Dali mi je sistem zarazen ?

1

Dali mi je sistem zarazen ?

offline
  • Dalibor
  • Pridružio: 03 Feb 2011
  • Poruke: 439
  • Gde živiš: Berlin

Dragi prijatelji,posto odavno nisam proveravao dali mi je sistem čist od kojekakve infekcije,pa bih vas zamolio za proveru istog,posto mi ponekada sistem malo zasteka,skenirao sam ja njega ali bez vas slaba vajda pa da ja vama prilozim fajlove Very Happy

DDS (Ver_2012-10-14.05) - NTFS_x86
Internet Explorer: 8.0.6001.18702
Run by Administrator at 21:00:26 on 2012-10-14
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.429 [GMT 2:00]
.
AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Avira Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
============== Running Processes ================
.
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\VMSnap3.exe
C:\WINDOWS\RTHDCPL.EXE
C:\program files\real\realplayer\update\realsched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MCShield\mcshieldrtm.exe
C:\Program Files\McAfee Security Scan\3.0.207\SSScheduler.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\Skype\Updater\Updater.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Web Assistant\ExtensionUpdaterService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k bthsvcs
C:\WINDOWS\system32\svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://home.sweetim.com/?st=1&crg=3.1010000.10002&barid={0DC38FBA-F5FB-11E1-9D78-001D92472BC2}
uWindow Title = Internet Explorer, optimized for Bing and MSN
uSearch Page = hxxp://www.google.com
uDefault_Page_URL = about:blank
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://home.sweetim.com/?st=1&crg=3.1010000.10002&barid={0DC38FBA-F5FB-11E1-9D78-001D92472BC2}
mDefault_Page_URL = hxxp://www.yahoo.com
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: FastestTubeBHO Class: {3E532CE8-C6D9-4A10-8ACE-4348C96E8B6A} - c:\program files\fastesttube\2.0.0\WombatBHO.dll
BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [MCShield Monitor] c:\program files\mcshield\mcshieldrtm.exe
uRun: [Google Update] "c:\documents and settings\administrator\local settings\application data\google\update\GoogleUpdate.exe" /c
mRun: [KernelFaultCheck] c:\windows\system32\dumprep 0 -k
mRun: [VMSnap3] c:\windows\VMSnap3.exe
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\admini~1\startm~1\programs\startup\yahoo!~1.lnk - c:\program files\yahoo!\widgets\YahooWidgets.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\3.0.207\SSScheduler.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:255
uPolicies-Explorer: NoDriveAutoRun = dword:67108863
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
mPolicies-Explorer: NoDriveTypeAutoRun = dword:255
mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - <no file>
IE: Free YouTube to MP3 Converter - c:\documents and settings\administrator\application data\dvdvideosoftiehelpers\freeyoutubetomp3converter.htm
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
.
INFO: HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1317104157750
TCP: Interfaces\{3318030E-D9FE-4743-86EB-1FC99D49B8CB} : NameServer = 194.247.192.33,194.247.192.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
Notify: AtiExtEvent - Ati2evxx.dll
.
============= SERVICES / DRIVERS ===============
.
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [2012-8-9 36000]
R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\avira\antivir desktop\sched.exe [2012-9-2 86224]
R2 AntiVirService;Avira Realtime Protection;c:\program files\avira\antivir desktop\avguard.exe [2012-9-2 110032]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2012-9-2 83392]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [2012-1-7 12184]
R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2012-10-9 399432]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-10-9 676936]
R2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-7-13 160944]
R2 Web Assistant Updater;Web Assistant Updater;c:\program files\web assistant\ExtensionUpdaterService.exe [2012-8-24 188760]
R3 gMouPS2;PS2 Scroll Mouse Device;c:\windows\system32\drivers\gMouPS2.sys [2012-2-29 17408]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-10-9 22856]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2009-12-1 34384]
R3 vvftav303;vvftav303;c:\windows\system32\drivers\vvftav303.sys [2011-8-28 480128]
R3 ZSMC0303;A4 TECH PC Camera H;c:\windows\system32\drivers\usbVM303.sys [2011-8-28 1472768]
S0 DwProt;DrWeb Protection;c:\windows\system32\drivers\dwprot.sys --> c:\windows\system32\drivers\dwprot.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-9-29 136176]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-20 250808]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2011-8-28 1691480]
S3 DrvAgent32;DrvAgent32;c:\windows\system32\drivers\DrvAgent32.sys [2012-1-8 23456]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-9-29 136176]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\3.0.207\McCHSvc.exe [2011-6-17 237008]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys --> e:\NTGLM7X.sys [?]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2004-8-4 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
2012-10-09 19:05:51 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-10-09 19:05:51 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-10-09 18:09:12 601088 ----a-w- c:\windows\system32\SET39.tmp
2012-10-09 18:08:21 177664 ----a-w- c:\windows\system32\SET25.tmp
2012-10-09 04:07:55 -------- d-----w- c:\program files\Spybot - Search & Destroy
2012-09-29 15:47:47 -------- d-----r- c:\program files\Skype
2012-09-26 17:32:39 -------- d-----w- c:\documents and settings\administrator\local settings\application data\APN
2012-09-26 17:32:15 -------- d-----w- c:\program files\common files\DVDVideoSoft
.
==================== Find3M ====================
.
2012-10-09 04:01:51 23624 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2012-10-08 18:59:29 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-10-08 18:59:29 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-28 15:14:53 916992 ----a-w- c:\windows\system32\wininet.dll
2012-08-28 15:14:53 43520 ------w- c:\windows\system32\licmgr10.dll
2012-08-28 15:14:52 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-08-28 12:07:15 385024 ------w- c:\windows\system32\html.iec
2012-08-21 13:33:26 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-08-21 12:58:09 2027520 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-08-07 15:31:24 81984 ----a-w- c:\windows\system32\bdod.bin
2012-07-22 18:45:36 12872 ----a-w- c:\windows\system32\bootdelete.exe
2012-07-22 16:16:51 558133 ----a-w- c:\windows\system32\sqlite3.dll
2012-07-18 16:05:10 83392 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-07-18 16:05:10 36000 ----a-w- c:\windows\system32\drivers\avkmgr.sys
.
============= FINISH: 21:01:09.57 ===============


https://www.mycity.rs/must-login.png

https://www.mycity.rs/must-login.png

https://www.mycity.rs/must-login.png

offline
  • Pridružio: 26 Avg 2010
  • Poruke: 10621
  • Gde živiš: Hypnos Control Room, Tokyo Metropolitan Government Building

Da uradimo jednu provjeru:

Preimenuj dds.scr u dds.exe.

Ukoliko vidiš samo dds u imenu fajla, uradi sljedeće. Idi u Control Panel -> Folder Options -> View i deštrikliraj Hide extensions for known filetypes. Nakon toga bi trebao biti u mogućnosti da preimenuješ dds.scr u dds.exe.
Ukoliko ni tad ne uspiješ, obriši DDS koji si skinuo i skini novi sa sljedećeg linka:

DDS

Pokreni dds.exe. Dobićeš prozor prikazan na slici:



Klikni na Options for dds.txt i štrikliraj Force scan all domains. Nakon toga, klikni na Start i sačekaj da DDS napravi izvještaje.

Kada se završi pravljenje izvještaja, prikači dds.txt uz poruku.

offline
  • Dalibor
  • Pridružio: 03 Feb 2011
  • Poruke: 439
  • Gde živiš: Berlin

Citat: Idi u Control Panel -> Folder Options -> View i deštrikliraj Hide extensions for known filetypes. Ovo sam odradio evo izvestaj koji sam sada uradio
https://www.mycity.rs/must-login.png

offline
  • Pridružio: 26 Avg 2010
  • Poruke: 10621
  • Gde živiš: Hypnos Control Room, Tokyo Metropolitan Government Building

Pročitaj uputstvo koje sam ti napisao i isprati ga.

offline
  • Dalibor
  • Pridružio: 03 Feb 2011
  • Poruke: 439
  • Gde živiš: Berlin

Nadam se da sam sada uspeo :
https://www.mycity.rs/must-login.png

offline
  • Pridružio: 26 Avg 2010
  • Poruke: 10621
  • Gde živiš: Hypnos Control Room, Tokyo Metropolitan Government Building

U postavljenim izvještajima nema tragova malware-a. Takođe vidim da si zaštitni softver deinstalirao sa Revo Uninstaller programom što je definitivno pogrešna praksa. Antivirusne programe deinstaliraj isključivo kroz Control Panel ili pomoću njihovog službenog alata sa deinstalaciju. Third-party programe za deinstalaciju nemoj korisititi za deinstalaciju AV programa.
Vidim da imaš i instaliran program DriverAgent. Ukoliko si sa njim instlairao drajvere postoji vjerovatnoća da je instalirao pogrešan drajver i da zbog toga imaš problem. U svakom slučaju, otvori temu u Winodws forumu i tamo iznesi svoj problem.

http://www.mycity.rs/Windows/

Prije toga, uradi sljedeće:



Arrow

Imaš ostatke Dr.Web antivirusa. Preuzmi:

http://people.drweb.com/people/yudin/remover/drw_remover-x86.exe
Nakon toga ga pokreni i prati korake. Nakon što program završi restartuj računar.



Arrow

Posjeti temu Testirajte da li vam je pretraživač ranjiv, pročitaj i isprati link koji stoji u njoj.

offline
  • Dalibor
  • Pridružio: 03 Feb 2011
  • Poruke: 439
  • Gde živiš: Berlin

Citat:Imaš ostatke Dr.Web antivirusa. Preuzmi:

http://people.drweb.com/people/yudin/remover/drw_remover-x86.exe
Nakon toga ga pokreni i prati korake. Nakon što program završi restartuj računar.

Ovde nemam na ovom linku nista da skinem,mrtav link GUZ - Glavom U Zid

offline
  • Pridružio: 26 Avg 2010
  • Poruke: 10621
  • Gde živiš: Hypnos Control Room, Tokyo Metropolitan Government Building

ftp://ftp.drweb.com/pub/drweb/tools/drw_remover.exe

Probaj odavde da preuzmeš alat za deinstalaciju.

offline
  • Dalibor
  • Pridružio: 03 Feb 2011
  • Poruke: 439
  • Gde živiš: Berlin

Napisano: 15 Okt 2012 17:24

Ovo zadnje sam sada uspeo da odradim i proverio sam ranjivost sistema i to je sada reseno.E sada sta me zanima,kako da uklonim ostatke antivirusa i ovaj DriverAgent.

Dopuna: 15 Okt 2012 17:27

DriverAgent sam sada u kontrol panelu deinstalirao dali je to sve sto se toga tice ili tu ima jos nesta u vezi njega ?

offline
  • Pridružio: 26 Avg 2010
  • Poruke: 10621
  • Gde živiš: Hypnos Control Room, Tokyo Metropolitan Government Building

njuskalo75 ::Ovo zadnje sam sada uspeo da odradim i proverio sam ranjivost sistema i to je sada reseno.E sada sta me zanima,kako da uklonim ostatke antivirusa i ovaj DriverAgent.

DriverAgent deisntaliraš kroz Add or Remove Programs u Control Panelu, a ostatke Dr.Web-a očistiš pomoću lata za koji sam ti dao link.

Ko je trenutno na forumu
 

Ukupno su 737 korisnika na forumu :: 40 registrovanih, 7 sakrivenih i 690 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: _commandos_, Andrija357, Arhiv, awathorn, Bogoslov, BRATORIII, Crazzer, Ctrl x, darkangel, Drug pukovnik, Duško, galijot, Hoegaarden, HrcAk47, ikan, ILGromovnik, indja, ivan1973, ivan979, Jethro, Krusarac, Lucije Kvint, lukac, mačković, MB120mm, micoboj, Mixelotti, nikoladim, orjen, ostoja, pavle_pzs, rovac, S-lash, sakota79, slavkonikolov, stemark, suton, trajkoni018, VJ, |_MeD_|