Danas sam na fejsbuku dobio preko e majl adrese virus. 21 .2011

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Uloguj se preko Facebooka da bi skinuo fajl:

Napisano: 22 Jul 2011 0:50

posle podne pustijo sam druga na komp i dobio je neku poruku na catu sa linkom da ode na yutube i kao da je on da nekom snimku. I otisao je virus je taj upo u računar i obrisao mi je anti virus sve igrice nemogu na fejs niti da pustim neki radio sa neta. to sam do sad primetila. skenirala sam kompa sa malvarijem i našao je 44 zarazena područja i obrise ih sve i kada restartujem kompa ostane 15 zarazenih oblasti koje ne ukloni...

Dopuna: 22 Jul 2011 0:52

mycity.rs/must-login.png

mycity.rs/must-login.png

mycity.rs/must-login.png

Dopuna: 22 Jul 2011 1:07

imam još da prikačim ovih logova od gmer ali jos mi skenira nesta sporije ide...

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Pozdrav anamarija14!











Detaljno procitaj Uputstvo za otvaranje teme i postavi sve potrebne izvestaje: LINK

Fali DDS.txt i Attach.txt izvestaj, kao i GMER izvestaji.
Ovaj Gmer1 izvestaj koji si okacila je samo uvodno skeniranje koje Gmer obavlja prilikom pokretanja. Da bi napravila pravilno Gmer1 izvestaj, potrebno je da pokrenes skeniranje (pise u Uputstvu).

Inace, skeniranje Gmer-om, u zavisnosti od sistema i infekcije moze da potraje, tako da to nemoj da te buni.







goran9888 (AMF Tim)

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Uloguj se preko Facebooka da bi skinuo fajl:

Napisano: 22 Jul 2011 1:49

mycity.rs/must-login.png

Dopuna: 22 Jul 2011 1:51

goran9888 , jeli ovo uredu

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

To je GMER1 izvestaj.


Okaci DDS, Attach, Gmer2 i Gmer3 izvestaje.



Procitaj Uputstvo jos jednom, od pocetka, detaljno (recenicu po recenicu).









goran9888 (AMF Tim)

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Uloguj se preko Facebooka da bi skinuo fajl:

.
DDS (Ver_11-05-19.01) - NTFSx86
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_26
Run by Vladan at 12:43:23 on 2011-07-22
Microsoft Windows XP Professional 5.1.2600.3.1250.381.1033.18.1023.583 [GMT 2:00]
.
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\D-Link\Bluetooth Software\BTTray.exe
svchost.exe
C:\Program Files\D-Link\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Documents and Settings\Vladan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Vladan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Vladan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Vladan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Vladan\My Documents\Downloads\dds.scr
C:\WINDOWS\system32\WSCRIPT.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://search.bearshare.com/
uSearch Bar = hxxp://dts.search-results.com/sidebar.html?src=ssb&appid=0&systemid=2
uSearchAssistant = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=2&q={searchTerms}
mSearchAssistant = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=2&q={searchTerms}
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: MediaBar: {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - c:\progra~1\bearsh~1\mediabar\datamngr\toolbar\bsdtxmltbpi.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: MediaBar: {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - c:\progra~1\bearsh~1\mediabar\datamngr\toolbar\bsdtxmltbpi.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Google Update] "c:\documents and settings\vladan\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [DAEMON Tools Pro Agent] "c:\program files\daemon tools pro\DTAgent.exe" -autorun
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\CLIStart.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [tray_ico]
mRun: [tray_ico1]
mRun: [tray_ico2]
mRun: [tray_ico3]
mRun: [tray_ico4]
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\d-link\bluetooth software\BTTray.exe
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableSecureUIAPaths = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\d-link\bluetooth software\btsendto_ie_ctx.htm
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\d-link\bluetooth software\btsendto_ie.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\vladan\application data\mozilla\firefox\profiles\tpzdnxub.default\
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - hxxp://dts.search-results.com/sr?src=ffb&appid=0&systemid=2&q=
FF - plugin: c:\documents and settings\vladan\local settings\application data\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
.
============= SERVICES / DRIVERS ===============
.
R0 fasttrak;fasttrak;c:\windows\system32\drivers\Fasttrak.sys [2011-6-1 73088]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-6-1 441176]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-6-1 309848]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2011-7-21 233024]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-6-1 19544]
R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2011-7-21 42184]
.
=============== Created Last 30 ================
.
2011-07-21 18:37:31 233024 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-07-21 18:36:58 -------- d-----w- c:\program files\DAEMON Tools Pro
2011-07-21 18:00:42 -------- d-----w- c:\program files\AVAST Software
2011-07-21 18:00:42 -------- d-----w- c:\documents and settings\all users\application data\Alwil Software
2011-07-21 14:40:40 -------- d-----w- c:\windows\ufa
2011-07-21 14:40:40 -------- d-----w- c:\windows\phoenix
2011-07-21 14:16:51 246272 ----a-w- c:\windows\unrar.exe
2011-07-21 14:16:35 -------- d--h--w- c:\windows\update.2
2011-07-21 14:16:20 -------- d--h--w- c:\windows\update.5.0
2011-07-21 14:15:02 -------- d-----w- c:\windows\av_ico
2011-07-21 14:13:09 -------- d--h--w- c:\windows\update.1
2011-07-21 14:13:05 -------- d--h--w- c:\windows\update.tray-7-0-lnk
2011-07-21 14:13:05 -------- d--h--w- c:\windows\update.tray-7-0
2011-07-03 14:46:43 2106216 ----a-w- c:\program files\mozilla firefox\D3DCompiler_43.dll
2011-07-03 14:46:42 1998168 ----a-w- c:\program files\mozilla firefox\d3dx9_43.dll
2011-06-29 14:25:57 -------- d-----w- c:\windows\system32\NtmsData
2011-06-23 13:38:04 -------- d-----w- c:\program files\The KMPlayer
.
==================== Find3M ====================
.
2011-07-06 17:52:42 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 17:52:42 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-04 11:43:53 40112 ----a-w- c:\windows\avastSS.scr
2011-07-04 11:36:43 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-06-23 14:05:30 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-15 20:37:21 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-06-15 20:37:21 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-06-10 18:02:19 717296 ----a-w- c:\windows\system32\drivers\sptd.sys
2011-06-02 14:02:05 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-05-02 15:31:52 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25:27 151552 ----a-w- c:\windows\system32\schannel.dll
2011-04-29 16:19:43 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-26 11:07:50 33280 ----a-w- c:\windows\system32\csrsrv.dll
2011-04-26 11:07:50 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-04-25 14:47:19 81920 ----a-w- c:\windows\system32\ieencode.dll
2011-04-25 14:47:19 667136 ----a-w- c:\windows\system32\wininet.dll
2011-04-25 14:47:19 61952 ----a-w- c:\windows\system32\tdc.ocx
2011-04-25 12:56:44 369664 ----a-w- c:\windows\system32\html.iec
.
============= FINISH: 12:45:08,03 ===============





mycity.rs/must-login.png

mycity.rs/must-login.png

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

anamarija14, zar je toliko tesko da detaljno procitas Upustvo koje sam linkovao? Pa tamo je sve kristalno jasno objasnjeno.


Gde je Attach izvestaj? Kada si pokrenula DDS dobila si dva izvestaja a ti si mi okacila samo jedan od njih. Gde su Gmer2 i Gmer3 izvestaji?




Zao mi je, ali dok mi ne dostavis potrebne izvestaje ja ne mogu krenuti u resavanje slucaja.







goran9888 (AMF Tim)

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Uloguj se preko Facebooka da bi skinuo fajl:

Napisano: 22 Jul 2011 15:23

mycity.rs/must-login.png

mycity.rs/must-login.png

mycity.rs/must-login.png

mycity.rs/must-login.png

mycity.rs/must-login.png

Dopuna: 22 Jul 2011 15:25

gorane samo jos da ti jedenom kazem da na fejsbuk ne mogu i nikakav radio nemogu da pustim. na netu...

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

U toku resavanja slucaja, zamolio bih te da se pridrzavas sledeceg:
Detaljno citati moja uputstva ( ili uputstva kolega koji ce me zamenjivati) i raditi iskljucivo po njima;
Ne traziti istovremeno pomoc na drugom mestu;
Nemoj koristiti druge programe za uklanjanje malware-a, osim onih za koje budes dobio uputstvo;
U toku intervencije ne koristiti USB memorijske uredjaje, dok to ne budem zatrazio;
Ukoliko ne odgovorim u roku od 48h, osvezi temu novim post-om;
Ukoliko se ne javis u roku od 5 dana, zatvoricemo slucaj.
Za vise informacija o pravilima Ambulante MyCity foruma: LINK

-------------------------------------------------------------------------------------






Preuzmi sUBs-ov ComboFix sa sledeće adrese na Desktop:


Bleeping Computer
Klikni desnim tasterom na link i odaberi opciju Save Target As... (Save Link As..., Save Linked Content As... ili sličnu);
Kada se otvori dijalog za izbor lokacije na kojoj treba sačuvati file, odaberi Desktop i klikni Save.



Kada preuzimanje programa bude završeno:
deaktiviraj zaštitni softver (uputstvo);
zatvori pokrenute programe;
dvoklikom pokreni program ComboFix;
u prozoru koji se otvori klikni "I Agree".
U toku rada, ComboFix će:proveriti postoji li novija verzija programa:
klikni Yes ako bude ponuđeno preuzimanje iste.ako Recovery Console nije instalirana, ponuditi instalaciju:
obavezno prihvati klikom na Yes i isprati postupak.postaviti/dati određeni broj upita/obaveštenja:
prihvati klikom na Yes ili OK.po potrebi, restartovati Windows (više puta);
na kraju rada, otvoriti Notepad sa izveštajem o skeniranju.

Iskopiraj izveštaj koji je ComboFix napravio u temu na forumu:
klikni desnim tasterom miša u prozor Notepad-a i izaberi Select All;
klikni desnim tasterom miša na obeleženi tekst i izaberi Copy;
klikni desnim tasterom miša u polje za pisanje poruke i izaberi Paste.

Napomena:Izveštaj će biti sačuvan pod nazivom ComboFix.txt na sistemskoj particiji (tipična lokacija: C:\ComboFix.txt);
Ukoliko nakon slanja poruke primetiš da izveštaj nije kompletan, iskoristi opciju Prikači fajl za prilaganje file-a C:\ComboFix.txt uz poruku.




goran9888 (AMF Tim)

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Uloguj se preko Facebooka da bi skinuo fajl:

Napisano: 22 Jul 2011 19:31

mycity.rs/must-login.png

mycity.rs/must-login.png

Dopuna: 22 Jul 2011 19:32

mycity.rs/must-login.png

mycity.rs/must-login.png






ComboFix 11-07-22.02 - Vladan 22.07.2011 19:04:21.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1250.381.1033.18.1023.705 [GMT 2:00]
Running from: c:\documents and settings\Vladan\My Documents\Downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\btc_client_iplist.txt
c:\windows\ddh_iplist.txt
c:\windows\front_ip_list.txt
c:\windows\iecheck_iplist.txt
c:\windows\info1
c:\windows\iplist.txt
c:\windows\loader2.exe_ok
c:\windows\phoenix.rar
c:\windows\proc_list1.log
c:\windows\rpcminer.rar
c:\windows\system32\drivers\etc\HSTS~1
c:\windows\ufa.rar
c:\windows\update.1
c:\windows\update.2
c:\windows\update.5.0
c:\windows\winlog-dirs.txt
c:\windows\winlog-ids.txt
c:\windows\winsetupapi.log
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_SRVIECHECK
-------\Legacy_WXPDRIVERS
.
.
((((((((((((((((((((((((( Files Created from 2011-06-22 to 2011-07-22 )))))))))))))))))))))))))))))))
.
.
2011-07-22 16:14 . 2011-07-22 16:14 -------- d-----w- c:\documents and settings\All Users\Application Data\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}
2011-07-22 15:50 . 2011-07-22 15:50 -------- d-----w- c:\documents and settings\Vladan\Application Data\vlc
2011-07-22 15:49 . 2011-07-22 15:49 -------- d-----w- c:\program files\VideoLAN
2011-07-21 18:37 . 2011-07-21 18:37 233024 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-07-21 18:36 . 2011-07-21 18:37 -------- d-----w- c:\program files\DAEMON Tools Pro
2011-07-21 18:00 . 2011-07-21 18:00 -------- d-----w- c:\program files\AVAST Software
2011-07-21 18:00 . 2011-07-21 18:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2011-07-21 14:40 . 2011-07-21 14:40 -------- d-----w- c:\windows\ufa
2011-07-21 14:40 . 2011-07-21 14:40 -------- d-----w- c:\windows\phoenix
2011-07-21 14:16 . 2011-07-21 14:40 246272 ----a-w- c:\windows\unrar.exe
2011-07-21 14:15 . 2011-07-21 14:15 -------- d-----w- c:\windows\av_ico
2011-07-21 14:13 . 2011-07-21 17:54 -------- d--h--w- c:\windows\update.tray-7-0
2011-07-21 14:13 . 2011-07-21 17:54 -------- d--h--w- c:\windows\update.tray-7-0-lnk
2011-07-03 14:46 . 2011-07-03 14:46 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-07-03 14:46 . 2011-07-03 14:46 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
2011-06-29 14:25 . 2011-06-29 14:37 -------- d-----w- c:\windows\system32\NtmsData
2011-06-23 13:38 . 2011-07-22 15:45 -------- d-----w- c:\program files\The KMPlayer
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-06 17:52 . 2011-06-01 16:15 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 17:52 . 2011-06-01 16:15 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-04 11:43 . 2011-06-01 15:13 40112 ----a-w- c:\windows\avastSS.scr
2011-07-04 11:43 . 2011-06-01 14:52 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-07-04 11:36 . 2011-06-01 15:13 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-07-04 11:36 . 2011-06-01 14:53 309848 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-07-04 11:35 . 2011-06-01 14:52 43608 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-07-04 11:35 . 2011-06-01 14:52 102616 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-07-04 11:35 . 2011-06-01 14:52 96344 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-07-04 11:32 . 2011-06-01 14:52 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-07-04 11:32 . 2011-06-01 14:52 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-07-04 11:32 . 2011-06-01 14:53 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-06-15 20:37 . 2011-06-15 20:37 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-06-15 20:37 . 2011-06-15 20:28 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-06-10 18:02 . 2011-06-10 18:02 717296 ----a-w- c:\windows\system32\drivers\sptd.sys
2011-06-02 14:19 . 2011-06-02 14:19 14744 ----a-w- c:\documents and settings\Vladan\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll
2011-06-02 14:02 . 2004-08-03 21:17 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-05-02 15:31 . 2011-06-01 14:15 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25 . 2004-08-03 22:56 151552 ----a-w- c:\windows\system32\schannel.dll
2011-04-29 16:19 . 2004-08-03 21:15 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-26 11:07 . 2004-08-03 22:56 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-04-26 11:07 . 2004-08-03 22:56 33280 ----a-w- c:\windows\system32\csrsrv.dll
2011-04-25 14:47 . 2004-08-03 22:56 667136 ----a-w- c:\windows\system32\wininet.dll
2011-04-25 14:47 . 2004-08-03 22:56 81920 ----a-w- c:\windows\system32\ieencode.dll
2011-04-25 14:47 . 2004-08-03 20:59 61952 ----a-w- c:\windows\system32\tdc.ocx
2011-04-25 12:56 . 2004-08-03 20:59 369664 ----a-w- c:\windows\system32\html.iec
2011-07-03 14:46 . 2011-06-05 20:48 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-07-04 11:43 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Pro Agent"="c:\program files\DAEMON Tools Pro\DTAgent.exe" [2011-03-17 842048]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2002-11-19 46592]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 90112]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-07-04 3493720]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\D-Link\Bluetooth Software\BTTray.exe [2006-4-12 643133]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableSecureUIAPaths"= 0 (0x0)
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 ------w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R0 fasttrak;fasttrak;c:\windows\system32\drivers\Fasttrak.sys [1.6.2011 16:34 73088]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10.6.2011 20:02 717296]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [1.6.2011 17:13 441176]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [1.6.2011 16:53 309848]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [21.7.2011 20:37 233024]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [1.6.2011 16:53 19544]
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1614895754-152049171-725345543-1003Core.job
- c:\documents and settings\Vladan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-06-01 15:28]
.
2011-07-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1614895754-152049171-725345543-1003UA.job
- c:\documents and settings\Vladan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-06-01 15:28]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.bearshare.com/
uSearchAssistant = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=2&q={searchTerms}
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\D-Link\Bluetooth Software\btsendto_ie_ctx.htm
FF - ProfilePath - c:\documents and settings\Vladan\Application Data\Mozilla\Firefox\Profiles\tpzdnxub.default\
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - hxxp://dts.search-results.com/sr?src=ffb&appid=0&systemid=2&q=
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - c:\progra~1\BEARSH~1\MediaBar\Datamngr\ToolBar\bsdtxmltbpi.dll
Toolbar-{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - c:\progra~1\BEARSH~1\MediaBar\Datamngr\ToolBar\bsdtxmltbpi.dll
Toolbar-10 - (no file)
HKLM-Run-tray_ico - (no file)
HKLM-Run-tray_ico1 - (no file)
HKLM-Run-tray_ico2 - (no file)
HKLM-Run-tray_ico3 - (no file)
HKLM-Run-tray_ico4 - (no file)
AddRemove-{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA} - c:\documents and settings\All Users\Application Data\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}\bm_installer.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2011-07-22 19:16
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(584)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\D-Link\Bluetooth Software\bin\btwdins.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\SOUNDMAN.EXE
c:\program files\ATI Technologies\ATI.ACE\CLI.EXE
c:\windows\system32\wscntfy.exe
c:\program files\ATI Technologies\ATI.ACE\cli.exe
c:\program files\ATI Technologies\ATI.ACE\cli.exe
.
**************************************************************************
.
Completion time: 2011-07-22 19:22:24 - machine was rebooted
ComboFix-quarantined-files.txt 2011-07-22 17:22
.
Pre-Run: 61.882.904.576 bytes free
Post-Run: 62.079.647.744 bytes free
.
- - End Of File - - 1A172E462A1284E01F7B3CA26EC582E6

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Otvoriti Notepad i iskopirati sledeci tekst:

File::
c:\windows\unrar.exe

Folder::
c:\windows\ufa
c:\windows\phoenix
c:\windows\av_ico
c:\windows\update.tray-7-0
c:\windows\update.tray-7-0-lnk



Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.







Preuzmi instalaciju za program Malwarebytes Anti-Malware sa sledećeg linka:
http://www.besttechie.net/tools/mbam-setup.exe

Dvoklikom pokreni instalaciju - na samom kraju procesa, proveri da su obeležene opcije:
Update Malwarebytes' Anti-Malware;
Launch Malwarebytes Anti-Malware;
a zatim klikni Finish.

Nakon završenog ažuriranja program će se pokrenuti.

Izaberi opciju Perform Quick Scan i klikni Scan.

Po završetku procesa klikni OK, Show Results: u listi detektovanog malware-a, obeleži sve stavke i klikni Remove Selected.

Po završetku procesa, logfile će se otvoriti u Notepad-u; iskopiraj ga u temu na forumu.
Ukoliko program zatraži restart kako bi se završio proces čišćenja, obavezno ga dozvoliti.

Napomena: ako dođe do restarta na kraju procesa čišćenja, logfile će biti dostupan na Logs kartici (obeleži ga i klikni Open).




goran9888 (AMF Tim)