13 01:16 <DIR> d-------- c:\program files\SubMagic
2009-03-13 01:16 . 2007-07-19 18:14 3,727,720 --a------ c:\windows\system32\d3dx9_35.dll
2009-03-13 00:44 . 2009-03-13 00:44 <DIR> d-------- c:\documents and settings\Milan\Application Data\GRETECH
2009-03-13 00:43 . 2009-03-13 00:43 <DIR> d-------- c:\program files\GRETECH
2009-03-13 00:42 . 2009-03-13 00:42 <DIR> d-------- c:\program files\GOM Player
2009-03-11 14:14 . 2009-03-11 14:14 <DIR> d--h----- c:\windows\$hf_mig$
2009-03-11 14:14 . 2005-02-25 04:35 22,752 --a------ c:\windows\system32\spupdsvc.exe
2009-03-11 10:48 . 2008-10-16 14:09 43,544 --a------ c:\windows\system32\wups2.dll
2009-03-11 10:48 . 2008-10-16 14:09 31,768 --a------ c:\windows\system32\wucltui.dll.mui
2009-03-11 10:48 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuaucpl.cpl.mui
2009-03-11 10:48 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuapi.dll.mui
2009-03-11 10:48 . 2008-10-16 14:07 18,456 --a------ c:\windows\system32\wuaueng.dll.mui
2009-02-27 20:15 . 2009-02-28 15:35 <DIR> d-------- c:\program files\Opera
2009-02-27 19:37 . 2009-03-17 10:03 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2009-02-27 19:37 . 2009-02-27 20:00 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-27 14:24 . 2009-02-27 14:24 <DIR> d-------- c:\program files\Magentic
2009-02-27 14:24 . 2008-08-04 09:51 750,984 --a------ c:\windows\system32\Magentic Screensaver.scr
2009-02-24 21:40 . 2009-02-24 21:40 <DIR> d-------- c:\program files\AskBarDis
2009-02-19 17:33 . 2009-02-19 17:33 <DIR> d-------- c:\documents and settings\Milan\Application Data\Uniblue
2009-02-18 18:24 . 2009-02-18 18:24 <DIR> d-------- c:\documents and settings\All Users\Application Data\PMB Files
2009-02-18 18:23 . 2009-02-18 18:23 204 --a------ C:\Plugins
2009-02-18 18:22 . 2009-02-18 18:22 <DIR> d-------- c:\program files\Pando Networks
2009-02-18 17:12 . 2009-02-23 22:05 <DIR> d-------- c:\documents and settings\Milan\Application Data\X3mE Yamb
2009-02-18 17:12 . 2009-02-23 22:04 <DIR> d-------- c:\documents and settings\All Users\Application Data\X3mE Yamb
2009-02-18 16:01 . 2009-02-18 16:01 <DIR> d-------- c:\program files\Adobe Media Player
2009-02-18 16:00 . 2009-02-18 16:00 <DIR> d-------- c:\program files\Common Files\Adobe AIR
2009-02-18 00:10 . 2009-02-18 01:00 <DIR> d-------- c:\program files\SMS Free Sender

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-18 12:43 4,941 ----a-w c:\program files\Yurecnik.ini
2009-03-16 23:26 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-03-12 22:22 --------- d-----w c:\program files\Winamp
2009-03-12 20:22 --------- d-----w c:\program files\Mv2Player
2009-03-10 14:21 --------- d-----w c:\program files\ToggleEN
2009-03-08 00:23 --------- d-----w c:\documents and settings\Milan\Application Data\uTorrent
2009-02-22 12:22 --------- d-----w c:\program files\Google
2009-02-19 15:45 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-02-18 16:15 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-17 12:49 --------- d-----w c:\program files\uTorrent
2009-02-17 12:04 --------- d-----w c:\program files\Conduit
2009-02-16 17:25 --------- d-----w c:\documents and settings\All Users\Application Data\DVD Shrink
2009-02-16 14:17 --------- d-----w c:\program files\IncrediMail
2009-02-16 14:17 --------- d-----w c:\documents and settings\All Users\Application Data\IM
2009-02-16 14:16 --------- d-----w c:\documents and settings\All Users\Application Data\IncrediMail
2009-02-16 13:33 --------- d-----w c:\program files\Windows Live SkyDrive
2009-02-16 13:33 --------- d-----w c:\program files\Windows Live
2009-02-16 13:33 --------- d-----w c:\program files\Microsoft
2009-02-16 13:24 --------- d-----w c:\program files\Common Files\Windows Live
2009-02-16 13:23 --------- d-----w c:\documents and settings\Milan\Application Data\MSNInstaller
2009-02-13 21:44 --------- d-----w c:\program files\Phenomedia AG
2009-02-13 21:36 --------- d-----w c:\program files\Tripper-IT
2009-02-13 17:46 325,128 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-02-13 17:46 107,272 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-02-13 17:46 10,520 ----a-w c:\windows\system32\avgrsstx.dll
2009-02-11 15:37 --------- d-----w c:\documents and settings\Milan\Application Data\SlipStream
2009-02-11 09:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-11 09:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-02-06 17:52 49,504 ----a-w c:\windows\system32\sirenacm.dll
2009-02-06 13:41 --------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-01-29 17:18 --------- d-----w c:\program files\GordianKnot
2009-01-29 17:15 --------- d-----w c:\program files\DVD Shrink
2009-01-29 17:11 --------- d-----w c:\program files\Gabest
2009-01-29 17:11 --------- d-----w c:\program files\AviSynth 2.5
2009-01-17 16:03 258 ----a-w c:\program files\Mini-YuRecnik.ini
2009-01-17 15:59 28,702 ----a-w c:\program files\Uninstal.exe
2009-01-17 15:59 1,998 ----a-w c:\program files\uninstal.log
1999-08-02 09:47 387,072 ----a-w c:\program files\YuRecnik.exe
1999-08-02 09:40 219,648 ----a-w c:\program files\MiniYuRecnik.exe
1999-08-02 09:35 9,559 ----a-w c:\program files\YURECNIK.HLP
1999-08-02 09:35 57 ----a-w c:\program files\Yurecnik.CNT
1999-07-29 09:43 2,447,472 ----a-w c:\program files\Reci.dat
1996-09-06 12:08 30,070 ----a-w c:\program files\Fb_deflt.dic
1996-02-23 15:26 469,504 ----a-w c:\program files\Fb_11k8.dll
1996-02-23 14:59 34,816 ----a-w c:\program files\Fb_spch.dll
1996-02-23 14:48 4,608 ----a-w c:\program files\Fb_timer.dll
1996-02-23 14:46 29,184 ----a-w c:\program files\Fb_ngn.exe
1996-02-23 14:21 16,896 ----a-w c:\program files\Uraspec.exe
1996-02-23 14:17 18,432 ----a-w c:\program files\Dictmgr.exe
1993-11-29 08:32 16,896 ----a-w c:\program files\Monologw.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{038cb5c7-48ea-4af9-94e0-a1646542e62b}"= "c:\program files\ToggleEN\tbTog1.dll" [2009-02-17 1882136]

[HKEY_CLASSES_ROOT\clsid\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]
2009-02-17 13:33 1882136 --a------ c:\program files\ToggleEN\tbTog1.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-11-24 20:25 333192 --a------ c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{038cb5c7-48ea-4af9-94e0-a1646542e62b}"= "c:\program files\ToggleEN\tbTog1.dll" [2009-02-17 1882136]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-11-24 333192]

[HKEY_CLASSES_ROOT\clsid\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{038CB5C7-48EA-4AF9-94E0-A1646542E62B}"= "c:\program files\ToggleEN\tbTog1.dll" [2009-02-17 1882136]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-11-24 333192]

[HKEY_CLASSES_ROOT\clsid\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"IncrediMail"="c:\program files\IncrediMail\bin\IncMail.exe" [2009-02-02 251264]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-12 39408]
"Magentic"="c:\progra~1\Magentic\bin\Magentic.exe" [2008-08-04 488808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2004-12-20 33792]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-13 1601304]
"SlipStream"="c:\program files\Raketa Krstarice\raketa-core.exe" [2007-09-25 344064]
"Raketa-veza"="c:\program files\Raketa Krstarice\raketa-veza.exe" [2007-09-11 69800]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"RTHDCPL"="RTHDCPL.EXE" [2007-09-03 c:\windows\RTHDCPL.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472]
Raketa Krstarice.lnk - c:\program files\Raketa Krstarice\raketa.exe [2008-12-03 229376]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-02-13 18:46 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImApp.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\Magentic\\bin\\MgImp.exe"=
"c:\\Program Files\\Magentic\\bin\\Magentic.exe"=
"c:\\Program Files\\Magentic\\bin\\MgApp.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"58459:TCP"= 58459:TCP:Pando Media Booster
"58459:UDP"= 58459:UDP:Pando Media Booster

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-12-02 325128]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-12-02 107272]
R2 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe [2009-02-24 464264]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-12-28 903960]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-12-28 298264]
S2 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [2009-02-24 234888]
S2 gupdate1c98d25e3423983;Google Update Service (gupdate1c98d25e3423983);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-12 133104]
S2 RPCER;Remote Procedure Call (HNM);c:\program files\NetMeeting\comp.exe [2007-03-28 12798152]
.
Contents of the 'Scheduled Tasks' folder

2009-03-18 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-12 16:21]

2009-03-18 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-12 16:23]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-ares - c:\program files\Ares\Ares.exe
HKCU-Run-Uniblue RegistryBooster 2009 - c:\program files\Uniblue\RegistryBooster\RegistryBooster.exe


.
------- Supplementary Scan -------
.
uStart Page = [Link mogu videti samo ulogovani korisnici]
uSearch Page = [Link mogu videti samo ulogovani korisnici]
uSearch Bar = [Link mogu videti samo ulogovani korisnici]
mStart Page = [Link mogu videti samo ulogovani korisnici]
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: c:\progra~1\RAKETA~1\sliplsp.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2009-03-18 14:08:06
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(696)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-03-18 14:09:02
ComboFix-quarantined-files.txt 2009-03-18 13:09:00

Pre-Run: 45,452,185,600 bytes free
Post-Run: 45,574,561,792 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
d:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

223

Poslao: 18 Mar 2009 15:51
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje

Moracemo da proverimo jedan fajl

c:\program files\NetMeeting\comp.exe

Imas putanju i nadji ga pa ga upload-uj na [Link mogu videti samo ulogovani korisnici]
Posle toga postavi ovde izvestaj da vidim o cemu se radi.

Fajl je malo veci oko 12 mb tako da ces malo sacekati.

MyCity » Ambulanta -> Arhiva Ambulante » Hitno potrebna pomoc

Ko je trenutno na forumu
 

Ukupno su 1864 korisnika na forumu :: 80 registrovanih, 3 sakrivenih i 1781 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 6018 - dana 19 Dec 2025 13:41

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 015, 9k38, Adaminho1985, alke12, ArmFPGA, Arsenije, Azzo, Bobrock1, bogdanpejcic, Bojan198527, bojcistv, BSD, Bubili, BZ, Cicumile, Cigi, Dexlex, Django777, Djuza, dmrdc, dnevnasoba, Dorcolac, dule10savic, dusan.l, EXIT78, Fog of War, Frunze, Futurama, gagidjuric, gasha, glados, goranvas, GrobarPovratak, hatman, HrcAk47, ivran064, Jager715510, joca83, kalens021, Kenanjoz, knutveliki, Kobrim, Korle, leptirleptir, MaCS, maksi007, Manjane, MarkoW, mercedesamg, Mi lao shu, milenko crazy north, mix1, Moldovan, Mrav Obrad, mrm, mrzimregistraciju, nekdo, Neutral-M, Nomica, Pale2025, Parker, pein, precan, raketaš, sarma, SDsd, sedan, sekretar, Silvertooth, Sky diver 29, tamno.nebo, Troja, vathra, Velizar Laro, Velički, vobo, Vrač, vuksa72, ZlatniRez, šumar bk2