MyCity » Ambulanta -> Arhiva Ambulante » Please help

Please help

Napisano na dan: 27.6.2008
1

Please help
Sledeća strana Pagination

Idi na vrh

Poslao: 27 Jun 2008 17:17
Idi na vrh
offline
  • Pridružio: 02 Jan 2006
  • Poruke: 232

Jel mi mozete pomoci posto je ovo firmrin comp a navukao sam neku glupost koji mi non-stop pokazuje da je sistem zarazen.


Logfile of HijackThis v1.99.1
Scan saved at 4:42:58 PM, on 6/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\PosLink\POS.exe
E:\Nt2005\Poslovanje.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Documents and Settings\branko\Desktop\New Folder\misha.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{2F8C5683-1A0B-4665-8E66-996BAF520DAE}: NameServer = 192.168.1.1
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Dopuna: 27 Jun 2008 17:17

Ovi procesi me muche.Ugasio sam ih i ne pojavljuje se nishta vishe ali ne mogu da im nadjem tacnu adresu u regeditu .




Poslao: 27 Jun 2008 17:58
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Jesi li cackao reg. bazu pre nego sto si napravio HJT log?



Poslao: 27 Jun 2008 18:02
Idi na vrh
offline
  • Pridružio: 02 Jan 2006
  • Poruke: 232

Jesam i uspeo sam da nadjem 1 folder koji je iste oznake kao i onaj u msconfigu i obrisao ga.

Poslao: 27 Jun 2008 19:01
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Log je cist, zato pitam.

Daj sledece:

Skini ComboFix sa jedne od sledecih adresa na Desktop:
[Link mogu videti samo ulogovani korisnici]
[Link mogu videti samo ulogovani korisnici]
[Link mogu videti samo ulogovani korisnici]

Startuj ga i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu. Kada zavrsi pojavice se log (C:\ComboFix.txt) koji ces nam ovde iskopirati.

Poslao: 27 Jun 2008 21:09
Idi na vrh
offline
  • Pridružio: 02 Jan 2006
  • Poruke: 232

Chistio sam neshto i sada izgleda da je sve ok ali za svaki slucaj evo i ovog loga.

ComboFix 08-06-20.4 - branko 2008-06-27 19:06:32.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.427 [GMT 2:00]
Running from: C:\Documents and Settings\branko\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-05-27 to 2008-06-27 )))))))))))))))))))))))))))))))
.

2008-06-27 18:56 . 2008-06-27 18:56 <DIR> d-------- C:\WINDOWS\Sun
2008-06-27 18:56 . 2008-06-27 18:56 <DIR> d-------- C:\Documents and Settings\branko\Application Data\bang
2008-06-27 15:23 . 2008-06-27 15:23 <DIR> d-------- C:\Documents and Settings\branko\Application Data\rhc7daj0e99p
2008-06-27 15:22 . 2008-06-27 15:22 109,056 --a------ C:\WINDOWS\system32\lphc3daj0e99p.exe
2008-06-27 15:22 . 2008-06-27 16:03 60,928 --a------ C:\WINDOWS\system32\blphc3daj0e99p.scr
2008-06-24 14:59 . 2008-06-24 15:18 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-24 13:14 . 2008-06-24 13:32 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-06-24 13:14 . 2008-06-24 14:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-23 14:10 . 2008-06-23 14:10 <DIR> d-------- C:\Program Files\MSECache
2008-06-19 15:45 . 2008-06-20 11:57 <DIR> d-------- C:\Program Files\Just Sudoku
2008-06-18 11:03 . 2008-06-19 15:43 <DIR> d-------- C:\Program Files\Sudoku XP
2008-06-10 17:51 . 2004-08-03 23:10 38,016 --a------ C:\WINDOWS\system32\drivers\bthmodem.sys
2008-06-10 17:51 . 2004-08-03 23:10 38,016 --a--c--- C:\WINDOWS\system32\dllcache\bthmodem.sys
2008-06-10 11:58 . 2008-06-10 14:30 <DIR> d-------- C:\WINDOWS\system32\Adobe
2008-06-10 11:58 . 2008-06-10 11:58 681 --a------ C:\WINDOWS\mozver.dat
2008-06-10 10:52 . 2008-06-10 10:53 <DIR> d-------- C:\Garmin
2008-05-31 11:39 . 2004-08-04 14:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-05-27 17:28 . 2008-06-27 16:52 16 --a------ C:\WINDOWS\popcinfo.dat
2008-05-27 17:24 . 2008-05-27 17:24 <DIR> d-------- C:\Program Files\ReflexiveArcade
2008-05-27 17:24 . 2008-06-27 16:07 <DIR> d-------- C:\Program Files\Bejeweled 2 Deluxe
2008-05-27 17:00 . 2008-05-27 17:00 <DIR> d-------- C:\games

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-27 15:02 --------- d-----w C:\Program Files\Symantec AntiVirus
2008-06-27 15:02 --------- d-----w C:\Documents and Settings\branko\Application Data\OpenOffice.org2
2008-06-10 08:50 --------- d-----w C:\Program Files\navigator
2008-05-15 11:35 --------- d-----w C:\Program Files\Pocket Tanks Deluxe
2008-05-13 11:09 --------- d-----w C:\Program Files\SoftwareDesign
2008-05-13 11:09 --------- d-----w C:\Program Files\Common Files\Borland Shared
2008-05-13 10:48 --------- d-----w C:\Program Files\OpenOffice.org 2.3
2008-05-13 10:39 720,896 ----a-w C:\WINDOWS\iun6002.exe
2008-05-13 10:39 --------- d-----w C:\Program Files\PosLink
2008-05-13 10:15 --------- d-----w C:\Documents and Settings\branko\Application Data\ImgBurn
2008-05-13 10:14 --------- d-----w C:\Program Files\ImgBurn
2008-05-13 10:14 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-13 10:12 --------- d-----w C:\Program Files\Java
2008-05-13 10:12 --------- d-----w C:\Program Files\Common Files\Java
2008-05-13 09:42 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-05-13 09:30 --------- d-----w C:\Program Files\Symantec
2008-05-13 09:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-05-13 09:19 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-13 09:19 --------- d-----w C:\Program Files\Attansic
2008-05-13 09:16 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-05-13 09:16 --------- d-----w C:\Program Files\Realtek
2008-05-13 09:15 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-05-13 09:12 --------- d-----w C:\Program Files\Intel
2008-05-13 09:04 --------- d-----w C:\Program Files\microsoft frontpage
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2006-08-16 17:39 98304]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2006-08-16 17:41 114688]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2006-08-16 17:38 94208]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-10 09:28 16126464 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2007-04-04 11:22 1822720 C:\WINDOWS\SkyTel.exe]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-06-02 09:21 48752]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2005-06-23 19:27 85696]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"BluetoothAuthenticationAgent"="bthprops.cpl,,BluetoothAuthenticationAgent" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360]

C:\Documents and Settings\branko\Start Menu\Programs\Startup\
OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 21:57:56 393216]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lphc3daj0e99p]
--a------ 2008-06-27 15:22 109056 C:\WINDOWS\system32\lphc3daj0e99p.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMrhc7daj0e99p]
C:\Program Files\rhc7daj0e99p\rhc7daj0e99p.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=

R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2006-11-01 13:10]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{17bb1605-30ae-11dd-944e-001d6033eb03}]
\Shell\AutoRun\command - G:\i.exe
\Shell\explore\Command - G:\i.exe
\Shell\open\Command - G:\i.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45437714-28a3-11dd-9442-001d6033eb03}]
\Shell\AutoRun\command - InstallTomTomHOME.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45437732-28a3-11dd-9442-001d6033eb03}]
\Shell\AutoOpen\command - .\MSOCache\90000804-6000-11D3-8CFE-0150048383C9\KB915865.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL .\MSOCache\90000804-6000-11D3-8CFE-0150048383C9\KB915865.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5e9de6e4-317d-11dd-9451-001d6033eb03}]
\Shell\AutoRun\command - F:\InstallTomTomHOME.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{657d503c-2e1c-11dd-944b-001d6033eb03}]
\Shell\AutoRun\command - wscript.exe .\.vbs
\Shell\open\command - wscript.exe .\.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ab7d3c6e-2b12-11dd-9444-001d6033eb03}]
\Shell\AutoRun\command - InstallTomTomHOME.exe

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2008-06-27 19:07:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-27 19:07:45
ComboFix-quarantined-files.txt 2008-06-27 17:07:43

Pre-Run: 35,490,652,160 bytes free
Post-Run: 36,037,066,752 bytes free

126

Dopuna: 27 Jun 2008 21:09

Bobby,pazi sad.Na gornjoj slici vidish procese koje sam iskljucio.Te procese sam obrisao u system32 folderu (bio je u exe varijanti) i u program files ali i dalje kada pustim normalan start up programa (odblokiram ih) ponovo mi se pojavi na desktopu da mi je racunar zarazen i da bla bla bla...Jel mi mozes pomoci da ga isecemo u korenu?

Poslao: 27 Jun 2008 22:17
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Sta ti je G: drajv? CD/DVD ili neki USB stick?
Mozda mobilni, ili MP3 pleyer?
Sta god da je, preko tog drajva je doslo do zaraze.
Javi mi koji je uredjaj u pitanju, pa da ga ocistimo.


Otvoriti Notepad i iskopirati sledeci tekst:

File::
C:\WINDOWS\system32\lphc3daj0e99p.exe
C:\WINDOWS\system32\blphc3daj0e99p.scr
C:\MSOCache\90000804-6000-11D3-8CFE-0150048383C9\KB915865.exe

Folder::
C:\Documents and Settings\branko\Application Data\rhc7daj0e99p
C:\Program Files\rhc7daj0e99p\

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lphc3daj0e99p]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMrhc7daj0e99p]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{17bb1605-30ae-11dd-944e-001d6033eb03}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45437732-28a3-11dd-9442-001d6033eb03}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{657d503c-2e1c-11dd-944b-001d6033eb03}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45437732-28a3-11dd-9442-001d6033eb03}]


Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

Poslao: 28 Jun 2008 09:11
Idi na vrh
offline
  • Pridružio: 02 Jan 2006
  • Poruke: 232

Nisam u kancelariji vishe ali do zaraze je doslo tako sto je koleginica skidala neshto i samo je pozvala i ono ,please help.G drajv koliko ja znam ne postoji ,mislim nista nije prikaceno na komp.Mozda je napravljen neki virtual drajv.
Hvala ti na uputstvima,odradicu ih sutra kada odem na posao.Javicu kako je proslo.Hvala ti jos jednom!

Dopuna: 28 Jun 2008 9:11

Evo loga posle ciscenja:



ComboFix 08-06-20.4 - branko 2008-06-28 9:07:41.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.565 [GMT 2:00]
Running from: C:\Documents and Settings\branko\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\branko\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\MSOCache\90000804-6000-11D3-8CFE-0150048383C9\KB915865.exe
C:\WINDOWS\system32\blphc3daj0e99p.scr
C:\WINDOWS\system32\lphc3daj0e99p.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\branko\Application Data\rhc7daj0e99p
C:\WINDOWS\system32\blphc3daj0e99p.scr

.
((((((((((((((((((((((((( Files Created from 2008-05-28 to 2008-06-28 )))))))))))))))))))))))))))))))
.

2008-06-27 19:36 . 2008-06-27 19:36 90,838 --a------ C:\WINDOWS\system32\phc3daj0e99p.bmp
2008-06-27 18:56 . 2008-06-27 18:56 <DIR> d-------- C:\WINDOWS\Sun
2008-06-27 18:56 . 2008-06-27 18:56 <DIR> d-------- C:\Documents and Settings\branko\Application Data\bang
2008-06-24 14:59 . 2008-06-24 15:18 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-24 13:14 . 2008-06-24 13:32 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-06-24 13:14 . 2008-06-24 14:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-23 14:10 . 2008-06-23 14:10 <DIR> d-------- C:\Program Files\MSECache
2008-06-19 15:45 . 2008-06-20 11:57 <DIR> d-------- C:\Program Files\Just Sudoku
2008-06-18 11:03 . 2008-06-19 15:43 <DIR> d-------- C:\Program Files\Sudoku XP
2008-06-10 17:51 . 2004-08-03 23:10 38,016 --a------ C:\WINDOWS\system32\drivers\bthmodem.sys
2008-06-10 17:51 . 2004-08-03 23:10 38,016 --a--c--- C:\WINDOWS\system32\dllcache\bthmodem.sys
2008-06-10 11:58 . 2008-06-10 14:30 <DIR> d-------- C:\WINDOWS\system32\Adobe
2008-06-10 11:58 . 2008-06-10 11:58 681 --a------ C:\WINDOWS\mozver.dat
2008-06-10 10:52 . 2008-06-10 10:53 <DIR> d-------- C:\Garmin
2008-05-31 11:39 . 2004-08-04 14:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-28 06:57 --------- d-----w C:\Program Files\Symantec AntiVirus
2008-06-28 06:57 --------- d-----w C:\Documents and Settings\branko\Application Data\OpenOffice.org2
2008-06-27 14:07 --------- d-----w C:\Program Files\Bejeweled 2 Deluxe
2008-06-10 08:50 --------- d-----w C:\Program Files\navigator
2008-05-27 15:24 --------- d-----w C:\Program Files\ReflexiveArcade
2008-05-15 11:35 --------- d-----w C:\Program Files\Pocket Tanks Deluxe
2008-05-13 11:09 --------- d-----w C:\Program Files\SoftwareDesign
2008-05-13 11:09 --------- d-----w C:\Program Files\Common Files\Borland Shared
2008-05-13 10:48 --------- d-----w C:\Program Files\OpenOffice.org 2.3
2008-05-13 10:39 720,896 ----a-w C:\WINDOWS\iun6002.exe
2008-05-13 10:39 --------- d-----w C:\Program Files\PosLink
2008-05-13 10:15 --------- d-----w C:\Documents and Settings\branko\Application Data\ImgBurn
2008-05-13 10:14 --------- d-----w C:\Program Files\ImgBurn
2008-05-13 10:14 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-13 10:12 --------- d-----w C:\Program Files\Java
2008-05-13 10:12 --------- d-----w C:\Program Files\Common Files\Java
2008-05-13 09:42 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-05-13 09:30 --------- d-----w C:\Program Files\Symantec
2008-05-13 09:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-05-13 09:19 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-13 09:19 --------- d-----w C:\Program Files\Attansic
2008-05-13 09:16 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-05-13 09:16 --------- d-----w C:\Program Files\Realtek
2008-05-13 09:15 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-05-13 09:12 --------- d-----w C:\Program Files\Intel
2008-05-13 09:04 --------- d-----w C:\Program Files\microsoft frontpage
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2006-08-16 17:39 98304]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2006-08-16 17:41 114688]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2006-08-16 17:38 94208]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-10 09:28 16126464 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2007-04-04 11:22 1822720 C:\WINDOWS\SkyTel.exe]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-06-02 09:21 48752]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2005-06-23 19:27 85696]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"BluetoothAuthenticationAgent"="bthprops.cpl,,BluetoothAuthenticationAgent" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360]

C:\Documents and Settings\branko\Start Menu\Programs\Startup\
OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 21:57:56 393216]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=

R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2006-11-01 13:10]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45437714-28a3-11dd-9442-001d6033eb03}]
\Shell\AutoRun\command - InstallTomTomHOME.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5e9de6e4-317d-11dd-9451-001d6033eb03}]
\Shell\AutoRun\command - F:\InstallTomTomHOME.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ab7d3c6e-2b12-11dd-9444-001d6033eb03}]
\Shell\AutoRun\command - InstallTomTomHOME.exe

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2008-06-28 09:08:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-28 9:08:52
ComboFix-quarantined-files.txt 2008-06-28 07:08:50

Pre-Run: 36,074,668,032 bytes free
Post-Run: 36,069,793,792 bytes free

115

Poslao: 28 Jun 2008 09:28
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Otvoriti Notepad i iskopirati sledeci tekst:

File::
C:\WINDOWS\system32\phc3daj0e99p.bmp


Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

Reci mi kako se racunar sada ponasa. Ima li jos simptoma?

Poslao: 28 Jun 2008 10:12
Idi na vrh
offline
  • Pridružio: 02 Jan 2006
  • Poruke: 232

Sve sada deluje ok,u msconfigu se vise ne pojavljuju na start up-u.Opet si mi resio problem i po o zna koji put ti dugujem pice!A i koleginica ti duguje neshto:)
Ako nekada dodjes u BG javi se da popijemo ta pica!

Evo loga i HVALA

ComboFix 08-06-20.4 - branko 2008-06-28 10:06:42.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.536 [GMT 2:00]
Running from: C:\Documents and Settings\branko\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\branko\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\system32\phc3daj0e99p.bmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\phc3daj0e99p.bmp

.
((((((((((((((((((((((((( Files Created from 2008-05-28 to 2008-06-28 )))))))))))))))))))))))))))))))
.

2008-06-27 18:56 . 2008-06-27 18:56 <DIR> d-------- C:\WINDOWS\Sun
2008-06-27 18:56 . 2008-06-27 18:56 <DIR> d-------- C:\Documents and Settings\branko\Application Data\bang
2008-06-24 14:59 . 2008-06-24 15:18 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-24 13:14 . 2008-06-24 13:32 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-06-24 13:14 . 2008-06-24 14:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-23 14:10 . 2008-06-23 14:10 <DIR> d-------- C:\Program Files\MSECache
2008-06-19 15:45 . 2008-06-20 11:57 <DIR> d-------- C:\Program Files\Just Sudoku
2008-06-18 11:03 . 2008-06-19 15:43 <DIR> d-------- C:\Program Files\Sudoku XP
2008-06-10 17:51 . 2004-08-03 23:10 38,016 --a------ C:\WINDOWS\system32\drivers\bthmodem.sys
2008-06-10 17:51 . 2004-08-03 23:10 38,016 --a--c--- C:\WINDOWS\system32\dllcache\bthmodem.sys
2008-06-10 11:58 . 2008-06-10 14:30 <DIR> d-------- C:\WINDOWS\system32\Adobe
2008-06-10 11:58 . 2008-06-10 11:58 681 --a------ C:\WINDOWS\mozver.dat
2008-06-10 10:52 . 2008-06-10 10:53 <DIR> d-------- C:\Garmin
2008-05-31 11:39 . 2004-08-04 14:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-28 07:28 --------- d-----w C:\Program Files\Symantec AntiVirus
2008-06-28 07:28 --------- d-----w C:\Documents and Settings\branko\Application Data\OpenOffice.org2
2008-06-27 14:07 --------- d-----w C:\Program Files\Bejeweled 2 Deluxe
2008-06-10 08:50 --------- d-----w C:\Program Files\navigator
2008-05-27 15:24 --------- d-----w C:\Program Files\ReflexiveArcade
2008-05-15 11:35 --------- d-----w C:\Program Files\Pocket Tanks Deluxe
2008-05-13 11:09 --------- d-----w C:\Program Files\SoftwareDesign
2008-05-13 11:09 --------- d-----w C:\Program Files\Common Files\Borland Shared
2008-05-13 10:48 --------- d-----w C:\Program Files\OpenOffice.org 2.3
2008-05-13 10:39 720,896 ----a-w C:\WINDOWS\iun6002.exe
2008-05-13 10:39 --------- d-----w C:\Program Files\PosLink
2008-05-13 10:15 --------- d-----w C:\Documents and Settings\branko\Application Data\ImgBurn
2008-05-13 10:14 --------- d-----w C:\Program Files\ImgBurn
2008-05-13 10:14 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-13 10:12 --------- d-----w C:\Program Files\Java
2008-05-13 10:12 --------- d-----w C:\Program Files\Common Files\Java
2008-05-13 09:42 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-05-13 09:30 --------- d-----w C:\Program Files\Symantec
2008-05-13 09:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-05-13 09:19 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-13 09:19 --------- d-----w C:\Program Files\Attansic
2008-05-13 09:16 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-05-13 09:16 --------- d-----w C:\Program Files\Realtek
2008-05-13 09:15 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-05-13 09:12 --------- d-----w C:\Program Files\Intel
2008-05-13 09:04 --------- d-----w C:\Program Files\microsoft frontpage
.

((((((((((((((((((((((((((((( snapshot@2008-06-28_ 9.08.45.54 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-28 06:56:54 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-28 07:28:08 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2006-08-16 17:39 98304]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2006-08-16 17:41 114688]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2006-08-16 17:38 94208]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-10 09:28 16126464 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2007-04-04 11:22 1822720 C:\WINDOWS\SkyTel.exe]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-06-02 09:21 48752]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2005-06-23 19:27 85696]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"BluetoothAuthenticationAgent"="bthprops.cpl,,BluetoothAuthenticationAgent" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360]

C:\Documents and Settings\branko\Start Menu\Programs\Startup\
OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 21:57:56 393216]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=

R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2006-11-01 13:10]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45437714-28a3-11dd-9442-001d6033eb03}]
\Shell\AutoRun\command - InstallTomTomHOME.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5e9de6e4-317d-11dd-9451-001d6033eb03}]
\Shell\AutoRun\command - F:\InstallTomTomHOME.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ab7d3c6e-2b12-11dd-9444-001d6033eb03}]
\Shell\AutoRun\command - InstallTomTomHOME.exe

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2008-06-28 10:07:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-28 10:07:56
ComboFix-quarantined-files.txt 2008-06-28 08:07:54
ComboFix2.txt 2008-06-28 07:08:53

Pre-Run: 36,051,984,384 bytes free
Post-Run: 36,047,663,104 bytes free

117

Poslao: 28 Jun 2008 11:05
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

MyCity » Ambulanta -> Arhiva Ambulante » Please help

Ko je trenutno na forumu
 

Ukupno su 958 korisnika na forumu :: 80 registrovanih, 11 sakrivenih i 867 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 20624 - dana 04 Apr 2026 04:18

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 33 bren, 357magnum, amonsrb, Asteker, bambulic, bojank, bokicacar, Boris90, boromir, Bozjidar87, bpop, Chainsaw, cifra, cuvarkuca, Daba75, Dare, Darth Wader, DeerHunter, Denaya, Doca, DonRumataEstorski, Duck of Death, dulleo, esko_hz, EVIDENTICAR, Georgius, Gheljda, Giskard, Goran_, Igor Antonic, Ikica977, Ivoo, Jester, Kajzer Soze, kaput21, Kole1975, Kontrausluga, Koridor 11, kybonacci, lacko, Laki Topalovic, LUDI, Man1ac021, MarsRed, max power, mercedesamg, mgolub, Milun24, miodrag, miso2709, MrG, Ndsk, nerislav2025, ObelixSRB, omen, ostoja, pein, procesor, promajauglavi, Remain, scimitar19, septembar, Sharpshooter, skvara, sony771, Spila 0405, tooljan, trutcina, Tvrtko I, vathra, VBoss, Velizar Laro, Viceroy, voja64, wolverined4, Wrangler, yrraf, Zastava, Zec, 223223