MyCity » Ambulanta -> Arhiva Ambulante » hijack provera??

hijack provera??

Napisano na dan: 4.4.2009

hijack provera??
Sledeća strana Pagination

Idi na vrh

Poslao: 04 Apr 2009 22:08
Idi na vrh
offline
  • Pridružio: 24 Okt 2007
  • Poruke: 122

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:07:06 PM, on 4/4/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\OSD.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\miki\Application Data\nidle\nidle.exe
C:\Documents and Settings\miki\Application Data\Twain\Twain.exe
C:\Documents and Settings\miki\Application Data\digifast\digifast.exe
C:\Documents and Settings\miki\Application Data\Microsoft\Windows\jxphyo.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: CPV - {15421B84-3488-49A7-AD18-CBF84A3EFAF6} - C:\Program Files\WWShow\WWShow.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: HelloWorldBHO - {D88E1558-7C2D-407A-953A-C044F5607CEA} - C:\Program Files\Jcore\Jcore2.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [LMgrVolOSD] C:\Program Files\Launch Manager\OSD.exe
O4 - HKLM\..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSDCtrl.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [ATICCC] "c:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKCU\..\Run: [nidle] "C:\Documents and Settings\miki\Application Data\nidle\nidle.exe" 61A847B5BBF72813359231466188719AB689201522886B092CBD44BD8689220221DD3257
O4 - HKCU\..\Run: [Twain] C:\Documents and Settings\miki\Application Data\Twain\Twain.exe
O4 - HKCU\..\Run: [DigiFast] C:\Documents and Settings\miki\Application Data\digifast\digifast.exe
O4 - HKCU\..\Run: [SfKg6wIPuSpdc] C:\Documents and Settings\miki\Application Data\Microsoft\Windows\jxphyo.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - [Link mogu videti samo ulogovani korisnici]
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

--
End of file - 4745 bytes



Poslao: 04 Apr 2009 22:25
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Skini ComboFix sa jedne od sledecih adresa na Desktop:
[Link mogu videti samo ulogovani korisnici]
[Link mogu videti samo ulogovani korisnici]
[Link mogu videti samo ulogovani korisnici]

Startuj ga i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu. Kada zavrsi pojavice se log (C:\ComboFix.txt) koji ces nam ovde iskopirati.



Poslao: 04 Apr 2009 22:40
Idi na vrh
offline
  • Pridružio: 24 Okt 2007
  • Poruke: 122

ComboFix 09-04-04.01 - miki 2009-04-04 22:34:07.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1790.1406 [GMT 2:00]
Running from: c:\documents and settings\miki\Local Settings\Application Data\Opera\Opera\profile\cache4\temporary_download\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ISODRIVE
-------\Service_ISODrive


((((((((((((((((((((((((( Files Created from 2009-03-04 to 2009-04-04 )))))))))))))))))))))))))))))))
.

2009-04-04 21:04 . 2009-04-04 21:04 <DIR> d--h----- c:\windows\PIF
2009-04-04 21:02 . 2009-04-04 21:02 <DIR> d-------- c:\program files\Trend Micro
2009-04-04 20:56 . 2009-04-04 20:56 <DIR> dr-h----- C:\MSOCache
2009-04-04 18:28 . 2009-04-04 18:28 <DIR> d-------- c:\program files\WWShow
2009-04-04 18:27 . 2009-04-04 18:27 <DIR> d-------- c:\program files\Windows Installer Clean Up
2009-04-04 18:27 . 2009-04-04 18:27 <DIR> d-------- c:\program files\MSECACHE
2009-04-04 18:12 . 2009-04-04 18:12 <DIR> d-------- c:\program files\Jcore
2009-04-03 23:38 . 2009-04-03 23:38 <DIR> d-------- c:\program files\CCleaner
2009-04-03 18:05 . 2009-04-03 18:08 <DIR> d-------- c:\program files\UltraISO
2009-04-03 18:05 . 2009-04-03 18:05 <DIR> d-------- c:\program files\Common Files\EZB Systems
2009-03-31 21:32 . 2008-04-14 01:12 151,552 --a------ c:\windows\system32\irftp.exe
2009-03-31 21:32 . 2008-04-14 01:12 151,552 --a--c--- c:\windows\system32\dllcache\irftp.exe
2009-03-31 21:32 . 2008-04-14 01:11 28,160 --a------ c:\windows\system32\irmon.dll
2009-03-31 21:32 . 2008-04-14 01:11 28,160 --a--c--- c:\windows\system32\dllcache\irmon.dll
2009-03-31 21:32 . 2008-04-14 01:12 8,192 --a------ c:\windows\system32\wshirda.dll
2009-03-31 21:32 . 2008-04-14 01:12 8,192 --a--c--- c:\windows\system32\dllcache\wshirda.dll
2009-03-31 21:21 . 2009-03-31 21:21 <DIR> d-------- c:\documents and settings\miki\Application Data\Apple Computer
2009-03-31 21:21 . 2008-04-17 12:12 107,368 --a------ c:\windows\system32\GEARAspi.dll
2009-03-31 21:21 . 2009-01-15 12:19 23,848 --a------ c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-31 21:20 . 2009-03-31 21:21 <DIR> d-------- c:\program files\iTunes
2009-03-31 21:20 . 2009-03-31 21:20 <DIR> d-------- c:\program files\iPod
2009-03-31 21:20 . 2009-03-31 21:20 <DIR> d-------- c:\program files\Bonjour
2009-03-31 21:20 . 2009-03-31 21:21 <DIR> d-------- c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-31 21:19 . 2009-03-31 21:21 <DIR> d----c--- c:\windows\system32\DRVSTORE
2009-03-31 21:19 . 2009-03-31 21:20 <DIR> d-------- c:\program files\QuickTime
2009-03-31 21:19 . 2009-03-31 21:19 <DIR> d-------- c:\program files\Apple Software Update
2009-03-31 21:19 . 2009-03-31 21:19 <DIR> d-------- c:\documents and settings\All Users\Application Data\Apple Computer
2009-03-31 21:19 . 2009-03-05 23:59 1,900,544 --a------ c:\windows\system32\usbaaplrc.dll
2009-03-31 21:19 . 2009-03-05 23:59 36,864 --a------ c:\windows\system32\drivers\usbaapl.sys
2009-03-31 21:18 . 2009-03-31 21:20 <DIR> d-------- c:\program files\Common Files\Apple
2009-03-31 21:18 . 2009-03-31 21:18 <DIR> d-------- c:\documents and settings\All Users\Application Data\Apple
2009-03-31 20:56 . 2009-04-04 11:39 <DIR> d-------- c:\program files\Windows Media Connect 2
2009-03-31 20:47 . 2009-03-31 20:47 <DIR> d-------- c:\windows\system32\LogFiles
2009-03-31 20:47 . 2009-03-31 20:48 <DIR> d-------- c:\windows\system32\drivers\UMDF
2009-03-25 23:11 . 2009-03-25 23:11 <DIR> d-------- c:\program files\uTorrent
2009-03-25 23:11 . 2009-04-04 17:59 <DIR> d-------- c:\documents and settings\miki\Application Data\uTorrent
2009-03-24 20:16 . 2009-03-24 20:16 <DIR> d-------- c:\windows\system32\Lang
2009-03-24 20:16 . 2009-03-24 20:16 940,794 --a------ c:\windows\system32\LoopyMusic.wav
2009-03-24 20:16 . 2009-03-24 20:16 146,650 --a------ c:\windows\system32\BuzzingBee.wav
2009-03-23 22:10 . 2009-03-23 22:10 <DIR> d-------- c:\windows\Motorola
2009-03-23 22:08 . 2006-05-18 15:27 16,207,872 --a------ c:\windows\RTHDCPL.exe
2009-03-23 22:08 . 2006-05-04 17:35 9,709,568 --a------ c:\windows\RTLCPL.exe
2009-03-23 22:08 . 2006-05-16 18:32 4,275,712 --a------ c:\windows\system32\drivers\RtkHDAud.Sys
2009-03-23 22:08 . 2006-05-04 17:26 2,808,832 --a------ c:\windows\alcwzrd.exe
2009-03-23 22:08 . 2006-03-10 20:32 2,158,592 --a------ c:\windows\MicCal.exe
2009-03-23 22:08 . 2005-04-16 23:20 487,424 --a------ c:\windows\RtlExUpd.dll
2009-03-23 22:08 . 2006-03-09 18:45 364,544 --a------ c:\windows\RtlUpd.exe
2009-03-23 22:08 . 2005-09-21 11:25 299,008 --a------ c:\windows\system32\ALSndMgr.Cpl
2009-03-23 22:08 . 2006-01-10 14:58 266,240 --a------ c:\windows\system32\RTSndMgr.Cpl
2009-03-23 22:08 . 2006-05-04 17:22 86,016 --a------ c:\windows\SoundMan.exe
2009-03-23 22:08 . 2005-05-03 19:43 69,632 --a------ c:\windows\Alcmtr.exe
2009-03-23 21:28 . 2009-03-23 21:28 <DIR> d-------- c:\documents and settings\miki\Application Data\ATI
2009-03-23 21:26 . 2009-03-23 21:26 <DIR> d-------- c:\program files\Common Files\ATI Technologies
2009-03-23 21:16 . 2008-04-13 20:45 26,368 --a--c--- c:\windows\system32\dllcache\usbstor.sys
2009-03-23 20:51 . 2001-08-17 14:48 12,160 --a------ c:\windows\system32\drivers\mouhid.sys
2009-03-23 20:51 . 2001-08-17 14:48 12,160 --a--c--- c:\windows\system32\dllcache\mouhid.sys
2009-03-23 20:51 . 2008-04-13 20:45 10,368 --a------ c:\windows\system32\drivers\hidusb.sys
2009-03-23 20:51 . 2008-04-13 20:45 10,368 --a--c--- c:\windows\system32\dllcache\hidusb.sys
2009-03-23 20:34 . 2009-03-23 20:34 <DIR> d-------- c:\program files\Opera
2009-03-23 01:40 . 2008-10-16 03:00 1,499,136 -----c--- c:\windows\system32\dllcache\shdocvw.dll
2009-03-23 01:40 . 2008-10-16 03:00 666,112 -----c--- c:\windows\system32\dllcache\wininet.dll
2009-03-23 01:40 . 2008-10-16 03:00 619,520 -----c--- c:\windows\system32\dllcache\urlmon.dll
2009-03-23 01:32 . 2008-12-12 19:01 3,067,904 -----c--- c:\windows\system32\dllcache\mshtml.dll
2009-03-23 01:31 . 2008-10-24 13:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2009-03-23 01:30 . 2008-08-14 12:11 2,189,184 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2009-03-23 01:30 . 2008-08-14 12:09 2,145,280 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-03-23 01:30 . 2008-08-14 11:33 2,066,048 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-03-23 01:30 . 2008-08-14 11:33 2,023,936 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2009-03-23 01:30 . 2008-04-11 21:04 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll
2009-03-23 01:30 . 2008-12-11 12:57 333,952 -----c--- c:\windows\system32\dllcache\srv.sys
2009-03-23 01:30 . 2008-05-01 16:33 331,776 -----c--- c:\windows\system32\dllcache\msadce.dll
2009-03-23 01:29 . 2008-06-13 13:05 272,128 -----c--- c:\windows\system32\dllcache\bthport.sys
2009-03-23 01:28 . 2008-05-08 16:02 203,136 -----c--- c:\windows\system32\dllcache\rmcast.sys
2009-03-23 01:26 . 2008-09-04 19:15 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2009-03-23 01:26 . 2008-10-15 18:34 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2009-03-23 01:19 . 2009-03-23 01:19 <DIR> d-------- c:\windows\system32\scripting
2009-03-23 01:19 . 2009-03-23 01:19 <DIR> d-------- c:\windows\system32\en
2009-03-23 01:19 . 2009-03-23 01:19 <DIR> d-------- c:\windows\system32\bits
2009-03-23 01:19 . 2009-03-23 01:19 <DIR> d-------- c:\windows\l2schemas
2009-03-23 01:18 . 2009-03-23 01:18 <DIR> d-------- c:\windows\ServicePackFiles
2009-03-23 01:13 . 2009-03-23 01:13 <DIR> d-------- c:\windows\EHome
2009-03-23 01:12 . 2009-03-23 01:12 <DIR> d-------- c:\program files\GRETECH
2009-03-23 01:12 . 2009-03-23 01:12 <DIR> d-------- c:\documents and settings\miki\Application Data\GRETECH
2009-03-23 01:09 . 2006-03-09 00:33 2,636,672 --a--c--- c:\windows\system32\dllcache\ati3duag.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-02 09:24 90,112 ----a-w c:\windows\DUMP3fe7.tmp
2009-03-23 20:08 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-23 20:08 --------- d-----w c:\program files\Realtek
2009-03-23 19:24 --------- d-----w c:\program files\Common Files\InstallShield
2009-03-23 19:24 --------- d-----w c:\program files\ATI Technologies
2009-03-22 22:28 9,388 ----a-w c:\windows\system32\drivers\iaStor.PNF
2009-03-22 22:28 7,280 ----a-w c:\windows\system32\drivers\viamraid.PNF
2009-03-22 22:28 63,240 ----a-w c:\windows\system32\drivers\Si3112r.PNF
2009-03-22 22:28 6,984 ----a-w c:\windows\system32\drivers\SiSRaid.PNF
2009-03-22 22:28 20,152 ----a-w c:\windows\system32\drivers\INFCACHE.1
2009-03-22 22:28 12,432 ----a-w c:\windows\system32\drivers\adpu320.PNF
2009-03-22 22:28 12,204 ----a-w c:\windows\system32\drivers\nvraid.PNF
2009-03-22 22:28 10,828 ----a-w c:\windows\system32\drivers\iaAHCI.PNF
2009-03-22 22:09 --------- d-----w c:\program files\Launch Manager
2009-03-22 22:02 --------- d-----w c:\program files\Synaptics
2009-03-22 21:50 --------- d-----w c:\program files\microsoft frontpage
2009-03-22 21:49 --------- d-----w c:\program files\Java
2009-03-22 21:48 --------- d-----w c:\program files\Common Files\Java
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-01-20 761946]
"LaunchAp"="c:\program files\Launch Manager\LaunchAp.exe" [2005-07-25 32768]
"HotkeyApp"="c:\program files\Launch Manager\HotkeyApp.exe" [2005-07-28 57344]
"LMgrVolOSD"="c:\program files\Launch Manager\OSD.exe" [2005-03-16 204800]
"LMgrOSD"="c:\program files\Launch Manager\OSDCtrl.exe" [2005-07-25 241664]
"Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2005-07-25 81920]
"CtrlVol"="c:\program files\Launch Manager\CtrlVol.exe" [2003-09-16 20480]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"RTHDCPL"="RTHDCPL.EXE" [2006-05-18 c:\windows\RTHDCPL.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 c:\windows\system32\bthprops.cpl]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2009-03-12 20:56 342312 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2009-01-05 16:18 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
--a------ 2005-11-10 04:44 557056 c:\windows\sm56hlpr.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 Hotkey;Hotkey;c:\windows\system32\drivers\HOTKEY.sys [2009-03-23 9867]
S1 mailKmd;mailKmd; [x]
S1 Wbutton;Wbutton;c:\windows\system32\drivers\Wbutton.sys --> c:\windows\system32\drivers\Wbutton.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2009-04-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2009-04-04 22:36:52
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CtrlVol = c:\program files\Launch Manager\CtrlVol.exe?8???\??????|x??|????q??|?j?wQj?w????????,??? ???????????????d??????|????????p?????@?u??????????????s???????s???sx??s@??????????????|h??st??????????s?????????????????C?sc"?sx??s???????w??@?N'?st>???6@??>?????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(560)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Completion time: 2009-04-04 22:38:46 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-04 20:38:44

Pre-Run: 43,093,708,800 bytes free
Post-Run: 43,042,185,216 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

205 --- E O F --- 2009-04-03 08:20:53

Poslao: 04 Apr 2009 23:00
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Bas ne zelis da ispratis upustva.

Prvo, upustvo za postavljanje loga HijackThis programa nije ispraceno, pa sada pokreces i ComboFix direktno iz Opere, a lepo sam napisao da ga skines na Desktop.

Necu da pisem nista dalje sve dok ne uradis kako je napisano u upustvima koja su ti data. Ne zelim da se osecam krivim ako se nesto zezne zato sto ne radis onako kako ti je sasvim jasno i precizno napisano.

Poslao: 06 Apr 2009 22:12
Idi na vrh
offline
  • Pridružio: 24 Okt 2007
  • Poruke: 122

aaa.. pa snimila sam na desktop ... pa cini mi se da sam startovala iz desktopa ...


sorry ....

Dopuna: 04 Apr 2009 23:20

ComboFix 09-04-04.01 - miki 2009-04-04 23:14:51.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1790.1363 [GMT 2:00]
Running from: c:\documents and settings\miki\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2009-03-04 to 2009-04-04 )))))))))))))))))))))))))))))))
.

2009-04-04 22:32 . 2009-04-04 22:32 <DIR> d-------- C:\32788R22FWJFW.0.tmp
2009-04-04 21:04 . 2009-04-04 21:04 <DIR> d--h----- c:\windows\PIF
2009-04-04 21:02 . 2009-04-04 21:02 <DIR> d-------- c:\program files\Trend Micro
2009-04-04 20:56 . 2009-04-04 20:56 <DIR> dr-h----- C:\MSOCache
2009-04-04 18:28 . 2009-04-04 18:28 <DIR> d-------- c:\program files\WWShow
2009-04-04 18:27 . 2009-04-04 18:27 <DIR> d-------- c:\program files\Windows Installer Clean Up
2009-04-04 18:27 . 2009-04-04 18:27 <DIR> d-------- c:\program files\MSECACHE
2009-04-04 18:12 . 2009-04-04 18:12 <DIR> d-------- c:\program files\Jcore
2009-04-03 23:38 . 2009-04-03 23:38 <DIR> d-------- c:\program files\CCleaner
2009-04-03 18:05 . 2009-04-03 18:08 <DIR> d-------- c:\program files\UltraISO
2009-04-03 18:05 . 2009-04-03 18:05 <DIR> d-------- c:\program files\Common Files\EZB Systems
2009-03-31 21:32 . 2008-04-14 01:12 151,552 --a------ c:\windows\system32\irftp.exe
2009-03-31 21:32 . 2008-04-14 01:12 151,552 --a--c--- c:\windows\system32\dllcache\irftp.exe
2009-03-31 21:32 . 2008-04-14 01:11 28,160 --a------ c:\windows\system32\irmon.dll
2009-03-31 21:32 . 2008-04-14 01:11 28,160 --a--c--- c:\windows\system32\dllcache\irmon.dll
2009-03-31 21:32 . 2008-04-14 01:12 8,192 --a------ c:\windows\system32\wshirda.dll
2009-03-31 21:32 . 2008-04-14 01:12 8,192 --a--c--- c:\windows\system32\dllcache\wshirda.dll
2009-03-31 21:21 . 2009-03-31 21:21 <DIR> d-------- c:\documents and settings\miki\Application Data\Apple Computer
2009-03-31 21:21 . 2008-04-17 12:12 107,368 --a------ c:\windows\system32\GEARAspi.dll
2009-03-31 21:21 . 2009-01-15 12:19 23,848 --a------ c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-31 21:20 . 2009-03-31 21:21 <DIR> d-------- c:\program files\iTunes
2009-03-31 21:20 . 2009-03-31 21:20 <DIR> d-------- c:\program files\iPod
2009-03-31 21:20 . 2009-03-31 21:20 <DIR> d-------- c:\program files\Bonjour
2009-03-31 21:20 . 2009-03-31 21:21 <DIR> d-------- c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-31 21:19 . 2009-03-31 21:21 <DIR> d----c--- c:\windows\system32\DRVSTORE
2009-03-31 21:19 . 2009-03-31 21:20 <DIR> d-------- c:\program files\QuickTime
2009-03-31 21:19 . 2009-03-31 21:19 <DIR> d-------- c:\program files\Apple Software Update
2009-03-31 21:19 . 2009-03-31 21:19 <DIR> d-------- c:\documents and settings\All Users\Application Data\Apple Computer
2009-03-31 21:19 . 2009-03-05 23:59 1,900,544 --a------ c:\windows\system32\usbaaplrc.dll
2009-03-31 21:19 . 2009-03-05 23:59 36,864 --a------ c:\windows\system32\drivers\usbaapl.sys
2009-03-31 21:18 . 2009-03-31 21:20 <DIR> d-------- c:\program files\Common Files\Apple
2009-03-31 21:18 . 2009-03-31 21:18 <DIR> d-------- c:\documents and settings\All Users\Application Data\Apple
2009-03-31 20:56 . 2009-04-04 11:39 <DIR> d-------- c:\program files\Windows Media Connect 2
2009-03-31 20:47 . 2009-03-31 20:47 <DIR> d-------- c:\windows\system32\LogFiles
2009-03-31 20:47 . 2009-03-31 20:48 <DIR> d-------- c:\windows\system32\drivers\UMDF
2009-03-25 23:11 . 2009-03-25 23:11 <DIR> d-------- c:\program files\uTorrent
2009-03-25 23:11 . 2009-04-04 17:59 <DIR> d-------- c:\documents and settings\miki\Application Data\uTorrent
2009-03-24 20:16 . 2009-03-24 20:16 <DIR> d-------- c:\windows\system32\Lang
2009-03-24 20:16 . 2009-03-24 20:16 940,794 --a------ c:\windows\system32\LoopyMusic.wav
2009-03-24 20:16 . 2009-03-24 20:16 146,650 --a------ c:\windows\system32\BuzzingBee.wav
2009-03-23 22:10 . 2009-03-23 22:10 <DIR> d-------- c:\windows\Motorola
2009-03-23 22:08 . 2006-05-18 15:27 16,207,872 --a------ c:\windows\RTHDCPL.exe
2009-03-23 22:08 . 2006-05-04 17:35 9,709,568 --a------ c:\windows\RTLCPL.exe
2009-03-23 22:08 . 2006-05-16 18:32 4,275,712 --a------ c:\windows\system32\drivers\RtkHDAud.Sys
2009-03-23 22:08 . 2006-05-04 17:26 2,808,832 --a------ c:\windows\alcwzrd.exe
2009-03-23 22:08 . 2006-03-10 20:32 2,158,592 --a------ c:\windows\MicCal.exe
2009-03-23 22:08 . 2005-04-16 23:20 487,424 --a------ c:\windows\RtlExUpd.dll
2009-03-23 22:08 . 2006-03-09 18:45 364,544 --a------ c:\windows\RtlUpd.exe
2009-03-23 22:08 . 2005-09-21 11:25 299,008 --a------ c:\windows\system32\ALSndMgr.Cpl
2009-03-23 22:08 . 2006-01-10 14:58 266,240 --a------ c:\windows\system32\RTSndMgr.Cpl
2009-03-23 22:08 . 2006-05-04 17:22 86,016 --a------ c:\windows\SoundMan.exe
2009-03-23 22:08 . 2005-05-03 19:43 69,632 --a------ c:\windows\Alcmtr.exe
2009-03-23 21:28 . 2009-03-23 21:28 <DIR> d-------- c:\documents and settings\miki\Application Data\ATI
2009-03-23 21:26 . 2009-03-23 21:26 <DIR> d-------- c:\program files\Common Files\ATI Technologies
2009-03-23 21:16 . 2008-04-13 20:45 26,368 --a--c--- c:\windows\system32\dllcache\usbstor.sys
2009-03-23 20:51 . 2001-08-17 14:48 12,160 --a------ c:\windows\system32\drivers\mouhid.sys
2009-03-23 20:51 . 2001-08-17 14:48 12,160 --a--c--- c:\windows\system32\dllcache\mouhid.sys
2009-03-23 20:51 . 2008-04-13 20:45 10,368 --a------ c:\windows\system32\drivers\hidusb.sys
2009-03-23 20:51 . 2008-04-13 20:45 10,368 --a--c--- c:\windows\system32\dllcache\hidusb.sys
2009-03-23 20:34 . 2009-03-23 20:34 <DIR> d-------- c:\program files\Opera
2009-03-23 01:40 . 2008-10-16 03:00 1,499,136 -----c--- c:\windows\system32\dllcache\shdocvw.dll
2009-03-23 01:40 . 2008-10-16 03:00 666,112 -----c--- c:\windows\system32\dllcache\wininet.dll
2009-03-23 01:40 . 2008-10-16 03:00 619,520 -----c--- c:\windows\system32\dllcache\urlmon.dll
2009-03-23 01:32 . 2008-12-12 19:01 3,067,904 -----c--- c:\windows\system32\dllcache\mshtml.dll
2009-03-23 01:31 . 2008-10-24 13:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2009-03-23 01:30 . 2008-08-14 12:11 2,189,184 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2009-03-23 01:30 . 2008-08-14 12:09 2,145,280 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-03-23 01:30 . 2008-08-14 11:33 2,066,048 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-03-23 01:30 . 2008-08-14 11:33 2,023,936 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2009-03-23 01:30 . 2008-04-11 21:04 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll
2009-03-23 01:30 . 2008-12-11 12:57 333,952 -----c--- c:\windows\system32\dllcache\srv.sys
2009-03-23 01:30 . 2008-05-01 16:33 331,776 -----c--- c:\windows\system32\dllcache\msadce.dll
2009-03-23 01:29 . 2008-06-13 13:05 272,128 -----c--- c:\windows\system32\dllcache\bthport.sys
2009-03-23 01:28 . 2008-05-08 16:02 203,136 -----c--- c:\windows\system32\dllcache\rmcast.sys
2009-03-23 01:26 . 2008-09-04 19:15 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2009-03-23 01:26 . 2008-10-15 18:34 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2009-03-23 01:19 . 2009-03-23 01:19 <DIR> d-------- c:\windows\system32\scripting
2009-03-23 01:19 . 2009-03-23 01:19 <DIR> d-------- c:\windows\system32\en
2009-03-23 01:19 . 2009-03-23 01:19 <DIR> d-------- c:\windows\system32\bits
2009-03-23 01:19 . 2009-03-23 01:19 <DIR> d-------- c:\windows\l2schemas
2009-03-23 01:18 . 2009-03-23 01:18 <DIR> d-------- c:\windows\ServicePackFiles
2009-03-23 01:13 . 2009-03-23 01:13 <DIR> d-------- c:\windows\EHome
2009-03-23 01:12 . 2009-03-23 01:12 <DIR> d-------- c:\program files\GRETECH
2009-03-23 01:12 . 2009-03-23 01:12 <DIR> d-------- c:\documents and settings\miki\Application Data\GRETECH
2009-03-23 01:09 . 2006-03-09 00:33 2,636,672 --a--c--- c:\windows\system32\dllcache\ati3duag.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-02 09:24 90,112 ----a-w c:\windows\DUMP3fe7.tmp
2009-03-23 20:08 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-23 20:08 --------- d-----w c:\program files\Realtek
2009-03-23 19:24 --------- d-----w c:\program files\Common Files\InstallShield
2009-03-23 19:24 --------- d-----w c:\program files\ATI Technologies
2009-03-22 22:28 9,388 ----a-w c:\windows\system32\drivers\iaStor.PNF
2009-03-22 22:28 7,280 ----a-w c:\windows\system32\drivers\viamraid.PNF
2009-03-22 22:28 63,240 ----a-w c:\windows\system32\drivers\Si3112r.PNF
2009-03-22 22:28 6,984 ----a-w c:\windows\system32\drivers\SiSRaid.PNF
2009-03-22 22:28 20,152 ----a-w c:\windows\system32\drivers\INFCACHE.1
2009-03-22 22:28 12,432 ----a-w c:\windows\system32\drivers\adpu320.PNF
2009-03-22 22:28 12,204 ----a-w c:\windows\system32\drivers\nvraid.PNF
2009-03-22 22:28 10,828 ----a-w c:\windows\system32\drivers\iaAHCI.PNF
2009-03-22 22:09 --------- d-----w c:\program files\Launch Manager
2009-03-22 22:02 --------- d-----w c:\program files\Synaptics
2009-03-22 21:50 --------- d-----w c:\program files\microsoft frontpage
2009-03-22 21:49 --------- d-----w c:\program files\Java
2009-03-22 21:48 --------- d-----w c:\program files\Common Files\Java
2009-02-09 11:13 1,846,784 ----a-w c:\windows\system32\win32k.sys
2009-01-16 13:45 73,728 ----a-w c:\windows\system32\RtNicProp32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-01-20 761946]
"LaunchAp"="c:\program files\Launch Manager\LaunchAp.exe" [2005-07-25 32768]
"HotkeyApp"="c:\program files\Launch Manager\HotkeyApp.exe" [2005-07-28 57344]
"LMgrVolOSD"="c:\program files\Launch Manager\OSD.exe" [2005-03-16 204800]
"LMgrOSD"="c:\program files\Launch Manager\OSDCtrl.exe" [2005-07-25 241664]
"Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2005-07-25 81920]
"CtrlVol"="c:\program files\Launch Manager\CtrlVol.exe" [2003-09-16 20480]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"RTHDCPL"="RTHDCPL.EXE" [2006-05-18 c:\windows\RTHDCPL.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 c:\windows\system32\bthprops.cpl]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2009-03-12 20:56 342312 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2009-01-05 16:18 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
--a------ 2005-11-10 04:44 557056 c:\windows\sm56hlpr.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 Hotkey;Hotkey;c:\windows\system32\drivers\HOTKEY.sys [2009-03-23 9867]
S1 mailKmd;mailKmd; [x]
S1 Wbutton;Wbutton;c:\windows\system32\drivers\Wbutton.sys --> c:\windows\system32\drivers\Wbutton.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2009-04-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2009-04-04 23:15:55
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CtrlVol = c:\program files\Launch Manager\CtrlVol.exe?8???\??????|x??|????q??|?j?wQj?w????????,??? ???????????????d??????|????????p?????@?u??????????????s???????s???sx??s@??????????????|h??st??????????s?????????????????C?sc"?sx??s???????w??@?N'?st>???6@??>?????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(560)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-04-04 23:16:51
ComboFix-quarantined-files.txt 2009-04-04 21:16:48
ComboFix2.txt 2009-04-04 20:38:47

Pre-Run: 43,053,477,888 bytes free
Post-Run: 43,040,493,568 bytes free

182 --- E O F --- 2009-04-03 08:20:53

Dopuna: 06 Apr 2009 22:12

evo sve iz pocetka ...

nadam se da je sad dobro, jer mislim da jos uvek imam virus ..


ComboFix 09-04-04.01 - miki 2009-04-06 21:58:38.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1790.1300 [GMT 2:00]
Running from: c:\documents and settings\miki\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ISODRIVE
-------\Service_ISODrive


((((((((((((((((((((((((( Files Created from 2009-03-06 to 2009-04-06 )))))))))))))))))))))))))))))))
.

2009-04-06 21:55 . 2009-04-06 21:58 <DIR> d-------- C:\32788R22FWJFW
2009-04-06 21:55 . 2006-03-03 00:42 73,728 --a------ C:\pv.exe
2009-04-05 23:01 . 2009-04-05 23:01 <DIR> d-------- c:\documents and settings\miki\Application Data\DivX
2009-04-05 19:53 . 2009-04-05 19:53 <DIR> d-------- c:\program files\Microsoft Visual Studio 8
2009-04-05 19:41 . 2008-04-14 01:12 363,520 --a------ c:\windows\system32\PsisDecd.dll
2009-04-05 18:59 . 2009-04-05 18:59 <DIR> d-------- c:\program files\DivX
2009-04-05 18:58 . 2009-04-05 18:58 <DIR> d-------- c:\program files\Common Files\Adobe
2009-04-05 18:56 . 2009-04-05 18:56 <DIR> d-------- c:\program files\MSXML 4.0
2009-04-05 18:56 . 2007-06-14 14:41 466,048 --a------ c:\windows\system32\drivers\Ltn_stk7070P.sys
2009-04-05 18:56 . 2007-06-13 19:30 13,440 --a------ c:\windows\system32\drivers\Ltn_stkrc.sys
2009-04-05 18:55 . 1998-11-02 20:57 196,096 --------- c:\windows\system32\MACD32.DLL
2009-04-05 18:55 . 1998-11-02 20:57 138,752 --------- c:\windows\system32\MASE32.DLL
2009-04-05 18:55 . 1998-11-02 20:57 136,192 --------- c:\windows\system32\MAMC32.DLL
2009-04-05 18:55 . 1998-11-02 20:57 57,856 --------- c:\windows\system32\MASD32.DLL
2009-04-05 18:55 . 1998-11-02 20:57 27,648 --------- c:\windows\system32\MA32.DLL
2009-04-05 18:54 . 2003-03-19 06:28 2,179,072 --------- c:\windows\system32\mfc71d.dll
2009-04-05 18:54 . 2003-03-19 05:04 765,952 --------- c:\windows\system32\msvcp71d.dll
2009-04-05 18:54 . 2002-01-05 21:16 737,280 --------- c:\windows\system32\msvcp70d.dll
2009-04-05 18:54 . 2003-03-19 05:03 544,768 --------- c:\windows\system32\msvcr71d.dll
2009-04-05 18:54 . 2002-01-05 21:16 536,576 --------- c:\windows\system32\msvcr70d.dll
2009-04-05 18:54 . 2004-07-23 09:00 446,464 --------- c:\windows\system32\HHActiveX.dll
2009-04-05 18:54 . 2004-06-03 12:47 385,100 --------- c:\windows\system32\MSVCRTD.DLL
2009-04-05 18:53 . 2009-04-05 18:53 <DIR> d-------- c:\program files\Pinnacle
2009-04-05 18:53 . 2003-03-19 07:20 1,060,864 --------- c:\windows\system32\MFC71.dll
2009-04-05 18:53 . 2003-03-19 08:12 1,047,552 --------- c:\windows\system32\MFC71u.dll
2009-04-05 18:53 . 2006-12-01 23:54 626,688 --------- c:\windows\system32\msvcr80.dll
2009-04-05 18:53 . 2006-12-01 23:54 548,864 --------- c:\windows\system32\msvcp80.dll
2009-04-05 18:53 . 2003-09-10 16:36 499,712 --------- c:\windows\system32\msvcp71.dll
2009-04-05 18:53 . 2002-01-05 13:40 487,424 --------- c:\windows\system32\MSVCP70.DLL
2009-04-05 18:53 . 2003-09-10 16:36 348,160 --------- c:\windows\system32\Msvcr71.dll
2009-04-05 18:53 . 2002-01-05 13:37 344,064 --------- c:\windows\system32\MSVCR70.DLL
2009-04-05 18:53 . 2003-03-19 06:05 89,088 --------- c:\windows\system32\atl71.dll
2009-04-05 18:52 . 2009-04-05 19:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\Pinnacle
2009-04-05 18:07 . 2009-04-05 18:46 <DIR> d-------- c:\program files\Foxit Software
2009-04-05 18:07 . 2009-04-05 18:07 <DIR> d-------- c:\documents and settings\miki\Application Data\Foxit
2009-04-05 13:42 . 2009-04-05 13:42 <DIR> d-------- c:\windows\SHELLNEW
2009-04-05 02:27 . 2009-04-05 02:27 156,544 ---h----- C:\treeinfo.wc
2009-04-05 02:22 . 2009-04-05 02:22 <DIR> d-------- c:\program files\Intelore
2009-04-05 02:15 . 2009-04-05 02:15 <DIR> d-------- C:\mo
2009-04-05 01:57 . 2009-04-05 01:57 <DIR> d-------- c:\program files\Dodatki
2009-04-05 01:33 . 2009-04-06 21:47 <DIR> d-------- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-04-05 01:28 . 2009-04-05 18:28 <DIR> d--h----- C:\$AVG8.VAULT$
2009-04-05 00:41 . 2009-04-06 19:25 <DIR> d-------- c:\windows\system32\drivers\Avg
2009-04-05 00:41 . 2009-04-05 01:29 <DIR> d-------- c:\documents and settings\miki\Application Data\AVGTOOLBAR
2009-04-05 00:41 . 2009-04-05 00:41 325,640 --a------ c:\windows\system32\drivers\avgldx86.sys
2009-04-05 00:41 . 2009-04-05 00:41 108,552 --a------ c:\windows\system32\drivers\avgtdix.sys
2009-04-05 00:41 . 2009-04-05 00:41 10,520 --a------ c:\windows\system32\avgrsstx.dll
2009-04-05 00:40 . 2009-04-05 00:40 <DIR> d-------- c:\program files\AVG
2009-04-05 00:40 . 2009-04-05 00:40 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8
2009-04-05 00:13 . 2008-08-05 20:10 1,684,736 --a------ c:\windows\system32\drivers\Ambfilt.sys
2009-04-05 00:13 . 2006-01-04 15:41 1,389,056 --a------ c:\windows\system32\drivers\Monfilt.sys
2009-04-05 00:13 . 2008-10-23 17:42 290,816 --a------ c:\windows\vncutil.exe
2009-04-05 00:13 . 2009-03-17 14:07 122,880 --a------ c:\windows\RtkAudioService.exe
2009-04-05 00:13 . 2009-03-17 12:44 36,352 --a------ c:\windows\system32\RtkCoInstXP.dll
2009-04-04 22:32 . 2009-04-04 22:32 <DIR> d-------- C:\32788R22FWJFW.0.tmp
2009-04-04 21:04 . 2009-04-04 21:04 <DIR> d--h----- c:\windows\PIF
2009-04-04 21:02 . 2009-04-04 21:02 <DIR> d-------- c:\program files\Trend Micro
2009-04-04 18:28 . 2009-04-05 01:28 <DIR> d-------- c:\program files\WWShow
2009-04-04 18:27 . 2009-04-04 18:27 <DIR> d-------- c:\program files\Windows Installer Clean Up
2009-04-04 18:27 . 2009-04-04 18:27 <DIR> d-------- c:\program files\MSECACHE
2009-04-04 18:12 . 2009-04-05 01:28 <DIR> d-------- c:\program files\Jcore
2009-04-03 23:38 . 2009-04-03 23:38 <DIR> d-------- c:\program files\CCleaner
2009-04-03 18:05 . 2009-04-03 18:08 <DIR> d-------- c:\program files\UltraISO
2009-04-03 18:05 . 2009-04-03 18:05 <DIR> d-------- c:\program files\Common Files\EZB Systems
2009-03-31 21:32 . 2008-04-14 01:12 151,552 --a------ c:\windows\system32\irftp.exe
2009-03-31 21:32 . 2008-04-14 01:12 151,552 --a--c--- c:\windows\system32\dllcache\irftp.exe
2009-03-31 21:32 . 2008-04-14 01:11 28,160 --a------ c:\windows\system32\irmon.dll
2009-03-31 21:32 . 2008-04-14 01:11 28,160 --a--c--- c:\windows\system32\dllcache\irmon.dll
2009-03-31 21:32 . 2008-04-14 01:12 8,192 --a------ c:\windows\system32\wshirda.dll
2009-03-31 21:32 . 2008-04-14 01:12 8,192 --a--c--- c:\windows\system32\dllcache\wshirda.dll
2009-03-31 21:21 . 2009-03-31 21:21 <DIR> d-------- c:\documents and settings\miki\Application Data\Apple Computer
2009-03-31 21:21 . 2008-04-17 12:12 107,368 --a------ c:\windows\system32\GEARAspi.dll
2009-03-31 21:21 . 2009-01-15 12:19 23,848 --a------ c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-31 21:20 . 2009-03-31 21:21 <DIR> d-------- c:\program files\iTunes
2009-03-31 21:20 . 2009-03-31 21:20 <DIR> d-------- c:\program files\iPod
2009-03-31 21:20 . 2009-03-31 21:20 <DIR> d-------- c:\program files\Bonjour
2009-03-31 21:20 . 2009-03-31 21:21 <DIR> d-------- c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-31 21:19 . 2009-03-31 21:21 <DIR> d----c--- c:\windows\system32\DRVSTORE
2009-03-31 21:19 . 2009-03-31 21:20 <DIR> d-------- c:\program files\QuickTime
2009-03-31 21:19 . 2009-03-31 21:19 <DIR> d-------- c:\program files\Apple Software Update
2009-03-31 21:19 . 2009-03-31 21:19 <DIR> d-------- c:\documents and settings\All Users\Application Data\Apple Computer
2009-03-31 21:19 . 2009-03-05 23:59 1,900,544 --a------ c:\windows\system32\usbaaplrc.dll
2009-03-31 21:19 . 2009-03-05 23:59 36,864 --a------ c:\windows\system32\drivers\usbaapl.sys
2009-03-31 21:18 . 2009-03-31 21:20 <DIR> d-------- c:\program files\Common Files\Apple
2009-03-31 21:18 . 2009-03-31 21:18 <DIR> d-------- c:\documents and settings\All Users\Application Data\Apple
2009-03-31 20:56 . 2009-04-04 11:39 <DIR> d-------- c:\program files\Windows Media Connect 2
2009-03-31 20:47 . 2009-03-31 20:47 <DIR> d-------- c:\windows\system32\LogFiles
2009-03-31 20:47 . 2009-03-31 20:48 <DIR> d-------- c:\windows\system32\drivers\UMDF
2009-03-25 23:11 . 2009-03-25 23:11 <DIR> d-------- c:\program files\uTorrent
2009-03-25 23:11 . 2009-04-06 22:00 <DIR> d-------- c:\documents and settings\miki\Application Data\uTorrent
2009-03-24 20:16 . 2009-03-24 20:16 <DIR> d-------- c:\windows\system32\Lang
2009-03-24 20:16 . 2009-03-24 20:16 940,794 --a------ c:\windows\system32\LoopyMusic.wav
2009-03-24 20:16 . 2009-03-24 20:16 146,650 --a------ c:\windows\system32\BuzzingBee.wav
2009-03-23 22:10 . 2009-03-23 22:10 <DIR> d-------- c:\windows\Motorola
2009-03-23 22:08 . 2009-03-27 11:22 17,567,736 --a------ c:\windows\RTHDCPL.EXE
2009-03-23 22:08 . 2008-06-19 16:27 9,715,200 --a------ c:\windows\RTLCPL.EXE
2009-03-23 22:08 . 2009-03-30 17:13 5,063,168 --a------ c:\windows\system32\drivers\RtkHDAud.sys
2009-03-23 22:08 . 2008-06-19 16:42 2,808,832 --a------ c:\windows\ALCWZRD.EXE
2009-03-23 22:08 . 2009-03-10 14:32 2,168,320 --a------ c:\windows\MicCal.exe
2009-03-23 22:08 . 2009-01-21 15:54 1,206,816 --a------ c:\windows\RtlUpd.exe
2009-03-23 22:08 . 2009-03-20 16:31 880,640 --a------ c:\windows\system32\RTSndMgr.CPL
2009-03-23 22:08 . 2009-03-17 13:58 540,672 --a------ c:\windows\RtlExUpd.dll
2009-03-23 22:08 . 2008-06-19 16:24 278,528 --a------ c:\windows\system32\ALSNDMGR.CPL
2009-03-23 22:08 . 2008-08-19 13:26 77,824 --a------ c:\windows\SOUNDMAN.EXE
2009-03-23 22:08 . 2009-03-02 11:14 57,344 --a------ c:\windows\ALCMTR.EXE
2009-03-23 21:28 . 2009-03-23 21:28 <DIR> d-------- c:\documents and settings\miki\Application Data\ATI
2009-03-23 21:26 . 2009-03-23 21:26 <DIR> d-------- c:\program files\Common Files\ATI Technologies
2009-03-23 21:16 . 2008-04-13 20:45 26,368 --a--c--- c:\windows\system32\dllcache\usbstor.sys
2009-03-23 20:51 . 2001-08-17 14:48 12,160 --a------ c:\windows\system32\drivers\mouhid.sys
2009-03-23 20:51 . 2001-08-17 14:48 12,160 --a--c--- c:\windows\system32\dllcache\mouhid.sys
2009-03-23 20:51 . 2008-04-13 20:45 10,368 --a------ c:\windows\system32\drivers\hidusb.sys
2009-03-23 20:51 . 2008-04-13 20:45 10,368 --a--c--- c:\windows\system32\dllcache\hidusb.sys
2009-03-23 20:34 . 2009-03-23 20:34 <DIR> d-------- c:\program files\Opera
2009-03-23 01:40 . 2008-10-16 03:00 1,499,136 -----c--- c:\windows\system32\dllcache\shdocvw.dll
2009-03-23 01:40 . 2008-10-16 03:00 666,112 -----c--- c:\windows\system32\dllcache\wininet.dll
2009-03-23 01:40 . 2008-10-16 03:00 619,520 -----c--- c:\windows\system32\dllcache\urlmon.dll
2009-03-23 01:32 . 2008-12-12 19:01 3,067,904 -----c--- c:\windows\system32\dllcache\mshtml.dll
2009-03-23 01:31 . 2008-10-24 13:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2009-03-23 01:30 . 2008-08-14 12:11 2,189,184 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2009-03-23 01:30 . 2008-08-14 12:09 2,145,280 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-03-23 01:30 . 2008-08-14 11:33 2,066,048 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-03-23 01:30 . 2008-08-14 11:33 2,023,936 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2009-03-23 01:30 . 2008-04-11 21:04 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll
2009-03-23 01:30 . 2008-12-11 12:57 333,952 -----c--- c:\windows\system32\dllcache\srv.sys
2009-03-23 01:30 . 2008-05-01 16:33 331,776 -----c--- c:\windows\system32\dllcache\msadce.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-05 16:53 --------- d--h--w c:\program files\InstallShield Installation Information
2009-04-04 22:13 --------- d-----w c:\program files\Realtek
2009-04-02 09:24 90,112 ----a-w c:\windows\DUMP3fe7.tmp
2009-03-23 19:24 --------- d-----w c:\program files\Common Files\InstallShield
2009-03-23 19:24 --------- d-----w c:\program files\ATI Technologies
2009-03-22 22:28 9,388 ----a-w c:\windows\system32\drivers\iaStor.PNF
2009-03-22 22:28 7,280 ----a-w c:\windows\system32\drivers\viamraid.PNF
2009-03-22 22:28 63,240 ----a-w c:\windows\system32\drivers\Si3112r.PNF
2009-03-22 22:28 6,984 ----a-w c:\windows\system32\drivers\SiSRaid.PNF
2009-03-22 22:28 20,152 ----a-w c:\windows\system32\drivers\INFCACHE.1
2009-03-22 22:28 12,432 ----a-w c:\windows\system32\drivers\adpu320.PNF
2009-03-22 22:28 12,204 ----a-w c:\windows\system32\drivers\nvraid.PNF
2009-03-22 22:28 10,828 ----a-w c:\windows\system32\drivers\iaAHCI.PNF
2009-03-22 22:09 --------- d-----w c:\program files\Launch Manager
2009-03-22 22:02 --------- d-----w c:\program files\Synaptics
2009-03-22 21:50 --------- d-----w c:\program files\microsoft frontpage
2009-03-22 21:49 --------- d-----w c:\program files\Java
2009-03-22 21:48 --------- d-----w c:\program files\Common Files\Java
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Total CMA Pack"="c:\program files\Dodatki\Total CMA Pack\Total CMA Pack.exe" [2008-09-18 42393]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-01-20 761946]
"LaunchAp"="c:\program files\Launch Manager\LaunchAp.exe" [2005-07-25 32768]
"HotkeyApp"="c:\program files\Launch Manager\HotkeyApp.exe" [2005-07-28 57344]
"LMgrVolOSD"="c:\program files\Launch Manager\OSD.exe" [2005-03-16 204800]
"LMgrOSD"="c:\program files\Launch Manager\OSDCtrl.exe" [2005-07-25 241664]
"Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2005-07-25 81920]
"CtrlVol"="c:\program files\Launch Manager\CtrlVol.exe" [2003-09-16 20480]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-04-05 1932568]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 c:\windows\system32\bthprops.cpl]
"RTHDCPL"="RTHDCPL.EXE" [2009-03-27 c:\windows\RTHDCPL.EXE]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-04-05 00:41 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2009-03-12 20:56 342312 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2009-01-05 16:18 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
--a------ 2005-11-10 04:44 557056 c:\windows\sm56hlpr.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-04-05 325640]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-04-05 108552]
R1 Hotkey;Hotkey;c:\windows\system32\drivers\HOTKEY.sys [2009-03-23 9867]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-04-05 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-04-05 298264]
S1 mailKmd;mailKmd; [x]
S1 Wbutton;Wbutton;c:\windows\system32\drivers\Wbutton.sys --> c:\windows\system32\drivers\Wbutton.sys [?]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009-04-05 1684736]
S3 Ltn_stk7070P;PCTV based TV tuner device;c:\windows\system32\drivers\Ltn_stk7070P.sys [2009-04-05 466048]
S3 Ltn_stkrc;PCTV Infrared Receiver;c:\windows\system32\drivers\Ltn_stkrc.sys [2009-04-05 13440]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\SETUP.EXE /AUTORUN
\Shell\configure\command - F:\SETUP.EXE
\Shell\install\command - F:\SETUP.EXE
.
Contents of the 'Scheduled Tasks' folder

2009-04-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-PMCRemote - (no file)


.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2009-04-06 22:03:58
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CtrlVol = c:\program files\Launch Manager\CtrlVol.exe?8???\??????|x??|????q??|?j?wQj?w????????,??? ???????????????d??????|????????p?????@?u??????????????s???????s???sx??s@??????????????|h??st??????????s?????????????????C?sc"?sx??s???????w??@?N'?st>???6@??>?????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:e2,63,26,f1,3f,c8,ff,68,79,72,e2,15,9e,
01,1b,74,e2,63,26,f1,3f,c8,ff,68,d3,8e,5e,40,8b,2b,fd,9b,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,fd,89,95,14,b9,
1f,15,34,6a,9c,d6,61,af,45,84,18,f1,2c,c0,86,4c,b7,80,fd,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:7a,45,05,fd,91,e8,6f,31,49,30,ab,d3,0b,
43,82,cc,ff,7c,85,e0,43,d4,0e,fe,7c,83,75,08,a8,b2,bb,43,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,9a,4e,d0,b0,c0,
56,a5,dc,86,8c,21,01,be,91,eb,e7,c8,38,e5,31,12,6e,51,8b,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,b0,8d,85,5f,13,
46,b7,a5,f5,1d,4d,73,a8,13,5c,05,86,55,db,61,f1,4d,b3,89,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:df,20,58,62,78,6b,cf,c8,11,56,bd,92,fa,
a5,1b,b8,df,20,58,62,78,6b,cf,c8,69,8b,94,62,42,03,da,c8,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:31,77,e1,ba,b1,f8,68,02,a0,88,c9,1e,23,
1a,05,a0,fb,a7,78,e6,12,2f,9a,ea,0c,b3,70,e1,31,d6,26,71,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,ed,95,c9,a7,28,
a1,5d,c9,01,3a,48,fc,e8,04,4a,f1,88,8e,9a,fe,2e,cd,43,63,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,d0,9c,79,de,19,
71,f8,17,f6,0f,4e,58,98,5b,89,c9,7e,bf,bb,cb,2d,2c,9b,ce,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:3d,ce,ea,26,2d,45,aa,78,b0,f2,cf,14,bd,
26,3c,7a,3d,ce,ea,26,2d,45,aa,78,43,be,e3,dc,ed,49,a1,71,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,fa,0f,74,30,88,
04,63,41,2a,b7,cc,b5,b9,7f,41,e7,b8,4c,47,ed,7c,f9,62,20,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,37,8f,94,89,8e,
97,6e,03,6c,43,2d,1e,aa,22,2f,9c,b6,c3,97,43,fe,44,c9,76,6c,43,2d,1e,aa,22,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(568-)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2009-04-06 22:06:13 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-06 20:06:09

Pre-Run: 35,033,292,800 bytes free
Post-Run: 34,991,943,680 bytes free

324 --- E O F --- 2009-04-03 08:20:53













hj:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:10:46 PM, on 4/6/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\OSD.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Opera\opera.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\mk\mko\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [LMgrVolOSD] C:\Program Files\Launch Manager\OSD.exe
O4 - HKLM\..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSDCtrl.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [ATICCC] "c:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Total CMA Pack] C:\Program Files\Dodatki\Total CMA Pack\Total CMA Pack.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - (no file)
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - [Link mogu videti samo ulogovani korisnici]
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

--
End of file - 5674 bytes

Poslao: 07 Apr 2009 12:45
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

U logovima nema niceg spornog.

Ostaje jos samo da deinstaliras ComboFix prema sledecem upustvu:

Klikni START a zatim RUN.

U liniju za unos teksta ukucaj (iskopiraj) sledeće:

Combofix /u



a zatim klikni OK.

Sačekaj da se proces deinstalacije završi.

Poslao: 07 Apr 2009 20:49
Idi na vrh
offline
  • Pridružio: 24 Okt 2007
  • Poruke: 122

a sta bi znacilo ovo:

u folderu temp ne mogu da obrisem:

Perflib_Perfdata_6c .dat
Perflib_Perfdata_858
Perflib_Perfdata_b7c

a ne mogu ni da otvorim.

Poslao: 07 Apr 2009 22:00
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Ne mozes ih obrisati ili otvoriti zato sto su ti fajlovi trenutno u upotrebi i to je sasvim normalno.

MyCity » Ambulanta -> Arhiva Ambulante » hijack provera??

Ko je trenutno na forumu
 

Ukupno su 3603 korisnika na forumu :: 82 registrovanih, 1 sakriven i 3520 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 20624 - dana 04 Apr 2026 04:18

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: alex71, Atomski čoban, Bahuss, bladesu, blue, bobo85, bojank, bojanM84, boromir, braca57, Brada64, brane2208, celt, cenejac111, cvrle312, Dannyboy, dejanlule72, Demi87, Denaya, Desmond, djonsule, DonRumataEstorski, Dragon Order, DragoslavS, dule10savic, Duschi, Goga, Great White, Igor Antonic, jarovitt, Jeremiah, Jozo74, kikisp, Koridor 11, lakson001, Lj_ubo, Makarid, Manjane, marko308, maxim_von_burdengate, mačković, Miki281, mikrimaus, mladen.zovko, mm1811, nefs, neko_drugi, nemkea71, nuke92, opt1, pein, Petarvu, Petjan, Piani Jazzer, Prle90, probisic, Profesor_018, Pururin, raster12, rokokoko, Romibrat, sajorg, saputnik plavetnila, sasics, Sharpshooter, shiro, sickmouse, SirOliver, Siti2, Slobodan Filipović, Stojan Mrsavi, Tamna_strana_Meseca, tecataki, Tvrtko I, VanZan, Velizar Laro, VJ, Vlad000, Volfero, YugoSlav, zax22r, 800077