Hi,facebook trojan

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Pozz.Pre par dana sam od prijateljice dobila na chetu por,odnosno link,naravno kliknula na njega i pojavila se snimka sa mojim imenom i prezimenom gde su naravno jos imali objavljeni kom.od nekih mojih prijatelja.Trazio je da instaliram novu verziju fles plajera,sto sam ja uradila i tako dobila virus.Kom.je poceo sa de gasi,da baguje i usporeno radi a anti aviru koju sam tada imala je zablokirala i nisam mogla nikako da je pokrenem i skeniram kom.Da kazem da nemogu od tada na feis,nemogu ni stranicu da ocitam.Kmpjuter je bio 2 puta kod majstora.Prvi put mi je obrisao stari anti virus i stavio novu anti aviru (avasti anti virus).Nikakve razlike nije bilo a feis i dalje nemoze.Rekao je da donesem kom 3. put da ga reinstalira sto ja neshvatam kako ce to pomoci da ja mogu na feis????Ja sam juce instalirala Malwerbytes,Anti Malware,snjim skenirala komplet kompj. i nasao je 31 trojan,stavila to pod karantenu i obrisala virus.Ja i dalje neznam, sta cu jer nemogu na feis,a sa mog feisa por. se same salju drugim prijateljima.Skinula sam Kaspersky anti aviru ali je nisam smela instalirat.32 bita,internet 1024/128kbit/s.
Vidim da ste vec pomogli ljudima,molim vas pomozite i meni.Unapred zahvalna.

Mislila sam da postujem po pravilima,skinila DDS ali pise da windovs nemoze da pristupi datom uredjaju

• 1Ovo se svidja korisniku: mcrule
  
  Registruj se da bi pohvalio/la poruku!

Pozdrav,


Slučajeve u Ambulanti analiziramo na osnovu izveštaja (logova). Na sledećem linku prilažem uputstvo kako se otvara tema u Ambulanti, kako bi postavila neophodne izveštaje:

http://www.mycity.rs/Ambulanta/Kako-otvoriti-temu-u-Ambulanti.html

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Uloguj se preko Facebooka da bi skinuo fajl:

Napisano: 22 Avg 2011 17:05

mycity.rs/must-login.png

mycity.rs/must-login.png
ja neznam da li ispravno radim ako ne nemojte da se ljutite




.
DDS (Ver_2011-06-23.01) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_26
Run by Korisnik at 16:58:47 on 2011-08-22
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.998.194 [GMT 2:00]
.
AV: AntiVir Desktop *Disabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Vimicro Corporation\VMUVC\VMonitor.exe
C:\Program Files\IM Magician\Vicamon.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\PROGRA~1\WINDOW~4\Datamngr\DATAMN~1.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\update.7.1\svchostdriver.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Documents and Settings\Korisnik\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Korisnik\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Korisnik\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Korisnik\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Korisnik\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Korisnik\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Korisnik\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\update.7.1\svchostdriver.exe
C:\Documents and Settings\Korisnik\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Korisnik\Desktop\É.pif
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.searchqu.com/406
uInternet Connection Wizard,ShellNext = iexplore
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: Searchqu Toolbar: {99079a25-328f-4bd4-be04-00955acaa0a7} - c:\progra~1\window~4\datamngr\toolbar\searchqudtx.dll
BHO: UrlHelper Class: {a40dc6c5-79d0-4ca8-a185-8ff989af1115} - c:\progra~1\window~4\datamngr\IEBHO.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Searchqu Toolbar: {99079a25-328f-4bd4-be04-00955acaa0a7} - c:\progra~1\window~4\datamngr\toolbar\searchqudtx.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [Google Update] "c:\documents and settings\korisnik\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [Facebook Update] "c:\documents and settings\korisnik\local settings\application data\facebook\update\FacebookUpdate.exe" /c /nocrashserver
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
mRun: [SkyTel] SkyTel.EXE
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [VMonitorVMUVC] "c:\program files\vimicro corporation\vmuvc\VMonitor.exe" VMUVC
mRun: [IMMON] "c:\program files\im magician\Vicamon.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [DATAMNGR] c:\progra~1\window~4\datamngr\DATAMN~1.EXE
mRun: [tray_ico]
mRun: [tray_ico2]
mRun: [tray_ico3]
mRun: [tray_ico4]
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
dRunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableSecureUIAPaths = 0 (0x0)
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: I&zvoz u Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1306484549765
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{74C86733-808B-4B7B-994E-5788E7C6194B} : DhcpNameServer = 192.168.1.254
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: c:\progra~1\window~4\datamngr\datamngr.dll c:\progra~1\window~4\datamngr\iebho.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\korisnik\application data\mozilla\firefox\profiles\yy35rof8.default\
FF - prefs.js: browser.search.selectedEngine - Search Results
FF - prefs.js: browser.startup.homepage - hxxp://www.searchqu.com/406
FF - prefs.js: keyword.URL - hxxp://dts.search-results.com/sr?src=ffb&appid=102&systemid=406&q=
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\documents and settings\korisnik\local settings\application data\facebook\video\skype\npFacebookVideoCalling.dll
FF - plugin: c:\documents and settings\korisnik\local settings\application data\google\update\1.3.21.65\npGoogleUpdate3.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
.
============= SERVICES / DRIVERS ===============
.
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:\windows\system32\drivers\sfsync03.sys [2005-12-6 35328]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-8-20 441176]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-8-20 309848]
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2011-4-18 165648]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-8-20 19544]
R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2011-8-20 42184]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-8-20 61960]
R2 ddservice;ddservice;c:\windows\update.7.1\svchostdriver.exe srv --> c:\windows\update.7.1\svchostdriver.exe srv [?]
R3 VMUVC;Vimicro Camera Service VMUVC;c:\windows\system32\drivers\VMUVC.sys [2011-5-29 252928]
R3 vvftUVC;Vimicro Camera Filter Service VMUVC;c:\windows\system32\drivers\vvftUVC.sys [2011-5-29 398720]
S1 avgio;avgio;\??\c:\program files\avira\antivir desktop\avgio.sys --> c:\program files\avira\antivir desktop\avgio.sys [?]
S1 MpKsl27e00207;MpKsl27e00207;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{a73400d8-5309-49e2-b3b5-582453b2114f}\mpksl27e00207.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{a73400d8-5309-49e2-b3b5-582453b2114f}\MpKsl27e00207.sys [?]
S1 MpKsl90cba38c;MpKsl90cba38c;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{4429c068-fc9d-41e6-b54b-7621deed1b64}\mpksl90cba38c.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{4429c068-fc9d-41e6-b54b-7621deed1b64}\MpKsl90cba38c.sys [?]
S1 MpKslf89e2fe0;MpKslf89e2fe0;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{9e5268fe-8634-46cc-880d-a7329caefccb}\mpkslf89e2fe0.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{9e5268fe-8634-46cc-880d-a7329caefccb}\MpKslf89e2fe0.sys [?]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;"c:\program files\avira\antivir desktop\sched.exe" --> c:\program files\avira\antivir desktop\sched.exe [?]
S2 AntiVirService;Avira AntiVir Guard;"c:\program files\avira\antivir desktop\avguard.exe" --> c:\program files\avira\antivir desktop\avguard.exe [?]
S2 srviecheck;srviecheck;c:\windows\update.2\svchost.exe srv --> c:\windows\update.2\svchost.exe srv [?]
.
=============== Created Last 30 ================
.
2011-08-22 13:29:08 -------- d--h--w- c:\windows\PIF
2011-08-21 14:29:57 -------- d-----w- c:\documents and settings\korisnik\application data\Malwarebytes
2011-08-21 14:29:48 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-21 14:29:47 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes
2011-08-21 14:29:43 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-21 14:29:43 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-20 21:19:36 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2011-08-20 21:04:20 2148864 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2011-08-20 21:04:19 2192768 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2011-08-20 21:04:19 2069376 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2011-08-20 21:04:19 2027008 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2011-08-20 21:03:29 456320 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2011-08-20 21:02:25 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2011-08-20 21:02:23 602112 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2011-08-20 21:02:23 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2011-08-20 21:02:23 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2011-08-20 21:02:23 1991680 -c----w- c:\windows\system32\dllcache\iertutil.dll
2011-08-20 21:02:22 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2011-08-20 21:02:22 11081728 -c----w- c:\windows\system32\dllcache\ieframe.dll
2011-08-20 11:02:54 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-08-20 11:02:38 40112 ----a-w- c:\windows\avastSS.scr
2011-08-20 11:02:23 -------- d-----w- c:\program files\AVAST Software
2011-08-20 11:02:23 -------- d-----w- c:\documents and settings\all users\application data\AVAST Software
2011-08-20 09:46:55 172032 ----a-w- c:\windows\system32\igfxres.dll
2011-08-20 09:32:59 27648 -c--a-w- c:\windows\system32\dllcache\rw001ext.dll
2011-08-20 09:31:59 13463552 -c--a-w- c:\windows\system32\dllcache\hwxjpn.dll
2011-08-20 09:30:59 82035 -c--a-w- c:\windows\system32\dllcache\fp4anscp.dll
2011-08-20 09:30:59 184435 -c--a-w- c:\windows\system32\dllcache\fp4amsft.dll
2011-08-20 09:30:59 147513 -c--a-w- c:\windows\system32\dllcache\fp4apws.dll
2011-08-20 09:30:58 46592 -c--a-w- c:\windows\system32\dllcache\coadmin.dll
2011-08-20 09:30:58 188480 -c--a-w- c:\windows\system32\dllcache\cfgwiz.exe
2011-08-20 09:30:57 43520 -c--a-w- c:\windows\system32\dllcache\admwprox.dll
2011-08-20 09:30:57 290816 -c--a-w- c:\windows\system32\dllcache\adsiis51.dll
2011-08-20 09:30:57 20540 -c--a-w- c:\windows\system32\dllcache\author.dll
2011-08-20 09:30:57 16439 -c--a-w- c:\windows\system32\dllcache\author.exe
2011-08-20 09:30:56 16439 -c--a-w- c:\windows\system32\dllcache\admin.exe
2011-08-20 09:30:55 20540 -c--a-w- c:\windows\system32\dllcache\admin.dll
2011-08-20 09:19:59 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2011-08-20 09:19:59 24661 ----a-w- c:\windows\system32\spxcoins.dll
2011-08-20 09:19:59 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll
2011-08-20 09:19:59 13312 ----a-w- c:\windows\system32\irclass.dll
2011-08-20 09:19:44 16535 ----a-r- c:\windows\SETC9.tmp
2011-08-20 09:19:41 1088840 ----a-r- c:\windows\SETBD.tmp
2011-08-20 09:19:39 1296669 ----a-r- c:\windows\SETBA.tmp
2011-08-19 23:41:01 -------- d-----w- c:\windows\system32\appmgmt
2011-08-19 22:54:07 -------- d--h--w- c:\windows\update.tray-8-0-lnk
2011-08-19 22:54:07 -------- d--h--w- c:\windows\update.tray-8-0
2011-08-19 22:51:25 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-08-19 22:34:15 -------- d--h--w- c:\windows\update.3
2011-08-19 12:07:11 -------- d-----w- c:\windows\ufa
2011-08-19 12:07:11 -------- d-----w- c:\windows\phoenix
2011-08-19 12:04:25 -------- d--h--w- c:\windows\update.5.0
2011-08-19 11:57:24 246272 ----a-w- c:\windows\unrar.exe
2011-08-19 11:55:41 -------- d--h--w- c:\windows\update.2
2011-08-19 11:52:54 -------- d--h--w- c:\windows\update.7.1
2011-08-19 11:50:33 -------- d-----w- c:\windows\av_ico
2011-08-19 11:49:12 -------- d--h--w- c:\windows\update.1
2011-08-19 11:48:53 -------- d--h--w- c:\windows\update.tray-14-0-lnk
2011-08-19 11:48:53 -------- d--h--w- c:\windows\update.tray-14-0
2011-08-18 07:56:28 7152464 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{e74c425f-9625-49e4-9f89-9bb8b72855c7}\mpengine.dll
2011-08-16 05:20:32 4892320 ----a-w- c:\program files\mozilla firefox\extensions\{82af8dca-6de9-405d-bd5e-43525bdad38a}\components\SkypeFfComponent.dll
2011-08-09 01:07:12 6881616 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\updates\mpengine.dll
2011-07-31 12:34:41 -------- d-----r- c:\program files\Skype
.
==================== Find3M ====================
.
2011-07-15 13:29:31 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-06-24 14:10:36 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:36:30 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:36:30 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-06-23 18:36:30 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2011-06-23 12:05:13 385024 ----a-w- c:\windows\system32\html.iec
2011-06-20 17:44:52 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-06-07 19:49:23 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-02 14:02:05 1858944 ----a-w- c:\windows\system32\win32k.sys
.
============= FINISH: 17:00:13,39 ===============

Dopuna: 22 Avg 2011 18:17

mycity.rs/must-login.png

mycity.rs/must-login.png

mycity.rs/must-login.png

ja se iskreno nadam da sam uradila sve kako treba,jos jednom vas molim za pomoc

• 2Ovo se svidja korisnicima: suza 12, mcrule
  
  Registruj se da bi pohvalio/la poruku!

Napisano: 22 Avg 2011 18:21

Niko će da se ljuti Samo detaljno isprati uputstvo koje sam postavio u prošloj poruci.

Lepo si poslala dds i attach log. Ostaje ti još da postaviš GMER logove. Ukoliko se GMER ponaša nestabilno ili neće da se pokrene, postavi RootRepeal log. Ovo sve piše u uputstvu.

Nemoj da žuriš, uputstva su vrlo precizna.

Dopuna: 22 Avg 2011 18:23

OK, sada vidim da si postavila i GMER logove, prekontrolisaću ih.

Dopuna: 23 Avg 2011 13:36

Deinstaliraj sva tri antivirusa (Avira, Avast i MSE) preko Control Panela, Add/Remove programs apleta.



Ukoliko deinstalacija nekog od ova tri antivirusa bude neuspešna, uradi sledeće:

Potrebno je da uđeš u Safe Mode With Networking, po ovome uputstvu:
http://www.mycity.rs/Uputstva/Kako-uci-u-Safe-Mode-2.html

Nakon što uđeš u Safe Mode, uklonićeš ova tri antivirusa koja imaš na računaru:

- Za uklanjanje Avire, preuzmi softver sa sledećeg linka:
http://dl.antivir.de/down/windows/registrycleaner_en.zip

- Za uklanjanje Avasta, preuzmi softver sa sledećeg linka:
http://files.avast.com/files/eng/aswclear.exe

- Za uklanjanje MSE, preuzmi softver sa sledećeg linka:
http://support.microsoft.com/kb/2435760/ i klikom na ikonicu FixIt


Ukoliko i dalje bude bilo problema sa deinstalacijom, pročitaj ovaj članak:
http://www.mycity.rs/Zastita/Kako-ukloniti-zastiti.....mover.html


Po završetku deinstalacije ovih antivirusa:

Preuzmi sUBs-ov ComboFix sa sledeće adrese na Desktop:


Bleeping Computer
Klikni desnim tasterom na link i odaberi opciju Save Target As... (Save Link As..., Save Linked Content As... ili sličnu);
Kada se otvori dijalog za izbor lokacije na kojoj treba sačuvati file, odaberi Desktop i klikni Save.



Kada preuzimanje programa bude završeno:
deaktiviraj zaštitni softver (uputstvo);
zatvori pokrenute programe;
dvoklikom pokreni program ComboFix;
u prozoru koji se otvori klikni "I Agree".
U toku rada, ComboFix će:proveriti postoji li novija verzija programa:
klikni Yes ako bude ponuđeno preuzimanje iste.ako Recovery Console nije instalirana, ponuditi instalaciju:
obavezno prihvati klikom na Yes i isprati postupak.postaviti/dati određeni broj upita/obaveštenja:
prihvati klikom na Yes ili OK.po potrebi, restartovati Windows (više puta);
na kraju rada, otvoriti Notepad sa izveštajem o skeniranju.

Iskopiraj izveštaj koji je ComboFix napravio u temu na forumu:
klikni desnim tasterom miša u prozor Notepad-a i izaberi Select All;
klikni desnim tasterom miša na obeleženi tekst i izaberi Copy;
klikni desnim tasterom miša u polje za pisanje poruke i izaberi Paste.

Napomena:Izveštaj će biti sačuvan pod nazivom ComboFix.txt na sistemskoj particiji (tipična lokacija: C:\ComboFix.txt);
Ukoliko nakon slanja poruke primetiš da izveštaj nije kompletan, iskoristi opciju Prikači fajl za prilaganje file-a C:\ComboFix.txt uz poruku.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

deinstalirala sam avast uspesno ali aviru i mse nemogu nigde da nadjem a u program dodaj i ukloni nema mse i avira

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Pročitaj deo uputstva ispod ovog citata u mojoj prethodnoj poruci:

Citat:Ukoliko deinstalacija nekog od ova tri antivirusa bude neuspešna, uradi sledeće:

Dakle ostala dva ćeš ukloniti sa aplikacijama (dati su linkovi za preuzimanje) koji su specijalizovani za uklanjanje tih antivirusa.

Uputstvo je detaljno napisano.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Napisano: 23 Avg 2011 16:20

ComboFix 11-08-23.03 - Korisnik 23.08.2011 16:06:02.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.998.572 [GMT 2:00]
Running from: c:\documents and settings\Korisnik\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Korisnik\WINDOWS
C:\install.exe
c:\windows\btc_client_iplist.txt
c:\windows\front_ip_list.txt
c:\windows\geoiplist
c:\windows\geoiplist.rar
c:\windows\iecheck_iplist.txt
c:\windows\info1
c:\windows\iplist.txt
c:\windows\loader2.exe_ok
c:\windows\phoenix
c:\windows\phoenix.rar
c:\windows\phoenix\kernels\phatk\__init__.py
c:\windows\phoenix\kernels\phatk\__init__.pyc
c:\windows\phoenix\kernels\phatk\BFIPatcher.py
c:\windows\phoenix\kernels\phatk\kernel.cl
c:\windows\phoenix\kernels\poclbm\__init__.py
c:\windows\phoenix\kernels\poclbm\__init__.pyc
c:\windows\phoenix\kernels\poclbm\BFIPatcher.py
c:\windows\phoenix\kernels\poclbm\kernel.cl
c:\windows\phoenix\phoenix.exe
c:\windows\proc_list1.log
c:\windows\rpcminer.rar
c:\windows\system32\drivers\etc\HSTS~1
c:\windows\ufa.rar
c:\windows\update.1
c:\windows\update.2
c:\windows\update.3
c:\windows\update.5.0
c:\windows\update.7.1
c:\windows\update.7.1\svchostdriver.exe
c:\windows\w_distrib_iplist.txt
c:\windows\winlog-dirs.txt
c:\windows\winlog-ids.txt
c:\windows\winsetupapi.log
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_SRVBTCCLIENT
-------\Legacy_SRVIECHECK
-------\Legacy_WXPDRIVERS
-------\Service_srviecheck
-------\Legacy_ddservice
-------\Legacy_ddservice
-------\Service_ddservice
-------\Service_ddservice
.
.
((((((((((((((((((((((((( Files Created from 2011-07-23 to 2011-08-23 )))))))))))))))))))))))))))))))
.
.
2011-08-23 13:39 . 2011-08-23 13:39 26086 ----a-w- C:\FixitRegBackup.reg
2011-08-22 13:29 . 2011-08-22 13:29 -------- d--h--w- c:\windows\PIF
2011-08-21 20:57 . 2011-08-21 20:57 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2011-08-21 14:29 . 2011-08-21 14:29 -------- d-----w- c:\documents and settings\Korisnik\Application Data\Malwarebytes
2011-08-21 14:29 . 2011-07-06 17:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-21 14:29 . 2011-08-21 14:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-08-21 14:29 . 2011-08-21 14:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-21 14:29 . 2011-07-06 17:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-21 14:02 . 2011-08-21 14:02 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE
2011-08-21 14:01 . 2011-08-21 14:01 -------- d-----w- c:\windows\system32\config\systemprofile\AppData
2011-08-20 21:19 . 2008-06-13 11:05 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2011-08-20 21:04 . 2010-12-09 13:42 2148864 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2011-08-20 21:04 . 2010-12-09 13:38 2192768 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2011-08-20 21:04 . 2010-12-09 13:07 2027008 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2011-08-20 21:04 . 2010-12-09 13:07 2069376 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2011-08-20 21:03 . 2011-07-15 13:29 456320 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2011-08-20 21:02 . 2011-06-23 18:36 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2011-08-20 21:02 . 2011-06-23 18:36 602112 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2011-08-20 21:02 . 2011-06-23 18:36 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2011-08-20 21:02 . 2011-06-23 18:36 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2011-08-20 21:02 . 2011-06-23 18:36 1991680 -c----w- c:\windows\system32\dllcache\iertutil.dll
2011-08-20 21:02 . 2011-06-23 18:36 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2011-08-20 21:02 . 2011-06-23 18:36 11081728 -c----w- c:\windows\system32\dllcache\ieframe.dll
2011-08-20 11:02 . 2011-08-23 11:54 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software
2011-08-20 11:02 . 2011-08-20 11:02 -------- d-----w- c:\program files\AVAST Software
2011-08-20 09:46 . 2007-06-22 06:31 172032 ----a-w- c:\windows\system32\igfxres.dll
2011-08-20 09:32 . 2008-04-14 12:00 27648 -c--a-w- c:\windows\system32\dllcache\rw001ext.dll
2011-08-20 09:31 . 2008-04-14 12:00 13463552 -c--a-w- c:\windows\system32\dllcache\hwxjpn.dll
2011-08-20 09:30 . 2004-05-12 22:39 184435 -c--a-w- c:\windows\system32\dllcache\fp4amsft.dll
2011-08-20 09:30 . 2003-03-24 14:52 82035 -c--a-w- c:\windows\system32\dllcache\fp4anscp.dll
2011-08-20 09:30 . 2003-03-24 14:52 147513 -c--a-w- c:\windows\system32\dllcache\fp4apws.dll
2011-08-20 09:30 . 2008-04-14 12:00 46592 -c--a-w- c:\windows\system32\dllcache\coadmin.dll
2011-08-20 09:30 . 2003-03-24 14:52 188480 -c--a-w- c:\windows\system32\dllcache\cfgwiz.exe
2011-08-20 09:30 . 2008-04-14 12:00 43520 -c--a-w- c:\windows\system32\dllcache\admwprox.dll
2011-08-20 09:30 . 2008-04-14 12:00 290816 -c--a-w- c:\windows\system32\dllcache\adsiis51.dll
2011-08-20 09:30 . 2003-03-24 14:52 20540 -c--a-w- c:\windows\system32\dllcache\author.dll
2011-08-20 09:30 . 2003-03-24 14:52 16439 -c--a-w- c:\windows\system32\dllcache\author.exe
2011-08-20 09:30 . 2003-03-24 14:52 16439 -c--a-w- c:\windows\system32\dllcache\admin.exe
2011-08-20 09:30 . 2003-03-24 14:52 20540 -c--a-w- c:\windows\system32\dllcache\admin.dll
2011-08-20 09:19 . 2008-04-14 12:00 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2011-08-20 09:19 . 2008-04-14 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll
2011-08-20 09:19 . 2008-04-14 12:00 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll
2011-08-20 09:19 . 2008-04-14 12:00 13312 ----a-w- c:\windows\system32\irclass.dll
2011-08-20 09:19 . 2008-04-14 12:00 16535 ----a-r- c:\windows\SETC9.tmp
2011-08-20 09:19 . 2008-04-14 12:00 1088840 ----a-r- c:\windows\SETBD.tmp
2011-08-20 09:19 . 2008-04-14 12:00 1296669 ----a-r- c:\windows\SETBA.tmp
2011-08-20 08:53 . 2011-08-20 08:53 -------- d-----w- c:\documents and settings\Administrator
2011-08-19 22:54 . 2011-08-20 10:51 -------- d--h--w- c:\windows\update.tray-8-0-lnk
2011-08-19 22:54 . 2011-08-20 09:18 -------- d--h--w- c:\windows\update.tray-8-0
2011-08-19 22:51 . 2011-07-20 09:30 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-08-19 22:51 . 2011-07-20 09:30 137656 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-08-19 22:51 . 2010-06-17 13:27 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2011-08-19 22:51 . 2010-06-17 13:27 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2011-08-19 12:07 . 2011-08-19 12:07 -------- d-----w- c:\windows\ufa
2011-08-19 11:59 . 2011-08-19 11:59 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2011-08-19 11:57 . 2011-08-19 12:07 246272 ----a-w- c:\windows\unrar.exe
2011-08-19 11:50 . 2011-08-19 22:55 -------- d-----w- c:\windows\av_ico
2011-08-19 11:48 . 2011-08-20 10:46 -------- d--h--w- c:\windows\update.tray-14-0-lnk
2011-08-19 11:48 . 2011-08-20 09:18 -------- d--h--w- c:\windows\update.tray-14-0
2011-08-18 07:56 . 2011-08-12 02:44 7152464 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E74C425F-9625-49E4-9F89-9BB8B72855C7}\mpengine.dll
2011-08-16 05:20 . 2011-08-16 05:20 4892320 ----a-w- c:\program files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
2011-08-09 01:07 . 2011-07-13 03:39 6881616 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Updates\mpengine.dll
2011-07-31 12:34 . 2011-08-20 13:04 -------- d-----r- c:\program files\Skype
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-12 02:44 . 2011-05-28 10:07 7152464 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-07-15 13:29 . 2008-04-14 12:00 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2008-04-14 12:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-06-24 14:10 . 2011-05-27 06:59 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:36 . 2008-04-14 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:36 . 2008-04-14 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-06-23 18:36 . 2008-04-14 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2011-06-23 12:05 . 2008-04-14 12:00 385024 ----a-w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2008-04-14 12:00 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-06-07 19:49 . 2011-05-27 09:09 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-02 14:02 . 2008-04-14 12:00 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-08-18 04:27 . 2011-05-27 09:08 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Facebook Update"="c:\documents and settings\Korisnik\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" [2011-07-14 137536]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-07-29 17361032]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkyTel"="SkyTel.EXE" [2006-06-27 2879488]
"VMonitorVMUVC"="c:\program files\Vimicro Corporation\VMUVC\VMonitor.exe" [2007-12-20 135168]
"IMMON"="c:\program files\IM Magician\Vicamon.exe" [2008-06-05 139264]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-06-27 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-06-27 162328]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-06-27 137752]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-27 16248320]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" [2009-03-08 128512]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableSecureUIAPaths"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Program Files\\theHunter\\launcher\\launcher.exe"=
"c:\\Documents and Settings\\Korisnik\\My Documents\\CS 1.6 v42 FULL\\hl.exe"=
"c:\\Program Files\\theHunter\\Nova mapa\\launcher\\launcher.exe"=
"c:\\Program Files\\Windows iLivid Toolbar\\Datamngr\\ToolBar\\dtUser.exe"=
"c:\\Documents and Settings\\Korisnik\\Local Settings\\Application Data\\Facebook\\Video\\Skype\\FacebookVideoCalling.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:\windows\system32\drivers\sfsync03.sys [6.12.2005 17:11 35328]
R3 VMUVC;Vimicro Camera Service VMUVC;c:\windows\system32\drivers\VMUVC.sys [29.5.2011 1:03 252928]
R3 vvftUVC;Vimicro Camera Filter Service VMUVC;c:\windows\system32\drivers\vvftUVC.sys [29.5.2011 1:03 398720]
S1 MpKsl27e00207;MpKsl27e00207;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A73400D8-5309-49E2-B3B5-582453B2114F}\MpKsl27e00207.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A73400D8-5309-49E2-B3B5-582453B2114F}\MpKsl27e00207.sys [?]
S1 MpKsl90cba38c;MpKsl90cba38c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4429C068-FC9D-41E6-B54B-7621DEED1B64}\MpKsl90cba38c.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4429C068-FC9D-41E6-B54B-7621DEED1B64}\MpKsl90cba38c.sys [?]
S1 MpKslf89e2fe0;MpKslf89e2fe0;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9E5268FE-8634-46CC-880D-A7329CAEFCCB}\MpKslf89e2fe0.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9E5268FE-8634-46CC-880D-A7329CAEFCCB}\MpKslf89e2fe0.sys [?]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;"c:\program files\Avira\AntiVir Desktop\sched.exe" --> c:\program files\Avira\AntiVir Desktop\sched.exe [?]
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-23 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-839522115-823518204-1177238915-1003Core.job
- c:\documents and settings\Korisnik\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2011-07-08 11:47]
.
2011-08-23 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-839522115-823518204-1177238915-1003UA.job
- c:\documents and settings\Korisnik\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2011-07-08 11:47]
.
2011-08-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-839522115-823518204-1177238915-1003Core.job
- c:\documents and settings\Korisnik\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-05-27 07:51]
.
2011-08-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-839522115-823518204-1177238915-1003UA.job
- c:\documents and settings\Korisnik\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-05-27 07:51]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.searchqu.com/406
uInternet Connection Wizard,ShellNext = iexplore
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: I&zvoz u Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.254
FF - ProfilePath - c:\documents and settings\Korisnik\Application Data\Mozilla\Firefox\Profiles\yy35rof8.default\
FF - prefs.js: browser.search.selectedEngine - Search Results
FF - prefs.js: browser.startup.homepage - hxxp://www.searchqu.com/406
FF - prefs.js: keyword.URL - hxxp://dts.search-results.com/sr?src=ffb&appid=102&systemid=406&q=
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-10 - (no file)
HKLM-Run-MSC - c:\program files\Microsoft Security Client\msseces.exe
HKLM-Run-tray_ico - (no file)
HKLM-Run-tray_ico2 - (no file)
HKLM-Run-tray_ico3 - (no file)
HKLM-Run-tray_ico4 - (no file)
HKU-Default-RunOnce-tscuninstall - c:\windows\system32\tscupgrd.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2011-08-23 16:12
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(3656)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\progra~1\WINDOW~4\Datamngr\DATAMN~1.EXE
c:\windows\RTHDCPL.EXE
c:\windows\system32\igfxsrvc.exe
.
**************************************************************************
.
Completion time: 2011-08-23 16:16:37 - machine was rebooted
ComboFix-quarantined-files.txt 2011-08-23 14:16
.
Pre-Run: 60.896.686.080 bytes free
Post-Run: 61.318.934.528 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /noexecute=alwaysoff /fastdetect
.
- - End Of File - - 110A1F1431115D1DDF5A1DD6268790C7

Dopuna: 23 Avg 2011 16:22

samo mi reci molim te jesam li odradila ovo kako treba

• 1Ovo se svidja korisniku: mcrule
  
  Registruj se da bi pohvalio/la poruku!

Pozdrav,


Preuzmi aplikaciju AppRemover sa sledećeg linka:
http://www.appremover.com/get/appremover.exe

Preko ove aplikacije ukloni ostatke ta dva antivirusa koji nisu hteli regularno da se deinstaliraju.

Članak, u kome je objašnjem postupak uklanjanja preko ove aplikacije je na sledećem linku:
http://www.mycity.rs/Zastita/Kako-ukloniti-zastiti.....mover.html


Otvoriti Notepad i iskopirati sledeci tekst:

Folder::
c:\windows\update.tray-8-0-lnk
c:\windows\update.tray-8-0
c:\windows\ufa
c:\windows\av_ico
c:\windows\update.tray-14-0-lnk
c:\windows\update.tray-14-0

File::
c:\windows\unrar.exe

DDS::
uStart Page = hxxp://www.searchqu.com/406

Firefox::
FF - ProfilePath - c:\documents and settings\Korisnik\Application Data\Mozilla\Firefox\Profiles\yy35rof8.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.searchqu.com/406
FF - prefs.js: keyword.URL - hxxp://dts.search-results.com/sr?src=ffb&appid=102&systemid=406&q=

Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Napisano: 23 Avg 2011 21:25

AppRemover sam pokrenula i naso mi je samo malwerbytes,anti malvare i to sam uklonila,prilikom 2 pokretanja nije nasao nista.Kada prekopiram u notepadu dati tekst na desktop pod nazivom CFScript.txt,
meni pise file-polazni program-tako da nisam sigurna jel to i neznam sta bih dalje

Dopuna: 23 Avg 2011 22:51

ComboFix 11-08-23.06 - Korisnik 23.08.2011 22:45:14.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.998.620 [GMT 2:00]
Running from: c:\documents and settings\Korisnik\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Korisnik\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
FILE ::
"c:\windows\unrar.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\av_ico
c:\windows\av_ico\ico_avira_start.ico
c:\windows\av_ico\ico_Essentials_start.ico
c:\windows\ufa
c:\windows\ufa\ufa.exe
c:\windows\unrar.exe
c:\windows\update.tray-14-0-lnk
c:\windows\update.tray-14-0
c:\windows\update.tray-8-0-lnk
c:\windows\update.tray-8-0
.
.
((((((((((((((((((((((((( Files Created from 2011-07-23 to 2011-08-23 )))))))))))))))))))))))))))))))
.
.
2011-08-23 13:39 . 2011-08-23 20:24 12170 ----a-w- C:\FixitRegBackup.reg
2011-08-22 13:29 . 2011-08-22 13:29 -------- d--h--w- c:\windows\PIF
2011-08-21 20:57 . 2011-08-21 20:57 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2011-08-21 14:29 . 2011-08-21 14:29 -------- d-----w- c:\documents and settings\Korisnik\Application Data\Malwarebytes
2011-08-21 14:29 . 2011-08-21 14:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-08-21 14:02 . 2011-08-21 14:02 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE
2011-08-21 14:01 . 2011-08-21 14:01 -------- d-----w- c:\windows\system32\config\systemprofile\AppData
2011-08-20 21:19 . 2008-06-13 11:05 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2011-08-20 21:04 . 2010-12-09 13:42 2148864 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2011-08-20 21:04 . 2010-12-09 13:38 2192768 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2011-08-20 21:04 . 2010-12-09 13:07 2027008 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2011-08-20 21:04 . 2010-12-09 13:07 2069376 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2011-08-20 21:03 . 2011-07-15 13:29 456320 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2011-08-20 21:02 . 2011-06-23 18:36 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2011-08-20 21:02 . 2011-06-23 18:36 602112 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2011-08-20 21:02 . 2011-06-23 18:36 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2011-08-20 21:02 . 2011-06-23 18:36 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2011-08-20 21:02 . 2011-06-23 18:36 1991680 -c----w- c:\windows\system32\dllcache\iertutil.dll
2011-08-20 21:02 . 2011-06-23 18:36 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2011-08-20 21:02 . 2011-06-23 18:36 11081728 -c----w- c:\windows\system32\dllcache\ieframe.dll
2011-08-20 11:02 . 2011-08-23 11:54 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software
2011-08-20 11:02 . 2011-08-20 11:02 -------- d-----w- c:\program files\AVAST Software
2011-08-20 09:46 . 2007-06-22 06:31 172032 ----a-w- c:\windows\system32\igfxres.dll
2011-08-20 09:32 . 2008-04-14 12:00 27648 -c--a-w- c:\windows\system32\dllcache\rw001ext.dll
2011-08-20 09:31 . 2008-04-14 12:00 13463552 -c--a-w- c:\windows\system32\dllcache\hwxjpn.dll
2011-08-20 09:30 . 2004-05-12 22:39 184435 -c--a-w- c:\windows\system32\dllcache\fp4amsft.dll
2011-08-20 09:30 . 2003-03-24 14:52 82035 -c--a-w- c:\windows\system32\dllcache\fp4anscp.dll
2011-08-20 09:30 . 2003-03-24 14:52 147513 -c--a-w- c:\windows\system32\dllcache\fp4apws.dll
2011-08-20 09:30 . 2008-04-14 12:00 46592 -c--a-w- c:\windows\system32\dllcache\coadmin.dll
2011-08-20 09:30 . 2003-03-24 14:52 188480 -c--a-w- c:\windows\system32\dllcache\cfgwiz.exe
2011-08-20 09:30 . 2008-04-14 12:00 43520 -c--a-w- c:\windows\system32\dllcache\admwprox.dll
2011-08-20 09:30 . 2008-04-14 12:00 290816 -c--a-w- c:\windows\system32\dllcache\adsiis51.dll
2011-08-20 09:30 . 2003-03-24 14:52 20540 -c--a-w- c:\windows\system32\dllcache\author.dll
2011-08-20 09:30 . 2003-03-24 14:52 16439 -c--a-w- c:\windows\system32\dllcache\author.exe
2011-08-20 09:30 . 2003-03-24 14:52 16439 -c--a-w- c:\windows\system32\dllcache\admin.exe
2011-08-20 09:30 . 2003-03-24 14:52 20540 -c--a-w- c:\windows\system32\dllcache\admin.dll
2011-08-20 09:19 . 2008-04-14 12:00 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2011-08-20 09:19 . 2008-04-14 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll
2011-08-20 09:19 . 2008-04-14 12:00 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll
2011-08-20 09:19 . 2008-04-14 12:00 13312 ----a-w- c:\windows\system32\irclass.dll
2011-08-20 09:19 . 2008-04-14 12:00 16535 ----a-r- c:\windows\SETC9.tmp
2011-08-20 09:19 . 2008-04-14 12:00 1088840 ----a-r- c:\windows\SETBD.tmp
2011-08-20 09:19 . 2008-04-14 12:00 1296669 ----a-r- c:\windows\SETBA.tmp
2011-08-20 08:53 . 2011-08-20 08:53 -------- d-----w- c:\documents and settings\Administrator
2011-08-19 22:51 . 2011-07-20 09:30 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-08-19 22:51 . 2011-07-20 09:30 137656 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-08-19 22:51 . 2010-06-17 13:27 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2011-08-19 22:51 . 2010-06-17 13:27 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2011-08-19 11:59 . 2011-08-19 11:59 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2011-08-18 07:56 . 2011-08-12 02:44 7152464 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E74C425F-9625-49E4-9F89-9BB8B72855C7}\mpengine.dll
2011-08-16 05:20 . 2011-08-16 05:20 4892320 ----a-w- c:\program files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
2011-08-09 01:07 . 2011-07-13 03:39 6881616 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Updates\mpengine.dll
2011-07-31 12:34 . 2011-08-20 13:04 -------- d-----r- c:\program files\Skype
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-12 02:44 . 2011-05-28 10:07 7152464 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-07-15 13:29 . 2008-04-14 12:00 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2008-04-14 12:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-06-24 14:10 . 2011-05-27 06:59 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:36 . 2008-04-14 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:36 . 2008-04-14 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-06-23 18:36 . 2008-04-14 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2011-06-23 12:05 . 2008-04-14 12:00 385024 ----a-w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2008-04-14 12:00 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-06-07 19:49 . 2011-05-27 09:09 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-02 14:02 . 2008-04-14 12:00 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-08-18 04:27 . 2011-05-27 09:08 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-08-23_14.12.51 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-08-23 18:58 . 2011-08-23 18:58 16384 c:\windows\Temp\Perflib_Perfdata_518.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Facebook Update"="c:\documents and settings\Korisnik\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" [2011-07-14 137536]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-07-29 17361032]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkyTel"="SkyTel.EXE" [2006-06-27 2879488]
"VMonitorVMUVC"="c:\program files\Vimicro Corporation\VMUVC\VMonitor.exe" [2007-12-20 135168]
"IMMON"="c:\program files\IM Magician\Vicamon.exe" [2008-06-05 139264]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-06-27 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-06-27 162328]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-06-27 137752]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-27 16248320]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" [2009-03-08 128512]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableSecureUIAPaths"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Program Files\\theHunter\\launcher\\launcher.exe"=
"c:\\Documents and Settings\\Korisnik\\My Documents\\CS 1.6 v42 FULL\\hl.exe"=
"c:\\Program Files\\theHunter\\Nova mapa\\launcher\\launcher.exe"=
"c:\\Program Files\\Windows iLivid Toolbar\\Datamngr\\ToolBar\\dtUser.exe"=
"c:\\Documents and Settings\\Korisnik\\Local Settings\\Application Data\\Facebook\\Video\\Skype\\FacebookVideoCalling.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:\windows\system32\drivers\sfsync03.sys [6.12.2005 17:11 35328]
R3 VMUVC;Vimicro Camera Service VMUVC;c:\windows\system32\drivers\VMUVC.sys [29.5.2011 1:03 252928]
R3 vvftUVC;Vimicro Camera Filter Service VMUVC;c:\windows\system32\drivers\vvftUVC.sys [29.5.2011 1:03 398720]
S1 MpKsl27e00207;MpKsl27e00207;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A73400D8-5309-49E2-B3B5-582453B2114F}\MpKsl27e00207.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A73400D8-5309-49E2-B3B5-582453B2114F}\MpKsl27e00207.sys [?]
S1 MpKsl90cba38c;MpKsl90cba38c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4429C068-FC9D-41E6-B54B-7621DEED1B64}\MpKsl90cba38c.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4429C068-FC9D-41E6-B54B-7621DEED1B64}\MpKsl90cba38c.sys [?]
S1 MpKslf89e2fe0;MpKslf89e2fe0;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9E5268FE-8634-46CC-880D-A7329CAEFCCB}\MpKslf89e2fe0.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9E5268FE-8634-46CC-880D-A7329CAEFCCB}\MpKslf89e2fe0.sys [?]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;"c:\program files\Avira\AntiVir Desktop\sched.exe" --> c:\program files\Avira\AntiVir Desktop\sched.exe [?]
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-23 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-839522115-823518204-1177238915-1003Core.job
- c:\documents and settings\Korisnik\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2011-07-08 11:47]
.
2011-08-23 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-839522115-823518204-1177238915-1003UA.job
- c:\documents and settings\Korisnik\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2011-07-08 11:47]
.
2011-08-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-839522115-823518204-1177238915-1003Core.job
- c:\documents and settings\Korisnik\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-05-27 07:51]
.
2011-08-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-839522115-823518204-1177238915-1003UA.job
- c:\documents and settings\Korisnik\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-05-27 07:51]
.
.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = iexplore
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: I&zvoz u Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.254
FF - ProfilePath - c:\documents and settings\Korisnik\Application Data\Mozilla\Firefox\Profiles\yy35rof8.default\
FF - prefs.js: browser.search.selectedEngine - Search Results
FF - prefs.js: network.proxy.type - 0
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2011-08-23 22:50
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2011-08-23 22:51:54
ComboFix-quarantined-files.txt 2011-08-23 20:51
ComboFix2.txt 2011-08-23 14:16
.
Pre-Run: 61.255.954.432 bytes free
Post-Run: 61.251.559.424 bytes free
.
- - End Of File - - 4F1972F15E430D11668861BF21815C0B

Dopuna: 23 Avg 2011 23:05

Evo zadnjeg izvestaja

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Kakvo je sada stanje na računaru? Možeš li otvoriti facebook?