 Poslao: 01 Okt 2008 19:58 |
|
|
|
|
Ako moze da se proveri dali ima neki virus sam pocne da luduje otvara programe po deskop samo tako jedno dve minute i onda opet radi normalno.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:53, on 1.10.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Atomic Alarm Clock\AtomicAlarmClock.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Documents and Settings\zan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\zan\Desktop\hjs.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKCU\..\Run: [SkinClock] C:\Program Files\Atomic Alarm Clock\AtomicAlarmClock.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: cbXpmKDT - C:\WINDOWS\
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: LVSrvLauncher - Labtec Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O24 - Desktop Component 0: Privacy Protection - (no file)
O24 - Desktop Component 1: My Current Home Page - About:Home
--
End of file - 8685 bytes |
|
|
|
|
|
| Poslao: 01 Okt 2008 20:21 |
|
|
| dr_Bora |
 Anti Malware Fighter
Rank 2 
Supermoderator
tech foruma |
 |
| |
| Pridružio: 24 Jul 2007 |
| Poruke: 7635 |
Gde živiš: Höganäs, SE
[Povratak na vrh] |
|
|
 |
|
 |
|
Poz...
 Privremeno treba isključiti TeaTimer:
- Pokrenite Spybot S&D
- Kliknite Mode stavku u meniju
- Odaberite Advance Mode
- Na traci levo kliknite na Tools
- Kliknite na Resident
- Destiklirajte Resident Tea-Timer
- Zatvorite Spybot S&D
- Restartujte kompjuter.
- Zatim skinuti program sa ovog linka na Desktop.
- Pokrenuti ga dvoklikom i ispratiti uputstva.
Nemojte zaboraviti da ponovo ukljucite ove opcije kada zavrsimo ciscenje.
Takođe, treba isključiti i KIS:
* Klikni desnim tasterom na Kaspersky ikonicu (  ) u donjem, desnom uglu ekrana i izaberi Pause Protection.
* U prozoru koji se otvori, izaberi By User Request.
Napomena: Ne zaboravi da uključiš ovu opciju po završetku čišćenja.
-------------------------------------------------------------------------------------
Skini ComboFix sa jedne od sledecih adresa na Desktop:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.forospyware.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe
Startuj ga i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu. Kada zavrsi pojavice se log (C:\ComboFix.txt) koji ces nam ovde iskopirati. |
|
|
|
|
|
| Poslao: 03 Okt 2008 21:10 |
|
|
|
|
ComboFix 08-10-02.04 - zan 2008-10-03 18:49:19.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1250.1.1033.18.1580 [GMT 2:00]
Running from: C:\Documents and Settings\zan\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-09-03 to 2008-10-03 )))))))))))))))))))))))))))))))
.
2008-10-01 18:59 . 2008-10-01 19:02 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-09-29 18:24 . 2008-09-29 18:24 <DIR> d-------- C:\Program Files\VoipDiscount.com
2008-09-28 08:43 . 2008-09-28 08:43 <DIR> d-------- C:\Program Files\Empire Interactive
2008-09-27 20:20 . 2008-09-27 20:20 <DIR> d-------- C:\Program Files\Nero
2008-09-27 20:11 . 2008-06-24 13:45 1,414,440 --a------ C:\WINDOWS\system32\ShellManager310E2D762.dll
2008-09-27 20:11 . 2008-06-23 17:36 773,120 --a------ C:\WINDOWS\system32\NEROINSTAEC43759.DB
2008-09-27 20:11 . 2008-09-27 20:11 0 --a------ C:\WINDOWS\Irremote.ini
2008-09-24 16:15 . 2008-09-24 16:15 <DIR> d-------- C:\Documents and Settings\zan\Application Data\Nero
2008-09-24 16:13 . 2008-09-27 20:20 <DIR> d-------- C:\Program Files\Common Files\Nero
2008-09-24 16:13 . 2008-09-27 20:20 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2008-09-21 15:14 . 2008-09-21 15:14 <DIR> d-------- C:\Program Files\Real
2008-09-21 15:14 . 2008-09-21 15:14 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-09-21 15:14 . 2008-09-21 15:14 <DIR> d-------- C:\Program Files\Common Files\Real
2008-09-21 09:50 . 2008-09-21 09:50 <DIR> d-------- C:\Program Files\YouTube Downloader
2008-09-20 18:57 . 2008-09-20 18:57 <DIR> d-------- C:\Program Files\CAPCOM
2008-09-20 18:49 . 2008-09-20 18:49 <DIR> d-------- C:\WINDOWS\Sun
2008-09-19 23:58 . 2008-09-19 23:59 <DIR> d-------- C:\temp
2008-09-18 17:41 . 2008-09-18 17:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Media Center Programs
2008-09-18 17:38 . 2008-09-18 17:38 <DIR> d-------- C:\WINDOWS\system32\AGEIA
2008-09-18 17:38 . 2008-09-18 17:38 <DIR> d-------- C:\Program Files\Sega
2008-09-18 17:38 . 2008-09-18 17:38 <DIR> d-------- C:\Program Files\AGEIA Technologies
2008-09-18 17:35 . 2008-09-18 17:35 <DIR> d-------- C:\Documents and Settings\zan\Application Data\InstallShield
2008-09-10 21:33 . 2008-09-10 21:33 275 --a------ C:\Bli§njica do Lokalni disk (D).lnk
2008-09-03 22:26 . 2005-05-03 12:43 69,632 -r------- C:\WINDOWS\Alcmtr.exe
2008-09-03 18:58 . 2008-09-03 18:58 <DIR> d-------- C:\Program Files\Common Files\Labtec
2008-09-03 18:57 . 2008-09-03 18:57 <DIR> d-------- C:\Program Files\Labtec
2008-09-03 18:57 . 2008-09-03 18:57 <DIR> d-------- C:\Program Files\Common Files\LogiShrd
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-03 16:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-10-03 16:42 696,352 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-10-03 16:42 6,232,608 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-10-03 16:42 50,820 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-10-03 16:42 4,508 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-10-03 12:29 --------- d-----w C:\Documents and Settings\zan\Application Data\uTorrent
2008-10-03 02:59 --------- d-----w C:\Documents and Settings\zan\Application Data\Skype
2008-10-02 03:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-01 12:48 --------- d-----w C:\Documents and Settings\zan\Application Data\skypePM
2008-09-29 16:26 --------- d-----w C:\Documents and Settings\zan\Application Data\VoipDiscount
2008-09-28 06:43 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-24 19:31 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2008-09-24 15:17 --------- d-----w C:\Program Files\eMule
2008-09-24 14:01 --------- d-----w C:\Program Files\Common Files\Ahead
2008-09-24 14:01 --------- d-----w C:\Program Files\Ahead
2008-09-22 15:14 --------- d-----w C:\Program Files\SpeedFan
2008-09-21 13:14 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-09-21 13:14 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-09-10 19:35 2,285,056 ----a-w C:\WINDOWS\system32\TUKernel.exe
2008-09-10 12:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-09-03 20:26 --------- d-----w C:\Program Files\Realtek
2008-09-02 17:53 --------- d-----w C:\Program Files\Microsoft MapPoint Europe
2008-08-30 11:51 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-08-30 11:51 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-08-30 11:51 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-08-29 16:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-08-29 16:51 --------- d-----w C:\Program Files\Yahoo!
2008-08-23 08:26 22,328 ----a-w C:\Documents and Settings\zan\Application Data\PnkBstrK.sys
2008-08-23 08:20 --------- d-----w C:\Program Files\Activision
2008-08-22 15:48 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-08-19 12:50 --------- d-----w C:\Program Files\Apple Software Update
2008-08-19 12:49 --------- d-----w C:\Program Files\Safari
2008-08-17 10:52 --------- d-----w C:\Program Files\iTunes
2008-08-17 10:52 --------- d-----w C:\Program Files\iPod
2008-08-17 10:52 --------- d-----w C:\Documents and Settings\zan\Application Data\Apple Computer
2008-08-17 10:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-08-17 10:51 --------- d-----w C:\Program Files\QuickTime
2008-08-17 10:51 --------- d-----w C:\Program Files\Common Files\Apple
2008-08-17 10:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-08-16 16:21 53,248 ----a-w C:\WINDOWS\system32\unrar.dll
2008-08-13 07:06 --------- d-----w C:\Program Files\nLite
2008-08-12 21:55 --------- d-----w C:\Documents and Settings\zan\Application Data\Lavasoft
2008-08-12 21:54 --------- d-----w C:\Program Files\Lavasoft
2008-08-12 21:51 --------- d-----w C:\Program Files\Unlocker
2008-08-10 12:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\services
2008-08-10 12:01 64,362 ----a-w C:\WINDOWS\system32\hstsjgeetrjdfwdf.exe
2008-08-06 17:32 96,976 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-08-05 15:07 --------- d-----w C:\Program Files\MSXML 4.0
2008-08-04 21:03 --------- d-----w C:\Documents and Settings\zan\Application Data\InterVideo
2008-08-04 20:33 --------- d-----w C:\Program Files\InterVideo Information Service
2008-08-04 20:33 --------- d-----w C:\Program Files\Common Files\Ulead
2008-08-04 20:30 --------- d-----w C:\Program Files\InterVideo
2008-08-04 20:30 --------- d-----w C:\Program Files\Common Files\InterVideo
2008-08-04 20:30 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-08-04 20:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\InstallShield
2008-07-23 14:22 99,622 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-07-23 14:22 218,624 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-07-23 14:22 2,791 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-11 13:00 355,584 ----a-w C:\WINDOWS\system32\TuneUpDefragService.exe
2008-07-10 19:13 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-07-07 20:26 253,952 ----a-w C:\WINDOWS\system32\es.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkinClock"="C:\Program Files\Atomic Alarm Clock\AtomicAlarmClock.exe" [2008-07-10 1707008]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"VoipDiscount"="C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe" [2007-05-31 7419456]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-14 1695232]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2008-04-25 201992]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-12 C:\WINDOWS\RTHDCPL.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" /background
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"VoipDiscount"="C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe" -nosplash -minimized
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe
"Google Update"="C:\Documents and Settings\zan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
"PWRISOVM.EXE"=C:\Program Files\PowerISO\PWRISOVM.EXE
"Alcmtr"=ALCMTR.EXE
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe"
"NeroFilterCheck"=C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"
"AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" -atboottime
"LogitechQuickCamRibbon"="C:\Program Files\Labtec\WebCam10\WebCam10.exe" /hide
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\VoipDiscount.com\\VoipDiscount\\VoipDiscount.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Sega\\Gas Powered Games\\Space Siege\\SpaceSiege.exe"=
"C:\\Program Files\\Empire Interactive\\Strangelite\\Starship Troopers\\STGame.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 32784]
R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-10-17 9216]
R0 xfilt;VIA SATA IDE Hot-plug Driver;C:\WINDOWS\system32\DRIVERS\xfilt.sys [2006-10-18 17920]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;C:\WINDOWS\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-03-25 24592]
S3 idrmkl;idrmkl;C:\DOCUME~1\zan\LOCALS~1\Temp\idrmkl.sys [ ]
S3 SetupNTGLM7X;SetupNTGLM7X;E:\NTGLM7X.sys [ ]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-07-11 355584]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -
Notify-cbXpmKDT - (no file)
Notify-WgaLogon - (no file)
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\zan\Application Data\Mozilla\Firefox\Profiles\lsdxjlua.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.si/
FF -: plugin - C:\Documents and Settings\zan\Local Settings\Application Data\Google\Update\1.2.131.11\npGoogleOneClick5.dll
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - C:\Program Files\Yahoo!\Common\npyaxmpb.dll
FF -: plugin - C:\Program Files\Yahoo!\Shared\npYState.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-03 18:50:50
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-10-03 18:51:43
ComboFix-quarantined-files.txt 2008-10-03 16:51:40
Pre-Run: 66.180.100.096 bytes free
Post-Run: 66,299,879,424 prosto bajtov
219 --- E O F --- 2008-09-10 12:28:10
sa malo zakasnjenja evo log |
|
|
|
|
|
| Poslao: 03 Okt 2008 21:39 |
|
|
| dr_Bora |
Anti Malware Fighter
Rank 2
Supermoderator
tech foruma |
|
| |
| Pridružio: 24 Jul 2007 |
| Poruke: 7635 |
Gde živiš: Höganäs, SE
[Povratak na vrh] |
|
|
|
|
|
|
Otvoriti Notepad i iskopirati sledeci tekst:
| Kod: | File::
C:\WINDOWS\system32\hstsjgeetrjdfwdf.exe
Folder::
C:\Documents and Settings\All Users\Application Data\services
|
Snimiti na Desktop fajl iz Notepada kao "CFScript"
Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja. |
|
|
|
|
|
| Poslao: 03 Okt 2008 21:58 |
|
|
|
|
ComboFix 08-10-03.01 - zan 2008-10-03 21:52:29.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1250.1.1033.18.1535 [GMT 2:00]
Running from: C:\Documents and Settings\zan\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\zan\Desktop\CFScript
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
C:\WINDOWS\system32\hstsjgeetrjdfwdf.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Application Data\services
C:\WINDOWS\system32\hstsjgeetrjdfwdf.exe
.
((((((((((((((((((((((((( Files Created from 2008-09-03 to 2008-10-03 )))))))))))))))))))))))))))))))
.
2008-10-01 18:59 . 2008-10-01 19:02 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-09-29 18:24 . 2008-09-29 18:24 <DIR> d-------- C:\Program Files\VoipDiscount.com
2008-09-28 08:43 . 2008-09-28 08:43 <DIR> d-------- C:\Program Files\Empire Interactive
2008-09-27 20:20 . 2008-09-27 20:20 <DIR> d-------- C:\Program Files\Nero
2008-09-27 20:11 . 2008-06-24 13:45 1,414,440 --a------ C:\WINDOWS\system32\ShellManager310E2D762.dll
2008-09-27 20:11 . 2008-06-23 17:36 773,120 --a------ C:\WINDOWS\system32\NEROINSTAEC43759.DB
2008-09-27 20:11 . 2008-09-27 20:11 0 --a------ C:\WINDOWS\Irremote.ini
2008-09-24 16:15 . 2008-09-24 16:15 <DIR> d-------- C:\Documents and Settings\zan\Application Data\Nero
2008-09-24 16:13 . 2008-09-27 20:20 <DIR> d-------- C:\Program Files\Common Files\Nero
2008-09-24 16:13 . 2008-09-27 20:20 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2008-09-21 15:14 . 2008-09-21 15:14 <DIR> d-------- C:\Program Files\Real
2008-09-21 15:14 . 2008-09-21 15:14 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-09-21 15:14 . 2008-09-21 15:14 <DIR> d-------- C:\Program Files\Common Files\Real
2008-09-21 09:50 . 2008-09-21 09:50 <DIR> d-------- C:\Program Files\YouTube Downloader
2008-09-20 18:57 . 2008-09-20 18:57 <DIR> d-------- C:\Program Files\CAPCOM
2008-09-20 18:49 . 2008-09-20 18:49 <DIR> d-------- C:\WINDOWS\Sun
2008-09-19 23:58 . 2008-09-19 23:59 <DIR> d-------- C:\temp
2008-09-18 17:41 . 2008-09-18 17:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Media Center Programs
2008-09-18 17:38 . 2008-09-18 17:38 <DIR> d-------- C:\WINDOWS\system32\AGEIA
2008-09-18 17:38 . 2008-09-18 17:38 <DIR> d-------- C:\Program Files\Sega
2008-09-18 17:38 . 2008-09-18 17:38 <DIR> d-------- C:\Program Files\AGEIA Technologies
2008-09-18 17:35 . 2008-09-18 17:35 <DIR> d-------- C:\Documents and Settings\zan\Application Data\InstallShield
2008-09-10 21:33 . 2008-09-10 21:33 275 --a------ C:\Bližnjica do Lokalni disk (D).lnk
2008-09-03 22:26 . 2005-05-03 12:43 69,632 -r------- C:\WINDOWS\Alcmtr.exe
2008-09-03 18:58 . 2008-09-03 18:58 <DIR> d-------- C:\Program Files\Common Files\Labtec
2008-09-03 18:57 . 2008-09-03 18:57 <DIR> d-------- C:\Program Files\Labtec
2008-09-03 18:57 . 2008-09-03 18:57 <DIR> d-------- C:\Program Files\Common Files\LogiShrd
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-03 19:50 712,736 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-10-03 19:50 4,564 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-10-03 16:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-10-03 16:42 6,232,608 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-10-03 16:42 50,820 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-10-03 12:29 --------- d-----w C:\Documents and Settings\zan\Application Data\uTorrent
2008-10-03 02:59 --------- d-----w C:\Documents and Settings\zan\Application Data\Skype
2008-10-02 03:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-01 12:48 --------- d-----w C:\Documents and Settings\zan\Application Data\skypePM
2008-09-29 16:26 --------- d-----w C:\Documents and Settings\zan\Application Data\VoipDiscount
2008-09-28 06:43 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-24 19:31 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2008-09-24 15:17 --------- d-----w C:\Program Files\eMule
2008-09-24 14:01 --------- d-----w C:\Program Files\Common Files\Ahead
2008-09-24 14:01 --------- d-----w C:\Program Files\Ahead
2008-09-22 15:14 --------- d-----w C:\Program Files\SpeedFan
2008-09-21 13:14 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-09-21 13:14 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-09-10 19:35 2,285,056 ----a-w C:\WINDOWS\system32\TUKernel.exe
2008-09-10 12:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-09-03 20:26 --------- d-----w C:\Program Files\Realtek
2008-09-02 17:53 --------- d-----w C:\Program Files\Microsoft MapPoint Europe
2008-08-30 11:51 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-08-30 11:51 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-08-30 11:51 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-08-29 16:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-08-29 16:51 --------- d-----w C:\Program Files\Yahoo!
2008-08-23 08:26 22,328 ----a-w C:\Documents and Settings\zan\Application Data\PnkBstrK.sys
2008-08-23 08:20 --------- d-----w C:\Program Files\Activision
2008-08-22 15:48 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-08-19 12:50 --------- d-----w C:\Program Files\Apple Software Update
2008-08-19 12:49 --------- d-----w C:\Program Files\Safari
2008-08-17 10:52 --------- d-----w C:\Program Files\iTunes
2008-08-17 10:52 --------- d-----w C:\Program Files\iPod
2008-08-17 10:52 --------- d-----w C:\Documents and Settings\zan\Application Data\Apple Computer
2008-08-17 10:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-08-17 10:51 --------- d-----w C:\Program Files\QuickTime
2008-08-17 10:51 --------- d-----w C:\Program Files\Common Files\Apple
2008-08-17 10:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-08-16 16:21 53,248 ----a-w C:\WINDOWS\system32\unrar.dll
2008-08-13 07:06 --------- d-----w C:\Program Files\nLite
2008-08-12 21:55 --------- d-----w C:\Documents and Settings\zan\Application Data\Lavasoft
2008-08-12 21:54 --------- d-----w C:\Program Files\Lavasoft
2008-08-12 21:51 --------- d-----w C:\Program Files\Unlocker
2008-08-06 17:32 96,976 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-08-05 15:07 --------- d-----w C:\Program Files\MSXML 4.0
2008-08-04 21:03 --------- d-----w C:\Documents and Settings\zan\Application Data\InterVideo
2008-08-04 20:33 --------- d-----w C:\Program Files\InterVideo Information Service
2008-08-04 20:33 --------- d-----w C:\Program Files\Common Files\Ulead
2008-08-04 20:30 --------- d-----w C:\Program Files\InterVideo
2008-08-04 20:30 --------- d-----w C:\Program Files\Common Files\InterVideo
2008-08-04 20:30 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-08-04 20:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\InstallShield
2008-07-23 14:22 99,622 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-07-23 14:22 218,624 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-07-23 14:22 2,791 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-11 13:00 355,584 ----a-w C:\WINDOWS\system32\TuneUpDefragService.exe
2008-07-10 19:13 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-07-07 20:26 253,952 ----a-w C:\WINDOWS\system32\es.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkinClock"="C:\Program Files\Atomic Alarm Clock\AtomicAlarmClock.exe" [2008-07-10 1707008]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"VoipDiscount"="C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe" [2007-05-31 7419456]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-14 1695232]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2008-04-25 201992]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-12 C:\WINDOWS\RTHDCPL.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" /background
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"VoipDiscount"="C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe" -nosplash -minimized
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe
"Google Update"="C:\Documents and Settings\zan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
"PWRISOVM.EXE"=C:\Program Files\PowerISO\PWRISOVM.EXE
"Alcmtr"=ALCMTR.EXE
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe"
"NeroFilterCheck"=C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"
"AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" -atboottime
"LogitechQuickCamRibbon"="C:\Program Files\Labtec\WebCam10\WebCam10.exe" /hide
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\VoipDiscount.com\\VoipDiscount\\VoipDiscount.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Sega\\Gas Powered Games\\Space Siege\\SpaceSiege.exe"=
"C:\\Program Files\\Empire Interactive\\Strangelite\\Starship Troopers\\STGame.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 32784]
R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-10-17 9216]
R0 xfilt;VIA SATA IDE Hot-plug Driver;C:\WINDOWS\system32\DRIVERS\xfilt.sys [2006-10-18 17920]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;C:\WINDOWS\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-03-25 24592]
S3 idrmkl;idrmkl;C:\DOCUME~1\zan\LOCALS~1\Temp\idrmkl.sys [ ]
S3 SetupNTGLM7X;SetupNTGLM7X;E:\NTGLM7X.sys [ ]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-07-11 355584]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-03 21:53:35
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-10-03 21:54:17
ComboFix-quarantined-files.txt 2008-10-03 19:54:14
ComboFix2.txt 2008-10-03 16:51:44
Pre-Run: 66.318.278.656 bytes free
Post-Run: 66,288,312,320 bytes free
213 --- E O F --- 2008-09-10 12:28:10 |
|
|
|
|
|
| Poslao: 03 Okt 2008 23:01 |
|
|
| dr_Bora |
Anti Malware Fighter
Rank 2
Supermoderator
tech foruma |
|
| |
| Pridružio: 24 Jul 2007 |
| Poruke: 7635 |
Gde živiš: Höganäs, SE
[Povratak na vrh] |
|
|
|
|
|
|
Ovo izgleda ok.
Kakvo je sada stanje? |
|
|
|
|
|
| Poslao: 04 Okt 2008 12:33 |
|
|
|
|
Sada zasad kaze da je stanje uredu ,nije vise spor kako je prije bio.
hvala za pomoc . |
|
|
|
|
|
| Poslao: 04 Okt 2008 12:41 |
|
|
| dr_Bora |
Anti Malware Fighter
Rank 2
Supermoderator
tech foruma |
|
| |
| Pridružio: 24 Jul 2007 |
| Poruke: 7635 |
Gde živiš: Höganäs, SE
[Povratak na vrh] |
|
|
|
|
|
|
Uradi sledeće:
- Klikni START a zatim RUN
- U liniju za unos teksta ukucaj Combofix /u i klikni OK
- Sačekaj da se proces deinstalacije završi
Gornja procedura će:
- Obrisati sledeće:
- ComboFix i njegove file-ove i foldere
- VundoFix Backups folder, ako postoji
- C:\Deckard folder, ako postoji
- C:\OtMoveIt folder, ako postoji
- Resetovati podešavanja sata na kompjuteru
- Sakriti ekstenzije file-ova, ako je potrebno
- Sakriti sistemske/skrivene file-ove/foldere, ako je potrebno
- Resetovati System Restore
To je sve. |
|
|
|
|
|
  |
Strana 1 od 1
|
(Registrovanim korisnicima se NE prikazuju reklame)
Ukupno su 117 korisnika na forumu :: 8 Registrovanih, 1 Sakrivenih i 108 Gosta :: [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije
Najviše korisnika na forumu ikad bilo je 972 - dana 26 Okt 2008 13:06
Korisnici trenutno na forumu: Acid_Burn, Da vam Bata nešto kaže..., despot77, Jean Luc, kole017, N1k0l4, saten, Žan Klod vam dam |
|
