Danas sam na fejsbuku dobio preko e majl adrese virus. 21 .2011

1

Danas sam na fejsbuku dobio preko e majl adrese virus. 21 .2011

offline
  • Pridružio: 22 Jul 2011
  • Poruke: 169

Napisano: 22 Jul 2011 0:50

posle podne pustijo sam druga na komp i dobio je neku poruku na catu sa linkom da ode na yutube i kao da je on da nekom snimku. I otisao je virus je taj upo u računar i obrisao mi je anti virus sve igrice nemogu na fejs niti da pustim neki radio sa neta. to sam do sad primetila. skenirala sam kompa sa malvarijem i našao je 44 zarazena područja i obrise ih sve i kada restartujem kompa ostane 15 zarazenih oblasti koje ne ukloni...

Dopuna: 22 Jul 2011 0:52

mycity.rs/must-login.png

mycity.rs/must-login.png

mycity.rs/must-login.png

Dopuna: 22 Jul 2011 1:07

imam još da prikačim ovih logova od gmer ali jos mi skenira nesta sporije ide...

offline
  • Pridružio: 02 Feb 2008
  • Poruke: 14018
  • Gde živiš: Nish

Pozdrav anamarija14!








Arrow


Detaljno procitaj Uputstvo za otvaranje teme i postavi sve potrebne izvestaje: LINK

Fali DDS.txt i Attach.txt izvestaj, kao i GMER izvestaji.
Ovaj Gmer1 izvestaj koji si okacila je samo uvodno skeniranje koje Gmer obavlja prilikom pokretanja. Da bi napravila pravilno Gmer1 izvestaj, potrebno je da pokrenes skeniranje (pise u Uputstvu).

Inace, skeniranje Gmer-om, u zavisnosti od sistema i infekcije moze da potraje, tako da to nemoj da te buni.







goran9888 (AMF Tim)

offline
  • Pridružio: 22 Jul 2011
  • Poruke: 169

Napisano: 22 Jul 2011 1:49

mycity.rs/must-login.png

Dopuna: 22 Jul 2011 1:51

goran9888 , jeli ovo uredu

offline
  • Pridružio: 02 Feb 2008
  • Poruke: 14018
  • Gde živiš: Nish

To je GMER1 izvestaj.


Okaci DDS, Attach, Gmer2 i Gmer3 izvestaje.



Procitaj Uputstvo jos jednom, od pocetka, detaljno (recenicu po recenicu).









goran9888 (AMF Tim)

offline
  • Pridružio: 22 Jul 2011
  • Poruke: 169

.
DDS (Ver_11-05-19.01) - NTFSx86
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_26
Run by Vladan at 12:43:23 on 2011-07-22
Microsoft Windows XP Professional 5.1.2600.3.1250.381.1033.18.1023.583 [GMT 2:00]
.
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\D-Link\Bluetooth Software\BTTray.exe
svchost.exe
C:\Program Files\D-Link\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Documents and Settings\Vladan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Vladan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Vladan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Vladan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Vladan\My Documents\Downloads\dds.scr
C:\WINDOWS\system32\WSCRIPT.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://search.bearshare.com/
uSearch Bar = hxxp://dts.search-results.com/sidebar.html?src=ssb&appid=0&systemid=2
uSearchAssistant = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=2&q={searchTerms}
mSearchAssistant = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=2&q={searchTerms}
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: MediaBar: {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - c:\progra~1\bearsh~1\mediabar\datamngr\toolbar\bsdtxmltbpi.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: MediaBar: {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - c:\progra~1\bearsh~1\mediabar\datamngr\toolbar\bsdtxmltbpi.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Google Update] "c:\documents and settings\vladan\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [DAEMON Tools Pro Agent] "c:\program files\daemon tools pro\DTAgent.exe" -autorun
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\CLIStart.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [tray_ico]
mRun: [tray_ico1]
mRun: [tray_ico2]
mRun: [tray_ico3]
mRun: [tray_ico4]
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\d-link\bluetooth software\BTTray.exe
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableSecureUIAPaths = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\d-link\bluetooth software\btsendto_ie_ctx.htm
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\d-link\bluetooth software\btsendto_ie.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\vladan\application data\mozilla\firefox\profiles\tpzdnxub.default\
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - hxxp://dts.search-results.com/sr?src=ffb&appid=0&systemid=2&q=
FF - plugin: c:\documents and settings\vladan\local settings\application data\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
.
============= SERVICES / DRIVERS ===============
.
R0 fasttrak;fasttrak;c:\windows\system32\drivers\Fasttrak.sys [2011-6-1 73088]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-6-1 441176]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-6-1 309848]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2011-7-21 233024]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-6-1 19544]
R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2011-7-21 42184]
.
=============== Created Last 30 ================
.
2011-07-21 18:37:31 233024 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-07-21 18:36:58 -------- d-----w- c:\program files\DAEMON Tools Pro
2011-07-21 18:00:42 -------- d-----w- c:\program files\AVAST Software
2011-07-21 18:00:42 -------- d-----w- c:\documents and settings\all users\application data\Alwil Software
2011-07-21 14:40:40 -------- d-----w- c:\windows\ufa
2011-07-21 14:40:40 -------- d-----w- c:\windows\phoenix
2011-07-21 14:16:51 246272 ----a-w- c:\windows\unrar.exe
2011-07-21 14:16:35 -------- d--h--w- c:\windows\update.2
2011-07-21 14:16:20 -------- d--h--w- c:\windows\update.5.0
2011-07-21 14:15:02 -------- d-----w- c:\windows\av_ico
2011-07-21 14:13:09 -------- d--h--w- c:\windows\update.1
2011-07-21 14:13:05 -------- d--h--w- c:\windows\update.tray-7-0-lnk
2011-07-21 14:13:05 -------- d--h--w- c:\windows\update.tray-7-0
2011-07-03 14:46:43 2106216 ----a-w- c:\program files\mozilla firefox\D3DCompiler_43.dll
2011-07-03 14:46:42 1998168 ----a-w- c:\program files\mozilla firefox\d3dx9_43.dll
2011-06-29 14:25:57 -------- d-----w- c:\windows\system32\NtmsData
2011-06-23 13:38:04 -------- d-----w- c:\program files\The KMPlayer
.
==================== Find3M ====================
.
2011-07-06 17:52:42 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 17:52:42 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-04 11:43:53 40112 ----a-w- c:\windows\avastSS.scr
2011-07-04 11:36:43 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-06-23 14:05:30 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-15 20:37:21 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-06-15 20:37:21 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-06-10 18:02:19 717296 ----a-w- c:\windows\system32\drivers\sptd.sys
2011-06-02 14:02:05 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-05-02 15:31:52 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25:27 151552 ----a-w- c:\windows\system32\schannel.dll
2011-04-29 16:19:43 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-26 11:07:50 33280 ----a-w- c:\windows\system32\csrsrv.dll
2011-04-26 11:07:50 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-04-25 14:47:19 81920 ----a-w- c:\windows\system32\ieencode.dll
2011-04-25 14:47:19 667136 ----a-w- c:\windows\system32\wininet.dll
2011-04-25 14:47:19 61952 ----a-w- c:\windows\system32\tdc.ocx
2011-04-25 12:56:44 369664 ----a-w- c:\windows\system32\html.iec
.
============= FINISH: 12:45:08,03 ===============





mycity.rs/must-login.png

mycity.rs/must-login.png

offline
  • Pridružio: 02 Feb 2008
  • Poruke: 14018
  • Gde živiš: Nish

anamarija14, zar je toliko tesko da detaljno procitas Upustvo koje sam linkovao? Pa tamo je sve kristalno jasno objasnjeno.


Gde je Attach izvestaj? Kada si pokrenula DDS dobila si dva izvestaja a ti si mi okacila samo jedan od njih. Gde su Gmer2 i Gmer3 izvestaji?




Zao mi je, ali dok mi ne dostavis potrebne izvestaje ja ne mogu krenuti u resavanje slucaja.







goran9888 (AMF Tim)

offline
  • Pridružio: 22 Jul 2011
  • Poruke: 169

Napisano: 22 Jul 2011 15:23

mycity.rs/must-login.png

mycity.rs/must-login.png

mycity.rs/must-login.png

mycity.rs/must-login.png

mycity.rs/must-login.png

Dopuna: 22 Jul 2011 15:25

gorane samo jos da ti jedenom kazem da na fejsbuk ne mogu i nikakav radio nemogu da pustim. na netu...

offline
  • Pridružio: 02 Feb 2008
  • Poruke: 14018
  • Gde živiš: Nish

U toku resavanja slucaja, zamolio bih te da se pridrzavas sledeceg:
Detaljno citati moja uputstva ( ili uputstva kolega koji ce me zamenjivati) i raditi iskljucivo po njima;
Ne traziti istovremeno pomoc na drugom mestu;
Nemoj koristiti druge programe za uklanjanje malware-a, osim onih za koje budes dobio uputstvo;
U toku intervencije ne koristiti USB memorijske uredjaje, dok to ne budem zatrazio;
Ukoliko ne odgovorim u roku od 48h, osvezi temu novim post-om;
Ukoliko se ne javis u roku od 5 dana, zatvoricemo slucaj.

Za vise informacija o pravilima Ambulante MyCity foruma: LINK

-------------------------------------------------------------------------------------



Arrow


Preuzmi sUBs-ov ComboFix sa sledeće adrese na Desktop:


Bleeping Computer
Klikni desnim tasterom na link i odaberi opciju Save Target As... (Save Link As..., Save Linked Content As... ili sličnu);
Kada se otvori dijalog za izbor lokacije na kojoj treba sačuvati file, odaberi Desktop i klikni Save.




Kada preuzimanje programa bude završeno:
deaktiviraj zaštitni softver (uputstvo);
zatvori pokrenute programe;
dvoklikom pokreni program ComboFix;
u prozoru koji se otvori klikni "I Agree".

U toku rada, ComboFix će:proveriti postoji li novija verzija programa:
klikni Yes ako bude ponuđeno preuzimanje iste.
ako Recovery Console nije instalirana, ponuditi instalaciju:
obavezno prihvati klikom na Yes i isprati postupak.
postaviti/dati određeni broj upita/obaveštenja:
prihvati klikom na Yes ili OK.
po potrebi, restartovati Windows (više puta);
na kraju rada, otvoriti Notepad sa izveštajem o skeniranju.


Iskopiraj izveštaj koji je ComboFix napravio u temu na forumu:
klikni desnim tasterom miša u prozor Notepad-a i izaberi Select All;
klikni desnim tasterom miša na obeleženi tekst i izaberi Copy;
klikni desnim tasterom miša u polje za pisanje poruke i izaberi Paste.


Napomena:Izveštaj će biti sačuvan pod nazivom ComboFix.txt na sistemskoj particiji (tipična lokacija: C:\ComboFix.txt);
Ukoliko nakon slanja poruke primetiš da izveštaj nije kompletan, iskoristi opciju Prikači fajl za prilaganje file-a C:\ComboFix.txt uz poruku.





goran9888 (AMF Tim)

offline
  • Pridružio: 22 Jul 2011
  • Poruke: 169

Napisano: 22 Jul 2011 19:31

mycity.rs/must-login.png

mycity.rs/must-login.png

Dopuna: 22 Jul 2011 19:32

mycity.rs/must-login.png

mycity.rs/must-login.png






ComboFix 11-07-22.02 - Vladan 22.07.2011 19:04:21.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1250.381.1033.18.1023.705 [GMT 2:00]
Running from: c:\documents and settings\Vladan\My Documents\Downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\btc_client_iplist.txt
c:\windows\ddh_iplist.txt
c:\windows\front_ip_list.txt
c:\windows\iecheck_iplist.txt
c:\windows\info1
c:\windows\iplist.txt
c:\windows\loader2.exe_ok
c:\windows\phoenix.rar
c:\windows\proc_list1.log
c:\windows\rpcminer.rar
c:\windows\system32\drivers\etc\HSTS~1
c:\windows\ufa.rar
c:\windows\update.1
c:\windows\update.2
c:\windows\update.5.0
c:\windows\winlog-dirs.txt
c:\windows\winlog-ids.txt
c:\windows\winsetupapi.log
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_SRVIECHECK
-------\Legacy_WXPDRIVERS
.
.
((((((((((((((((((((((((( Files Created from 2011-06-22 to 2011-07-22 )))))))))))))))))))))))))))))))
.
.
2011-07-22 16:14 . 2011-07-22 16:14 -------- d-----w- c:\documents and settings\All Users\Application Data\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}
2011-07-22 15:50 . 2011-07-22 15:50 -------- d-----w- c:\documents and settings\Vladan\Application Data\vlc
2011-07-22 15:49 . 2011-07-22 15:49 -------- d-----w- c:\program files\VideoLAN
2011-07-21 18:37 . 2011-07-21 18:37 233024 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-07-21 18:36 . 2011-07-21 18:37 -------- d-----w- c:\program files\DAEMON Tools Pro
2011-07-21 18:00 . 2011-07-21 18:00 -------- d-----w- c:\program files\AVAST Software
2011-07-21 18:00 . 2011-07-21 18:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2011-07-21 14:40 . 2011-07-21 14:40 -------- d-----w- c:\windows\ufa
2011-07-21 14:40 . 2011-07-21 14:40 -------- d-----w- c:\windows\phoenix
2011-07-21 14:16 . 2011-07-21 14:40 246272 ----a-w- c:\windows\unrar.exe
2011-07-21 14:15 . 2011-07-21 14:15 -------- d-----w- c:\windows\av_ico
2011-07-21 14:13 . 2011-07-21 17:54 -------- d--h--w- c:\windows\update.tray-7-0
2011-07-21 14:13 . 2011-07-21 17:54 -------- d--h--w- c:\windows\update.tray-7-0-lnk
2011-07-03 14:46 . 2011-07-03 14:46 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-07-03 14:46 . 2011-07-03 14:46 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
2011-06-29 14:25 . 2011-06-29 14:37 -------- d-----w- c:\windows\system32\NtmsData
2011-06-23 13:38 . 2011-07-22 15:45 -------- d-----w- c:\program files\The KMPlayer
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-06 17:52 . 2011-06-01 16:15 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 17:52 . 2011-06-01 16:15 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-04 11:43 . 2011-06-01 15:13 40112 ----a-w- c:\windows\avastSS.scr
2011-07-04 11:43 . 2011-06-01 14:52 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-07-04 11:36 . 2011-06-01 15:13 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-07-04 11:36 . 2011-06-01 14:53 309848 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-07-04 11:35 . 2011-06-01 14:52 43608 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-07-04 11:35 . 2011-06-01 14:52 102616 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-07-04 11:35 . 2011-06-01 14:52 96344 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-07-04 11:32 . 2011-06-01 14:52 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-07-04 11:32 . 2011-06-01 14:52 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-07-04 11:32 . 2011-06-01 14:53 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-06-15 20:37 . 2011-06-15 20:37 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-06-15 20:37 . 2011-06-15 20:28 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-06-10 18:02 . 2011-06-10 18:02 717296 ----a-w- c:\windows\system32\drivers\sptd.sys
2011-06-02 14:19 . 2011-06-02 14:19 14744 ----a-w- c:\documents and settings\Vladan\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll
2011-06-02 14:02 . 2004-08-03 21:17 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-05-02 15:31 . 2011-06-01 14:15 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25 . 2004-08-03 22:56 151552 ----a-w- c:\windows\system32\schannel.dll
2011-04-29 16:19 . 2004-08-03 21:15 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-26 11:07 . 2004-08-03 22:56 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-04-26 11:07 . 2004-08-03 22:56 33280 ----a-w- c:\windows\system32\csrsrv.dll
2011-04-25 14:47 . 2004-08-03 22:56 667136 ----a-w- c:\windows\system32\wininet.dll
2011-04-25 14:47 . 2004-08-03 22:56 81920 ----a-w- c:\windows\system32\ieencode.dll
2011-04-25 14:47 . 2004-08-03 20:59 61952 ----a-w- c:\windows\system32\tdc.ocx
2011-04-25 12:56 . 2004-08-03 20:59 369664 ----a-w- c:\windows\system32\html.iec
2011-07-03 14:46 . 2011-06-05 20:48 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-07-04 11:43 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Pro Agent"="c:\program files\DAEMON Tools Pro\DTAgent.exe" [2011-03-17 842048]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2002-11-19 46592]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 90112]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-07-04 3493720]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\D-Link\Bluetooth Software\BTTray.exe [2006-4-12 643133]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableSecureUIAPaths"= 0 (0x0)
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 ------w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R0 fasttrak;fasttrak;c:\windows\system32\drivers\Fasttrak.sys [1.6.2011 16:34 73088]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10.6.2011 20:02 717296]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [1.6.2011 17:13 441176]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [1.6.2011 16:53 309848]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [21.7.2011 20:37 233024]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [1.6.2011 16:53 19544]
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1614895754-152049171-725345543-1003Core.job
- c:\documents and settings\Vladan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-06-01 15:28]
.
2011-07-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1614895754-152049171-725345543-1003UA.job
- c:\documents and settings\Vladan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-06-01 15:28]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.bearshare.com/
uSearchAssistant = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=2&q={searchTerms}
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\D-Link\Bluetooth Software\btsendto_ie_ctx.htm
FF - ProfilePath - c:\documents and settings\Vladan\Application Data\Mozilla\Firefox\Profiles\tpzdnxub.default\
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - hxxp://dts.search-results.com/sr?src=ffb&appid=0&systemid=2&q=
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - c:\progra~1\BEARSH~1\MediaBar\Datamngr\ToolBar\bsdtxmltbpi.dll
Toolbar-{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - c:\progra~1\BEARSH~1\MediaBar\Datamngr\ToolBar\bsdtxmltbpi.dll
Toolbar-10 - (no file)
HKLM-Run-tray_ico - (no file)
HKLM-Run-tray_ico1 - (no file)
HKLM-Run-tray_ico2 - (no file)
HKLM-Run-tray_ico3 - (no file)
HKLM-Run-tray_ico4 - (no file)
AddRemove-{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA} - c:\documents and settings\All Users\Application Data\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}\bm_installer.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2011-07-22 19:16
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(584)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\D-Link\Bluetooth Software\bin\btwdins.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\SOUNDMAN.EXE
c:\program files\ATI Technologies\ATI.ACE\CLI.EXE
c:\windows\system32\wscntfy.exe
c:\program files\ATI Technologies\ATI.ACE\cli.exe
c:\program files\ATI Technologies\ATI.ACE\cli.exe
.
**************************************************************************
.
Completion time: 2011-07-22 19:22:24 - machine was rebooted
ComboFix-quarantined-files.txt 2011-07-22 17:22
.
Pre-Run: 61.882.904.576 bytes free
Post-Run: 62.079.647.744 bytes free
.
- - End Of File - - 1A172E462A1284E01F7B3CA26EC582E6

offline
  • Pridružio: 02 Feb 2008
  • Poruke: 14018
  • Gde živiš: Nish

Arrow


Otvoriti Notepad i iskopirati sledeci tekst:

File::
c:\windows\unrar.exe

Folder::
c:\windows\ufa
c:\windows\phoenix
c:\windows\av_ico
c:\windows\update.tray-7-0
c:\windows\update.tray-7-0-lnk



Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.





Arrow

Preuzmi instalaciju za program Malwarebytes Anti-Malware sa sledećeg linka:
http://www.besttechie.net/tools/mbam-setup.exe

Dvoklikom pokreni instalaciju - na samom kraju procesa, proveri da su obeležene opcije:
Update Malwarebytes' Anti-Malware;
Launch Malwarebytes Anti-Malware;

a zatim klikni Finish.

Nakon završenog ažuriranja program će se pokrenuti.

Izaberi opciju Perform Quick Scan i klikni Scan.

Po završetku procesa klikni OK, Show Results: u listi detektovanog malware-a, obeleži sve stavke i klikni Remove Selected.

Po završetku procesa, logfile će se otvoriti u Notepad-u; iskopiraj ga u temu na forumu.
Ukoliko program zatraži restart kako bi se završio proces čišćenja, obavezno ga dozvoliti.

Napomena: ako dođe do restarta na kraju procesa čišćenja, logfile će biti dostupan na Logs kartici (obeleži ga i klikni Open).




goran9888 (AMF Tim)

Ko je trenutno na forumu
 

Ukupno su 356 korisnika na forumu :: 8 registrovanih, 1 sakriven i 347 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: dane007, Dežurni pod palubom, djordje92sm, ILGromovnik, Oluj2.1, samsung, Simon simonović, wolf431