MyCity » Ambulanta -> Arhiva Ambulante » Komp poludeo, internet isto

Komp poludeo, internet isto

Napisano na dan: 21.7.2009

Komp poludeo, internet isto

Sledeća strana

Pagination

Odgovori

travelizard Poslao: 21 Jul 2009 19:56 Idi na vrh
offline travelizard Građanin Pridružio: 28 Mar 2008 Poruke: 125	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Dakle ni Avira ne pomaze, prijavljuje mi uporno virus koji ne mogu niti da izbrisem niti da ignore-ujem sve dok ne ugasim aviru. Imam i SygateFirewall koji se blokira cim upalim komp. evo log-a Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19.53.49, on 21/07/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programmi\Sygate\SPF\smc.exe C:\Programmi\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\SOUNDMAN.EXE C:\Programmi\Microsoft Office\Office12\GrooveMonitor.exe C:\Programmi\Java\jre6\bin\jusched.exe C:\Programmi\File comuni\Real\Update_OB\realsched.exe C:\WINDOWS\system32\ctfmon.exe C:\Programmi\Registry Mechanic\RegMech.exe C:\documents and settings\proprietario\impostazioni locali\dati applicazioni\geqqe.exe C:\WINDOWS\system32\spoolsv.exe C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Programmi\File comuni\Autodesk Shared\Service\AdskScSrv.exe C:\Programmi\Bonjour\mDNSResponder.exe C:\Programmi\Java\jre6\bin\jqs.exe C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Programmi\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\Programmi\Opera\opera.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\WINDOWS\system32\taskmgr.exe C:\Documents and Settings\Proprietario\Desktop\Nuova cartella\TR3.exe.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre6\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [GrooveMonitor] "C:\Programmi\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [RegistryMechanic] C:\Programmi\Registry Mechanic\RegMech.exe /H O4 - HKCU\..\Run: [cdoosoft] C:\WINDOWS\system32\olhrwef.exe O4 - HKCU\..\Run: [geqqe] "c:\documents and settings\proprietario\impostazioni locali\dati applicazioni\geqqe.exe" geqqe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Programmi\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Programmi\File comuni\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Programmi\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programmi\File comuni\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Servizio di Google Update (gupdate1c9991c7bf6fb0c) (gupdate1c9991c7bf6fb0c) - Google Inc. - C:\Programmi\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max 2008 32-bit 32-bit (mi-raysat_3dsMax2008_32) - Unknown owner - C:\Programmi\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe O23 - Service: NBService - Nero AG - C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Programmi\Sygate\SPF\smc.exe -- End of file - 6847 bytes

Profil

diarno Poslao: 21 Jul 2009 20:29 Idi na vrh
offline diarno Anti Malware Fighter Rank 2 Pridružio: 15 Jun 2007 Poruke: 5572	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Preuzmi sUBs-ov ComboFix sa sledeće adrese na Desktop: Bleeping Computer Klikni desnim tasterom na link i odaberi opciju Save Target As... (Save Link As..., Save Linked Content As... ili sličnu); Kada se otvori dijalog za izbor lokacije na kojoj treba sačuvati file, odaberi Desktop i klikni Save. Kada preuzimanje programa bude završeno: zatvori pokrenute programe; deaktiviraj zaštitni softver (uputstvo); dvoklikom pokreni program ComboFix. U toku rada, ComboFix će:proveriti postoji li novija verzija programa: klikni Yes ako bude ponuđeno preuzimanje iste. prikazati DISCLAIMER OF WARRANTY ON SOFTWARE: klikni Yes kako bi proces bio nastavljen.ako Recovery Console nije instalirana, ponuditi instalaciju: prihvati klikom na Yes i isprati postupak.postaviti/dati određeni broj upita/obaveštenja: prihvati klikom na Yes ili OK.po potrebi, restartovati Windows (više puta); na kraju rada, otvoriti Notepad sa izveštajem o skeniranju. Iskopiraj izveštaj koji je ComboFix napravio u temu na forumu: klikni desnim tasterom miša u prozor Notepad-a i izaberi Select All; klikni desnim tasterom miša na obeleženi tekst i izaberi Copy; klikni desnim tasterom miša u polje za pisanje poruke i izaberi Paste. Napomena:Izveštaj će biti sačuvan pod nazivom ComboFix.txt na sistemskoj particiji (tipična lokacija: C:\ComboFix.txt); Ukoliko nakon slanja poruke primetiš da izveštaj nije kompletan, iskoristi opciju Prikači fajl za prilaganje file-a C:\ComboFix.txt uz poruku.

Profil

travelizard Poslao: 14 Avg 2009 22:21 Idi na vrh
offline travelizard Građanin Pridružio: 28 Mar 2008 Poruke: 125	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Uloguj se preko Facebooka da bi skinuo fajl: Napisano: 14 Avg 2009 22:18 Izvinjavam se zbog duge pauze, evo rezultata: ComboFix 09-08-10.06 - Proprietario 14/08/2009 21.54.51.1.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.39.1040.18.1023.612 [GMT 2:00] Eseguito da: c:\documents and settings\Proprietario\Desktop\ComboFix.exe FW: Sygate Personal Firewall enabled {BE898FE3-CD0B-4014-85A9-03DB9923DDB6} * Creato nuovo punto di ripristino ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !! . ((((((((((((((((((((((((((((((((((((( Altre eliminazioni ))))))))))))))))))))))))))))))))))))))))))))))))))) . C:\1xniph.bat C:\8rcahp.exe c:\documents and settings\Proprietario\Impostazioni locali\Dati applicazioni\ugmusai.dat c:\documents and settings\Proprietario\Impostazioni locali\Dati applicazioni\ugmusai.exe c:\documents and settings\Proprietario\Impostazioni locali\Dati applicazioni\ugmusai_nav.dat c:\documents and settings\Proprietario\Impostazioni locali\Dati applicazioni\ugmusai_navps.dat C:\ljnhwt.bat C:\qothmn.cmd c:\windows\AhnRpta.exe c:\windows\system32\e8main0.dll c:\windows\system32\e8main1.dll c:\windows\system32\nmdfgds0.dll c:\windows\system32\nmdfgds1.dll c:\windows\system32\olhrwef.exe . ((((((((((((((((((((((((((((((((((((((( Driver/Servizi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_AVPsys ((((((((((((((((((((((((( Files Creati Da 2009-07-14 al 2009-08-14 ))))))))))))))))))))))))))))))))))) . 2009-07-19 22:27 . 2009-08-14 13:12 -------- d-----w- c:\documents and settings\Proprietario\Impostazioni locali\Dati applicazioni\Temp . (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-08-14 20:07 . 2008-11-06 14:05 -------- d---a-w- c:\documents and settings\All Users\Dati applicazioni\TEMP 2009-08-14 19:48 . 2008-11-11 16:12 -------- d-----w- c:\programmi\ApexDC++ 2009-08-14 13:11 . 2009-02-27 20:44 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Google Updater 2009-07-20 22:23 . 2009-06-18 17:42 115200 ----a-w- c:\windows\system32\nmdfgds0.VIR 2009-06-27 22:42 . 2009-02-21 19:26 -------- d-----w- c:\documents and settings\Proprietario\Dati applicazioni\uTorrent 2009-06-18 17:49 . 2009-06-18 17:47 -------- d-----w- c:\programmi\PhotoModelerPro5 2009-01-27 01:34 . 2009-01-27 01:34 1044480 ----a-w- c:\programmi\opera\program\plugins\libdivx.dll 2009-01-27 01:34 . 2009-01-27 01:34 200704 ----a-w- c:\programmi\opera\program\plugins\ssldivx.dll . ((((((((((((((((((((((((((((((((((((( Punti Reg Caricati )))))))))))))))))))))))))))))))))))))))))))))))))) . . Nota i valori vuoti & legittimi/default non sono visualizzati. REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RegistryMechanic"="c:\programmi\Registry Mechanic\RegMech.exe" [2008-07-08 2828184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="c:\programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-05-15 339968] "SmcService"="c:\progra~1\Sygate\SPF\smc.exe" [2004-10-15 2577632] "Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "GrooveMonitor"="c:\programmi\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016] "SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2008-11-10 136600] "TkBellExe"="c:\programmi\File comuni\Real\Update_OB\realsched.exe" [2009-03-07 198160] "SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-06-18 67584] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Programmi\\Messenger\\msmsgs.exe"= "c:\\Programmi\\ApexDC++\\ApexDC.exe"= "c:\\Programmi\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Programmi\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Programmi\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Programmi\\Windows Live\\Messenger\\livecall.exe"= "c:\\Programmi\\Autodesk\\Backburner\\monitor.exe"= "c:\\Programmi\\Autodesk\\Backburner\\manager.exe"= "c:\\Programmi\\Autodesk\\Backburner\\server.exe"= "c:\\Programmi\\Autodesk\\3ds Max 2008\\3dsmax.exe"= "c:\\Programmi\\Bonjour\\mDNSResponder.exe"= "c:\\Programmi\\iTunes\\iTunes.exe"= "c:\\Programmi\\uTorrent\\uTorrent.exe"= "c:\\Programmi\\eMule AdunanzA\\eMule_AdnzA.exe"= "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "c:\\Programmi\\Opera\\opera.exe"= "c:\\Programmi\\SopCast\\adv\\SopAdver.exe"= "c:\\Programmi\\SopCast\\SopCast.exe"= "c:\\Programmi\\Skype\\Phone\\Skype.exe"= R3 CONAN;CONAN;c:\windows\system32\drivers\o2mmb.sys [28/09/2008 18.45.20 191092] R3 MbxStby;MbxStby;c:\windows\system32\drivers\MbxStby.sys [28/09/2008 18.45.20 6100] S2 gupdate1c9991c7bf6fb0c;Servizio di Google Update (gupdate1c9991c7bf6fb0c);c:\programmi\Google\Update\GoogleUpdate.exe [27/02/2009 22.46.33 133104] S3 PRISM_A00;PRISM 802.11 Driver;c:\windows\system32\drivers\PRISMA00.sys [28/09/2008 18.42.21 388448] . Contenuto della cartella 'Scheduled Tasks' 2009-08-14 c:\windows\Tasks\Google Software Updater.job - c:\programmi\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-27 16:30] 2009-08-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\programmi\Google\Update\GoogleUpdate.exe [2009-02-27 20:46] 2009-08-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\programmi\Google\Update\GoogleUpdate.exe [2009-02-27 20:46] . - - - - CHIAVI ORFANE RIMOSSE - - - - HKCU-Run-ugmusai - c:\documents and settings\proprietario\impostazioni locali\dati applicazioni\ugmusai.exe . ------- Scansione supplementare ------- . uInternet Settings,ProxyOverride = .local IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 . *********************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net Rootkit scan 2009-08-14 22:07 Windows 5.1.2600 Service Pack 2 NTFS scansione processi nascosti ... scansione entrate autostart nascoste ... Scansione files nascosti ... Scansione completata con successo Files nascosti: 0 ********************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vsdatant] "ImagePath"="" . --------------------- Dlls caricate dai processi in esecuzione --------------------- - - - - - - - > 'winlogon.exe'(604) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(2672) c:\programmi\File comuni\Ahead\Lib\NeroSearchBar.dll c:\programmi\File comuni\Ahead\Lib\MFC71U.DLL c:\programmi\File comuni\Ahead\Lib\BCGCBPRO800u.dll c:\windows\system32\MFC71LOC.DLL c:\windows\system32\SSSensor.dll c:\windows\system32\msi.dll . ------------------------ Altri processi in esecuzione ------------------------ . c:\windows\system32\ati2evxx.exe c:\programmi\Sygate\SPF\Smc.exe c:\programmi\Lavasoft\Ad-Aware\aawservice.exe c:\windows\system32\ati2evxx.exe c:\programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\programmi\File comuni\Autodesk Shared\Service\AdskScSrv.exe c:\programmi\Bonjour\mDNSResponder.exe c:\programmi\Java\jre6\bin\jqs.exe c:\programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE c:\programmi\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe c:\windows\system32\wscntfy.exe . ************************************************************************ . Ora fine scansione: 2009-08-14 22.12.16 - Il pc è stato riavviato ComboFix-quarantined-files.txt 2009-08-14 20:12 Pre-Run: 20.617.592.832 byte disponibili Post-Run: 31.499.554.816 byte disponibili 149 Dopuna: 14 Avg 2009 22:21 a i da prikacim txt file za svaki slucaj mycity.rs/must-login.png

Profil

dr_Bora Poslao: 21 Avg 2009 20:34 Idi na vrh
offline dr_Bora Anti Malware Fighter Rank 2 Pridružio: 24 Jul 2007 Poruke: 12280 Gde živiš: Höganäs, SE	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Pozdrav... Izgleda da smo te zaboravili. Izvinjavam se zbog toga; nije bilo namerno. Ukoliko ti je još uvek potrebna pomoć, skini novi ComboFix sa ranije datog linka, pokreni ga i postavi svež log.

Profil

travelizard Poslao: 01 Sep 2009 02:22 Idi na vrh
offline travelizard Građanin Pridružio: 28 Mar 2008 Poruke: 125	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Evo svezeg log-oa ComboFix 09-08-31.03 - Proprietario 01/09/2009 2.10.46.2.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.39.1040.18.1023.671 [GMT 2:00] Eseguito da: c:\documents and settings\Proprietario\Desktop\ComboFix.exe FW: Sygate Personal Firewall disabled {BE898FE3-CD0B-4014-85A9-03DB9923DDB6} * Creato nuovo punto di ripristino . ((((((((((((((((((((((((((((((((((((( Altre eliminazioni ))))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\Fonts\AcadEref.ttf . ((((((((((((((((((((((((( Files Creati Da 2009-08-01 al 2009-09-01 ))))))))))))))))))))))))))))))))))) . Nessun nuovo file creato in questo arco di tempo . (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-08-31 20:41 . 2009-02-27 20:44 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Google Updater 2009-08-31 19:28 . 2008-11-06 14:05 -------- d---a-w- c:\documents and settings\All Users\Dati applicazioni\TEMP 2009-08-22 20:59 . 2009-02-21 19:26 -------- d-----w- c:\documents and settings\Proprietario\Dati applicazioni\uTorrent 2009-08-14 19:48 . 2008-11-11 16:12 -------- d-----w- c:\programmi\ApexDC++ 2009-07-20 22:23 . 2009-06-18 17:42 115200 ----a-w- c:\windows\system32\nmdfgds0.VIR 2009-01-27 01:34 . 2009-01-27 01:34 1044480 ----a-w- c:\programmi\opera\program\plugins\libdivx.dll 2009-01-27 01:34 . 2009-01-27 01:34 200704 ----a-w- c:\programmi\opera\program\plugins\ssldivx.dll . ((((((((((((((((((((((((((((((((((((( Punti Reg Caricati )))))))))))))))))))))))))))))))))))))))))))))))))) . . Nota i valori vuoti & legittimi/default non sono visualizzati. REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RegistryMechanic"="c:\programmi\Registry Mechanic\RegMech.exe" [2008-07-08 2828184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="c:\programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-05-15 339968] "SmcService"="c:\progra~1\Sygate\SPF\smc.exe" [2004-10-15 2577632] "Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "GrooveMonitor"="c:\programmi\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016] "SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2008-11-10 136600] "TkBellExe"="c:\programmi\File comuni\Real\Update_OB\realsched.exe" [2009-03-07 198160] "SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-06-18 67584] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Programmi\\Messenger\\msmsgs.exe"= "c:\\Programmi\\ApexDC++\\ApexDC.exe"= "c:\\Programmi\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Programmi\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Programmi\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Programmi\\Windows Live\\Messenger\\livecall.exe"= "c:\\Programmi\\Autodesk\\Backburner\\monitor.exe"= "c:\\Programmi\\Autodesk\\Backburner\\manager.exe"= "c:\\Programmi\\Autodesk\\Backburner\\server.exe"= "c:\\Programmi\\Autodesk\\3ds Max 2008\\3dsmax.exe"= "c:\\Programmi\\Bonjour\\mDNSResponder.exe"= "c:\\Programmi\\iTunes\\iTunes.exe"= "c:\\Programmi\\uTorrent\\uTorrent.exe"= "c:\\Programmi\\eMule AdunanzA\\eMule_AdnzA.exe"= "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "c:\\Programmi\\Opera\\opera.exe"= "c:\\Programmi\\SopCast\\adv\\SopAdver.exe"= "c:\\Programmi\\SopCast\\SopCast.exe"= "c:\\Programmi\\Skype\\Phone\\Skype.exe"= R3 CONAN;CONAN;c:\windows\system32\drivers\o2mmb.sys [28/09/2008 18.45.20 191092] R3 MbxStby;MbxStby;c:\windows\system32\drivers\MbxStby.sys [28/09/2008 18.45.20 6100] S2 gupdate1c9991c7bf6fb0c;Servizio di Google Update (gupdate1c9991c7bf6fb0c);c:\programmi\Google\Update\GoogleUpdate.exe [27/02/2009 22.46.33 133104] S3 PRISM_A00;PRISM 802.11 Driver;c:\windows\system32\drivers\PRISMA00.sys [28/09/2008 18.42.21 388448] . Contenuto della cartella 'Scheduled Tasks' 2009-08-31 c:\windows\Tasks\Google Software Updater.job - c:\programmi\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-27 16:30] 2009-08-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\programmi\Google\Update\GoogleUpdate.exe [2009-02-27 20:46] 2009-08-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\programmi\Google\Update\GoogleUpdate.exe [2009-02-27 20:46] . . ------- Scansione supplementare ------- . uInternet Settings,ProxyOverride = .local IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 . *********************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net Rootkit scan 2009-09-01 02:15 Windows 5.1.2600 Service Pack 2 NTFS scansione processi nascosti ... scansione entrate autostart nascoste ... Scansione files nascosti ... Scansione completata con successo Files nascosti: 0 ************************************************************************ [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vsdatant] "ImagePath"="" . --------------------- Dlls caricate dai processi in esecuzione --------------------- - - - - - - - > 'winlogon.exe'(604) c:\windows\system32\Ati2evxx.dll . Ora fine scansione: 2009-09-01 2.18.35 ComboFix-quarantined-files.txt 2009-09-01 00:18 ComboFix2.txt 2009-08-14 20:12 Pre-Run: 23.928.860.672 byte disponibili Post-Run: 24.060.796.928 byte disponibili WindowsXP-KB310994-SP2-Home-BootDisk-ITA.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect 114

Profil

dr_Bora Poslao: 01 Sep 2009 16:20 Idi na vrh
offline dr_Bora Anti Malware Fighter Rank 2 Pridružio: 24 Jul 2007 Poruke: 12280 Gde živiš: Höganäs, SE	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Upload-uj file: C:\Qoobox\Quarantine\C\WINDOWS\Fonts\AcadEref.ttf.vir preko ovog linka: http://www.mycity.rs/ambulanta-upload.php Obriši sledeći file: c:\windows\system32\nmdfgds0.VIR Javi kada si odradio upload...

Profil

travelizard Poslao: 02 Sep 2009 11:55 Idi na vrh
offline travelizard Građanin Pridružio: 28 Mar 2008 Poruke: 125	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Odradio sam upload.

Profil

dr_Bora Poslao: 02 Sep 2009 16:30 Idi na vrh
offline dr_Bora Anti Malware Fighter Rank 2 Pridružio: 24 Jul 2007 Poruke: 12280 Gde živiš: Höganäs, SE	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Uloguj se preko Facebooka da bi skinuo fajl: Ok. Ovo sada izgleda čisto. Skini sledeći zip i raspakuj ga u c:\windows\Fonts folder: https://www.mycity.rs/must-login.png Potrebno je deinstalirati ComboFix: klikni start (ili ), a zatim RUN. Na Visti koristiti Start Search polje ukoliko Run nije dostupan. U liniju za unos teksta ukucaj (iskopiraj) sledeće: combofix /u Primeti da postoji razmak između "ComboFix" i "/u". a zatim klikni OK (ili pritisni Enter). Sačekaj da se proces deinstalacije završi. To je sve.

Profil

travelizard Poslao: 03 Sep 2009 00:40 Idi na vrh
offline travelizard Građanin Pridružio: 28 Mar 2008 Poruke: 125	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Hvala puno! Ziv bio

Profil

MyCity » Ambulanta -> Arhiva Ambulante » Komp poludeo, internet isto

Ko je trenutno na forumu

Ukupno su 902 korisnika na forumu :: 52 registrovanih, 3 sakrivenih i 847 gosta :: [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:: Korisnici trenutno na forumu: Apok, ArchaBasha, Areal84, Bobrock1, cenejac111, comi_pfc, Dimitrise93, Djokkinen, djordje92sm, DonRumataEstorski, FOX, goxin, Griffon vulture, havoc995, hooraay, ikan, Karla, Krvava Devetka, Kubovac, ladro, ljuba, mercedesamg, Mercury, Milenaaa, milenko crazy north, minmatar34957, mkukoleca, muaddib, nebkv, oldtimer, ostoja, ozzy, pacika, panzerwaffe, pedja.st, raykan, royst33, shone34, Singidunumac, Sirius, Srle993, Tores, vasa.93, Vatreni Zmaj, virked, Vlad000, vlajkox, Vlajman1957, voja64, wizzardone, wolverined4, zeo

Svaki korisnik ovog sajta je odgovoran za sadržaj svoje poruke koju objavi na sajtu. Sajt se odriče svake odgovornosti za sadržaj tih poruka.
Postavljanjem vaše poruke ili vašeg autorskog dela na ovaj sajt, saglasni ste da ovaj sajt postaje distributer vašeg dela, i odričete se mogućnosti njegovog povlačenja ili brisanja, bez saglasnosti uprave sajta.
Distribucija sadržaja sa ovog sajta je dozvoljena samo u nekomercijalne svrhe, uz obaveznu napomenu da je sadržaj preuzet sa ovog sajta, i uz obavezno navođenje adrese MyCity sajta. Za sve ostale vidove distribucije obavezni ste da prethodno zatražite odobrenje od vlasnika MyCity sajta.
MyCity pokrenuo, administrira i razvija Predrag Damnjanović, a o uređenju sajta se brine MyCity Tim.
Ukoliko želite da nas kontaktirate kliknite ovde.
Naši sajtovi:
Vesti, Vojni forum, Zaštita od virusa, TekstPesme.rs

This content is licensed under a Creative Commons License.
Based on phpBB 2, translated by Simke, designed by