MyCity » Ambulanta -> Arhiva Ambulante » virus killvbs.vbs

virus killvbs.vbs

Napisano na dan: 5.1.2009
1

virus killvbs.vbs
Sledeća strana Pagination

Idi na vrh

Poslao: 05 Jan 2009 22:43
Idi na vrh
offline
  • Pridružio: 05 Jan 2009
  • Poruke: 7

Logfile of HijackThis v1.99.1
Scan saved at 22:30:26, on 5.1.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscript.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Common Files\ARS Company\Agent\Agent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Opera\Opera.exe
C:\Documents and Settings\sasa ns\Desktop\danijelce\3.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = [Link mogu videti samo ulogovani korisnici]*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici]*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = [Link mogu videti samo ulogovani korisnici]*http://www.yahoo.com
R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wscript.exe C:\WINDOWS\system32\killVBS.vbs
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Research - {037C7B8A-151A-49E6-BAED-CC05FCB50328} - C:\WINDOWS\system32\winsrc.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\awtuRKec.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {77AB59B4-55A3-4737-9FD5-B93C6430BF78} - C:\WINDOWS\system32\agfmnqxq.dll
O2 - BHO: (no name) - {E8F3C912-F674-4CAA-9645-E0B7BEC49B06} - C:\WINDOWS\system32\pmnLExxu.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [MSN] C:\Windows\msnmsgr.exe
O4 - HKLM\..\Run: [a8c3ef43] rundll32.exe "C:\WINDOWS\system32\hhbffici.dll",b
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe"
O4 - HKCU\..\Run: [AMP Agent] C:\Program Files\Common Files\ARS Company\Agent\Agent.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O20 - Winlogon Notify: awtuRKec - C:\WINDOWS\SYSTEM32\awtuRKec.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O23 - Service: Kaspersky Internet Security (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" -r (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe



Poslao: 06 Jan 2009 00:02
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Pozdrav...


Zašto nemaš instaliran antivirus?




Preuzmi instalaciju za program Malwarebytes Anti-Malware sa sledećeg linka:
[Link mogu videti samo ulogovani korisnici]

Dvoklikom pokreni instalaciju - na samom kraju procesa, proveri da su obeležene opcije:
Update Malwarebytes' Anti-Malware;
Launch Malwarebytes Anti-Malware;
a zatim klikni Finish.

Nakon završenog ažuriranja program će se pokrenuti.

Izaberi opciju Perform Quick Scan i klikni Scan.

Po završetku procesa klikni OK, Show Results: u listi detektovanog malware-a, obeleži sve stavke i klikni Remove Selected.

Po završetku procesa, logfile će se otvoriti u Notepad-u; iskopiraj ga u temu na forumu.
Ukoliko program zatraži restart kako bi se završio proces čišćenja, obavezno ga dozvoliti.

Napomena: ako dođe do restarta na kraju procesa čišćenja, logfile će biti dostupan na Logs kartici (obeleži ga i klikni Open).


Takođe, nakon svega, potrebno je postaviti i svež HijackThis logfile.



Poslao: 06 Jan 2009 21:59
Idi na vrh
offline
  • Pridružio: 05 Jan 2009
  • Poruke: 7

Ne mogu da preuzmem instalaciju sa ovog linka. Imas li alternativu? Unapred hvala.

Poslao: 06 Jan 2009 22:33
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Idemo na drugi alat...



Skini ComboFix sa jedne od sledecih adresa na Desktop:
[Link mogu videti samo ulogovani korisnici]
[Link mogu videti samo ulogovani korisnici]
[Link mogu videti samo ulogovani korisnici]

Startuj ga i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu. Kada zavrsi pojavice se log (C:\ComboFix.txt) koji ces nam ovde iskopirati.

Poslao: 18 Jan 2009 19:03
Idi na vrh
offline
  • Pridružio: 05 Jan 2009
  • Poruke: 7

evo mene opet...
Nazalost, nisam uspeo da skinem combo ni sa jedne adrese. Skinuo sam sa drugog racunara setup za Malwarebytes Anti-malware prebacio na flash memoriju, i pokusao da pokrenem na mom racunaru ali bezuspesno. Sta dalje?

Poslao: 18 Jan 2009 20:33
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Temu si otvorio pre dve nedelje - a još ni počeli nismo da radimo bilo šta.

To tako teško može funkcionisati. Ako hoćeš da ovo rešavamo, potrebno je da se bar jednom na dan javljaš u temi.

Poslao: 19 Jan 2009 09:00
Idi na vrh
offline
  • Pridružio: 05 Jan 2009
  • Poruke: 7

Nisam bio kuci, pa sam sve odlozio kad se vratim. Izvinjavam se, nisam znao forum tako funkcionise. U svakom slucaju hvala.

Poslao: 19 Jan 2009 19:17
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

To nije nikakvo pisano pravilo, već je to jedini način da očistimo kompjuter.

Ukoliko između različitih delova postupka prođe previše vremena, velika je verovatnoća regeneracije malware-a.


Ako želiš da radimo na ovome... Skini ComboFix sa ovog linka:
[Link mogu videti samo ulogovani korisnici]

Poslao: 20 Jan 2009 21:23
Idi na vrh
offline
  • Pridružio: 05 Jan 2009
  • Poruke: 7

zelim jer mi je sada racunar vec prilicno u autu...Gasi se sam od sebe, a juce mi se desilo da ne mogu da ga iskljucim!!! Nekako sam uspeo na kraju, ali mislim da je u prilicno losem stanju. pokusacu danas da skinem combo pa se javim.

Dopuna: 20 Jan 2009 21:07

ComboFix 09-01-19.01 - sasa ns 2009-01-20 20:46:12.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.759.576 [GMT 1:00]
Running from: c:\documents and settings\sasa ns\Desktop\C-F.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Outdated)
FW: Kaspersky Internet Security *disabled*

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\fxstaller.exe
c:\windows\IE4 Error Log.txt
c:\windows\system32\agfmnqxq.dll
c:\windows\system32\awtuRKec.dll
c:\windows\system32\buvvugxa.ini
c:\windows\system32\drivers\TDSSmaxt.sys
c:\windows\system32\explorer32.exe
c:\windows\system32\hgGxXqNF.dll
c:\windows\system32\hhbffici.dll
c:\windows\system32\iciffbhh.ini
c:\windows\system32\ieupdates.exe
c:\windows\system32\ifjypdoc.ini
c:\windows\system32\khfGwUKc.dll
c:\windows\system32\kxsbllmv.ini
c:\windows\system32\lfrjscna.ini
c:\windows\system32\llcthjwx.ini
c:\windows\system32\mqqqoejs.ini
c:\windows\system32\ooxdmukj.ini
c:\windows\system32\pmnLExxu.dll
c:\windows\system32\sxcxqfdl.ini
c:\windows\system32\TDSScfgb.dll
c:\windows\system32\TDSSfpmp.dll
c:\windows\system32\TDSSnmxh.log
c:\windows\system32\TDSSnrsr.dll
c:\windows\system32\TDSSoeqh.dll
c:\windows\system32\TDSSosvn.dat
c:\windows\system32\TDSSriqp.dll
c:\windows\system32\TDSSsbhc.dll
c:\windows\system32\TDSSthym.log
c:\windows\system32\TDSStkdv.log
c:\windows\system32\uxxELnmp.ini
c:\windows\system32\uxxELnmp.ini2
c:\windows\system32\vmllbsxk.dll
c:\windows\system32\winsrc.dll
c:\windows\system32\winsrc.dll.tmp
c:\windows\system32\wvUkLffg.dll
c:\windows\system32\xpbqxyfd.ini
c:\windows\Tasks\wjlzemtp.job
c:\windows\Temp\tmp3.tmp

----- BITS: Possible infected sites -----

[Link mogu videti samo ulogovani korisnici]
[Link mogu videti samo ulogovani korisnici]
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_TDSSserv.sys
-------\Legacy_TDSSserv.sys


((((((((((((((((((((((((( Files Created from 2008-12-20 to 2009-01-20 )))))))))))))))))))))))))))))))
.

2009-01-01 13:31 . 2009-01-01 13:31 <DIR> d-------- c:\windows\system32\NtmsData
2008-12-31 18:02 . 2008-12-31 18:02 <DIR> d-------- c:\documents and settings\Administrator

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-20 19:55 5,824 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-01-20 19:55 473,120 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-01-20 19:55 2,604 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-01-20 19:55 139,296 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-01-18 16:45 --------- d-----w c:\documents and settings\sasa ns\Application Data\Skype
2008-12-21 19:08 --------- d-----w c:\program files\Winamp
2008-12-05 18:42 --------- d-----w c:\documents and settings\sasa ns\Application Data\Winamp
2008-12-01 15:38 --------- d-----w c:\program files\Common Files\Adobe
2008-11-26 11:47 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo! Companion
2008-11-25 09:56 --------- d-----w c:\program files\Yahoo!
2008-11-25 09:56 --------- d-----w c:\documents and settings\sasa ns\Application Data\Yahoo!
2008-11-25 09:55 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2008-11-20 21:10 --------- d-----w c:\program files\Nokia
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2008-07-16 1266992]

[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2007-12-19 486856]
"AMP Agent"="c:\program files\Common Files\ARS Company\Agent\Agent.exe" [2001-09-20 37376]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"VIDC.ACDV"= ACDV.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-03 23:56 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DrvLsnr]
--------- 2003-05-08 10:34 69632 c:\program files\Analog Devices\SoundMAX\DrvLsnr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
--a------ 2005-09-20 09:36 114688 c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]
--a------ 2008-04-01 02:54 507904 c:\program files\Winamp Remote\bin\OrbTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RAM Idle Professional]
--a------ 2007-03-23 08:05 440320 c:\program files\TweakNow PowerPack 2006\RAM_XP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Search Protection]
--a------ 2008-10-07 16:23 111856 c:\program files\Yahoo!\Search Protection\SearchProtection.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YSearchProtection]
--a------ 2008-10-07 16:23 111856 c:\program files\Yahoo!\Search Protection\SearchProtection.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"d:\\Podaci\\Documents\\Desktop\\Skype.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784]
R3 iadusb;MT882;c:\windows\system32\drivers\glauiad.sys [2008-07-25 30336]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-03-25 24592]
R4 YahooAUService;Yahoo! Updater;c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe [2008-11-09 602392]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5fb7512c-5a23-11dd-89af-e481f1d48849}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe killVBS.vbs
.
- - - - ORPHANS REMOVED - - - -

BHO-{037C7B8A-151A-49E6-BAED-CC05FCB50328} - c:\windows\system32\winsrc.dll
BHO-{5148D838-BBA9-487D-81C7-B71D58703556} - c:\windows\system32\pmnLExxu.dll
BHO-{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - c:\windows\system32\awtuRKec.dll
BHO-{77AB59B4-55A3-4737-9FD5-B93C6430BF78} - c:\windows\system32\agfmnqxq.dll
ShellExecuteHooks-{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - c:\windows\system32\awtuRKec.dll
MSConfigStartUp-59765017630064627458613452757454 - c:\program files\A360\av360.exe
MSConfigStartUp-a8c3ef43 - c:\windows\system32\vmllbsxk.dll
MSConfigStartUp-ieupdate - c:\windows\system32\explorer32.exe
MSConfigStartUp-Windows UDP Control Center - fxstaller.exe


.
------- Supplementary Scan -------
.
uStart Page =
uSearchMigratedDefaultURL = [Link mogu videti samo ulogovani korisnici]{searchTerms}&ei=utf-8&fr=b1ie7
uSearchURL,(Default) = [Link mogu videti samo ulogovani korisnici]*http://www.yahoo.com
IE: &Winamp Search - c:\documents and settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: Add to Banner Ad Blocker - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2009-01-20 20:56:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(964)
c:\windows\system32\klogon.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
.
**************************************************************************
.
Completion time: 2009-01-20 20:58:08 - machine was rebooted
ComboFix-quarantined-files.txt 2009-01-20 19:58:04

Pre-Run: 4,926,144,512 bytes free
Post-Run: 5,013,196,800 bytes free

184

Dopuna: 20 Jan 2009 21:23

dodacu jos i to da sam imao instaliran Kasperski ali mi se masina cudno ponasala - gasila se, pa sam ga skinuo, a nisam nista novo instalirao od AV programa. Koji preporucujete?

Poslao: 20 Jan 2009 22:42
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

AV izaberi po želji. Ako hoćeš besplatan, neka od mogućih rešenja su avast, Avira, AVG...


Kakvo je sada stanje?

MyCity » Ambulanta -> Arhiva Ambulante » virus killvbs.vbs

Ko je trenutno na forumu
 

Ukupno su 1218 korisnika na forumu :: 178 registrovanih, 9 sakrivenih i 1031 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 15694 - dana 01 Feb 2026 12:23

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 04bokibole, _Sale, A.R.Chafee.Jr., Agape, Aleksa 3215, AleksandarV, alex71, AMCXXL, aramis s, as2025, Asparagus, Asteker, atmel, bavar357, beki76, bestguarder, Bo96, Bobrock1, bojcistv, bokicacar, Bosnjo, Bozjidar87, Bradonja89, brufen, capetron, ccoogg123, celik, crnogorac, darcaud, darkkran, Darko8, DeerHunter, dejankm, dekiz, del boy, delboy, Denaya, DezurniOperativni, Dixtrix, djboj, djonsule, DJUNTA, Dobi, doktor097, dradex, dragan_mig31, draganl, dule10savic, dunavzed, entriun, Ercomero, esko_hz, EVIDENTICAR, Filip1, g_g, Gintoki, Giro77, Gitzherai, gobrad, Grochow, Heavy Jerk, Ice, icemilos, istina, janezek67, Jaz, Jeremiah, Jester, jodzula, JOntra, Jose, Jovan1983, kaput21, kenny74, Kichma, kikisp, king111, kljift, kokodakalo, koliko, kovacicbozo, KUZMAR, kybonacci, lacko, lord sir giga, LostInSpaceandTime, lucko1, luka35, markoskjk, marsi, marsovac 2, mat, matrix_1, mercedesamg, Mi lao shu, miki kv, Miki01, mikrimaus, Miler88, milimoj, Millennium, Mis uz pusku, mnn2, MR Z, MrG, N.e.m.a.nj.a., Naj-Turs, narandzasti, Natuzzi, neko iz mase, nick79, nixos, Njubara, nnovakis, operniki, Orlova, OtacMakarije, ozzy, pablojepao, Pale2025, Parker, Pegggio, Pero, picknick, ping15, Povratak1912, Prašinar, Pv123, radovanstojkov023, RajkoB, rambod, Rebel Frank, Resnica, Romibrat, royst33, ruma, ruso, sale755, savaskytec, sevenino, shadow, Sinduk, singa, Sone0883, Srki98, Srpska zauvjek, Stanislav1970, Stanlio, Stefan M, strelac07, styg, synergia, t84dar, Topaz9, Tragač, US_Rank_0, Utd4ce, vazduh, vedko, VJ, vlahale, VojaeZ, Volfero, vrlenija, vukiNo1, wize, x011, Zastava, Zeljo980, zgoljo, zil10, Zimbabwe, zmajbre, zoran-ruma, Zoran1959, Zorge, 1453, 2001