Poslao: 29 Apr 2012 21:28
|
offline
- Master Boot
- Počasni građanin
- Pridružio: 21 Avg 2011
- Poruke: 810
- Gde živiš: Sibir
|
Napisano: 29 Apr 2012 21:19
Pozdrav.
Pokrenuo sam USB na kome je Avast! detektovao virus Sality.MCShield nije mogao da pokrene pretragu zbog toga sto ga je Avast! onemogucio (ne znam zbog cega).
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by BOGDAN at 20:58:19 on 2012-04-29
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.154 [GMT 2:00]
.
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Terminator\Quick TV\Scheduled.exe
C:\WINDOWS\system32\CTFMON.EXE
C:\Program Files\Terminator\TV7131 Utilities\P3XRCtl.exe
svchost.exe
C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\BitTorrent\BitTorrent.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\MCShield\MCShieldRTM.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Adobe\Reader 10.0\Reader\AcroRd32.exe
C:\Program Files\Adobe\Reader 10.0\Reader\AcroRd32.exe
C:\Program Files\Rainmeter\Rainmeter.exe
C:\Program Files\DealBulldog Toolbar\TbHelper2.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.bigseekpro.com/freedesktopclock/{BB1D9097-6112-4B6D-9043-251035940B25}
mStart Page = hxxp://www.bigseekpro.com/freedesktopclock/{BB1D9097-6112-4B6D-9043-251035940B25}
uURLSearchHooks: ToolbarURLSearchHook Class: {ca3eb689-8f09-4026-aa10-b9534c691ce0} - c:\program files\dealbulldog toolbar\tbhelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: Search Results Toolbar: {94366e2c-9923-431c-b0d6-747447dd0f2b} - c:\program files\searchresults1\searchresultsDx.dll
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: SMTTB2009 Class: {fcbccb87-9224-4b8d-b117-f56d924beb18} - c:\program files\dealbulldog toolbar\tbcore3.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
TB: DealBulldog Toolbar: {338b4dfe-2e2c-4338-9e41-e176d497299e} - c:\program files\dealbulldog toolbar\tbcore3.dll
TB: Search Results Toolbar: {94366e2c-9923-431c-b0d6-747447dd0f2b} - c:\program files\searchresults1\searchresultsDx.dll
uRun: [ctfmon.exe] c:\windows\system32\CTFMON.EXE
uRun: [Google Update] "c:\documents and settings\bogdan\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [MCShield Monitor] c:\program files\mcshield\MCShieldRTM.exe
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [Quick TV Agent] c:\program files\terminator\quick tv\Scheduled.exe
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [RemoteControl] "c:\program files\asustek\asusdvd\PDVDServ.exe"
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [WinampAgent] "c:\program files\winamp\winampa.exe"
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
mRunOnce: [Malwarebytes Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
dRunOnce: [IE8] rundll32 advpack.dll,LaunchINFSection IE8.INF,FirstUserStart
dRunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\tvremo~1.lnk - c:\program files\terminator\tv7131 utilities\P3XRCtl.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
TCP: DhcpNameServer = 37.0.70.18 37.0.70.19 109.122.98.116 109.122.98.117
TCP: Interfaces\{F2A40791-69D5-41B4-951D-61A093228F96} : DhcpNameServer = 37.0.70.18 37.0.70.19 109.122.98.116 109.122.98.117
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\bogdan\application data\mozilla\firefox\profiles\tsjpa7f7.default\
FF - plugin: c:\documents and settings\bogdan\local settings\application data\google\update\1.3.21.111\npGoogleUpdate3.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_2_202_233.dll
.
============= SERVICES / DRIVERS ===============
.
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2012-4-29 337880]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2012-4-29 20696]
R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2012-4-29 44768]
R3 Cap713x;Philips Cap713x Video Capture;c:\windows\system32\drivers\Cap713x.sys [2012-4-29 685824]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2012-4-29 612184]
S3 3xHybrid;DTV-DVB 3056 PCI Card;c:\windows\system32\drivers\3xHybrid.sys [2012-4-29 883328]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-29 253088]
.
=============== Created Last 30 ================
.
2012-04-29 18:33:38 -------- d-sh--w- c:\windows\system32\AI_RecycleBin
2012-04-29 18:33:22 -------- d-----w- c:\program files\W3i, LLC
2012-04-29 18:32:18 -------- d-----w- c:\documents and settings\bogdan\application data\searchresults1
2012-04-29 18:31:48 -------- d-----w- c:\program files\searchresults1
2012-04-29 18:13:36 -------- d-----w- c:\documents and settings\bogdan\application data\Toolbar4
2012-04-29 18:13:23 -------- d-----w- c:\program files\DealBulldog Toolbar
2012-04-29 17:41:38 -------- d-----w- c:\documents and settings\bogdan\application data\Rainmeter
2012-04-29 17:40:18 -------- d-----w- c:\program files\Rainmeter
.
==================== Find3M ====================
.
2012-04-29 11:19:48 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-29 11:19:48 418464 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-04-04 13:56:40 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-03-06 23:15:19 41184 ----a-w- c:\windows\avastSS.scr
2012-03-06 23:03:51 612184 ----a-w- c:\windows\system32\drivers\aswSnx.sys
.
============= FINISH: 21:02:10,06 ===============
https://www.mycity.rs/must-login.png
Ne mogu da napravim GMER log jer mi na sredinu skeniranje izbacuje problem sa programom.
Dopuna: 29 Apr 2012 21:28
Ovo je Avast! pronasao.
|
|
|
|
|
Poslao: 29 Apr 2012 22:18
|
offline
- Master Boot
- Počasni građanin
- Pridružio: 21 Avg 2011
- Poruke: 810
- Gde živiš: Sibir
|
Napisano: 29 Apr 2012 21:57
MCShield log
>>> MCShield v 2.0.3.11 <<<
29.4.2012 21:56:54 > Диск G: - скенирање започето (BOGDAN ~491 MB, FAT32 флeш диск )...
>>> G:\edic.pif - Malware > Обрисано. (12.04.29. 21.56 edic.pif.455334; MD5: 7869d75c671d95bead8909cc69565727)
>>> G:\opal.cmd - Malware > Обрисано. (12.04.29. 21.56 opal.cmd.808693; MD5: 26ead136a8d32eac983e3342ec9a0231)
>>> G:\ubbul.pif - Malware > Обрисано. (12.04.29. 21.57 ubbul.pif.255941; MD5: 49aa293fcba2204700eb93d59d1402c4)
>>> G:\mafqxc.pif - Malware > Обрисано. (12.04.29. 21.57 mafqxc.pif.22122; MD5: 7e0b07c5b1aef9d528eb5ff7bdab1ea1)
>>> G:\ahmmku.exe - Сумњиво > Преименовано. (MD5: 41673074c3b9b9aa001a105efa5dc2b2)
>>> G:\ffpsri.exe - Сумњиво > Преименовано. (MD5: 58d1efa5a6b5bd5e14e3f4034643e043)
>>> G:\~WRL3448.tmp - Сумњиво > Преименовано. (MD5: 4a8f527e6eff6841f230aeec5acb502a)
>>> G:\~WRL3351.tmp - Сумњиво > Преименовано. (MD5: 7bc33c1cbadbeaae0456000ceeccbe4f)
>>> G:\~WRL0714.tmp - Сумњиво > Преименовано. (MD5: c09fae4b0c1ceb1a58c05f047fe0de23)
=> Малициозних датотека : 4/4 обрисано.
=> Сумњивих датотека : 5/5 преименовано.
____________________________________________
::::: Трајање скенирања: 8s ::::::::::::::::
____________________________________________
Dopuna: 29 Apr 2012 22:18
Izvini ako te prekidam
Je li na racunar inficiran?
|
|
|
|
|
Poslao: 30 Apr 2012 16:10
|
offline
- Master Boot
- Počasni građanin
- Pridružio: 21 Avg 2011
- Poruke: 810
- Gde živiš: Sibir
|
Napisano: 30 Apr 2012 15:07
Formatirao sam fles.
Na njemu je bio samo jedan teksualni dokument i na njemu je pronasao virus,i onda sam ga formatirao(ne gubim nista posebno).
Avast ga je skenirao i blokirao malware pa ga zatim otvorio.Je li postoji mogucnost da sam se zarazio?
Izvinite sto sam ovako skeptican ali stvarno ne bih volio da se ponovo zarazim Salytijem
Dopuna: 30 Apr 2012 16:10
I da na poslednjem skeniranju MCShield nije pronasao nikakvu pretnju.
>>> MCShield v 2.0.3.11 <<<
30.4.2012 15:01:22 > Диск G: - скенирање започето (BOGDAN ~491 MB, FAT32 флeш диск )...
=> Диск је чист.
|
|
|
|
|
|
Poslao: 30 Apr 2012 20:45
|
offline
- ivance95
- AMF pripravnik
- Pridružio: 04 Jul 2011
- Poruke: 5424
|
Da proverimo još jednom za svaki slučaj.
Preuzmi program DDS sa ovog, ovog ili ovog linka na Desktop.
Dvoklikom pokreni DDS;
nakon par minuta će se pojaviti poruka o završetku procesa i otvoriće se dva izveštaja;
snimi oba izveštaja na Desktop (izborom File > Save As);
dvoklikom otvori DDS.txt i iskopiraj sadržaj u temu;
file Attach.txt priloži uz poruku korišćenjem opcije Prikači fajl.
Napomena: u slučaju da zaštitni softver omete DDS u radu, privremeno deaktiviraj isti (uputstvo) i ponovo pokreni DDS.
Ivance95 (AMF Tim)
|
|
|
|
Poslao: 30 Apr 2012 21:04
|
offline
- Master Boot
- Počasni građanin
- Pridružio: 21 Avg 2011
- Poruke: 810
- Gde živiš: Sibir
|
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by BOGDAN at 21:02:01 on 2012-04-30
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.145 [GMT 2:00]
.
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MCShield\mcshieldrtm.exe
C:\Program Files\Terminator\TV7131 Utilities\P3XRCtl.exe
svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Rainmeter\Rainmeter.exe
C:\Program Files\BitTorrent\BitTorrent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.bigseekpro.com/freedesktopclock/{BB1D9097-6112-4B6D-9043-251035940B25}
mStart Page = hxxp://www.bigseekpro.com/freedesktopclock/{BB1D9097-6112-4B6D-9043-251035940B25}
uURLSearchHooks: ToolbarURLSearchHook Class: {ca3eb689-8f09-4026-aa10-b9534c691ce0} - c:\program files\dealbulldog toolbar\tbhelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: Search Results Toolbar: {94366e2c-9923-431c-b0d6-747447dd0f2b} - c:\program files\searchresults1\searchresultsDx.dll
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: SMTTB2009 Class: {fcbccb87-9224-4b8d-b117-f56d924beb18} - c:\program files\dealbulldog toolbar\tbcore3.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
TB: DealBulldog Toolbar: {338b4dfe-2e2c-4338-9e41-e176d497299e} - c:\program files\dealbulldog toolbar\tbcore3.dll
TB: Search Results Toolbar: {94366e2c-9923-431c-b0d6-747447dd0f2b} - c:\program files\searchresults1\searchresultsDx.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Google Update] "c:\documents and settings\bogdan\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [MCShield Monitor] c:\program files\mcshield\mcshieldrtm.exe
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [Quick TV Agent] c:\program files\terminator\quick tv\Scheduled.exe
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [RemoteControl] "c:\program files\asustek\asusdvd\PDVDServ.exe"
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [WinampAgent] "c:\program files\winamp\winampa.exe"
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
dRunOnce: [IE8] rundll32 advpack.dll,LaunchINFSection IE8.INF,FirstUserStart
dRunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\tvremo~1.lnk - c:\program files\terminator\tv7131 utilities\P3XRCtl.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
TCP: DhcpNameServer = 37.0.70.18 37.0.70.19 109.122.98.116 109.122.98.117
TCP: Interfaces\{F2A40791-69D5-41B4-951D-61A093228F96} : DhcpNameServer = 37.0.70.18 37.0.70.19 109.122.98.116 109.122.98.117
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\bogdan\application data\mozilla\firefox\profiles\tsjpa7f7.default\
FF - plugin: c:\documents and settings\bogdan\local settings\application data\google\update\1.3.21.111\npGoogleUpdate3.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_2_202_233.dll
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2012-4-29 612184]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2012-4-29 337880]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2012-4-29 20696]
R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2012-4-29 44768]
R3 Cap713x;Philips Cap713x Video Capture;c:\windows\system32\drivers\Cap713x.sys [2012-4-29 685824]
S3 3xHybrid;DTV-DVB 3056 PCI Card;c:\windows\system32\drivers\3xHybrid.sys [2012-4-29 883328]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-29 253088]
.
=============== Created Last 30 ================
.
2012-04-30 10:54:46 15232 -c--a-w- c:\windows\system32\dllcache\mpe.sys
2012-04-30 10:54:46 15232 ----a-w- c:\windows\system32\drivers\MPE.sys
2012-04-29 18:33:38 -------- d-sh--w- c:\windows\system32\AI_RecycleBin
2012-04-29 18:33:22 -------- d-----w- c:\program files\W3i, LLC
2012-04-29 18:32:18 -------- d-----w- c:\documents and settings\bogdan\application data\searchresults1
2012-04-29 18:31:48 -------- d-----w- c:\program files\searchresults1
2012-04-29 18:13:36 -------- d-----w- c:\documents and settings\bogdan\application data\Toolbar4
2012-04-29 18:13:23 -------- d-----w- c:\program files\DealBulldog Toolbar
2012-04-29 17:41:38 -------- d-----w- c:\documents and settings\bogdan\application data\Rainmeter
2012-04-29 17:40:18 -------- d-----w- c:\program files\Rainmeter
.
==================== Find3M ====================
.
2012-04-29 11:19:48 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-29 11:19:48 418464 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-04-04 13:56:40 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-03-06 23:15:19 41184 ----a-w- c:\windows\avastSS.scr
2012-03-06 23:03:51 612184 ----a-w- c:\windows\system32\drivers\aswSnx.sys
.
============= FINISH: 21:04:12,78 ===============
https://www.mycity.rs/must-login.png
|
|
|
|
|