76 virusa

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Uloguj se preko Facebooka da bi skinuo fajl:

dakle radi se o sledecem:

ovo je komjuter od moje drugarice. fakultet joj je ukinuo internet jer je sa svog maila slala dnevno 10000 mailova. naravno u pitanju je virus i rekli su joj da mora ocistiti komp da bi joj vratili internet.

ja sam sa malwarebytes pronasla 76 virusa, najvise trojanaca.

vratili su joj internet, medjutim da proverim da li joj je kompjuter jos uvek zarazen:

ovo je prvi log:



DDS (Ver_10-10-05.01) - NTFSx86
Run by Violeta at 0:01:03,18 on 09.10.2010 Ј.
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Home Edition 5.1.2600.2.1251.359.1033.18.382.73 [GMT 3:00]


============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Nakido\nakido.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
E:\BitComet\BitComet.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Violeta\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.facebook.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: BitComet Helper: {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - e:\bitcomet\tools\BitCometBHO_1.3.7.16.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [BitComet] "e:\bitcomet\BitComet.exe" /tray
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [SkyTel] SkyTel.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe"
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Sony Ericsson PC Suite] "c:\program files\sony ericsson\mobile2\application launcher\Application Launcher.exe" /startoptions
mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
IE: &D&ownload &with BitComet - e:\bitcomet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - e:\bitcomet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - e:\bitcomet\BitComet.exe/AddAllLink.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://e:\bitcomet\tools\BitCometBHO_1.3.7.16.dll/206
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://go.microsoft.com/fwlink/?linkid=58813
DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://go.divx.com/plugin/DivXBrowserPlugin.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\violeta\applic~1\mozilla\firefox\profiles\tnz6ho4j.default\
FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\k-lite codec pack\real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\k-lite codec pack\real\browser\plugins\nprpjplug.dll
FF - plugin: e:\divx\divx player\npDivxPlayerPlugin.dll

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

============= SERVICES / DRIVERS ===============

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-10-8 304464]
R2 Nakido;Nakido;c:\program files\nakido\nakido.exe [2010-1-23 330240]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-10-8 20952]
S2 gupdate;Услуга Google Update (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-5-17 135664]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [2009-8-31 20160]

=============== Created Last 30 ================

2010-10-08 19:23:06 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-08 19:23:05 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-10-08 19:23:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-10-08 18:01:50 -------- d-----w- c:\docume~1\violeta\locals~1\applic~1\Mozilla
2010-10-06 17:33:58 -------- d-----w- c:\docume~1\violeta\applic~1\Malwarebytes
2010-10-06 17:33:48 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-09-28 08:47:08 -------- d--h--w- c:\windows\PIF

==================== Find3M ====================

2010-09-25 15:10:28 1032192 ----a-w- c:\windows\explorer.exe
2010-07-12 18:36:10 133616 -c----w- c:\windows\system32\pxafs.dll
2010-07-12 18:36:10 126448 -c----w- c:\windows\system32\pxinsi64.exe
2010-07-12 18:36:10 123888 -c----w- c:\windows\system32\pxcpyi64.exe

============= FINISH: 0:02:20,34 ===============

mycity.rs/must-login.png

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Pozdrav...


Zamolio bih te da postaviš i Gmer log-ove koji se navode u uputstvu Kako otvoriti temu u Ambulanti.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Uloguj se preko Facebooka da bi skinuo fajl:

Napisano: 08 Okt 2010 23:40

hocu hocu upravo se skenira ... to malo duze traje ...

Dopuna: 09 Okt 2010 0:30

evo i gmer fajlova:

mycity.rs/must-login.png

mycity.rs/must-login.png

mycity.rs/must-login.png

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Izvini na čekanju.



Preuzmi sUBs-ov ComboFix sa sledeće adrese na Desktop:


Bleeping Computer
Klikni desnim tasterom na link i odaberi opciju Save Target As... (Save Link As..., Save Linked Content As... ili sličnu);
Kada se otvori dijalog za izbor lokacije na kojoj treba sačuvati file, odaberi Desktop i klikni Save.



Kada preuzimanje programa bude završeno:
deaktiviraj zaštitni softver (uputstvo);
zatvori pokrenute programe;
dvoklikom pokreni program ComboFix.
U toku rada, ComboFix će:proveriti postoji li novija verzija programa:
klikni Yes ako bude ponuđeno preuzimanje iste. prikazati DISCLAIMER OF WARRANTY ON SOFTWARE:
klikni Yes kako bi proces bio nastavljen.ako Recovery Console nije instalirana, ponuditi instalaciju:
obavezno prihvati klikom na Yes i isprati postupak.postaviti/dati određeni broj upita/obaveštenja:
prihvati klikom na Yes ili OK.po potrebi, restartovati Windows (više puta);
na kraju rada, otvoriti Notepad sa izveštajem o skeniranju.

Iskopiraj izveštaj koji je ComboFix napravio u temu na forumu:
klikni desnim tasterom miša u prozor Notepad-a i izaberi Select All;
klikni desnim tasterom miša na obeleženi tekst i izaberi Copy;
klikni desnim tasterom miša u polje za pisanje poruke i izaberi Paste.

Napomena:Izveštaj će biti sačuvan pod nazivom ComboFix.txt na sistemskoj particiji (tipična lokacija: C:\ComboFix.txt);
Ukoliko nakon slanja poruke primetiš da izveštaj nije kompletan, iskoristi opciju Prikači fajl za prilaganje file-a C:\ComboFix.txt uz poruku.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

ComboFix 10-10-08.01 - Violeta 10.2010 г. 19:56:53.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1251.359.1033.18.382.147 [GMT 3:00]
Running from: c:\documents and settings\Violeta\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Thumbs.db

c:\windows\system32\winlogon.exe . . . is infected!!

c:\windows\explorer.exe . . . is infected!!

c:\windows\system32\drivers\ndis.sys . . . is infected!!

c:\windows\system32\grpconv.exe . . . is missing!!

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ATAPIDRV
-------\Legacy_PROTECT


((((((((((((((((((((((((( Files Created from 2010-09-09 to 2010-10-09 )))))))))))))))))))))))))))))))
.

2010-10-08 19:23 . 2010-04-29 12:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-08 19:23 . 2010-10-08 20:30 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-10-08 19:23 . 2010-04-29 12:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-10-08 19:19 . 2010-10-08 19:19 84038 ----a-w- c:\documents and settings\All Users\Application Data\DivX\TransferWizard\Uninstaller.exe
2010-10-08 19:19 . 2010-10-08 19:19 57054 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DSDesktopComponents\Uninstaller.exe
2010-10-08 19:19 . 2010-10-08 19:19 54166 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DSAVCDecoder\Uninstaller.exe
2010-10-08 19:19 . 2010-10-08 19:19 57532 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DSASPDecoder\Uninstaller.exe
2010-10-08 19:19 . 2010-10-08 19:19 56458 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DivXDecoderShortcut\Uninstaller.exe
2010-10-08 19:19 . 2010-10-08 19:19 54174 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DSAACDecoder\Uninstaller.exe
2010-10-08 19:19 . 2010-10-08 19:19 54153 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DFXPlugin\Uninstaller.exe
2010-10-08 19:18 . 2010-10-08 19:18 54128 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Converter\Uninstaller.exe
2010-10-08 19:18 . 2010-10-08 19:18 54644 ----a-w- c:\documents and settings\All Users\Application Data\DivX\TranscodeEngine\Uninstaller.exe
2010-10-08 19:18 . 2010-10-08 19:18 56969 ----a-w- c:\documents and settings\All Users\Application Data\DivX\ASPEncoder\Uninstaller.exe
2010-10-08 19:18 . 2010-10-08 19:18 54101 ----a-w- c:\documents and settings\All Users\Application Data\DivX\MPEG2Plugin\Uninstaller.exe
2010-10-08 18:01 . 2010-10-08 18:01 -------- d-----w- c:\documents and settings\Violeta\Local Settings\Application Data\Mozilla
2010-10-06 17:33 . 2010-10-06 17:33 -------- d-----w- c:\documents and settings\Violeta\Application Data\Malwarebytes
2010-10-06 17:33 . 2010-10-06 17:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-09-28 08:47 . 2010-09-28 08:47 -------- d--h--w- c:\windows\PIF

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-09 17:06 . 2010-02-20 01:31 -------- d-----w- c:\program files\Nakido
2010-10-08 20:37 . 2009-08-31 10:38 -------- d-----w- c:\program files\ESET
2010-10-08 19:55 . 2010-05-16 21:50 57344 -c--a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-10-08 19:55 . 2010-05-16 21:28 -------- d-----w- c:\documents and settings\All Users\Application Data\DivX
2010-10-08 19:19 . 2010-05-16 21:28 -------- d-----w- c:\program files\DivX
2010-09-28 09:10 . 2009-09-02 21:03 -------- d-----w- c:\documents and settings\Violeta\Application Data\Skype
2010-09-28 09:10 . 2009-09-02 21:17 -------- d-----w- c:\documents and settings\Violeta\Application Data\skypePM
2010-09-25 15:10 . 2004-08-04 12:00 1032192 ----a-w- c:\windows\explorer.exe
2010-09-21 07:13 . 2004-08-04 12:00 211072 ----a-w- c:\windows\system32\drivers\ndis.sys
2010-09-16 00:04 . 2009-09-09 17:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-08-29 13:29 . 2010-08-29 13:28 -------- d-----w- c:\documents and settings\Violeta\Application Data\BSplayer Pro
2010-08-28 06:39 . 2010-08-27 08:55 -------- d-----w- c:\program files\Picture Collection
2010-08-25 16:51 . 2010-08-25 16:51 -------- d-----w- c:\documents and settings\Violeta\Application Data\CoSoSys
2010-07-12 18:36 . 2009-09-06 18:28 45648 ----a-w- c:\windows\system32\drivers\PxHelp20.sys
2010-07-12 18:36 . 2009-09-06 18:28 133616 -c----w- c:\windows\system32\pxafs.dll
2010-07-12 18:36 . 2009-09-06 18:28 126448 -c----w- c:\windows\system32\pxinsi64.exe
2010-07-12 18:36 . 2009-09-06 18:28 123888 -c----w- c:\windows\system32\pxcpyi64.exe
.

------- Sigcheck -------

[-] 2010-09-21 07:13 . !HASH: COULD NOT OPEN FILE !!!!! . 211072 . . [------] . . c:\windows\system32\drivers\ndis.sys
[-] 2010-09-21 07:13 . !HASH: COULD NOT OPEN FILE !!!!! . 211072 . . [------] . . c:\windows\system32\dllcache\ndis.sys
[-] 2008-04-13 19:20 . !HASH: COULD NOT OPEN FILE !!!!! . 182656 . . [------] . . c:\windows\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\ndis.sys

[-] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\winlogon.exe
[-] 2004-08-04 . F6122644E583AB757CC906493397687B . 502272 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe
[-] 2004-08-04 . 8298A792898A05625DEE9AD16C355132 . 502272 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\winlogon.exe

[-] 2010-09-25 . 1109F551183AF08358890BABA239CD9C . 1032192 . . [6.00.2900.2180] . . c:\windows\explorer.exe
[-] 2010-09-23 . 6ADEF6D995FCB0E64F5EA1B8FB08029F . 1032192 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\explorer.exe
[-] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitComet"="e:\bitcomet\BitComet.exe" [2009-07-31 2674488]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2009-08-31 16248320]
"SkyTel"="SkyTel.EXE" [2009-08-31 2879488]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-12-11 344064]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-08-31 761946]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-20 149280]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2006-11-23 487424]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-04-12 1135912]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-04-29 437584]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-14 22:04 39792 -c--a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2006-10-26 21:47 31016 -c--a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-08-03 22:06 1667584 ------w- c:\program files\Messenger\msmsgs.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"e:\\BitComet\\BitComet.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Nakido\\nakido.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26540:TCP"= 26540:TCP:BitComet 26540 TCP
"26540:UDP"= 26540:UDP:BitComet 26540 UDP

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [08.10.2010 г. 22:23 304464]
R2 Nakido;Nakido;c:\program files\Nakido\nakido.exe [23.1.2010 г. 09:12 330240]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [08.10.2010 г. 22:23 20952]
S2 gupdate;Услуга Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [17.5.2010 г. 00:30 135664]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [31.8.2009 г. 12:57 20160]
.
Contents of the 'Scheduled Tasks' folder

2010-10-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-16 21:29]

2010-10-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-16 21:29]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.facebook.com/
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &D&ownload &with BitComet - e:\bitcomet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - e:\bitcomet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - e:\bitcomet\BitComet.exe/AddAllLink.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\Violeta\Application Data\Mozilla\Firefox\Profiles\tnz6ho4j.default\
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: e:\divx\DivX Player\npDivxPlayerPlugin.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
.
------- File Associations -------
.
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
AddRemove-{56582EEA-3AEF-4D84-8B9D-C87A3CD9250F} - f:\gdbnt\GetDataBack for NTFS\Uninstall.exe



Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe >>UNKNOWN [0x82B1D0E0]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7754fc3
\Driver\ACPI -> ACPI.sys @ 0xf76c7cb8
\Driver\atapi -> atapi.sys @ 0xf76617b4
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a18f6
ParseProcedure -> ntoskrnl.exe @ 0x8056f26d
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a18f6
ParseProcedure -> ntoskrnl.exe @ 0x8056f26d
NDIS: -> SendCompleteHandler -> 0x0
PacketIndicateHandler -> 0x0
SendHandler -> 0x0
user & kernel MBR OK

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(496)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3696)
c:\windows\system32\msi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\program files\Common Files\Teleca Shared\Generic.exe
c:\program files\Common Files\Teleca Shared\CapabilityManager.exe
c:\program files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
.
**************************************************************************
.
Completion time: 2010-10-09 20:14:48 - machine was rebooted
ComboFix-quarantined-files.txt 2010-10-09 17:14

Pre-Run: 443 514 880 bytes free
Post-Run: 351 830 016 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 632B2DA73A132ECEF7E1AEECD75F464B

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Pokreni ponovo ComboFix i postavi mi log koji dobiješ.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

evo ga:


ComboFix 10-10-09.01 - Violeta 10.2010 г. 23:13:44.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1251.359.1033.18.382.139 [GMT 3:00]
Running from: c:\documents and settings\Violeta\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\winlogon.exe . . . is infected!!

c:\windows\explorer.exe . . . is infected!!

c:\windows\system32\drivers\ndis.sys . . . is infected!!

c:\windows\system32\grpconv.exe . . . is missing!!

.
((((((((((((((((((((((((( Files Created from 2010-09-09 to 2010-10-09 )))))))))))))))))))))))))))))))
.

2010-10-08 19:23 . 2010-04-29 12:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-08 19:23 . 2010-10-08 20:30 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-10-08 19:23 . 2010-04-29 12:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-10-08 19:19 . 2010-10-08 19:19 84038 ----a-w- c:\documents and settings\All Users\Application Data\DivX\TransferWizard\Uninstaller.exe
2010-10-08 19:19 . 2010-10-08 19:19 57054 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DSDesktopComponents\Uninstaller.exe
2010-10-08 19:19 . 2010-10-08 19:19 54166 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DSAVCDecoder\Uninstaller.exe
2010-10-08 19:19 . 2010-10-08 19:19 57532 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DSASPDecoder\Uninstaller.exe
2010-10-08 19:19 . 2010-10-08 19:19 56458 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DivXDecoderShortcut\Uninstaller.exe
2010-10-08 19:19 . 2010-10-08 19:19 54174 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DSAACDecoder\Uninstaller.exe
2010-10-08 19:19 . 2010-10-08 19:19 54153 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DFXPlugin\Uninstaller.exe
2010-10-08 19:18 . 2010-10-08 19:18 54128 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Converter\Uninstaller.exe
2010-10-08 19:18 . 2010-10-08 19:18 54644 ----a-w- c:\documents and settings\All Users\Application Data\DivX\TranscodeEngine\Uninstaller.exe
2010-10-08 19:18 . 2010-10-08 19:18 56969 ----a-w- c:\documents and settings\All Users\Application Data\DivX\ASPEncoder\Uninstaller.exe
2010-10-08 19:18 . 2010-10-08 19:18 54101 ----a-w- c:\documents and settings\All Users\Application Data\DivX\MPEG2Plugin\Uninstaller.exe
2010-10-08 18:01 . 2010-10-08 18:01 -------- d-----w- c:\documents and settings\Violeta\Local Settings\Application Data\Mozilla
2010-10-06 17:33 . 2010-10-06 17:33 -------- d-----w- c:\documents and settings\Violeta\Application Data\Malwarebytes
2010-10-06 17:33 . 2010-10-06 17:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-09-28 08:47 . 2010-09-28 08:47 -------- d--h--w- c:\windows\PIF

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-09 20:21 . 2010-02-20 01:31 -------- d-----w- c:\program files\Nakido
2010-10-08 20:37 . 2009-08-31 10:38 -------- d-----w- c:\program files\ESET
2010-10-08 19:55 . 2010-05-16 21:50 57344 -c--a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-10-08 19:55 . 2010-05-16 21:28 -------- d-----w- c:\documents and settings\All Users\Application Data\DivX
2010-10-08 19:19 . 2010-05-16 21:28 -------- d-----w- c:\program files\DivX
2010-09-28 09:10 . 2009-09-02 21:03 -------- d-----w- c:\documents and settings\Violeta\Application Data\Skype
2010-09-28 09:10 . 2009-09-02 21:17 -------- d-----w- c:\documents and settings\Violeta\Application Data\skypePM
2010-09-25 15:10 . 2004-08-04 12:00 1032192 ----a-w- c:\windows\explorer.exe
2010-09-21 07:13 . 2004-08-04 12:00 211072 ----a-w- c:\windows\system32\drivers\ndis.sys
2010-09-16 00:04 . 2009-09-09 17:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-08-29 13:29 . 2010-08-29 13:28 -------- d-----w- c:\documents and settings\Violeta\Application Data\BSplayer Pro
2010-08-28 06:39 . 2010-08-27 08:55 -------- d-----w- c:\program files\Picture Collection
2010-08-25 16:51 . 2010-08-25 16:51 -------- d-----w- c:\documents and settings\Violeta\Application Data\CoSoSys
2010-07-12 18:36 . 2009-09-06 18:28 45648 ----a-w- c:\windows\system32\drivers\PxHelp20.sys
2010-07-12 18:36 . 2009-09-06 18:28 133616 -c----w- c:\windows\system32\pxafs.dll
2010-07-12 18:36 . 2009-09-06 18:28 126448 -c----w- c:\windows\system32\pxinsi64.exe
2010-07-12 18:36 . 2009-09-06 18:28 123888 -c----w- c:\windows\system32\pxcpyi64.exe
.

------- Sigcheck -------

[-] 2010-09-21 07:13 . D10EC5534AE81F81F35C0E8EB289D4F7 . 211072 . . [------] . . c:\windows\system32\drivers\ndis.sys
[-] 2010-09-21 07:13 . D10EC5534AE81F81F35C0E8EB289D4F7 . 211072 . . [------] . . c:\windows\system32\dllcache\ndis.sys
[-] 2008-04-13 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\ndis.sys

[-] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\winlogon.exe
[-] 2004-08-04 . F6122644E583AB757CC906493397687B . 502272 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe
[-] 2004-08-04 . 8298A792898A05625DEE9AD16C355132 . 502272 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\winlogon.exe

[-] 2010-09-25 . 1109F551183AF08358890BABA239CD9C . 1032192 . . [6.00.2900.2180] . . c:\windows\explorer.exe
[-] 2010-09-23 . 6ADEF6D995FCB0E64F5EA1B8FB08029F . 1032192 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\explorer.exe
[-] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitComet"="e:\bitcomet\BitComet.exe" [2009-07-31 2674488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2009-08-31 16248320]
"SkyTel"="SkyTel.EXE" [2009-08-31 2879488]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-12-11 344064]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-08-31 761946]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-20 149280]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2006-11-23 487424]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-04-12 1135912]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-04-29 437584]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-14 22:04 39792 -c--a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2006-10-26 21:47 31016 -c--a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-08-03 22:06 1667584 ------w- c:\program files\Messenger\msmsgs.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"e:\\BitComet\\BitComet.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Nakido\\nakido.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26540:TCP"= 26540:TCP:BitComet 26540 TCP
"26540:UDP"= 26540:UDP:BitComet 26540 UDP

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [08.10.2010 г. 22:23 304464]
R2 Nakido;Nakido;c:\program files\Nakido\nakido.exe [23.1.2010 г. 09:12 330240]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [08.10.2010 г. 22:23 20952]
S2 gupdate;Услуга Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [17.5.2010 г. 00:30 135664]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [31.8.2009 г. 12:57 20160]
.
Contents of the 'Scheduled Tasks' folder

2010-10-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-16 21:29]

2010-10-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-16 21:29]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.facebook.com/
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &D&ownload &with BitComet - e:\bitcomet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - e:\bitcomet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - e:\bitcomet\BitComet.exe/AddAllLink.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\Violeta\Application Data\Mozilla\Firefox\Profiles\tnz6ho4j.default\
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: e:\divx\DivX Player\npDivxPlayerPlugin.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(500)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-10-09 23:25:48
ComboFix-quarantined-files.txt 2010-10-09 20:25
ComboFix2.txt 2010-10-09 17:14

Pre-Run: 358 035 456 bytes free
Post-Run: 349 904 896 bytes free

- - End Of File - - 5BA3A82EC284FCDED1A1DCEDCCD42DE3

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Skinuti ndis fixer


Pokrenuti i sačekati dok se ugasi prozor konzole.

Nakon toga će se javiti Windowsova ugradjena zaštita od zamene sistemskih fajlova (ukoliko je ukljucena):



Ovde kliknuti Cancel



Ovde kliknuti Yes.

Nakon toga restartovati računar.
Nakon restarta iskopirati log na forum. Log se nalazi na sistemskoj particiji pod imenom NDIS_Fixer.txt (obično je sistemska particija C:, tj. log ce biti C:\NDIS_Fixer.txt)

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

evi i log-a|


NDIS fix

C:\WINDOWS\system32\drivers\ndis.sys found 182656 bytes
C:\WINDOWS\system32\dllcache\ndis.sys found 182656 bytes

Backup C:\WINDOWS\system32\drivers\ndis.sys to C:\ndis_drivers(2).bak 182656 bytes
C:\WINDOWS\system32\drivers\ndis.sys deleted
New copy of C:\WINDOWS\system32\drivers\ndis.sys dropped

Backup C:\WINDOWS\system32\dllcache\ndis.sys to C:\ndis_dllcache(2).bak 182656 bytes
C:\WINDOWS\system32\dllcache\ndis.sys deleted
New copy of C:\WINDOWS\system32\dllcache\ndis.sys dropped

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Ponovo pokreni ComboFix i postavi mi log.