Trojan horse PSW

Trojan horse PSW

offline
  • Pridružio: 28 Feb 2009
  • Poruke: 190
  • Gde živiš: Beograd

Molim za pomoc,komp je malo usporen a kada otvorim IE pokazuje Error on page

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:59:59 PM, on 3/24/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Raketa Krstarice\raketa-core.exe
C:\Program Files\Raketa Krstarice\raketa-veza.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\IncrediMail\bin\ImApp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\Magentic\bin\MgApp.exe
C:\Program Files\Raketa Krstarice\raketa.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\AskBarDis\bar\bin\AskService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Documents and Settings\Milan\Desktop\Pomoc\TR3.exe..exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = krstarica.com
R3 - URLSearchHook: ToggleEN Toolbar - {038cb5c7-48ea-4af9-94e0-a1646542e62b} - C:\Program Files\ToggleEN\tbTog1.dll
O2 - BHO: ToggleEN Toolbar - {038cb5c7-48ea-4af9-94e0-a1646542e62b} - C:\Program Files\ToggleEN\tbTog1.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live pomagac za prijavljivanje - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: NOW!Imaging - {9AA2F14F-E956-44B8-8694-A5B615CDF341} - C:\Program Files\Raketa Krstarice\components\NOWImaging.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Raketa Krstarice - {8B79EE88-E62D-4AA8-B530-CC357BA112B7} - C:\Program Files\Raketa Krstarice\Toolband.dll
O3 - Toolbar: ToggleEN Toolbar - {038cb5c7-48ea-4af9-94e0-a1646542e62b} - C:\Program Files\ToggleEN\tbTog1.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SlipStream] "C:\Program Files\Raketa Krstarice\raketa-core.exe"
O4 - HKLM\..\Run: [Raketa-veza] C:\Program Files\Raketa Krstarice\raketa-veza.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Magentic] C:\PROGRA~1\Magentic\bin\Magentic.exe /c
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Raketa Krstarice.lnk = C:\Program Files\Raketa Krstarice\raketa.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - update.microsoft.com/windowsupdate/v6/V5Con.....6764830906
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - update.microsoft.com/microsoftupdate/v6/V5C.....6778031203
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: ASKService - Unknown owner - C:\Program Files\AskBarDis\bar\bin\AskService.exe
O23 - Service: ASKUpgrade - Unknown owner - C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Google Update Service (gupdate1c98d25e3423983) (gupdate1c98d25e3423983) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 8524 bytes

offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Pozdrav...


Pokrenite Spybot S&D
Kliknite Mode stavku u meniju
Odaberite Advance Mode
Na traci levo kliknite na Tools
Kliknite na Resident
Destiklirajte Resident Tea-Timer
Zatvorite Spybot S&D
Restartujte kompjuter.

- Zatim skinuti program sa ovog linka na Desktop.
- Pokrenuti ga dvoklikom i ispratiti uputstva.

Nemojte zaboraviti da ponovo ukljucite ove opcije kada zavrsimo ciscenje.




Otvori AVG 8 Control Center (desni klik na AVG ikonicu ( ) u donjem, desnom uglu ekrana, stavka Open AVG User Interface).
* Kada se pokrene AVG Control Center, dvoklikni na Resident Shield komponentu.
* U prozoru koji se otvori, deštikliraj opciju Resident Shield active i klikni Save changes.

Napomena: Ne zaboravi da uključiš ovu opciju po završetku čišćenja.




Arrow Skini ComboFix sa jedne od sledecih adresa na Desktop:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.forospyware.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

Startuj ga i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu. Kada zavrsi pojavice se log (C:\ComboFix.txt) koji ces nam ovde iskopirati.

offline
  • Pridružio: 28 Feb 2009
  • Poruke: 190
  • Gde živiš: Beograd

ComboFix 09-03-23.01 - Milan 2009-03-24 18:36:58.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.560 [GMT 1:00]
Running from: c:\documents and settings\Milan\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-02-24 to 2009-03-24 )))))))))))))))))))))))))))))))
.

2009-03-21 11:14 . 2009-03-21 11:14 <DIR> d-------- c:\documents and settings\Milan\Application Data\JLC's Software
2009-03-21 11:13 . 2009-03-21 11:13 <DIR> d-------- c:\program files\JLC's Software
2009-03-20 13:12 . 2009-03-20 12:51 18,025 --a------ C:\Riding_the_Bullet.jpg
2009-03-20 12:55 . 2009-03-20 12:51 29,595 --a------ C:\The_Locals.jpg
2009-03-20 12:44 . 2009-03-20 12:36 140,707 --a------ C:\Killing Ariel1.jpg
2009-03-20 12:44 . 2009-03-20 12:36 27,914 --a------ C:\Killing Ariel.jpg
2009-03-19 18:43 . 2009-03-19 18:42 252,439 --a------ C:\next.png
2009-03-19 18:43 . 2009-03-19 18:42 78,152 --a------ C:\NEXT.jpg
2009-03-19 18:35 . 2009-03-19 18:35 43,111 --a------ C:\eight-below-dvd-poster.jpg
2009-03-19 18:16 . 2009-03-19 18:16 35,600 --a------ C:\Blow.jpg
2009-03-19 17:48 . 2009-03-19 17:47 46,657 --a------ C:\a job.jpg
2009-03-19 17:26 . 2009-03-19 17:26 29,746 --a------ C:\shiner.jpg
2009-03-19 17:20 . 2009-03-19 17:20 94,722 --a------ C:\turistas.jpg
2009-03-18 00:05 . 2009-03-18 00:05 <DIR> d-------- c:\documents and settings\Milan\Application Data\MxBoost
2009-03-18 00:04 . 2009-03-18 00:06 <DIR> d-------- c:\program files\Maxthon2
2009-03-18 00:03 . 2009-03-18 00:03 <DIR> d-------- c:\program files\Maxton
2009-03-16 19:41 . 2009-03-16 19:41 <DIR> d-------- c:\program files\Readon Technology
2009-03-16 16:02 . 2009-03-16 16:04 <DIR> d-------- c:\program files\Eggiz
2009-03-15 20:59 . 2009-03-15 17:51 33,556 --a------ C:\midnightexpress.jpg
2009-03-15 20:50 . 2009-03-15 18:17 35,551 --a------ C:\1234024115_me_myself_and_irene_posters.jpg
2009-03-15 20:47 . 2009-03-15 18:10 22,696 --a------ C:\Mean_Machine_poster.jpg
2009-03-15 20:44 . 2009-03-15 17:54 18,844 --a------ C:\Theoneposter.jpg
2009-03-15 20:38 . 2009-03-15 20:38 37,860 --a------ C:\1172603115_city_of_angels.jpg
2009-03-15 20:32 . 2009-03-15 15:29 502,803 --a------ C:\Sahara.jpg
2009-03-15 15:07 . 2009-03-15 14:52 91,640 --a------ C:\legally_blonde.jpg
2009-03-15 15:07 . 2009-03-15 15:01 78,739 --a------ C:\legally_blonde_two.jpg
2009-03-13 01:16 . 2009-03-13 01:16 <DIR> d-------- c:\program files\SubMagic
2009-03-13 01:16 . 2007-07-19 18:14 3,727,720 --a------ c:\windows\system32\d3dx9_35.dll
2009-03-13 00:44 . 2009-03-13 00:44 <DIR> d-------- c:\documents and settings\Milan\Application Data\GRETECH
2009-03-13 00:43 . 2009-03-13 00:43 <DIR> d-------- c:\program files\GRETECH
2009-03-13 00:42 . 2009-03-13 00:42 <DIR> d-------- c:\program files\GOM Player
2009-03-11 14:14 . 2009-03-11 14:14 <DIR> d--h----- c:\windows\$hf_mig$
2009-03-11 14:14 . 2005-02-25 04:35 22,752 --a------ c:\windows\system32\spupdsvc.exe
2009-03-11 10:48 . 2008-10-16 14:09 43,544 --a------ c:\windows\system32\wups2.dll
2009-03-11 10:48 . 2008-10-16 14:09 31,768 --a------ c:\windows\system32\wucltui.dll.mui
2009-03-11 10:48 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuaucpl.cpl.mui
2009-03-11 10:48 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuapi.dll.mui
2009-03-11 10:48 . 2008-10-16 14:07 18,456 --a------ c:\windows\system32\wuaueng.dll.mui
2009-02-27 20:15 . 2009-02-28 15:35 <DIR> d-------- c:\program files\Opera
2009-02-27 19:37 . 2009-03-17 10:03 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2009-02-27 19:37 . 2009-02-27 20:00 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-27 14:24 . 2009-02-27 14:24 <DIR> d-------- c:\program files\Magentic
2009-02-27 14:24 . 2008-08-04 09:51 750,984 --a------ c:\windows\system32\Magentic Screensaver.scr
2009-02-24 21:40 . 2009-02-24 21:40 <DIR> d-------- c:\program files\AskBarDis

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-23 13:53 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-03-23 12:30 5,129 ----a-w c:\program files\Yurecnik.ini
2009-03-22 17:27 --------- d-----w c:\program files\Winamp
2009-03-12 20:22 --------- d-----w c:\program files\Mv2Player
2009-03-10 14:21 --------- d-----w c:\program files\ToggleEN
2009-03-08 00:23 --------- d-----w c:\documents and settings\Milan\Application Data\uTorrent
2009-02-23 21:05 --------- d-----w c:\documents and settings\Milan\Application Data\X3mE Yamb
2009-02-23 21:04 --------- d-----w c:\documents and settings\All Users\Application Data\X3mE Yamb
2009-02-22 12:22 --------- d-----w c:\program files\Google
2009-02-19 16:33 --------- d-----w c:\documents and settings\Milan\Application Data\Uniblue
2009-02-19 15:45 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-02-18 17:24 --------- d-----w c:\documents and settings\All Users\Application Data\PMB Files
2009-02-18 17:22 --------- d-----w c:\program files\Pando Networks
2009-02-18 16:15 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-18 15:01 --------- d-----w c:\program files\Adobe Media Player
2009-02-18 15:00 --------- d-----w c:\program files\Common Files\Adobe AIR
2009-02-18 00:00 --------- d-----w c:\program files\SMS Free Sender
2009-02-17 12:49 --------- d-----w c:\program files\uTorrent
2009-02-17 12:04 --------- d-----w c:\program files\Conduit
2009-02-16 17:25 --------- d-----w c:\documents and settings\All Users\Application Data\DVD Shrink
2009-02-16 14:17 --------- d-----w c:\program files\IncrediMail
2009-02-16 14:17 --------- d-----w c:\documents and settings\All Users\Application Data\IM
2009-02-16 14:16 --------- d-----w c:\documents and settings\All Users\Application Data\IncrediMail
2009-02-16 13:33 --------- d-----w c:\program files\Windows Live SkyDrive
2009-02-16 13:33 --------- d-----w c:\program files\Windows Live
2009-02-16 13:33 --------- d-----w c:\program files\Microsoft
2009-02-16 13:24 --------- d-----w c:\program files\Common Files\Windows Live
2009-02-16 13:23 --------- d-----w c:\documents and settings\Milan\Application Data\MSNInstaller
2009-02-13 21:44 --------- d-----w c:\program files\Phenomedia AG
2009-02-13 21:36 --------- d-----w c:\program files\Tripper-IT
2009-02-13 17:46 325,128 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-02-13 17:46 107,272 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-02-13 17:46 10,520 ----a-w c:\windows\system32\avgrsstx.dll
2009-02-11 15:37 --------- d-----w c:\documents and settings\Milan\Application Data\SlipStream
2009-02-11 09:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-11 09:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-02-06 17:52 49,504 ----a-w c:\windows\system32\sirenacm.dll
2009-02-06 13:41 --------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-01-29 17:18 --------- d-----w c:\program files\GordianKnot
2009-01-29 17:15 --------- d-----w c:\program files\DVD Shrink
2009-01-29 17:11 --------- d-----w c:\program files\Gabest
2009-01-29 17:11 --------- d-----w c:\program files\AviSynth 2.5
2009-01-17 16:03 258 ----a-w c:\program files\Mini-YuRecnik.ini
2009-01-17 15:59 28,702 ----a-w c:\program files\Uninstal.exe
2009-01-17 15:59 1,998 ----a-w c:\program files\uninstal.log
1999-08-02 09:47 387,072 ----a-w c:\program files\YuRecnik.exe
1999-08-02 09:40 219,648 ----a-w c:\program files\MiniYuRecnik.exe
1999-08-02 09:35 9,559 ----a-w c:\program files\YURECNIK.HLP
1999-08-02 09:35 57 ----a-w c:\program files\Yurecnik.CNT
1999-07-29 09:43 2,447,472 ----a-w c:\program files\Reci.dat
1996-09-06 12:08 30,070 ----a-w c:\program files\Fb_deflt.dic
1996-02-23 15:26 469,504 ----a-w c:\program files\Fb_11k8.dll
1996-02-23 14:59 34,816 ----a-w c:\program files\Fb_spch.dll
1996-02-23 14:48 4,608 ----a-w c:\program files\Fb_timer.dll
1996-02-23 14:46 29,184 ----a-w c:\program files\Fb_ngn.exe
1996-02-23 14:21 16,896 ----a-w c:\program files\Uraspec.exe
1996-02-23 14:17 18,432 ----a-w c:\program files\Dictmgr.exe
1993-11-29 08:32 16,896 ----a-w c:\program files\Monologw.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{038cb5c7-48ea-4af9-94e0-a1646542e62b}"= "c:\program files\ToggleEN\tbTog1.dll" [2009-02-17 1882136]

[HKEY_CLASSES_ROOT\clsid\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]
2009-02-17 13:33 1882136 --a------ c:\program files\ToggleEN\tbTog1.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-11-24 20:25 333192 --a------ c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{038cb5c7-48ea-4af9-94e0-a1646542e62b}"= "c:\program files\ToggleEN\tbTog1.dll" [2009-02-17 1882136]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-11-24 333192]

[HKEY_CLASSES_ROOT\clsid\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{038CB5C7-48EA-4AF9-94E0-A1646542E62B}"= "c:\program files\ToggleEN\tbTog1.dll" [2009-02-17 1882136]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-11-24 333192]

[HKEY_CLASSES_ROOT\clsid\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"IncrediMail"="c:\program files\IncrediMail\bin\IncMail.exe" [2009-02-02 251264]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-12 39408]
"Magentic"="c:\progra~1\Magentic\bin\Magentic.exe" [2008-08-04 488808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2004-12-20 33792]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-13 1601304]
"SlipStream"="c:\program files\Raketa Krstarice\raketa-core.exe" [2007-09-25 344064]
"Raketa-veza"="c:\program files\Raketa Krstarice\raketa-veza.exe" [2007-09-11 69800]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"RTHDCPL"="RTHDCPL.EXE" [2007-09-03 c:\windows\RTHDCPL.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472]
Raketa Krstarice.lnk - c:\program files\Raketa Krstarice\raketa.exe [2008-12-03 229376]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-02-13 18:46 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImApp.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\Magentic\\bin\\MgImp.exe"=
"c:\\Program Files\\Magentic\\bin\\Magentic.exe"=
"c:\\Program Files\\Magentic\\bin\\MgApp.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"58459:TCP"= 58459:TCP:Pando Media Booster
"58459:UDP"= 58459:UDP:Pando Media Booster

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-12-02 325128]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-12-02 107272]
R2 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe [2009-02-24 464264]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-12-28 903960]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-12-28 298264]
S2 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [2009-02-24 234888]
S2 gupdate1c98d25e3423983;Google Update Service (gupdate1c98d25e3423983);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-12 133104]
.
Contents of the 'Scheduled Tasks' folder

2009-03-24 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-12 16:21]

2009-03-24 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-12 16:23]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mStart Page = hxxp://www.krstarica.com
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: c:\progra~1\RAKETA~1\sliplsp.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2009-03-24 18:38:46
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(696)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-03-24 18:39:53
ComboFix-quarantined-files.txt 2009-03-24 17:39:49
ComboFix2.txt 2009-03-18 17:58:47

Pre-Run: 38,598,778,880 bytes free
Post-Run: 41,141,284,864 bytes free

226

offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Taj trojan iz naslova... Šta s njim? Detektovan? Obrisan? Ili?

Ovde ne vidim tragove malware-a.

offline
  • Pridružio: 28 Feb 2009
  • Poruke: 190
  • Gde živiš: Beograd

Detektovana su mi dva trojanca.Jedan je smesten u Virus Valut a za drugi je pisalo,nesto kao da nije premesten u Virus Valut i i da moze samo da se obrise zarazen fajl.Kad sam skenirao komp posle toga sa AVG pokazuje mi da nema nista.Ali kad otvaram npr.IE prozor se "zaledi" na par trenutaka,zatim mi otvori pocetnu stranu i na dnu mi pise Error on page.I isto od tada kada u googlu kucam neku rec ne nudi mi onu padajucu listu vezanu za tu rec.Takodje,kada mi stigne mail sa nekim linkom u njemu,link ne mogu da otvorim-otvori mi se novi prazan prozor blank page i nista se ne ucitava.

offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

lanmi1983 ::... kad otvaram npr.IE prozor se "zaledi" na par trenutaka,zatim mi otvori pocetnu stranu i na dnu mi pise Error on page.I isto od tada kada u googlu kucam neku rec ne nudi mi onu padajucu listu vezanu za tu rec.Takodje,kada mi stigne mail sa nekim linkom u njemu,link ne mogu da otvorim-otvori mi se novi prazan prozor blank page i nista se ne ucitava.

Posto ovde vise nema malware-a, preporucio bih ti da potrazis savete oko ovih problema u forumu Internet klijenti.

offline
  • Pridružio: 28 Feb 2009
  • Poruke: 190
  • Gde živiš: Beograd

Ok...hvala na pomoci

Ko je trenutno na forumu
 

Ukupno su 1101 korisnika na forumu :: 31 registrovanih, 6 sakrivenih i 1064 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 8u47, A.R.Chafee.Jr., Asparagus, bladesu, BORUTUS, Bubimir, bufanje, Duh sa sekirom, FOX, goxin, GveX, havoc995, kinez88, Kubovac, kybonacci, Lucije Kvint, mean_machine, menges, milenko crazy north, naki011, pedja.st, pera bager, sevenino, Sir Budimir, Stanlio, styg, uruk, virked, VP6919, |_MeD_|, 223223