Vesti

x-Death-x · Ugledni građanin

Ovako...
Kada upalim racunar iskoci mi ova slika:

A nakon toga...par minuti iskoci ovo...

Trazio sam po netu...ali nisam nasao nista korisno...
Pa reko da pitam profesionalce...pa se sjetio vas... Smile

[/img]

I Izvinjavam se sto su slike...sto imaju ovo bijelo...ali u zurbi sam radio...

Bogdan-Tc · Anti Malware Fighter Rank 1

http://www.mycity.rs/Ambulanta/Kako-otvoriti-temu-u-Ambulanti.html

x-Death-x · Ugledni građanin

Izvinjavam se zbog NEprofesionalnog odnosa prema AMF Timu...

Prije jedno 2 dana su odjednom poceli da iskacu prozori koje cete vidjeti u nastavku...
Tada nisam instalirao/brisao nikakve programe ili neke druge fajlove.
Koristim Avast5,updade-ujem ga redovno...
Prije par min sam uradio Full System Scan i nije bilo nikakvih infektovanih datoteka...

Koristim Windows XP SP2 32-bitni...

Evo Log fajla...

Bogdan-Tc · Anti Malware Fighter Rank 1

Preuzmi sUBs-ov ComboFix sa sledeće adrese na Desktop:

Bleeping Computer

Klikni desnim tasterom na link i odaberi opciju Save Target As... (Save Link As..., Save Linked Content As... ili sličnu);
Kada se otvori dijalog za izbor lokacije na kojoj treba sačuvati file, odaberi Desktop i klikni Save.

Kada preuzimanje programa bude završeno:

deaktiviraj zaštitni softver (uputstvo);
zatvori pokrenute programe;
dvoklikom pokreni program ComboFix.

U toku rada, ComboFix će:

proveriti postoji li novija verzija programa:
- klikni Yes ako bude ponuđeno preuzimanje iste.
prikazati DISCLAIMER OF WARRANTY ON SOFTWARE:
- klikni Yes kako bi proces bio nastavljen.
ako Recovery Console nije instalirana, ponuditi instalaciju:
- obavezno prihvati klikom na Yes i isprati postupak.
postaviti/dati određeni broj upita/obaveštenja:
- prihvati klikom na Yes ili OK.
po potrebi, restartovati Windows (više puta);
na kraju rada, otvoriti Notepad sa izveštajem o skeniranju.

Iskopiraj izveštaj koji je ComboFix napravio u temu na forumu:

klikni desnim tasterom miša u prozor Notepad-a i izaberi Select All;
klikni desnim tasterom miša na obeleženi tekst i izaberi Copy;
klikni desnim tasterom miša u polje za pisanje poruke i izaberi Paste.

Napomena:

Izveštaj će biti sačuvan pod nazivom ComboFix.txt na sistemskoj particiji (tipična lokacija: C:\ComboFix.txt);
Ukoliko nakon slanja poruke primetiš da izveštaj nije kompletan, iskoristi opciju Prikači fajl za prilaganje file-a C:\ComboFix.txt uz poruku.

x-Death-x · Ugledni građanin

Evo i ComboFix Log-fajl

ComboFix 10-02-05.04 - x-Death-x 06.02.2010 19:46:07.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1470.846 [GMT 1:00]
Running from: c:\documents and settings\x-Death-x\Desktop\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((( Files Created from 2010-01-06 to 2010-02-06 )))))))))))))))))))))))))))))))
.

2010-02-06 14:35 . 2010-02-06 14:43 -------- d-----w- c:\program files\Garena
2010-02-06 14:18 . 2010-02-06 14:25 76295 ----a-w- c:\windows\War3Unin.dat
2010-02-06 14:18 . 2010-02-06 14:24 2829 ----a-w- c:\windows\War3Unin.pif
2010-02-06 14:18 . 2010-02-06 14:24 139264 ----a-w- c:\windows\War3Unin.exe
2010-02-06 14:17 . 2010-02-06 17:58 -------- d-----w- c:\program files\Warcraft III
2010-02-06 14:11 . 2010-02-06 14:11 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-02-06 10:51 . 2010-02-06 10:51 2560 ----a-w- c:\windows\_MSRSTRT.EXE
2010-02-05 23:41 . 2010-02-06 10:59 -------- d-----w- c:\program files\JDownloader
2010-02-04 21:50 . 2004-08-03 22:08 31616 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2010-02-04 21:50 . 2004-08-03 22:08 31616 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2010-02-04 16:43 . 2010-02-04 16:43 -------- d-----w- c:\documents and settings\Default User\Local Settings\Application Data\Adobe
2010-02-04 16:42 . 2010-02-04 16:42 -------- d-----w- c:\program files\Common Files\Adobe
2010-02-04 16:39 . 2009-11-20 11:08 38784 ----a-w- c:\documents and settings\x-Death-x\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-02-04 16:39 . 2009-11-20 11:08 38784 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-02-04 16:39 . 2010-02-04 16:39 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-02-04 16:35 . 2010-02-04 16:58 -------- d-----w- c:\documents and settings\x-Death-x\Local Settings\Application Data\Adobe
2010-02-04 16:35 . 2010-02-04 16:35 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-02-04 16:35 . 2010-02-05 18:28 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-02-04 16:35 . 2010-02-04 16:35 -------- d-----w- c:\program files\NOS
2010-02-04 16:35 . 2010-01-25 09:02 31936 ----a-w- c:\documents and settings\x-Death-x\Application Data\Mozilla\Firefox\Profiles\vk1wbsjs.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
2010-02-04 16:35 . 2010-01-25 09:02 29344 ----a-w- c:\documents and settings\x-Death-x\Application Data\Mozilla\Firefox\Profiles\vk1wbsjs.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
2010-02-02 19:50 . 2010-02-02 19:50 -------- d-----w- c:\program files\WinPcap
2010-02-02 19:50 . 2010-02-02 19:50 -------- d-----w- c:\program files\YouTubeMP3Downloader
2010-02-02 14:58 . 2010-02-02 14:58 78264 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-02-02 14:38 . 2010-02-02 14:38 -------- d-----w- c:\program files\Unlocker
2010-02-02 14:20 . 2010-02-02 14:20 -------- d-----w- c:\documents and settings\x-Death-x\Local Settings\Application Data\Nero
2010-02-02 04:33 . 2010-02-02 14:43 -------- d-----w- c:\program files\Windows Sidebar
2010-02-02 04:20 . 2010-02-02 14:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2010-02-01 19:20 . 2010-02-02 15:36 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\vlc
2010-02-01 19:17 . 2010-02-01 19:18 -------- d-----w- c:\program files\VLC
2010-02-01 15:40 . 2010-02-01 15:40 -------- d-----w- c:\windows\system32\XPSViewer
2010-02-01 15:40 . 2010-02-01 15:40 -------- d-----w- c:\program files\MSBuild
2010-02-01 15:40 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-02-01 15:39 . 2010-02-01 15:40 -------- d-----w- C:\9d6e42c39e220bdf0352dc5ebce6
2010-02-01 15:39 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-02-01 15:39 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-02-01 15:39 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2010-02-01 15:39 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2010-02-01 15:39 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2010-02-01 15:39 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2010-02-01 15:39 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-02-01 15:39 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-02-01 15:36 . 2010-02-01 15:36 -------- d-----w- c:\program files\MSXML 6.0
2010-01-31 20:05 . 2010-01-31 20:05 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\TeamViewer
2010-01-31 20:04 . 2010-01-31 20:04 -------- d-----w- c:\program files\TeamViewer
2010-01-28 00:37 . 2010-01-28 00:37 -------- d-----w- c:\documents and settings\Turisti\Application Data\skypePM
2010-01-27 21:48 . 2010-01-28 01:19 -------- d-----w- c:\documents and settings\Turisti\Application Data\Skype
2010-01-25 19:05 . 2004-08-03 22:08 25600 -c--a-w- c:\windows\system32\dllcache\usbser.sys
2010-01-25 19:05 . 2004-08-03 22:08 25600 ----a-w- c:\windows\system32\drivers\usbser.sys
2010-01-24 20:44 . 2010-01-24 20:44 -------- d-----w- c:\program files\Stardock
2010-01-24 20:23 . 2010-01-25 22:08 -------- d-----w- c:\documents and settings\x-Death-x\Local Settings\Application Data\Stardock
2010-01-24 20:21 . 2010-02-06 10:52 -------- d-----w- c:\program files\AlienWare
2010-01-24 20:21 . 2010-02-06 10:48 -------- d-----w- c:\program files\Common Files\Stardock
2010-01-24 20:21 . 2003-02-26 21:27 36864 ----a-w- c:\windows\system32\wbsys.dll
2010-01-24 18:42 . 2010-01-24 18:42 -------- d-----w- c:\program files\Alwil Software
2010-01-24 18:42 . 2010-01-24 18:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-01-23 22:02 . 2010-01-23 22:06 -------- d-----w- c:\documents and settings\x-Death-x\Local Settings\Application Data\Paint.NET
2010-01-23 21:58 . 2010-01-23 21:58 -------- d-----w- c:\program files\Reference Assemblies
2010-01-23 21:53 . 2010-01-23 21:53 -------- d-----r- C:\AHCache
2010-01-21 23:29 . 2010-01-21 23:29 -------- d-----w- c:\documents and settings\Turisti\Application Data\Corel
2010-01-21 10:49 . 2010-01-21 10:49 -------- d-----w- c:\documents and settings\Turisti\Local Settings\Application Data\Apple Computer
2010-01-21 10:40 . 2010-01-21 10:40 -------- d-----w- c:\documents and settings\Turisti
2010-01-20 19:26 . 2010-01-20 19:31 -------- d-----w- c:\program files\ScreenCapture
2010-01-20 19:26 . 2010-01-20 19:26 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\InstallShield
2010-01-12 18:33 . 2010-01-12 18:33 -------- d-----w- c:\documents and settings\x-Death-x\Local Settings\Application Data\Identities
2010-01-12 16:45 . 2010-01-26 19:22 -------- d-----w- c:\documents and settings\Maja\Application Data\skypePM
2010-01-08 20:39 . 2010-01-08 21:39 -------- d-----w- c:\program files\Valve
2010-01-07 23:31 . 2010-01-07 23:31 -------- d-----w- c:\windows\Sun

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-06 10:51 . 2009-12-31 15:18 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\uTorrent
2010-02-02 15:01 . 2010-01-04 00:00 -------- d-----w- c:\program files\AIMP2
2010-02-01 17:32 . 2009-12-31 11:42 19224 ----a-w- c:\documents and settings\x-Death-x\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-31 20:08 . 2009-12-31 17:50 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\Skype
2010-01-31 20:01 . 2009-12-31 17:51 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\skypePM
2010-01-27 21:47 . 2010-01-04 21:45 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-01-26 20:47 . 2010-01-04 21:37 -------- d-----w- c:\documents and settings\Maja\Application Data\Skype
2010-01-25 19:01 . 2010-01-25 19:01 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2010-01-25 19:01 . 2010-01-25 19:01 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2010-01-20 19:27 . 2009-12-31 12:00 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-19 13:13 . 2009-12-31 11:44 162640 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-01-19 11:57 . 2009-12-31 11:44 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-01-19 11:57 . 2009-12-31 11:43 152672 ----a-w- c:\windows\system32\aswBoot.exe
2010-01-19 11:46 . 2009-12-31 11:44 46544 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-01-19 11:43 . 2009-12-31 11:44 23248 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-01-19 11:43 . 2009-12-31 11:44 100304 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-01-19 11:43 . 2009-12-31 11:44 94672 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-01-19 11:42 . 2009-12-31 11:44 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-01-19 11:42 . 2009-12-31 11:44 28240 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-01-09 15:43 . 2009-12-31 18:07 -------- d-----w- c:\program files\Common Files\Apple
2010-01-07 16:25 . 2010-01-07 16:25 -------- d-----w- c:\program files\Microsoft
2010-01-07 16:25 . 2010-01-07 16:25 -------- d-----w- c:\program files\Windows Live
2010-01-07 16:25 . 2010-01-07 16:25 -------- d-----w- c:\program files\Windows Live SkyDrive
2010-01-07 16:14 . 2010-01-07 16:14 -------- d-----w- c:\program files\Common Files\Windows Live
2010-01-07 12:25 . 2009-12-31 15:50 -------- d-----w- c:\program files\Common Files\AVSMedia
2010-01-07 12:19 . 2010-01-07 12:16 -------- d-----w- c:\program files\PowerDVD
2010-01-07 12:19 . 2010-01-07 12:19 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\CyberLink
2010-01-07 12:18 . 2010-01-07 12:18 -------- d-----w- c:\documents and settings\All Users\Application Data\CyberLink
2010-01-07 12:17 . 2010-01-07 12:16 -------- d-----w- c:\program files\CyberLink
2010-01-07 12:02 . 2010-01-04 21:44 -------- d-----w- c:\program files\SourceTec
2010-01-07 12:02 . 2010-01-04 21:44 -------- d-----w- c:\program files\Common Files\SourceTec
2010-01-06 15:15 . 2010-01-04 10:26 -------- d-----w- c:\documents and settings\Maja\Application Data\Free Download Manager
2010-01-05 20:44 . 2010-01-05 20:44 -------- d-----w- c:\documents and settings\Maja\Application Data\Corel
2010-01-05 20:40 . 2009-12-31 12:06 -------- d-----w- c:\program files\Realtek
2010-01-05 16:52 . 2010-01-05 16:52 -------- d-----w- c:\program files\D-Link AirPlus
2010-01-05 16:13 . 2010-01-05 16:11 -------- d-----w- c:\program files\Driver Magician
2010-01-04 21:37 . 2010-01-04 21:37 -------- d-----w- c:\program files\Common Files\Skype
2010-01-04 21:37 . 2009-12-31 17:48 -------- d-----r- c:\program files\Skype
2010-01-04 21:31 . 2010-01-04 21:31 -------- d-----w- c:\program files\Inpaint
2010-01-03 23:03 . 2010-01-03 22:16 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-01-03 22:14 . 2010-01-03 22:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard
2010-01-02 20:38 . 2010-01-02 20:39 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-01-02 20:38 . 2010-01-02 20:38 -------- d-----w- c:\program files\Java
2010-01-02 20:38 . 2010-01-02 20:38 152576 ----a-w- c:\documents and settings\x-Death-x\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2010-01-02 20:36 . 2010-01-02 20:36 79488 ----a-w- c:\documents and settings\x-Death-x\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-01-02 19:24 . 2010-01-02 19:24 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\Leadertech
2010-01-02 19:12 . 2010-01-02 19:12 -------- d-----w- c:\program files\Deamon
2010-01-02 14:35 . 2009-12-31 18:08 -------- d-----w- c:\program files\QuickTime
2010-01-02 14:35 . 2009-12-31 18:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-01-01 14:31 . 2009-12-31 18:10 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\Apple Computer
2010-01-01 13:58 . 2010-01-01 13:58 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\AnvSoft
2010-01-01 11:56 . 2010-01-01 11:56 -------- d-----w- c:\documents and settings\All Users\Application Data\AVS4YOU
2010-01-01 11:52 . 2009-12-31 11:16 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-12-31 18:10 . 2009-12-31 18:09 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-12-31 18:08 . 2009-12-31 18:08 -------- d-----w- c:\program files\Apple Software Update
2009-12-31 18:07 . 2009-12-31 18:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-12-31 17:51 . 2009-12-31 17:51 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-12-31 17:48 . 2009-12-31 17:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-12-31 15:31 . 2009-12-31 15:31 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\Ambient Design
2009-12-31 15:19 . 2009-12-31 15:19 -------- d-----w- c:\program files\uTorrent
2009-12-31 14:03 . 2009-12-31 14:03 -------- d-----w- c:\program files\7-Zip
2009-12-31 14:01 . 2009-12-31 14:01 0 ----a-w- c:\windows\nsreg.dat
2009-12-31 13:59 . 2009-12-31 13:59 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\Corel
2009-12-31 12:36 . 2009-12-31 12:36 -------- d-----w- c:\program files\Common Files\Corel
2009-12-31 12:36 . 2009-12-31 12:00 -------- d-----w- c:\program files\Common Files\InstallShield
2009-12-31 12:36 . 2009-12-31 12:36 -------- d-----w- c:\program files\Corel
2009-12-31 12:27 . 2009-12-31 12:27 -------- d-----w- c:\program files\Microsoft ActiveSync
2009-12-31 11:57 . 2009-12-31 11:57 -------- d-----w- c:\program files\MSXML 4.0
2009-12-31 11:17 . 2009-12-31 11:17 -------- d-----w- c:\program files\microsoft frontpage
2009-12-31 11:12 . 2009-12-31 11:12 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-12-29 21:29 . 2009-12-31 19:44 258352 ----a-w- c:\windows\system32\unicows.dll
.

------- Sigcheck -------

[-] 2007-12-29 . 9F960FAC5166F8626B9CDE4DD9A0EB84 . 1580544 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cf59ae24-5796-44fc-9575-8d4f383c65f8}]
2010-01-29 14:44 221184 ----a-w- c:\program files\YouTubeMP3Downloader\MinBHOMp3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{f27a9a1d-6f23-442d-88c0-5dc40fd13dcd}"= "c:\program files\YouTubeMP3Downloader\YouTubeMP3.dll" [2010-01-29 704512]

[HKEY_CLASSES_ROOT\clsid\{f27a9a1d-6f23-442d-88c0-5dc40fd13dcd}]
[HKEY_CLASSES_ROOT\KBBar.KBBarBandMp3.1]
[HKEY_CLASSES_ROOT\TypeLib\{f20fd027-a5f3-451a-8db1-13298321f6a8}]
[HKEY_CLASSES_ROOT\KBBar.KBBarBandMp3]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2005-10-15 14864384]
"CorelDRAW Graphics Suite 11b"="c:\program files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe" [2003-11-25 729088]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-01-02 149280]
"RemoteControl"="c:\program files\PowerDVD\PDVDServ.exe" [2007-02-07 71216]
"LanguageShortcut"="c:\program files\PowerDVD\Language\Language.exe" [2007-02-07 54832]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-01-19 2743104]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

c:\documents and settings\x-Death-x\Start Menu\Programs\Startup\
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2010-1-24 3450608]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
D-Link AirPlus.lnk - c:\program files\D-Link AirPlus\AirPlus.exe [2010-1-5 262144]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\PowerDVD\\PowerDVD.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Program Files\\YouTubeMP3Downloader\\YouTubeMP3.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Garena\\Garena.exe"=

R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [2.1.2010 20:12 155136]
R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [2.1.2010 20:12 5248]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [31.12.2009 12:44 162640]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [31.12.2009 12:44 19024]
R3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\X-DEAT~1\LOCALS~1\Temp\ISD14F.tmp --> c:\docume~1\X-DEAT~1\LOCALS~1\Temp\ISD14F.tmp [?]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [6.2.2010 15:11 691696]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [6.11.2007 21:22 34064]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - GARENAPENGINE

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.googlebreak.com/?CID=3&PID=STV
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\x-Death-x\Application Data\Mozilla\Firefox\Profiles\vk1wbsjs.default\
FF - prefs.js: browser.search.selectedEngine - www.googlebreak.com
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ba/
FF - plugin: c:\documents and settings\x-Death-x\Application Data\Mozilla\Firefox\Profiles\vk1wbsjs.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-06 19:49
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x897A3AE8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba8ecfc3
\Driver\ACPI -> ACPI.sys @ 0xba759cb8
\Driver\atapi -> 0x897a3ae8
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x8058236c
ParseProcedure -> ntkrnlpa.exe @ 0x8058146a
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x8058236c
ParseProcedure -> ntkrnlpa.exe @ 0x8058146a
NDIS: Realtek RTL8139/810x Family Fast Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0xba5e0ba0
PacketIndicateHandler -> NDIS.sys @ 0xba5edb21
SendHandler -> NDIS.sys @ 0xba5cb87b
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\X-DEAT~1\LOCALS~1\Temp\ISD14F.tmp"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\PowerDVD\000.fcl"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-527237240-329068152-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(716)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2604)
c:\windows\system32\msi.dll
.
Completion time: 2010-02-06 19:50:26
ComboFix-quarantined-files.txt 2010-02-06 18:50

Pre-Run: 51.167.334.400 bytes free
Post-Run: 51.789.438.976 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 0CE7CD7EB18E4AAC87A0D7228EF91E14

Bogdan-Tc · Anti Malware Fighter Rank 1

Korak 1.

Preuzmi DeFogger sa ovog linka na Desktop .

Dvoklikom pokreni DeFogger;
Pojaviće se MsgBox na kome ćeš kliknuti na taster Disable;
Ponovo će se pojaviti MsgBox na kome ćeš kliknuti na Yes;

Sačekaj da se procesuiranje programa DeFogger izvrši pa nastavi prema sledećem uputstvu.

Napomena:Na kraju postupka ce biti potrebno ponovno pokretanje Windows-a.
Ovim postupkom će biti deaktivirani CD/DVD emulatori i omogućen neometan rad programa koje koristimo.

Korak 2.

Otvoriti Notepad i iskopirati sledeci tekst:

x-Death-x · Ugledni građanin

Evo ga...

ComboFix 10-02-05.04 - x-Death-x 07.02.2010 15:34:47.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1470.993 [GMT 1:00]
Running from: c:\documents and settings\x-Death-x\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\x-Death-x\Desktop\CFScript.txt
AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((( Files Created from 2010-01-07 to 2010-02-07 )))))))))))))))))))))))))))))))
.

2010-02-06 14:35 . 2010-02-06 22:43 -------- d-----w- c:\program files\Garena
2010-02-06 14:18 . 2010-02-06 19:32 98366 ----a-w- c:\windows\War3Unin.dat
2010-02-06 14:18 . 2010-02-06 14:24 2829 ----a-w- c:\windows\War3Unin.pif
2010-02-06 14:18 . 2010-02-06 14:24 139264 ----a-w- c:\windows\War3Unin.exe
2010-02-06 14:17 . 2010-02-06 22:35 -------- d-----w- c:\program files\Warcraft III
2010-02-06 14:11 . 2010-02-06 14:11 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-02-06 10:51 . 2010-02-06 10:51 2560 ----a-w- c:\windows\_MSRSTRT.EXE
2010-02-05 23:41 . 2010-02-06 10:59 -------- d-----w- c:\program files\JDownloader
2010-02-04 21:50 . 2004-08-03 22:08 31616 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2010-02-04 21:50 . 2004-08-03 22:08 31616 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2010-02-04 16:43 . 2010-02-04 16:43 -------- d-----w- c:\documents and settings\Default User\Local Settings\Application Data\Adobe
2010-02-04 16:42 . 2010-02-04 16:42 -------- d-----w- c:\program files\Common Files\Adobe
2010-02-04 16:39 . 2009-11-20 11:08 38784 ----a-w- c:\documents and settings\x-Death-x\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-02-04 16:39 . 2009-11-20 11:08 38784 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-02-04 16:39 . 2010-02-04 16:39 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-02-04 16:35 . 2010-02-04 16:58 -------- d-----w- c:\documents and settings\x-Death-x\Local Settings\Application Data\Adobe
2010-02-04 16:35 . 2010-02-04 16:35 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-02-04 16:35 . 2010-02-05 18:28 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-02-04 16:35 . 2010-02-04 16:35 -------- d-----w- c:\program files\NOS
2010-02-04 16:35 . 2010-01-25 09:02 31936 ----a-w- c:\documents and settings\x-Death-x\Application Data\Mozilla\Firefox\Profiles\vk1wbsjs.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
2010-02-04 16:35 . 2010-01-25 09:02 29344 ----a-w- c:\documents and settings\x-Death-x\Application Data\Mozilla\Firefox\Profiles\vk1wbsjs.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
2010-02-02 19:50 . 2010-02-02 19:50 -------- d-----w- c:\program files\WinPcap
2010-02-02 19:50 . 2010-02-02 19:50 -------- d-----w- c:\program files\YouTubeMP3Downloader
2010-02-02 14:58 . 2010-02-02 14:58 78264 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-02-02 14:38 . 2010-02-02 14:38 -------- d-----w- c:\program files\Unlocker
2010-02-02 14:20 . 2010-02-02 14:20 -------- d-----w- c:\documents and settings\x-Death-x\Local Settings\Application Data\Nero
2010-02-02 04:33 . 2010-02-02 14:43 -------- d-----w- c:\program files\Windows Sidebar
2010-02-02 04:20 . 2010-02-02 14:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2010-02-01 19:20 . 2010-02-02 15:36 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\vlc
2010-02-01 19:17 . 2010-02-01 19:18 -------- d-----w- c:\program files\VLC
2010-02-01 15:40 . 2010-02-01 15:40 -------- d-----w- c:\windows\system32\XPSViewer
2010-02-01 15:40 . 2010-02-01 15:40 -------- d-----w- c:\program files\MSBuild
2010-02-01 15:40 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-02-01 15:39 . 2010-02-01 15:40 -------- d-----w- C:\9d6e42c39e220bdf0352dc5ebce6
2010-02-01 15:39 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-02-01 15:39 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-02-01 15:39 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2010-02-01 15:39 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2010-02-01 15:39 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2010-02-01 15:39 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2010-02-01 15:39 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-02-01 15:39 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-02-01 15:36 . 2010-02-01 15:36 -------- d-----w- c:\program files\MSXML 6.0
2010-01-31 20:05 . 2010-01-31 20:05 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\TeamViewer
2010-01-31 20:04 . 2010-01-31 20:04 -------- d-----w- c:\program files\TeamViewer
2010-01-28 00:37 . 2010-01-28 00:37 -------- d-----w- c:\documents and settings\Turisti\Application Data\skypePM
2010-01-27 21:48 . 2010-01-28 01:19 -------- d-----w- c:\documents and settings\Turisti\Application Data\Skype
2010-01-25 19:05 . 2004-08-03 22:08 25600 -c--a-w- c:\windows\system32\dllcache\usbser.sys
2010-01-25 19:05 . 2004-08-03 22:08 25600 ----a-w- c:\windows\system32\drivers\usbser.sys
2010-01-24 20:44 . 2010-01-24 20:44 -------- d-----w- c:\program files\Stardock
2010-01-24 20:23 . 2010-01-25 22:08 -------- d-----w- c:\documents and settings\x-Death-x\Local Settings\Application Data\Stardock
2010-01-24 20:21 . 2010-02-06 10:52 -------- d-----w- c:\program files\AlienWare
2010-01-24 20:21 . 2010-02-06 10:48 -------- d-----w- c:\program files\Common Files\Stardock
2010-01-24 20:21 . 2003-02-26 21:27 36864 ----a-w- c:\windows\system32\wbsys.dll
2010-01-24 18:42 . 2010-01-24 18:42 -------- d-----w- c:\program files\Alwil Software
2010-01-24 18:42 . 2010-01-24 18:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-01-23 22:02 . 2010-01-23 22:06 -------- d-----w- c:\documents and settings\x-Death-x\Local Settings\Application Data\Paint.NET
2010-01-23 21:58 . 2010-01-23 21:58 -------- d-----w- c:\program files\Reference Assemblies
2010-01-23 21:53 . 2010-01-23 21:53 -------- d-----r- C:\AHCache
2010-01-21 23:29 . 2010-01-21 23:29 -------- d-----w- c:\documents and settings\Turisti\Application Data\Corel
2010-01-21 10:49 . 2010-01-21 10:49 -------- d-----w- c:\documents and settings\Turisti\Local Settings\Application Data\Apple Computer
2010-01-21 10:40 . 2010-01-21 10:40 -------- d-----w- c:\documents and settings\Turisti
2010-01-20 19:26 . 2010-01-20 19:31 -------- d-----w- c:\program files\ScreenCapture
2010-01-20 19:26 . 2010-01-20 19:26 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\InstallShield
2010-01-12 18:33 . 2010-01-12 18:33 -------- d-----w- c:\documents and settings\x-Death-x\Local Settings\Application Data\Identities
2010-01-12 16:45 . 2010-01-26 19:22 -------- d-----w- c:\documents and settings\Maja\Application Data\skypePM
2010-01-08 20:39 . 2010-01-08 21:39 -------- d-----w- c:\program files\Valve

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-06 10:51 . 2009-12-31 15:18 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\uTorrent
2010-02-02 15:01 . 2010-01-04 00:00 -------- d-----w- c:\program files\AIMP2
2010-02-01 17:32 . 2009-12-31 11:42 19224 ----a-w- c:\documents and settings\x-Death-x\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-31 20:08 . 2009-12-31 17:50 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\Skype
2010-01-31 20:01 . 2009-12-31 17:51 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\skypePM
2010-01-27 21:47 . 2010-01-04 21:45 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-01-26 20:47 . 2010-01-04 21:37 -------- d-----w- c:\documents and settings\Maja\Application Data\Skype
2010-01-25 19:01 . 2010-01-25 19:01 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2010-01-25 19:01 . 2010-01-25 19:01 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2010-01-20 19:27 . 2009-12-31 12:00 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-19 13:13 . 2009-12-31 11:44 162640 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-01-19 11:57 . 2009-12-31 11:44 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-01-19 11:57 . 2009-12-31 11:43 152672 ----a-w- c:\windows\system32\aswBoot.exe
2010-01-19 11:46 . 2009-12-31 11:44 46544 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-01-19 11:43 . 2009-12-31 11:44 23248 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-01-19 11:43 . 2009-12-31 11:44 100304 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-01-19 11:43 . 2009-12-31 11:44 94672 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-01-19 11:42 . 2009-12-31 11:44 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-01-19 11:42 . 2009-12-31 11:44 28240 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-01-09 15:43 . 2009-12-31 18:07 -------- d-----w- c:\program files\Common Files\Apple
2010-01-07 16:25 . 2010-01-07 16:25 -------- d-----w- c:\program files\Microsoft
2010-01-07 16:25 . 2010-01-07 16:25 -------- d-----w- c:\program files\Windows Live
2010-01-07 16:25 . 2010-01-07 16:25 -------- d-----w- c:\program files\Windows Live SkyDrive
2010-01-07 16:14 . 2010-01-07 16:14 -------- d-----w- c:\program files\Common Files\Windows Live
2010-01-07 12:25 . 2009-12-31 15:50 -------- d-----w- c:\program files\Common Files\AVSMedia
2010-01-07 12:19 . 2010-01-07 12:16 -------- d-----w- c:\program files\PowerDVD
2010-01-07 12:19 . 2010-01-07 12:19 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\CyberLink
2010-01-07 12:18 . 2010-01-07 12:18 -------- d-----w- c:\documents and settings\All Users\Application Data\CyberLink
2010-01-07 12:17 . 2010-01-07 12:16 -------- d-----w- c:\program files\CyberLink
2010-01-07 12:02 . 2010-01-04 21:44 -------- d-----w- c:\program files\SourceTec
2010-01-07 12:02 . 2010-01-04 21:44 -------- d-----w- c:\program files\Common Files\SourceTec
2010-01-06 15:15 . 2010-01-04 10:26 -------- d-----w- c:\documents and settings\Maja\Application Data\Free Download Manager
2010-01-05 20:44 . 2010-01-05 20:44 -------- d-----w- c:\documents and settings\Maja\Application Data\Corel
2010-01-05 20:40 . 2009-12-31 12:06 -------- d-----w- c:\program files\Realtek
2010-01-05 16:52 . 2010-01-05 16:52 -------- d-----w- c:\program files\D-Link AirPlus
2010-01-05 16:13 . 2010-01-05 16:11 -------- d-----w- c:\program files\Driver Magician
2010-01-04 21:37 . 2010-01-04 21:37 -------- d-----w- c:\program files\Common Files\Skype
2010-01-04 21:37 . 2009-12-31 17:48 -------- d-----r- c:\program files\Skype
2010-01-04 21:31 . 2010-01-04 21:31 -------- d-----w- c:\program files\Inpaint
2010-01-03 23:03 . 2010-01-03 22:16 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-01-03 22:14 . 2010-01-03 22:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard
2010-01-02 20:38 . 2010-01-02 20:39 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-01-02 20:38 . 2010-01-02 20:38 -------- d-----w- c:\program files\Java
2010-01-02 20:38 . 2010-01-02 20:38 152576 ----a-w- c:\documents and settings\x-Death-x\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2010-01-02 20:36 . 2010-01-02 20:36 79488 ----a-w- c:\documents and settings\x-Death-x\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-01-02 19:24 . 2010-01-02 19:24 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\Leadertech
2010-01-02 19:12 . 2010-01-02 19:12 -------- d-----w- c:\program files\Deamon
2010-01-02 14:35 . 2009-12-31 18:08 -------- d-----w- c:\program files\QuickTime
2010-01-02 14:35 . 2009-12-31 18:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-01-01 14:31 . 2009-12-31 18:10 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\Apple Computer
2010-01-01 13:58 . 2010-01-01 13:58 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\AnvSoft
2010-01-01 11:56 . 2010-01-01 11:56 -------- d-----w- c:\documents and settings\All Users\Application Data\AVS4YOU
2010-01-01 11:52 . 2009-12-31 11:16 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-12-31 18:10 . 2009-12-31 18:09 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-12-31 18:08 . 2009-12-31 18:08 -------- d-----w- c:\program files\Apple Software Update
2009-12-31 18:07 . 2009-12-31 18:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-12-31 17:51 . 2009-12-31 17:51 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-12-31 17:48 . 2009-12-31 17:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-12-31 15:31 . 2009-12-31 15:31 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\Ambient Design
2009-12-31 15:19 . 2009-12-31 15:19 -------- d-----w- c:\program files\uTorrent
2009-12-31 14:03 . 2009-12-31 14:03 -------- d-----w- c:\program files\7-Zip
2009-12-31 14:01 . 2009-12-31 14:01 0 ----a-w- c:\windows\nsreg.dat
2009-12-31 13:59 . 2009-12-31 13:59 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\Corel
2009-12-31 12:36 . 2009-12-31 12:36 -------- d-----w- c:\program files\Common Files\Corel
2009-12-31 12:36 . 2009-12-31 12:00 -------- d-----w- c:\program files\Common Files\InstallShield
2009-12-31 12:36 . 2009-12-31 12:36 -------- d-----w- c:\program files\Corel
2009-12-31 12:27 . 2009-12-31 12:27 -------- d-----w- c:\program files\Microsoft ActiveSync
2009-12-31 11:57 . 2009-12-31 11:57 -------- d-----w- c:\program files\MSXML 4.0
2009-12-31 11:17 . 2009-12-31 11:17 -------- d-----w- c:\program files\microsoft frontpage
2009-12-31 11:12 . 2009-12-31 11:12 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-12-29 21:29 . 2009-12-31 19:44 258352 ----a-w- c:\windows\system32\unicows.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

--- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File size: 86016
Created time: 2010-02-04 16:35
Modified time: 2010-02-04 16:35
MD5: 8C27E380661ECBE327203F3B1456DD2C
SHA1: 56E3ABCA71E56065FB1E91BE7A070DDB8FE6F132

------- Sigcheck -------

[-] 2007-12-29 . 9F960FAC5166F8626B9CDE4DD9A0EB84 . 1580544 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-02-06_18.49.08 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-02-07 14:28 . 2010-02-07 14:28 16384 c:\windows\Temp\Perflib_Perfdata_1fc.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cf59ae24-5796-44fc-9575-8d4f383c65f8}]
2010-01-29 14:44 221184 ----a-w- c:\program files\YouTubeMP3Downloader\MinBHOMp3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{f27a9a1d-6f23-442d-88c0-5dc40fd13dcd}"= "c:\program files\YouTubeMP3Downloader\YouTubeMP3.dll" [2010-01-29 704512]

[HKEY_CLASSES_ROOT\clsid\{f27a9a1d-6f23-442d-88c0-5dc40fd13dcd}]
[HKEY_CLASSES_ROOT\KBBar.KBBarBandMp3.1]
[HKEY_CLASSES_ROOT\TypeLib\{f20fd027-a5f3-451a-8db1-13298321f6a8}]
[HKEY_CLASSES_ROOT\KBBar.KBBarBandMp3]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2005-10-15 14864384]
"CorelDRAW Graphics Suite 11b"="c:\program files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe" [2003-11-25 729088]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-01-02 149280]
"RemoteControl"="c:\program files\PowerDVD\PDVDServ.exe" [2007-02-07 71216]
"LanguageShortcut"="c:\program files\PowerDVD\Language\Language.exe" [2007-02-07 54832]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-01-19 2743104]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

c:\documents and settings\x-Death-x\Start Menu\Programs\Startup\
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2010-1-24 3450608]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
D-Link AirPlus.lnk - c:\program files\D-Link AirPlus\AirPlus.exe [2010-1-5 262144]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\PowerDVD\\PowerDVD.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Garena\\Garena.exe"=
"c:\\Program Files\\YouTubeMP3Downloader\\YouTubeMP3.exe"=

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [31.12.2009 12:44 162640]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [31.12.2009 12:44 19024]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\X-DEAT~1\LOCALS~1\Temp\UZM361.tmp --> c:\docume~1\X-DEAT~1\LOCALS~1\Temp\UZM361.tmp [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [6.11.2007 21:22 34064]
S4 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [2.1.2010 20:12 155136]
S4 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [2.1.2010 20:12 5248]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [6.2.2010 15:11 691696]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - ISAPNP

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.googlebreak.com/?CID=3&PID=STV
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\x-Death-x\Application Data\Mozilla\Firefox\Profiles\vk1wbsjs.default\
FF - prefs.js: browser.search.selectedEngine - www.googlebreak.com
FF - prefs.js: browser.startup.homepage - hxxp://www.googlebreak.com/?CID=3&PID=STV
FF - plugin: c:\documents and settings\x-Death-x\Application Data\Mozilla\Firefox\Profiles\vk1wbsjs.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-07 15:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\X-DEAT~1\LOCALS~1\Temp\UZM361.tmp"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\PowerDVD\000.fcl"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(700)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3328)
c:\program files\Stardock\ObjectDock\DockShellHook.dll
.
Completion time: 2010-02-07 15:40:23
ComboFix-quarantined-files.txt 2010-02-07 14:40
ComboFix2.txt 2010-02-06 18:50

Pre-Run: 51.729.027.072 bytes free
Post-Run: 51.699.220.480 bytes free

- - End Of File - - 863F0CAE70693A84743474C18B32237F

Bogdan-Tc · Anti Malware Fighter Rank 1

Ovo sad deluje ok.

Isprati još sledeća uputstva...

Korak 1.

Potrebno je deinstalirati ComboFix:

klikni start (ili ), a zatim RUN.

Na Visti koristiti Start Search polje ukoliko Run nije dostupan.
U liniju za unos teksta ukucaj (iskopiraj) sledeće:
ComboFix /Uninstall

Primeti da postoji razmak između "ComboFix" i "/Uninstall".
a zatim klikni OK (ili pritisni Enter).

Sačekaj da se proces deinstalacije završi.

Korak 2.

DeFogger

Pojaviće se MsgBox na kome ćeš kliknuti na taster Re-enable;
Ponovo će se pojaviti MsgBox na kome ćeš kliknuti na Yes;

Sačekaj da se procesuiranje programa DeFogger izvrši pa nastavi prema sledećem uputstvu.

Napomena:Na kraju postupka ce biti potrebno ponovno pokretanje Windows-a.
Ovim postupkom će ponovo biti aktivirani CD/DVD emulatori.

x-Death-x · Ugledni građanin

Hvala mnogo...Sada neko od modova neka stavi katanac ako hoce...da drugi nebi piskarali ovuda...

Imas moje postovanje...

Vesti

Problem!!Nije Hitno Ali Je Pozeljna Pomoc...