MyCity » Ambulanta -> Arhiva Ambulante » zarazen komp

zarazen komp

Napisano na dan: 20.5.2009
1

zarazen komp
Sledeća strana Pagination

Idi na vrh

Poslao: 20 Maj 2009 11:35
Idi na vrh
offline
  • Pridružio: 13 Mar 2009
  • Poruke: 13
  • Gde živiš: Pale

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:25:13, on 20.5.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
E:\Program Files\Alwil Software\Avast4\ashServ.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\RUNDLL32.EXE
E:\Program Files\Synaptics\SynTP\SynTPEnh.exe
E:\Program Files\Atheros\ACU.exe
E:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
E:\WINDOWS\RTHDCPL.EXE
E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
E:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
E:\Program Files\Wireless Console 2\wcourier.exe
E:\Program Files\Winamp\winampa.exe
E:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
E:\Program Files\DAEMON Tools\daemon.exe
E:\PROGRA~1\MYWEBS~1\bar\4.bin\mwsoemon.exe
E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
E:\Program Files\CyberLink\Power2Go\Power2GoExpress.exe
E:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
E:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
E:\WINDOWS\system32\ctfmon.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\WordWeb\wweb32.exe
E:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
E:\WINDOWS\system32\acs.exe
E:\Program Files\Common Files\LightScribe\LSSrvc.exe
E:\WINDOWS\system32\nvsvc32.exe
E:\Program Files\CyberLink\Shared Files\RichVideo.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
E:\Program Files\PC Connectivity Solution\ServiceLayer.exe
E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\WINDOWS\system32\wuauclt.exe
E:\Documents and Settings\Milenka\Desktop\fe5.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici]
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - E:\Program Files\MyWebSearch\bar\4.bin\MWSSRCAS.DLL
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - E:\Program Files\MyWebSearch\bar\4.bin\MWSSRCAS.DLL
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - E:\Program Files\MyWebSearch\bar\4.bin\MWSBAR.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - E:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - E:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - E:\Program Files\MyWebSearch\bar\4.bin\MWSBAR.DLL
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - E:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPEnh] E:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ACU] "E:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [SMSERIAL] E:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [GrooveMonitor] "E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [RemoteControl] "E:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "E:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [UpdatePPShortCut] "E:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "E:\Program Files\CyberLink\PowerProducer" update "Software\CyberLink\PowerProducer\4.0"
O4 - HKLM\..\Run: [Wireless Console 2] "E:\Program Files\Wireless Console 2\wcourier.exe"
O4 - HKLM\..\Run: [WinampAgent] "E:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] E:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] E:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [DAEMON Tools] "E:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32 E:\PROGRA~1\MYWEBS~1\bar\4.bin\M3PLUGIN.DLL,UPF
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 E:\PROGRA~1\MYWEBS~1\bar\4.bin\MWSBAR.DLL,S
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] E:\PROGRA~1\MYWEBS~1\bar\4.bin\mwsoemon.exe
O4 - HKLM\..\Run: [avast!] E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Power2GoExpress] "E:\Program Files\CyberLink\Power2Go\Power2GoExpress.exe" /Startup
O4 - HKCU\..\Run: [LightScribe Control Panel] E:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "E:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] E:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DU Meter] E:\Program Files\DU Meter\DUMeter.exe
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] E:\PROGRA~1\MYWEBS~1\bar\4.bin\mwsoemon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] E:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: WordWeb.lnk = E:\Program Files\WordWeb\wweb32.exe
O8 - Extra context menu item: &Search - [Link mogu videti samo ulogovani korisnici]
O8 - Extra context menu item: &Windows Live Search - [Link mogu videti samo ulogovani korisnici]\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{EE1F06F9-D363-464A-9545-C66672BC9612}: NameServer = 81.93.85.152 81.93.85.132
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Atheros Configuration Service (ACS) - Atheros - E:\WINDOWS\system32\acs.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Kwinzy Service - Unknown owner - E:\Documents and Settings\All Users\Application Data\Kwinzy\kwinzy117.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - E:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: My Web Search Service (MyWebSearchService) - MyWebSearch.com - E:\PROGRA~1\MYWEBS~1\bar\4.bin\mwssvc.exe
O23 - Service: NBService - Nero AG - E:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - E:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia. - E:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - E:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

--
End of file - 9047 bytes



Poslao: 20 Maj 2009 12:06
Idi na vrh
offline
  • diarno  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 15 Jun 2007
  • Poruke: 5572

Pozdrav...


Preuzmi sUBs-ov ComboFix sa jedne od sledećih adresa na Desktop:


Bleeping Computer . . . . . Geeks to Go!
Klikni desnim tasterom na neki od linkova i odaberi opciju Save Target As... (Save Link As..., Save Linked Content As... ili sličnu);
Kada se otvori dijalog za izbor lokacije na kojoj treba sačuvati file, odaberi Desktop i klikni Save.



Kada preuzimanje programa bude završeno:
zatvori pokrenute programe;
deaktiviraj zaštitni softver (uputstvo);
dvoklikom pokreni program ComboFix.
U toku rada, ComboFix će:proveriti postoji li novija verzija programa:
klikni Yes ako bude ponuđeno preuzimanje iste. prikazati DISCLAIMER OF WARRANTY ON SOFTWARE:
klikni Yes kako bi proces bio nastavljen.ako Recovery Console nije instalirana, ponuditi instalaciju:
prihvati klikom na Yes i isprati postupak.postaviti/dati određeni broj upita/obaveštenja:
prihvati klikom na Yes ili OK.po potrebi, restartovati Windows (više puta);
na kraju rada, otvoriti Notepad sa izveštajem o skeniranju.

Iskopiraj izveštaj koji je ComboFix napravio u temu na forumu:
klikni desnim tasterom miša u prozor Notepad-a i izaberi Select All;
klikni desnim tasterom miša na obeleženi tekst i izaberi Copy;
klikni desnim tasterom miša u polje za pisanje poruke i izaberi Paste.

Napomena:Izveštaj će biti sačuvan pod nazivom ComboFix.txt na sistemskoj particiji (tipična lokacija: C:\ComboFix.txt);
Ukoliko nakon slanja poruke primetiš da izveštaj nije kompletan, iskoristi opciju Prikači fajl za prilaganje file-a C:\ComboFix.txt uz poruku.



Poslao: 20 Maj 2009 12:46
Idi na vrh
offline
  • Pridružio: 13 Mar 2009
  • Poruke: 13
  • Gde živiš: Pale

ComboFix 09-05-19.08 - Milenka 20.05.2009 12:36.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.381.1033.18.1919.1445 [GMT 2:00]
Running from: e:\documents and settings\Milenka\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090519-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

e:\program files\FunWebProducts
e:\program files\FunWebProducts\Shared\Cache\CursorManiaBtn-new.html
e:\program files\FunWebProducts\Shared\Cache\CursorManiaBtn.html
e:\program files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html
e:\program files\FunWebProducts\Shared\Cache\SmileyCentralBtn-new.html
e:\program files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
e:\program files\FunWebProducts\Shared\Cache\WebfettiBtn.html
e:\program files\Internet Explorer\msimg32.dll
e:\program files\MyWebSearch
e:\program files\MyWebSearch\bar\3.bin\F3HTMLMU.DLL
e:\program files\MyWebSearch\bar\3.bin\M3PLUGIN.DLL
e:\program files\MyWebSearch\bar\3.bin\MWSBAR.DLL
e:\program files\MyWebSearch\bar\3.bin\MWSOEMON.EXE
e:\program files\MyWebSearch\bar\3.bin\MWSOESTB.DLL
e:\program files\MyWebSearch\bar\4.bin\F3BKGERR.JPG
e:\program files\MyWebSearch\bar\4.bin\F3CJPEG.DLL
e:\program files\MyWebSearch\bar\4.bin\F3DTACTL.DLL
e:\program files\MyWebSearch\bar\4.bin\F3HISTSW.DLL
e:\program files\MyWebSearch\bar\4.bin\F3HTMLMU.DLL
e:\program files\MyWebSearch\bar\4.bin\F3HTTPCT.DLL
e:\program files\MyWebSearch\bar\4.bin\F3IMSTUB.DLL
e:\program files\MyWebSearch\bar\4.bin\F3POPSWT.DLL
e:\program files\MyWebSearch\bar\4.bin\F3PSSAVR.SCR
e:\program files\MyWebSearch\bar\4.bin\F3REPROX.DLL
e:\program files\MyWebSearch\bar\4.bin\F3RESTUB.DLL
e:\program files\MyWebSearch\bar\4.bin\F3SCHMON.EXE
e:\program files\MyWebSearch\bar\4.bin\F3SCRCTR.DLL
e:\program files\MyWebSearch\bar\4.bin\F3SPACER.WMV
e:\program files\MyWebSearch\bar\4.bin\F3WALLPP.DAT
e:\program files\MyWebSearch\bar\4.bin\F3WPHOOK.DLL
e:\program files\MyWebSearch\bar\4.bin\FWPBUDDY.PNG
e:\program files\MyWebSearch\bar\4.bin\M3FFXTBR.JAR
e:\program files\MyWebSearch\bar\4.bin\M3FFXTBR.MANIFEST
e:\program files\MyWebSearch\bar\4.bin\M3HIGHIN.EXE
e:\program files\MyWebSearch\bar\4.bin\M3HTML.DLL
e:\program files\MyWebSearch\bar\4.bin\M3IDLE.DLL
e:\program files\MyWebSearch\bar\4.bin\M3IMPIPE.EXE
e:\program files\MyWebSearch\bar\4.bin\M3MEDINT.EXE
e:\program files\MyWebSearch\bar\4.bin\M3MSG.DLL
e:\program files\MyWebSearch\bar\4.bin\M3NTSTBR.JAR
e:\program files\MyWebSearch\bar\4.bin\M3NTSTBR.MANIFEST
e:\program files\MyWebSearch\bar\4.bin\M3OUTLCN.DLL
e:\program files\MyWebSearch\bar\4.bin\M3PLUGIN.DLL
e:\program files\MyWebSearch\bar\4.bin\M3SKIN.DLL
e:\program files\MyWebSearch\bar\4.bin\M3SKPLAY.EXE
e:\program files\MyWebSearch\bar\4.bin\M3SLSRCH.EXE
e:\program files\MyWebSearch\bar\4.bin\M3SRCHMN.EXE
e:\program files\MyWebSearch\bar\4.bin\MWSBAR.DLL
e:\program files\MyWebSearch\bar\4.bin\MWSOEMON.EXE
e:\program files\MyWebSearch\bar\4.bin\MWSOEPLG.DLL
e:\program files\MyWebSearch\bar\4.bin\MWSOESTB.DLL
e:\program files\MyWebSearch\bar\4.bin\MWSSRCAS.DLL
e:\program files\MyWebSearch\bar\4.bin\MWSSVC.EXE
e:\program files\MyWebSearch\bar\4.bin\NPMYWEBS.DLL
e:\program files\MyWebSearch\bar\Avatar\COMMON.F3S
e:\program files\MyWebSearch\bar\Cache\000169F0
e:\program files\MyWebSearch\bar\Cache\00F6108D
e:\program files\MyWebSearch\bar\Cache\019F76D3.bin
e:\program files\MyWebSearch\bar\Cache\019F79E0.bin
e:\program files\MyWebSearch\bar\Cache\019F7C9F.bin
e:\program files\MyWebSearch\bar\Cache\019F7FBC.bin
e:\program files\MyWebSearch\bar\Cache\01FC1B80.bin
e:\program files\MyWebSearch\bar\Cache\01FC1E4E.bin
e:\program files\MyWebSearch\bar\Cache\01FC20CF.bin
e:\program files\MyWebSearch\bar\Cache\01FC2294.bin
e:\program files\MyWebSearch\bar\Cache\0371FEC5
e:\program files\MyWebSearch\bar\Cache\files.ini
e:\program files\MyWebSearch\bar\Game\CHECKERS.F3S
e:\program files\MyWebSearch\bar\Game\CHESS.F3S
e:\program files\MyWebSearch\bar\Game\REVERSI.F3S
e:\program files\MyWebSearch\bar\History\search3
e:\program files\MyWebSearch\bar\icons\CM.ICO
e:\program files\MyWebSearch\bar\icons\MFC.ICO
e:\program files\MyWebSearch\bar\icons\PSS.ICO
e:\program files\MyWebSearch\bar\icons\SMILEY.ICO
e:\program files\MyWebSearch\bar\icons\WB.ICO
e:\program files\MyWebSearch\bar\icons\ZWINKY.ICO
e:\program files\MyWebSearch\bar\Message\COMMON.F3S
e:\program files\MyWebSearch\bar\Notifier\COMMON.F3S
e:\program files\MyWebSearch\bar\Notifier\DOG.F3S
e:\program files\MyWebSearch\bar\Notifier\FISH.F3S
e:\program files\MyWebSearch\bar\Notifier\KUNGFU.F3S
e:\program files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
e:\program files\MyWebSearch\bar\Notifier\MAID.F3S
e:\program files\MyWebSearch\bar\Notifier\MAILBOX.F3S
e:\program files\MyWebSearch\bar\Notifier\OPERA.F3S
e:\program files\MyWebSearch\bar\Notifier\ROBOT.F3S
e:\program files\MyWebSearch\bar\Notifier\SEDUCT.F3S
e:\program files\MyWebSearch\bar\Notifier\SURFER.F3S
e:\program files\MyWebSearch\bar\Settings\prevcfg2.htm
e:\program files\MyWebSearch\bar\Settings\s_pid.dat
e:\windows\system32\f3PSSavr.scr

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MYWEBSEARCHSERVICE
-------\Service_MyWebSearchService


((((((((((((((((((((((((( Files Created from 2009-04-20 to 2009-05-20 )))))))))))))))))))))))))))))))
.

2009-05-08 22:08 . 2009-05-08 22:08 -------- d-----w e:\program files\MSXML 4.0
2009-05-07 15:25 . 2009-05-07 20:22 -------- d-----w e:\windows\system32\CatRoot_bak
2009-05-07 15:18 . 2009-02-06 10:29 2142720 -c----w e:\windows\system32\dllcache\ntkrnlmp.exe
2009-05-07 15:18 . 2009-02-06 10:32 2186112 -c----w e:\windows\system32\dllcache\ntoskrnl.exe
2009-05-07 15:18 . 2009-02-06 09:49 2020864 -c----w e:\windows\system32\dllcache\ntkrpamp.exe
2009-05-07 15:18 . 2009-02-06 09:49 2062976 -c----w e:\windows\system32\dllcache\ntkrnlpa.exe
2009-05-07 15:16 . 2008-06-13 13:10 272128 -c----w e:\windows\system32\dllcache\bthport.sys
2009-05-07 15:16 . 2008-06-13 13:10 272128 ------w e:\windows\system32\drivers\bthport.sys
2009-05-07 07:15 . 2008-10-24 11:10 453632 -c----w e:\windows\system32\dllcache\mrxsmb.sys
2009-05-06 22:40 . 2009-05-08 22:11 -------- d--h--w e:\windows\$hf_mig$
2009-05-06 17:18 . 2008-10-16 12:06 208744 ----a-w e:\windows\system32\muweb.dll
2009-05-06 17:18 . 2008-10-16 12:06 268648 ----a-w e:\windows\system32\mucltui.dll
2009-05-06 17:18 . 2009-05-06 17:18 -------- d-----w e:\program files\Real
2009-05-06 17:18 . 2009-05-06 17:18 -------- d-----w e:\documents and settings\All Users\Application Data\Windows Live Toolbar
2009-05-06 17:17 . 2008-10-16 12:09 43544 ----a-w e:\windows\system32\wups2.dll
2009-05-06 17:12 . 2009-05-12 09:18 -------- d-----w e:\documents and settings\Milenka\Contacts
2009-05-06 17:10 . 2009-05-06 17:10 -------- d-----w e:\program files\Windows Live Toolbar
2009-05-06 17:08 . 2009-05-06 17:13 -------- d-----w e:\program files\MSN Messenger
2009-05-06 16:53 . 2009-05-06 16:53 -------- d-----w e:\documents and settings\All Users\Application Data\Winferno
2009-05-06 16:48 . 2006-10-09 11:06 495616 ----a-w e:\windows\system32\WINUTIL5.DLL
2009-05-06 16:48 . 2006-05-17 06:40 393216 ----a-w e:\windows\system32\WINLCTL5.DLL
2009-05-06 16:47 . 2009-05-06 16:47 -------- d-----w e:\program files\Winferno
2009-05-06 16:43 . 2009-05-15 07:20 -------- d-----w e:\program files\Kwinzy
2009-05-06 16:43 . 2009-05-06 16:46 -------- d-----w e:\documents and settings\All Users\Application Data\Kwinzy
2009-04-25 12:15 . 2009-04-25 12:15 -------- d-----w e:\program files\Alwil Software

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-08 22:10 . 2009-05-08 22:10 -------- d-----w e:\program files\Microsoft CAPICOM 2.1.0.2
2009-04-25 12:26 . 2008-12-17 09:10 -------- d-----w e:\program files\DAEMON Tools
2009-04-20 13:16 . 2009-01-12 19:11 14 ----a-w e:\windows\popcinfo.dat
2009-04-20 07:27 . 2009-03-16 13:01 -------- d-----w e:\program files\DU Meter
2009-04-06 18:07 . 2008-12-12 20:01 -------- d-----w e:\program files\TheSage
2009-03-06 14:00 . 2004-08-03 23:56 284160 ----a-w e:\windows\system32\pdh.dll
2009-02-20 08:30 . 2004-08-03 23:56 659456 ----a-w e:\windows\system32\wininet.dll
2009-02-20 08:30 . 2004-08-03 23:56 81920 ----a-w e:\windows\system32\ieencode.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Power2GoExpress"="e:\program files\CyberLink\Power2Go\Power2GoExpress.exe" [2008-03-18 2508072]
"LightScribe Control Panel"="e:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-03-17 2289664]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="e:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264]
"ctfmon.exe"="e:\windows\system32\ctfmon.exe" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="e:\windows\system32\NvCpl.dll" [2007-08-16 8478720]
"NvMediaCenter"="e:\windows\system32\NvMcTray.dll" [2007-08-16 81920]
"SynTPEnh"="e:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-05-25 786521]
"ACU"="e:\program files\Atheros\ACU.exe" [2007-10-23 376921]
"SMSERIAL"="e:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 630784]
"GrooveMonitor"="e:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"RemoteControl"="e:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2008-04-02 87336]
"LanguageShortcut"="e:\program files\CyberLink\PowerDVD\Language\Language.exe" [2008-02-22 62760]
"UpdatePPShortCut"="e:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2008-01-04 222504]
"Wireless Console 2"="e:\program files\Wireless Console 2\wcourier.exe" [2007-07-05 1040384]
"WinampAgent"="e:\program files\Winamp\winampa.exe" [2008-04-01 36352]
"NeroFilterCheck"="e:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"PCSuiteTrayApplication"="e:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 227328]
"DAEMON Tools"="e:\program files\DAEMON Tools\daemon.exe" [2005-12-10 133016]
"avast!"="e:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"nwiz"="nwiz.exe" - e:\windows\system32\nwiz.exe [2007-08-16 1626112]
"RTHDCPL"="RTHDCPL.EXE" - e:\windows\RTHDCPL.exe [2007-12-12 16859136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="e:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
"Nokia.PCSync"="e:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896]

e:\documents and settings\Milenka\Start Menu\Programs\Startup\
WordWeb.lnk - e:\program files\WordWeb\wweb32.exe [2008-12-12 42168]

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave1"= serwvdrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"e:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"e:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"e:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"e:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"=
"e:\\Program Files\\CyberLink\\PowerDirector\\PDR.exe"=
"e:\\Program Files\\Messenger\\msmsgs.exe"=
"e:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"e:\\Program Files\\MSN Messenger\\livecall.exe"=

R1 aswSP;avast! Self Protection;e:\windows\system32\drivers\aswSP.sys [25.4.2009 14:15 114768]
R2 aswFsBlk;aswFsBlk;e:\windows\system32\drivers\aswFsBlk.sys [25.4.2009 14:15 20560]
R3 WSIMD;wsimd Service;e:\windows\system32\drivers\wsimd.sys [29.10.2008 18:24 57344]
S2 Kwinzy Service;Kwinzy Service;e:\documents and settings\All Users\Application Data\Kwinzy\kwinzy117.exe [6.5.2009 18:46 54760]
S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service;e:\program files\MSN Messenger\usnsvc.exe [19.1.2007 12:54 97136]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"e:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder

2009-05-20 e:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- e:\program files\Windows Live Toolbar\MSNTBUP.EXE [2006-09-27 15:39]

2009-05-20 e:\windows\Tasks\RegPowerClean.job
- e:\program files\Winferno\RegistryPowerCleaner\RegPowerClean.exe [2009-05-06 12:48]

2009-05-20 e:\windows\Tasks\RPCReminder.job
- e:\program files\Winferno\RegistryPowerCleaner\RPCReminder.exe [2009-05-06 12:34]

2009-05-20 e:\windows\Tasks\WGASetup.job
- e:\windows\system32\KB905474\wgasetup.exe [2009-05-08 20:18]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-DU Meter - e:\program files\DU Meter\DUMeter.exe
HKLM-Run-MyWebSearch Plugin - e:\progra~1\MYWEBS~1\bar\4.bin\M3PLUGIN.DLL


.
------- Supplementary Scan -------
.
IE: &Search - [Link mogu videti samo ulogovani korisnici]
IE: &Windows Live Search - e:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: E&xport to Microsoft Excel - e:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {EE1F06F9-D363-464A-9545-C66672BC9612} = 81.93.85.152 81.93.85.132
FF - ProfilePath - e:\documents and settings\Milenka\Application Data\Mozilla\Firefox\Profiles\34vtlumg.default\
FF - prefs.js: browser.search.selectedEngine - YouTube Video Search
FF - prefs.js: browser.startup.homepage - [Link mogu videti samo ulogovani korisnici]
FF - prefs.js: keyword.URL - [Link mogu videti samo ulogovani korisnici]
FF - prefs.js: network.proxy.type - 4
FF - plugin: e:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: e:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: e:\program files\Mozilla Firefox\plugins\NPMyWebS.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2009-05-20 12:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
e:\program files\Alwil Software\Avast4\aswUpdSv.exe
e:\program files\Alwil Software\Avast4\ashServ.exe
e:\windows\system32\acs.exe
e:\program files\Common Files\LightScribe\LSSrvc.exe
e:\windows\system32\rundll32.exe
e:\windows\system32\nvsvc32.exe
e:\program files\CyberLink\Shared Files\RichVideo.exe
e:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
e:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
e:\program files\Alwil Software\Avast4\ashMaiSv.exe
e:\program files\Alwil Software\Avast4\ashWebSv.exe
e:\program files\PC Connectivity Solution\ServiceLayer.exe
.
**************************************************************************
.
Completion time: 2009-05-20 12:41 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-20 10:41
ComboFix2.txt 2009-03-13 17:15

Pre-Run: 16.191.315.968 bytes free
Post-Run: 16.262.139.904 bytes free

262 --- E O F --- 2009-05-13 17:49

Poslao: 20 Maj 2009 23:50
Idi na vrh
offline
  • diarno  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 15 Jun 2007
  • Poruke: 5572

Uploaduj mi sledeci fajl :

e:\documents and settings\All Users\Application Data\Kwinzy\kwinzy117.exe

Preko sledece forme :

[Link mogu videti samo ulogovani korisnici]

Poslao: 21 Maj 2009 11:42
Idi na vrh
offline
  • Pridružio: 13 Mar 2009
  • Poruke: 13
  • Gde živiš: Pale

uploadovala sam ovo sto je gore trazeno

Poslao: 21 Maj 2009 12:44
Idi na vrh
offline
  • diarno  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 15 Jun 2007
  • Poruke: 5572

Otvoriti Notepad i iskopirati sledeci tekst:

File::
e:\windows\Tasks\RPCReminder.job
e:\windows\Tasks\RegPowerClean.job
e:\program files\Mozilla Firefox\plugins\NPMyWebS.dll
e:\windows\system32\WINUTIL5.DLL
e:\windows\system32\WINLCTL5.DLL

Folder::
e:\program files\Winferno
e:\documents and settings\All Users\Application Data\Winferno
 
Firefox::
FF - ProfilePath - e:\documents and settings\Milenka\Application Data\Mozilla\Firefox\Profiles\34vtlumg.default\
FF - prefs.js: keyword.URL - hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZRfox000&fl=0&ptb=0vvW6_5Dus2fbl.SLysfPw&st=kwd&o=kwd&url=http://search.mywebsearch.com/mywebsearch/dft_redir.jhtml&searchfor=
FF - plugin: e:\program files\Mozilla Firefox\plugins\NPMyWebS.dll
 
DDS::
IE: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZRfox000


Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

Poslao: 21 Maj 2009 13:39
Idi na vrh
offline
  • Pridružio: 13 Mar 2009
  • Poruke: 13
  • Gde živiš: Pale

ComboFix 09-05-20.A0 - Milenka 21.05.2009 13:31.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.381.1033.18.1919.1464 [GMT 2:00]
Running from: e:\documents and settings\Milenka\Desktop\ComboFix.exe
Command switches used :: e:\documents and settings\Milenka\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1335 [VPS 090520-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
e:\program files\Mozilla Firefox\plugins\NPMyWebS.dll
e:\windows\system32\WINLCTL5.DLL
e:\windows\system32\WINUTIL5.DLL
e:\windows\Tasks\RegPowerClean.job
e:\windows\Tasks\RPCReminder.job
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

e:\documents and settings\All Users\Application Data\Winferno
e:\documents and settings\All Users\Application Data\Winferno\RegPowerClean\results.rcs
e:\program files\Mozilla Firefox\plugins\NPMyWebS.dll
e:\program files\Winferno
e:\program files\Winferno\RegistryPowerCleaner\CHives.dll
e:\program files\Winferno\RegistryPowerCleaner\regpowerclean.chm
e:\program files\Winferno\RegistryPowerCleaner\RegPowerClean.exe
e:\program files\Winferno\RegistryPowerCleaner\RPCL.DLL
e:\program files\Winferno\RegistryPowerCleaner\RPCReminder.exe
e:\program files\Winferno\RegistryPowerCleaner\SysRst.exe
e:\program files\Winferno\RegistryPowerCleaner\unins000.dat
e:\program files\Winferno\RegistryPowerCleaner\unins000.exe
e:\program files\Winferno\RegistryPowerCleaner\WinCMR.dll
e:\windows\system32\WINLCTL5.DLL
e:\windows\system32\WINUTIL5.DLL
e:\windows\Tasks\RegPowerClean.job
e:\windows\Tasks\RPCReminder.job

.
((((((((((((((((((((((((( Files Created from 2009-04-21 to 2009-05-21 )))))))))))))))))))))))))))))))
.

2009-05-08 22:08 . 2009-05-08 22:08 -------- d-----w e:\program files\MSXML 4.0
2009-05-07 15:25 . 2009-05-07 20:22 -------- d-----w e:\windows\system32\CatRoot_bak
2009-05-07 15:18 . 2009-02-06 10:29 2142720 -c----w e:\windows\system32\dllcache\ntkrnlmp.exe
2009-05-07 15:18 . 2009-02-06 10:32 2186112 -c----w e:\windows\system32\dllcache\ntoskrnl.exe
2009-05-07 15:18 . 2009-02-06 09:49 2020864 -c----w e:\windows\system32\dllcache\ntkrpamp.exe
2009-05-07 15:18 . 2009-02-06 09:49 2062976 -c----w e:\windows\system32\dllcache\ntkrnlpa.exe
2009-05-07 15:16 . 2008-06-13 13:10 272128 -c----w e:\windows\system32\dllcache\bthport.sys
2009-05-07 15:16 . 2008-06-13 13:10 272128 ------w e:\windows\system32\drivers\bthport.sys
2009-05-07 07:15 . 2008-10-24 11:10 453632 -c----w e:\windows\system32\dllcache\mrxsmb.sys
2009-05-06 22:40 . 2009-05-08 22:11 -------- d--h--w e:\windows\$hf_mig$
2009-05-06 17:18 . 2008-10-16 12:06 208744 ----a-w e:\windows\system32\muweb.dll
2009-05-06 17:18 . 2008-10-16 12:06 268648 ----a-w e:\windows\system32\mucltui.dll
2009-05-06 17:18 . 2009-05-06 17:18 -------- d-----w e:\program files\Real
2009-05-06 17:18 . 2009-05-06 17:18 -------- d-----w e:\documents and settings\All Users\Application Data\Windows Live Toolbar
2009-05-06 17:17 . 2008-10-16 12:09 43544 ----a-w e:\windows\system32\wups2.dll
2009-05-06 17:12 . 2009-05-12 09:18 -------- d-----w e:\documents and settings\Milenka\Contacts
2009-05-06 17:10 . 2009-05-06 17:10 -------- d-----w e:\program files\Windows Live Toolbar
2009-05-06 17:08 . 2009-05-06 17:13 -------- d-----w e:\program files\MSN Messenger
2009-05-06 16:43 . 2009-05-21 07:50 -------- d-----w e:\documents and settings\All Users\Application Data\Kwinzy
2009-05-06 16:43 . 2009-05-15 07:20 -------- d-----w e:\program files\Kwinzy
2009-04-25 12:15 . 2009-04-25 12:15 -------- d-----w e:\program files\Alwil Software

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-08 22:10 . 2009-05-08 22:10 -------- d-----w e:\program files\Microsoft CAPICOM 2.1.0.2
2009-04-25 12:26 . 2008-12-17 09:10 -------- d-----w e:\program files\DAEMON Tools
2009-04-20 13:16 . 2009-01-12 19:11 14 ----a-w e:\windows\popcinfo.dat
2009-04-20 07:27 . 2009-03-16 13:01 -------- d-----w e:\program files\DU Meter
2009-04-06 18:07 . 2008-12-12 20:01 -------- d-----w e:\program files\TheSage
2009-03-06 14:00 . 2004-08-03 23:56 284160 ----a-w e:\windows\system32\pdh.dll
.

((((((((((((((((((((((((((((( [Link mogu videti samo ulogovani korisnici] )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-21 06:46 . 2009-05-21 06:46 16384 e:\windows\temp\Perflib_Perfdata_6e8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Power2GoExpress"="e:\program files\CyberLink\Power2Go\Power2GoExpress.exe" [2008-03-18 2508072]
"LightScribe Control Panel"="e:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-03-17 2289664]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="e:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264]
"ctfmon.exe"="e:\windows\system32\ctfmon.exe" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="e:\windows\system32\NvCpl.dll" [2007-08-16 8478720]
"NvMediaCenter"="e:\windows\system32\NvMcTray.dll" [2007-08-16 81920]
"SynTPEnh"="e:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-05-25 786521]
"ACU"="e:\program files\Atheros\ACU.exe" [2007-10-23 376921]
"SMSERIAL"="e:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 630784]
"GrooveMonitor"="e:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"RemoteControl"="e:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2008-04-02 87336]
"LanguageShortcut"="e:\program files\CyberLink\PowerDVD\Language\Language.exe" [2008-02-22 62760]
"UpdatePPShortCut"="e:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2008-01-04 222504]
"Wireless Console 2"="e:\program files\Wireless Console 2\wcourier.exe" [2007-07-05 1040384]
"WinampAgent"="e:\program files\Winamp\winampa.exe" [2008-04-01 36352]
"NeroFilterCheck"="e:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"PCSuiteTrayApplication"="e:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 227328]
"DAEMON Tools"="e:\program files\DAEMON Tools\daemon.exe" [2005-12-10 133016]
"avast!"="e:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"nwiz"="nwiz.exe" - e:\windows\system32\nwiz.exe [2007-08-16 1626112]
"RTHDCPL"="RTHDCPL.EXE" - e:\windows\RTHDCPL.exe [2007-12-12 16859136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="e:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
"Nokia.PCSync"="e:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896]

e:\documents and settings\Milenka\Start Menu\Programs\Startup\
WordWeb.lnk - e:\program files\WordWeb\wweb32.exe [2008-12-12 42168]

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave1"= serwvdrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"e:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"e:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"e:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"e:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"=
"e:\\Program Files\\CyberLink\\PowerDirector\\PDR.exe"=
"e:\\Program Files\\Messenger\\msmsgs.exe"=
"e:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"e:\\Program Files\\MSN Messenger\\livecall.exe"=

R1 aswSP;avast! Self Protection;e:\windows\system32\drivers\aswSP.sys [25.4.2009 14:15 114768]
R2 aswFsBlk;aswFsBlk;e:\windows\system32\drivers\aswFsBlk.sys [25.4.2009 14:15 20560]
R3 WSIMD;wsimd Service;e:\windows\system32\drivers\wsimd.sys [29.10.2008 18:24 57344]
S2 Kwinzy Service;Kwinzy Service;e:\documents and settings\All Users\Application Data\Kwinzy\kwinzy117.exe [6.5.2009 18:46 54760]
S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service;e:\program files\MSN Messenger\usnsvc.exe [19.1.2007 12:54 97136]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"e:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder

2009-05-21 e:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- e:\program files\Windows Live Toolbar\MSNTBUP.EXE [2006-09-27 15:39]

2009-05-21 e:\windows\Tasks\WGASetup.job
- e:\windows\system32\KB905474\wgasetup.exe [2009-05-08 20:18]
.
.
------- Supplementary Scan -------
.
IE: &Windows Live Search - e:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: E&xport to Microsoft Excel - e:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {EE1F06F9-D363-464A-9545-C66672BC9612} = 81.93.85.152 81.93.85.132
FF - ProfilePath - e:\documents and settings\Milenka\Application Data\Mozilla\Firefox\Profiles\34vtlumg.default\
FF - prefs.js: browser.search.selectedEngine - YouTube Video Search
FF - prefs.js: browser.startup.homepage - [Link mogu videti samo ulogovani korisnici]
FF - prefs.js: network.proxy.type - 4
FF - plugin: e:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: e:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2009-05-21 13:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-05-21 13:33
ComboFix-quarantined-files.txt 2009-05-21 11:33
ComboFix2.txt 2009-05-20 10:41
ComboFix3.txt 2009-03-13 17:15

Pre-Run: 16.195.698.688 bytes free
Post-Run: 16.204.730.368 bytes free

162 --- E O F --- 2009-05-13 17:49

Poslao: 21 Maj 2009 18:17
Idi na vrh
offline
  • diarno  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 15 Jun 2007
  • Poruke: 5572

I.. kakvo je sad stanje ? Smile

Poslao: 21 Maj 2009 19:39
Idi na vrh
offline
  • Pridružio: 13 Mar 2009
  • Poruke: 13
  • Gde živiš: Pale

Izgleda da je sve OK. Hvala ti

Poslao: 23 Maj 2009 15:57
Idi na vrh
offline
  • diarno  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 15 Jun 2007
  • Poruke: 5572

Potrebno je deinstalirati ComboFix:
klikni start (ili ), a zatim RUN.

Na Visti koristiti Start Search polje ukoliko Run nije dostupan.

U liniju za unos teksta ukucaj (iskopiraj) sledeće:

combofix /u

Primeti da postoji razmak između "ComboFix" i "/u".



a zatim klikni OK (ili pritisni Enter).

Sačekaj da se proces deinstalacije završi.

MyCity » Ambulanta -> Arhiva Ambulante » zarazen komp

Ko je trenutno na forumu
 

Ukupno su 1737 korisnika na forumu :: 96 registrovanih, 9 sakrivenih i 1632 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 5623 - dana 13 Dec 2025 19:56

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 015, 04bokibole, 252., A.R.Chafee.Jr., amaterSRB, Asteker, Bo96, Bobrock1, boj.an, Bojan198527, bojan581, bokicacar, BOXRR, Brot, bukefal, Cicumile, Ciri1994, Comyymoc, Daba75, dearg, Deki Duga Devetka, Dexlex, dexteroza, Dioniss, djordjemiklusev, Djota1, Djuza, DonRumataEstorski, Draganeli, draganl, DrFlyFisherman, Džekson, Gall, ginjica, Igor Antonic, istina, jaeger, JK, Jonbonjovi, Kandrbandrdzilo, Kaneda, knutveliki, konstruktor, kovacicbozo, laganini123, Lester Freamon, Leteća Krofna, ljubo70, LostInSpaceandTime, mane123, Marko00, maxim_von_burdengate, mercedesamg, metallac777, mgolub, MilosKop, Milun24, momcilob55, monomah, nebkv, nelezele, nemkea71, nenad81, nikoladim, pein, Pero, pisac12, Plavi1, PlayerOne, Povratak1912, Ray1973, Remarqe, repac, Roksi, Samo gledam, Saša1989, Sharpshooter, shlauf, Sinduk, Sinisa76, Skenderbeg, sluga, Tastatura ratnik, Tila Painen, tomo2, vathra, VBoss, VekiJ, veljkovicdani, Vlad000, vlado_pg, vukajlo71, Wrangler, yrraf, Žoržo, 1324