Molim vas pogledajte ovo Please!!!

2

Molim vas pogledajte ovo Please!!!

offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8488
  • Gde živiš: Novi Beograd

Postavi mi novi ComboFix log.

Prvo iskljuci zastitu.

offline
  • GTA  Male
  • Počasni građanin
  • Pridružio: 14 Avg 2008
  • Poruke: 717

ComboFix 09-04-04.01 - Administrator 2009-04-05 23:14:44.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1024.495 [GMT 2:00]
Running from: c:\documents and settings\Administrator\My Documents\ComboFix.exe
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated)
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Administrator\reader_s.exe
c:\windows\system32\drivers\protect.sys
c:\windows\system32\reader_s.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_PROTECT
-------\Service_protect
-------\Service_restore


((((((((((((((((((((((((( Files Created from 2009-03-05 to 2009-04-05 )))))))))))))))))))))))))))))))
.

2009-04-05 22:09 . 2009-04-05 22:09 66,048 --a------ c:\windows\system32\gcc.exe
2009-04-05 22:08 . 2009-04-05 22:09 64,512 --a------ c:\windows\system32\55DD.tmp
2009-04-05 22:08 . 2009-04-05 22:08 84 --a------ c:\windows\system32\55DC.tmp
2009-04-05 20:21 . 2008-03-03 18:21 568 --ah----- c:\windows\nod32fixtemdono.reg
2009-04-05 17:41 . 2009-04-05 17:41 11,451,859 --a------ c:\windows\services.ex_
2009-04-05 17:41 . 2009-04-05 17:41 130 --a------ c:\windows\adobe.bat
2009-04-05 17:41 . 2009-04-05 17:44 7 --a------ c:\windows\_id.dat
2009-04-05 17:41 . 2009-04-05 17:41 0 --a------ c:\windows\system32\6.tmp
2009-04-05 17:40 . 2009-04-05 17:41 64,512 --a------ c:\windows\system32\3.tmp
2009-04-05 17:40 . 2009-04-05 17:40 124 --a------ c:\windows\system32\2.tmp
2009-03-24 14:22 . 2009-03-24 14:22 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Ipref
2009-03-23 10:48 . 2009-04-02 16:15 <DIR> d-------- c:\documents and settings\Administrator\Application Data\mIRC
2009-03-14 23:39 . 2009-04-02 19:01 <DIR> d-------- C:\Picture This
2009-03-14 23:39 . 2009-03-14 23:39 32,768 --ahs---- C:\Thumbs.db

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-05 21:20 --------- d-----w c:\program files\Crawler
2009-04-05 15:41 182,912 ----a-w c:\windows\system32\drivers\ndis.sys
2009-04-05 15:41 --------- d-----w c:\program files\Winamp
2009-04-04 16:50 --------- d-----w c:\program files\Webteh
2009-04-04 16:50 --------- d-----w c:\documents and settings\Administrator\Application Data\BSplayer Pro
2009-04-04 16:49 --------- d-----w c:\program files\TC PowerPack
2009-04-04 16:37 --------- d-----w c:\program files\Common Files\LightScribe
2009-04-04 16:26 --------- d-----w c:\program files\Merriam-Webster
2009-04-04 14:53 --------- d-----w c:\program files\D-Tools
2009-03-27 14:40 --------- d-----w c:\program files\Java
2009-03-24 16:42 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-04 17:51 --------- d-----w c:\program files\Avanquest update
2009-02-28 15:08 --------- d-----w c:\documents and settings\Administrator\Application Data\GameHouse
2009-02-26 19:54 --------- d-----w c:\documents and settings\All Users\Application Data\Fugazo
2009-02-24 18:52 --------- d-----w c:\documents and settings\All Users\Application Data\PopCap
2009-02-24 18:30 --------- d-----w c:\documents and settings\All Users\Application Data\JollyBear
2009-02-23 16:47 --------- d-----w c:\documents and settings\All Users\Application Data\Zylom
2009-02-23 16:47 --------- d-----w c:\documents and settings\All Users\Application Data\GameHouse
2009-02-23 16:30 --------- d-----w c:\documents and settings\All Users\Application Data\n7-89-o9-3r-4t-r9
2009-02-23 16:23 --------- d-----w c:\documents and settings\Administrator\Application Data\PlayFirst
2009-02-22 17:29 --------- d-----w c:\documents and settings\All Users\Application Data\Tarma Installer
2009-02-16 11:39 --------- d-----w c:\program files\ESET
.

------- Sigcheck -------

2009-04-05 17:41 213376 558635d3af1c7546d26067d5d9b6959e c:\windows\system32\dllcache\ndis.sys
2009-04-05 17:41 213376 558635d3af1c7546d26067d5d9b6959e c:\windows\system32\drivers\ndis.sys

2007-06-13 12:23 3195392 3be4584f9ac9b9094c634f9348a57fe2 c:\windows\EXPLORER.EXE
md5deep: c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe: Permission denied
md5deep: c:\windows\$NtUninstallKB938828$\explorer.exe: Permission denied
md5deep: c:\windows\system32\dllcache\explorer.exe: Permission denied

2001-08-23 11:00 15360 32694ac77d5e914c1e41b770ad8c36b8 c:\windows\system32\ctfmon.exe
md5deep: c:\windows\system32\dllcache\ctfmon.exe: Permission denied

md5deep: c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe: Permission denied
md5deep: c:\windows\$NtUninstallKB896423$\spoolsv.exe: Permission denied
2005-06-11 01:53 75264 4fae26cdc82923a92c85f57fb7cfe177 c:\windows\system32\SPOOLSV.EXE
md5deep: c:\windows\system32\dllcache\spoolsv.exe: Permission denied

2001-08-23 11:00 24576 a6469e376946ac97e397ad2543bf62f9 c:\windows\system32\USERINIT.EXE
md5deep: c:\windows\system32\dllcache\userinit.exe: Permission denied
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
"vidc.CDVC"= cdvccodc.dll
"MSACM.pcdv"= pcdv.acm
"vidc.CDV5"= cdv5codc.dll
"vidc.CLLC"= cllccodc.dll
"vidc.CUVC"= cuvccodc.dll
"vidc.CDVH"= cdvhcodc.dll
"vidc.CMIC"= cmiccodc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\iexplore.exe]
"Debugger"=

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\InterVideo\\DVD7\\WinDVD.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"f:\\igrica2\\DC++\\DCPlusPlus.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Sony\\Vegas Pro 8.0\\VegSrv80.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
.
Contents of the 'Scheduled Tasks' folder

2009-04-03 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClick.exe []

2009-02-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uDefault_Search_URL =
uSearchURL,(Default) = hxxp://www.searchgateway.net/search-Google-Gateway.php?sa=Search+Here&client=pub-4642981363251965&forid=1&ie=ISO-8859-1&oe=ISO-8859-1&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A11&q=%s
IE: Crawler Search - tbr:iemenu
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\ctbr.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {6715D12F-213F-4C6E-ACE1-8A363F550B96} - hxxp://www.gamehouse.com/games/DoggieDash.cab
DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} - hxxp://www.gamehouse.com/games/gamehouse/ghplayer.cab
DPF: {74EF5274-F439-2168-B543-14745B625C72} - hxxp://www.gamehouse.com/games/WeddingDash2.cab
DPF: {935F9B04-0C7B-4454-A391-348C54AD7ADD} - hxxp://www.gamehouse.com/games/JBGamePlayer.cab
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://www.gamehouse.com/games/zylom/zylomplayer.cab
DPF: {D40F5876-A494-4124-8161-82625BB28C06} - hxxp://www.gamehouse.com/games/Chocolatier2.cab
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\krdyd8eg.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - component: c:\progra~1\Crawler\firefox\components\xcomm.dll
FF - component: c:\progra~1\Crawler\firefox\components\xshared.dll
FF - component: c:\progra~1\Crawler\firefox\components\xsupport.dll
FF - component: c:\progra~1\Crawler\firefox\components\xwsg.dll
.

**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(672)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\windows\system32\UAService7.exe
c:\windows\system32\WgaTray.exe
c:\windows\system32\config\SYSTEM~1\LOCALS~1\Temp\BN5.tmp
c:\program files\ATI Technologies\ATI Control Panel\ATIPTAXX.EXE
c:\program files\Common Files\Real\Update_OB\realsched.exe
c:\program files\CyberLink\PowerDVD\PDVDSERV.EXE
c:\program files\D-Tools\DAEMON.EXE
c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
c:\program files\Java\jre6\bin\jusched.exe
c:\program files\ESET\ESET NOD32 Antivirus\egui.exe
c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSUITE.EXE
c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe
c:\windows\BricoPacks\Crystal Clear\RocketDock\ROCKETDOCK.EXE
c:\windows\BricoPacks\Crystal Clear\YzToolbar\YZTOOLBAR.EXE
.
**************************************************************************
.
Completion time: 2009-04-05 23:22:46 - machine was rebooted [Administrator]
ComboFix-quarantined-files.txt 2009-04-05 21:22:40

Pre-Run: 29,760,585,728 bytes free
Post-Run: 29,748,084,736 bytes free

178 --- E O F --- 2009-01-13 21:10:23

Dopuna: 06 Apr 2009 15:22

mozda sam dosad ali ovo sam nasao o ovo virusu www.eset.eu/encyclopaedia/win32_virut_nbm_virus_virut_ce_cf_n_gen_virus
molim vas pogledajte ovu stranu

offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8488
  • Gde živiš: Novi Beograd

Zdravo,

ndis.sys ti je patchovan.

Da li imas strpljenja da pokusamo da dizinfikujemo. To moze da potraje, i ne garantujem uspeh?

offline
  • GTA  Male
  • Počasni građanin
  • Pridružio: 14 Avg 2008
  • Poruke: 717

Da ima mnogo strpljenja samo ti lepo objasni sta treba da radim

offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Ja cu da preuzmem odavde, posto cemo pokusati jedan fix na kojem trenutno radim.

Skini sledece programe na root C: particije:
http://amf.mycity.rs/personal/bobby/ndis_fixer.exe
http://www2.gmer.net/catchme.exe

Idi na Start > Run, pa tu u dijalogu upisi CMD i klikni OK.
Otvorice se konzola.
Tu kucaj sledece komande (iza svake stisni Enter):
cd \
catchme -e pIofCallDriver
ndis_fixer

Nakon toga odmah idi na restartovanje kompa.

Nakon restarta mi postavi ovde log C:\NDIS_Fix.txt

Nakon toga iskljuci ponovo NOD i pokreni ponovo ComboFix, pa mi ovde postavi log.

Dopuna: 06 Apr 2009 20:11

zaboravio sam da spomenem - ukoliko ti se kod pokretanja ndis_fixera javi Windowsov System File Protection, tu odbij da ubacis Windowsov instalacioni CD.

Ukoliko nakon restarta ne proradi internet, onda otvori ponovo konzolu i kucaj sledece:
 sfc /scannow i ubaci instalacioni CD Windowsa onda kada ti SFC to zatrazi.

offline
  • GTA  Male
  • Počasni građanin
  • Pridružio: 14 Avg 2008
  • Poruke: 717

Sta je root C ?

Dopuna: 06 Apr 2009 22:43

Evo loga
ComboFix 09-04-04.01 - Administrator 2009-04-06 22:37:27.5 - NTFSx86
Running from: c:\documents and settings\Administrator\My Documents\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\windows\system32\ds43g4nfjkn93.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_restore


((((((((((((((((((((((((( Files Created from 2009-03-06 to 2009-04-06 )))))))))))))))))))))))))))))))
.

2009-04-06 22:22 . 2009-04-06 22:22 213,376 --a------ C:\ndis.bak
2009-04-06 22:22 . 2009-04-06 22:22 213,376 --a------ C:\ndis(1).bak
2009-04-06 22:16 . 2009-04-06 22:16 272,896 --a------ C:\ndis_fixer.exe
2009-04-06 22:16 . 2009-04-06 22:16 169,472 --a------ C:\catchme.exe
2009-04-06 15:38 . 2009-04-06 15:48 <DIR> d-------- c:\program files\a-squared Free
2009-04-06 11:07 . 2001-08-23 11:00 221,184 --a------ c:\windows\system32\wmpns.dll
2009-04-05 22:09 . 2009-04-05 22:09 66,048 --a------ c:\windows\system32\gcc.exe
2009-04-05 22:08 . 2009-04-05 22:09 64,512 --a------ c:\windows\system32\55DD.tmp
2009-04-05 22:08 . 2009-04-05 22:08 84 --a------ c:\windows\system32\55DC.tmp
2009-04-05 20:21 . 2008-03-03 18:21 568 --ah----- c:\windows\nod32fixtemdono.reg
2009-04-05 17:41 . 2009-04-05 17:41 11,451,859 --a------ c:\windows\services.ex_
2009-04-05 17:41 . 2009-04-05 17:41 130 --a------ c:\windows\adobe.bat
2009-04-05 17:41 . 2009-04-05 17:44 7 --a------ c:\windows\_id.dat
2009-04-05 17:41 . 2009-04-05 17:41 0 --a------ c:\windows\system32\6.tmp
2009-04-05 17:40 . 2009-04-05 17:41 64,512 --a------ c:\windows\system32\3.tmp
2009-04-05 17:40 . 2009-04-05 17:40 124 --a------ c:\windows\system32\2.tmp
2009-03-24 14:22 . 2009-03-24 14:22 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Ipref
2009-03-23 10:48 . 2009-04-02 16:15 <DIR> d-------- c:\documents and settings\Administrator\Application Data\mIRC
2009-03-14 23:39 . 2009-04-02 19:01 <DIR> d-------- C:\Picture This
2009-03-14 23:39 . 2009-03-14 23:39 32,768 --ahs---- C:\Thumbs.db

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-06 20:34 --------- d-----w c:\program files\Crawler
2009-04-06 20:22 182,656 ----a-w c:\windows\system32\drivers\ndis.sys
2009-04-06 13:49 61,952 ----a-w c:\windows\system32\alg.exe
2009-04-06 13:49 3,195,392 ----a-w c:\windows\Explorer.EXE
2009-04-05 15:41 --------- d-----w c:\program files\Winamp
2009-04-04 16:50 --------- d-----w c:\program files\Webteh
2009-04-04 16:49 --------- d-----w c:\program files\TC PowerPack
2009-04-04 16:37 --------- d-----w c:\program files\Common Files\LightScribe
2009-04-04 16:26 --------- d-----w c:\program files\Merriam-Webster
2009-04-04 14:53 --------- d-----w c:\program files\D-Tools
2009-03-27 14:40 --------- d-----w c:\program files\Java
2009-03-24 16:42 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-09 04:19 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-03-04 17:51 --------- d-----w c:\program files\Avanquest update
2009-02-28 15:08 --------- d-----w c:\documents and settings\Administrator\Application Data\GameHouse
2009-02-26 19:54 --------- d-----w c:\documents and settings\All Users\Application Data\Fugazo
2009-02-24 18:52 --------- d-----w c:\documents and settings\All Users\Application Data\PopCap
2009-02-24 18:30 --------- d-----w c:\documents and settings\All Users\Application Data\JollyBear
2009-02-23 16:47 --------- d-----w c:\documents and settings\All Users\Application Data\Zylom
2009-02-23 16:47 --------- d-----w c:\documents and settings\All Users\Application Data\GameHouse
2009-02-23 16:30 --------- d-----w c:\documents and settings\All Users\Application Data\n7-89-o9-3r-4t-r9
2009-02-23 16:23 --------- d-----w c:\documents and settings\Administrator\Application Data\PlayFirst
2009-02-22 17:29 --------- d-----w c:\documents and settings\All Users\Application Data\Tarma Installer
2009-02-16 11:39 --------- d-----w c:\program files\ESET
.

------- Sigcheck -------

2009-04-06 22:22 182656 1df7f42665c94b825322fae71721130d c:\windows\system32\dllcache\ndis.sys
2009-04-06 22:22 182656 1df7f42665c94b825322fae71721130d c:\windows\system32\drivers\ndis.sys

2009-04-06 15:49 3195392 3be4584f9ac9b9094c634f9348a57fe2 c:\windows\Explorer.EXE
2007-06-13 12:23 3195392 3be4584f9ac9b9094c634f9348a57fe2 c:\windows\system32\dllcache\EXPLORER.EXE

2001-08-23 11:00 15360 32694ac77d5e914c1e41b770ad8c36b8 c:\windows\system32\CTFMON.EXE
2001-08-23 11:00 15360 32694ac77d5e914c1e41b770ad8c36b8 c:\windows\system32\dllcache\CTFMON.EXE

2005-06-11 02:17 57856 133a73d934146423b7a7da1720003e9f c:\windows\$hf_mig$\KB896423\SP2QFE\SPOOLSV.EXE
2001-08-23 11:00 75264 cce859e4ac703108ca655b2f1634310b c:\windows\$NtUninstallKB896423$\SPOOLSV.EXE
2005-06-11 01:53 75264 4fae26cdc82923a92c85f57fb7cfe177 c:\windows\system32\SPOOLSV.EXE
2005-06-11 01:53 57856 aaa6eaea2cdae6139e71ff603ebbe9dd c:\windows\system32\dllcache\SPOOLSV.EXE

2001-08-23 11:00 24576 a6469e376946ac97e397ad2543bf62f9 c:\windows\system32\USERINIT.EXE
2001-08-23 11:00 25088 24166e7ca7f86911e80972f881b8723d c:\windows\system32\dllcache\USERINIT.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-07-02 393216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-12 339968]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-06-26 185896]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"DAEMON Tools-1033"="c:\program files\D-Tools\daemon.exe" [2004-08-22 86016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 1443072]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
"vidc.CDVC"= cdvccodc.dll
"MSACM.pcdv"= pcdv.acm
"vidc.CDV5"= cdv5codc.dll
"vidc.CLLC"= cllccodc.dll
"vidc.CUVC"= cuvccodc.dll
"vidc.CDVH"= cdvhcodc.dll
"vidc.CMIC"= cmiccodc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\iexplore.exe]
"Debugger"=

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\InterVideo\\DVD7\\WinDVD.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"f:\\igrica2\\DC++\\DCPlusPlus.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Sony\\Vegas Pro 8.0\\VegSrv80.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=

R1 epfwtdir;epfwtdir; [x]
R2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2001-08-23 20992]
R3 k510bus;Sony Ericsson K510 Driver driver (WDM);c:\windows\system32\DRIVERS\k510bus.sys [2008-04-26 58288]
R3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;c:\windows\system32\DRIVERS\k510mdfl.sys [2008-04-26 8336]
R3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;c:\windows\system32\DRIVERS\k510mdm.sys [2008-04-26 94064]
R3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\k510mgmt.sys [2008-04-26 85408]
R3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\k510obex.sys [2008-04-26 83344]
R3 MSSQL$SONY_MEDIAMGR2;SQL Server (SONY_MEDIAMGR2); [x]
R3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\DRIVERS\s0016bus.sys [2008-05-16 89256]
R3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s0016mdfl.sys [2008-05-16 15016]
R3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s0016mdm.sys [2008-05-16 120744]
R3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s0016mgmt.sys [2008-05-16 114216]
R3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\DRIVERS\s0016nd5.sys [2008-05-16 25512]
R3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s0016obex.sys [2008-05-16 110632]
R3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\DRIVERS\s0016unic.sys [2008-05-16 115752]
S1 cdrblock;cdrblock;c:\windows\system32\DRIVERS\cdrblock.sys [2007-05-31 20864]
S1 cdrport;cdrport;c:\windows\system32\DRIVERS\cdrport.sys [2005-03-11 4608]
S2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-02-20 472320]


--- Other Services/Drivers In Memory ---

*Deregistered* - a2free
*Deregistered* - AFD
*Deregistered* - ALG
*Deregistered* - Ati HotKey Poller
*Deregistered* - ATI Smart
*Deregistered* - AudioSrv
*Deregistered* - audstub
*Deregistered* - Beep
*Deregistered* - Browser
*Deregistered* - Cdfs
*Deregistered* - cdrport
*Deregistered* - CryptSvc
*Deregistered* - d347bus
*Deregistered* - DcomLaunch
*Deregistered* - Dhcp
*Deregistered* - dmboot
*Deregistered* - dmio
*Deregistered* - dmload
*Deregistered* - dmserver
*Deregistered* - Dnscache
*Deregistered* - eamon
*Deregistered* - easdrv
*Deregistered* - EIO
*Deregistered* - ekrn
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - Fastfat
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - Fips
*Deregistered* - FltMgr
*Deregistered* - Ftdisk
*Deregistered* - Gpc
*Deregistered* - Hardlock
*Deregistered* - helpsvc
*Deregistered* - HTTP
*Deregistered* - ImapiService
*Deregistered* - IpNat
*Deregistered* - IPSec
*Deregistered* - JavaQuickStarterService
*Deregistered* - KSecDD
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LightScribeService
*Deregistered* - LmHosts
*Deregistered* - MDM
*Deregistered* - mnmdd
*Deregistered* - Mouclass
*Deregistered* - MountMgr
*Deregistered* - MRxDAV
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - Ndisuio
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Netman
*Deregistered* - Nla
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - PartMgr
*Deregistered* - ParVdm
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - PSched
*Deregistered* - RasAcd
*Deregistered* - Rasl2tp
*Deregistered* - RasMan
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - rdpdr
*Deregistered* - RemoteRegistry
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - SoundMAX Agent Service (default)
*Deregistered* - Spooler
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - Srv
*Deregistered* - SSDPSRV
*Deregistered* - swenum
*Deregistered* - TapiSrv
*Deregistered* - Tcpip
*Deregistered* - TermDD
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - tifsfilter
*Deregistered* - TrkWks
*Deregistered* - uagp35
*Deregistered* - Update
*Deregistered* - UserAccess7
*Deregistered* - VgaSave
*Deregistered* - VolSnap
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - wscsvc
*Deregistered* - WZCSVC
.
Contents of the 'Scheduled Tasks' folder

2009-04-03 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClick.exe []

2009-02-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]
.
- - - - ORPHANS REMOVED - - - -

BHO-{D5BF49A0-94F3-42BD-F434-3604812C8955} - c:\windows\system32\ds43g4nfjkn93.dll
HKLM-Run-WinampAgent - c:\program files\Winamp\winampa.exe
HKU-Default-Run-reader_s - c:\documents and settings\Administrator\reader_s.exe
HKU-Default-Run-services - c:\windows\services.exe
HKU-Default-Run-Windows Resurections - c:\windows\system32\%USERPROFILE%\Local Settings\Temp\fo5cxyj.exe
HKLM-Explorer_Run-services - c:\windows\services.exe
HKU-Default-Explorer_Run-services - c:\windows\services.exe
SharedTaskScheduler-{D5BF49A0-94F3-42BD-F434-3604812C8955} - c:\windows\system32\ds43g4nfjkn93.dll


.
------- Supplementary Scan -------
.
uStart Page = about:blank
uDefault_Search_URL =
uSearchURL,(Default) = hxxp://www.searchgateway.net/search-Google-Gateway.php?sa=Search+Here&client=pub-4642981363251965&forid=1&ie=ISO-8859-1&oe=ISO-8859-1&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A11&q=%s
IE: Crawler Search - tbr:iemenu
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\ctbr.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {6715D12F-213F-4C6E-ACE1-8A363F550B96} - hxxp://www.gamehouse.com/games/DoggieDash.cab
DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} - hxxp://www.gamehouse.com/games/gamehouse/ghplayer.cab
DPF: {74EF5274-F439-2168-B543-14745B625C72} - hxxp://www.gamehouse.com/games/WeddingDash2.cab
DPF: {935F9B04-0C7B-4454-A391-348C54AD7ADD} - hxxp://www.gamehouse.com/games/JBGamePlayer.cab
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://www.gamehouse.com/games/zylom/zylomplayer.cab
DPF: {D40F5876-A494-4124-8161-82625BB28C06} - hxxp://www.gamehouse.com/games/Chocolatier2.cab
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\krdyd8eg.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - component: c:\progra~1\Crawler\firefox\components\xcomm.dll
FF - component: c:\progra~1\Crawler\firefox\components\xshared.dll
FF - component: c:\progra~1\Crawler\firefox\components\xsupport.dll
FF - component: c:\progra~1\Crawler\firefox\components\xwsg.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-06 22:39:17
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwOpenFile

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1659004503-764733703-682003330-500\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:10,a8,30,d3,b8,33,00,8f,fc,ad,fd,0d,76,5a,ce,7c,4c,c5,d0,2d,c1,00,ab,
e2,32,1a,58,0b,6d,4b,57,a0,c0,af,28,a6,00,0c,5c,e7,9b,51,de,34,80,c4,5c,77,\
"??"=hex:07,49,a2,2d,fb,b0,e3,48,51,fa,5f,01,d8,8c,79,84
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(672)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-04-06 22:41:26
ComboFix-quarantined-files.txt 2009-04-06 20:41:03
ComboFix2.txt 2009-04-05 21:22:47

Pre-Run: 29,494,845,440 bytes free
Post-Run: 29,518,897,152 bytes free

317 --- E O F --- 2009-01-13 21:10:23

offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Otvoriti Notepad i iskopirati sledeci tekst:

File::
C:\ndis.bak
C:\ndis(1).bak
C:\ndis_fixer.exe
C:\catchme.exe
c:\windows\system32\gcc.exe
c:\windows\system32\55DD.tmp
c:\windows\system32\55DC.tmp
c:\windows\services.ex_
c:\windows\adobe.bat
c:\windows\_id.dat
c:\windows\system32\6.tmp
c:\windows\system32\3.tmp
c:\windows\system32\2.tmp


Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

offline
  • GTA  Male
  • Počasni građanin
  • Pridružio: 14 Avg 2008
  • Poruke: 717

ComboFix 09-04-04.01 - Administrator 2009-04-06 23:07:25.6 - NTFSx86
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\catchme.exe
C:\ndis(1).bak
C:\ndis.bak
C:\ndis_fixer.exe
c:\windows\_id.dat
c:\windows\adobe.bat
c:\windows\services.ex_
c:\windows\system32\2.tmp
c:\windows\system32\3.tmp
c:\windows\system32\55DC.tmp
c:\windows\system32\55DD.tmp
c:\windows\system32\6.tmp
c:\windows\system32\gcc.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\catchme.exe
C:\ndis(1).bak
C:\ndis.bak
C:\ndis_fixer.exe
c:\windows\_id.dat
c:\windows\adobe.bat
c:\windows\services.ex_
c:\windows\system32\2.tmp
c:\windows\system32\3.tmp
c:\windows\system32\55DC.tmp
c:\windows\system32\55DD.tmp
c:\windows\system32\6.tmp
c:\windows\system32\gcc.exe

.
((((((((((((((((((((((((( Files Created from 2009-03-06 to 2009-04-06 )))))))))))))))))))))))))))))))
.

2009-04-06 15:38 . 2009-04-06 15:48 <DIR> d-------- c:\program files\a-squared Free
2009-04-06 11:07 . 2001-08-23 11:00 221,184 --a------ c:\windows\system32\wmpns.dll
2009-04-05 20:21 . 2008-03-03 18:21 568 --ah----- c:\windows\nod32fixtemdono.reg
2009-03-24 14:22 . 2009-03-24 14:22 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Ipref
2009-03-23 10:48 . 2009-04-02 16:15 <DIR> d-------- c:\documents and settings\Administrator\Application Data\mIRC
2009-03-14 23:39 . 2009-04-02 19:01 <DIR> d-------- C:\Picture This
2009-03-14 23:39 . 2009-03-14 23:39 32,768 --ahs---- C:\Thumbs.db

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-06 20:41 --------- d-----w c:\program files\Crawler
2009-04-06 20:22 182,656 ----a-w c:\windows\system32\drivers\ndis.sys
2009-04-06 13:49 61,952 ----a-w c:\windows\system32\alg.exe
2009-04-06 13:49 3,195,392 ----a-w c:\windows\Explorer.EXE
2009-04-05 15:41 --------- d-----w c:\program files\Winamp
2009-04-04 16:50 --------- d-----w c:\program files\Webteh
2009-04-04 16:49 --------- d-----w c:\program files\TC PowerPack
2009-04-04 16:37 --------- d-----w c:\program files\Common Files\LightScribe
2009-04-04 16:26 --------- d-----w c:\program files\Merriam-Webster
2009-04-04 14:53 --------- d-----w c:\program files\D-Tools
2009-03-27 14:40 --------- d-----w c:\program files\Java
2009-03-24 16:42 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-09 04:19 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-03-04 17:51 --------- d-----w c:\program files\Avanquest update
2009-02-28 15:08 --------- d-----w c:\documents and settings\Administrator\Application Data\GameHouse
2009-02-26 19:54 --------- d-----w c:\documents and settings\All Users\Application Data\Fugazo
2009-02-24 18:52 --------- d-----w c:\documents and settings\All Users\Application Data\PopCap
2009-02-24 18:30 --------- d-----w c:\documents and settings\All Users\Application Data\JollyBear
2009-02-23 16:47 --------- d-----w c:\documents and settings\All Users\Application Data\Zylom
2009-02-23 16:47 --------- d-----w c:\documents and settings\All Users\Application Data\GameHouse
2009-02-23 16:30 --------- d-----w c:\documents and settings\All Users\Application Data\n7-89-o9-3r-4t-r9
2009-02-23 16:23 --------- d-----w c:\documents and settings\Administrator\Application Data\PlayFirst
2009-02-22 17:29 --------- d-----w c:\documents and settings\All Users\Application Data\Tarma Installer
2009-02-16 11:39 --------- d-----w c:\program files\ESET
.

------- Sigcheck -------

2009-04-06 22:22 182656 1df7f42665c94b825322fae71721130d c:\windows\system32\dllcache\ndis.sys
2009-04-06 22:22 182656 1df7f42665c94b825322fae71721130d c:\windows\system32\drivers\ndis.sys

2009-04-06 15:49 3195392 3be4584f9ac9b9094c634f9348a57fe2 c:\windows\Explorer.EXE
2007-06-13 12:23 3195392 3be4584f9ac9b9094c634f9348a57fe2 c:\windows\system32\dllcache\EXPLORER.EXE

2001-08-23 11:00 15360 32694ac77d5e914c1e41b770ad8c36b8 c:\windows\system32\CTFMON.EXE
2001-08-23 11:00 15360 32694ac77d5e914c1e41b770ad8c36b8 c:\windows\system32\dllcache\CTFMON.EXE

2005-06-11 02:17 57856 133a73d934146423b7a7da1720003e9f c:\windows\$hf_mig$\KB896423\SP2QFE\SPOOLSV.EXE
2001-08-23 11:00 75264 cce859e4ac703108ca655b2f1634310b c:\windows\$NtUninstallKB896423$\SPOOLSV.EXE
2005-06-11 01:53 75264 4fae26cdc82923a92c85f57fb7cfe177 c:\windows\system32\SPOOLSV.EXE
2005-06-11 01:53 57856 aaa6eaea2cdae6139e71ff603ebbe9dd c:\windows\system32\dllcache\SPOOLSV.EXE

2001-08-23 11:00 24576 a6469e376946ac97e397ad2543bf62f9 c:\windows\system32\USERINIT.EXE
2001-08-23 11:00 25088 24166e7ca7f86911e80972f881b8723d c:\windows\system32\dllcache\USERINIT.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-07-02 393216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-12 339968]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-06-26 185896]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"DAEMON Tools-1033"="c:\program files\D-Tools\daemon.exe" [2004-08-22 86016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 1443072]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
"vidc.CDVC"= cdvccodc.dll
"MSACM.pcdv"= pcdv.acm
"vidc.CDV5"= cdv5codc.dll
"vidc.CLLC"= cllccodc.dll
"vidc.CUVC"= cuvccodc.dll
"vidc.CDVH"= cdvhcodc.dll
"vidc.CMIC"= cmiccodc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\iexplore.exe]
"Debugger"=

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\InterVideo\\DVD7\\WinDVD.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"f:\\igrica2\\DC++\\DCPlusPlus.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Sony\\Vegas Pro 8.0\\VegSrv80.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=

R1 epfwtdir;epfwtdir; [x]
R2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2001-08-23 20992]
R3 k510bus;Sony Ericsson K510 Driver driver (WDM);c:\windows\system32\DRIVERS\k510bus.sys [2008-04-26 58288]
R3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;c:\windows\system32\DRIVERS\k510mdfl.sys [2008-04-26 8336]
R3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;c:\windows\system32\DRIVERS\k510mdm.sys [2008-04-26 94064]
R3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\k510mgmt.sys [2008-04-26 85408]
R3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\k510obex.sys [2008-04-26 83344]
R3 MSSQL$SONY_MEDIAMGR2;SQL Server (SONY_MEDIAMGR2); [x]
R3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\DRIVERS\s0016bus.sys [2008-05-16 89256]
R3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s0016mdfl.sys [2008-05-16 15016]
R3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s0016mdm.sys [2008-05-16 120744]
R3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s0016mgmt.sys [2008-05-16 114216]
R3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\DRIVERS\s0016nd5.sys [2008-05-16 25512]
R3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s0016obex.sys [2008-05-16 110632]
R3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\DRIVERS\s0016unic.sys [2008-05-16 115752]
S1 cdrblock;cdrblock;c:\windows\system32\DRIVERS\cdrblock.sys [2007-05-31 20864]
S1 cdrport;cdrport;c:\windows\system32\DRIVERS\cdrport.sys [2005-03-11 4608]
S2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-02-20 472320]


--- Other Services/Drivers In Memory ---

*Deregistered* - a2free
*Deregistered* - AFD
*Deregistered* - ALG
*Deregistered* - Ati HotKey Poller
*Deregistered* - ATI Smart
*Deregistered* - AudioSrv
*Deregistered* - audstub
*Deregistered* - Beep
*Deregistered* - Browser
*Deregistered* - Cdfs
*Deregistered* - cdrport
*Deregistered* - CryptSvc
*Deregistered* - d347bus
*Deregistered* - DcomLaunch
*Deregistered* - Dhcp
*Deregistered* - dmboot
*Deregistered* - dmio
*Deregistered* - dmload
*Deregistered* - dmserver
*Deregistered* - Dnscache
*Deregistered* - eamon
*Deregistered* - easdrv
*Deregistered* - EIO
*Deregistered* - ekrn
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - Fastfat
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - Fips
*Deregistered* - FltMgr
*Deregistered* - Ftdisk
*Deregistered* - Gpc
*Deregistered* - Hardlock
*Deregistered* - helpsvc
*Deregistered* - HTTP
*Deregistered* - ImapiService
*Deregistered* - IpNat
*Deregistered* - IPSec
*Deregistered* - JavaQuickStarterService
*Deregistered* - KSecDD
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LightScribeService
*Deregistered* - LmHosts
*Deregistered* - MDM
*Deregistered* - mnmdd
*Deregistered* - Mouclass
*Deregistered* - MountMgr
*Deregistered* - MRxDAV
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - Ndisuio
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Netman
*Deregistered* - Nla
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - PartMgr
*Deregistered* - ParVdm
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - PSched
*Deregistered* - RasAcd
*Deregistered* - Rasl2tp
*Deregistered* - RasMan
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - rdpdr
*Deregistered* - RemoteRegistry
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - SoundMAX Agent Service (default)
*Deregistered* - Spooler
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - Srv
*Deregistered* - SSDPSRV
*Deregistered* - swenum
*Deregistered* - TapiSrv
*Deregistered* - Tcpip
*Deregistered* - TermDD
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - tifsfilter
*Deregistered* - TrkWks
*Deregistered* - uagp35
*Deregistered* - Update
*Deregistered* - UserAccess7
*Deregistered* - VgaSave
*Deregistered* - VolSnap
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - wscsvc
*Deregistered* - WZCSVC
.
Contents of the 'Scheduled Tasks' folder

2009-04-03 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClick.exe []

2009-02-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uDefault_Search_URL =
uSearchURL,(Default) = hxxp://www.searchgateway.net/search-Google-Gateway.php?sa=Search+Here&client=pub-4642981363251965&forid=1&ie=ISO-8859-1&oe=ISO-8859-1&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A11&q=%s
IE: Crawler Search - tbr:iemenu
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\ctbr.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {6715D12F-213F-4C6E-ACE1-8A363F550B96} - hxxp://www.gamehouse.com/games/DoggieDash.cab
DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} - hxxp://www.gamehouse.com/games/gamehouse/ghplayer.cab
DPF: {74EF5274-F439-2168-B543-14745B625C72} - hxxp://www.gamehouse.com/games/WeddingDash2.cab
DPF: {935F9B04-0C7B-4454-A391-348C54AD7ADD} - hxxp://www.gamehouse.com/games/JBGamePlayer.cab
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://www.gamehouse.com/games/zylom/zylomplayer.cab
DPF: {D40F5876-A494-4124-8161-82625BB28C06} - hxxp://www.gamehouse.com/games/Chocolatier2.cab
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\krdyd8eg.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - component: c:\progra~1\Crawler\firefox\components\xcomm.dll
FF - component: c:\progra~1\Crawler\firefox\components\xshared.dll
FF - component: c:\progra~1\Crawler\firefox\components\xsupport.dll
FF - component: c:\progra~1\Crawler\firefox\components\xwsg.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-06 23:08:41
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwOpenFile

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1659004503-764733703-682003330-500\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:10,a8,30,d3,b8,33,00,8f,fc,ad,fd,0d,76,5a,ce,7c,4c,c5,d0,2d,c1,00,ab,
e2,32,1a,58,0b,6d,4b,57,a0,c0,af,28,a6,00,0c,5c,e7,9b,51,de,34,80,c4,5c,77,\
"??"=hex:07,49,a2,2d,fb,b0,e3,48,51,fa,5f,01,d8,8c,79,84
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(672)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-04-06 23:10:50
ComboFix-quarantined-files.txt 2009-04-06 21:10:19
ComboFix2.txt 2009-04-06 20:41:28
ComboFix3.txt 2009-04-05 21:22:47

Pre-Run: 29,523,111,936 bytes free
Post-Run: 29,513,674,752 bytes free

317 --- E O F --- 2009-01-13 21:10:23

offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Pusti sada ponovo NOD da skenira, i postavi mi log.
Zelim da vidim da li smo se otarasili i one druge infekcije koja je bila prisutna (Virut).

Dopuna: 06 Apr 2009 23:19

Koja stativa. Zaboravio sam da ti kazem da restartujes.

Hajde molim te restartuj jednom komp, pa onda ponovo pusti ComboFix i postavi mi log.
Nije bitno da li ces to uraditi pre ili posle skeniranja NOD-om.

offline
  • GTA  Male
  • Počasni građanin
  • Pridružio: 14 Avg 2008
  • Poruke: 717

ComboFix 09-04-04.01 - Administrator 2009-04-06 23:26:48.7 - NTFSx86
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2009-03-06 to 2009-04-06 )))))))))))))))))))))))))))))))
.

2009-04-06 15:38 . 2009-04-06 15:48 <DIR> d-------- c:\program files\a-squared Free
2009-04-06 11:07 . 2001-08-23 11:00 221,184 --a------ c:\windows\system32\wmpns.dll
2009-04-05 20:21 . 2008-03-03 18:21 568 --ah----- c:\windows\nod32fixtemdono.reg
2009-03-24 14:22 . 2009-03-24 14:22 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Ipref
2009-03-23 10:48 . 2009-04-02 16:15 <DIR> d-------- c:\documents and settings\Administrator\Application Data\mIRC
2009-03-14 23:39 . 2009-04-02 19:01 <DIR> d-------- C:\Picture This
2009-03-14 23:39 . 2009-03-14 23:39 32,768 --ahs---- C:\Thumbs.db

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-06 21:11 --------- d-----w c:\program files\Crawler
2009-04-06 20:22 182,656 ----a-w c:\windows\system32\drivers\ndis.sys
2009-04-06 13:49 61,952 ----a-w c:\windows\system32\alg.exe
2009-04-06 13:49 3,195,392 ----a-w c:\windows\Explorer.EXE
2009-04-05 15:41 --------- d-----w c:\program files\Winamp
2009-04-04 16:50 --------- d-----w c:\program files\Webteh
2009-04-04 16:49 --------- d-----w c:\program files\TC PowerPack
2009-04-04 16:37 --------- d-----w c:\program files\Common Files\LightScribe
2009-04-04 16:26 --------- d-----w c:\program files\Merriam-Webster
2009-04-04 14:53 --------- d-----w c:\program files\D-Tools
2009-03-27 14:40 --------- d-----w c:\program files\Java
2009-03-24 16:42 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-09 04:19 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-03-04 17:51 --------- d-----w c:\program files\Avanquest update
2009-02-28 15:08 --------- d-----w c:\documents and settings\Administrator\Application Data\GameHouse
2009-02-26 19:54 --------- d-----w c:\documents and settings\All Users\Application Data\Fugazo
2009-02-24 18:52 --------- d-----w c:\documents and settings\All Users\Application Data\PopCap
2009-02-24 18:30 --------- d-----w c:\documents and settings\All Users\Application Data\JollyBear
2009-02-23 16:47 --------- d-----w c:\documents and settings\All Users\Application Data\Zylom
2009-02-23 16:47 --------- d-----w c:\documents and settings\All Users\Application Data\GameHouse
2009-02-23 16:30 --------- d-----w c:\documents and settings\All Users\Application Data\n7-89-o9-3r-4t-r9
2009-02-23 16:23 --------- d-----w c:\documents and settings\Administrator\Application Data\PlayFirst
2009-02-22 17:29 --------- d-----w c:\documents and settings\All Users\Application Data\Tarma Installer
2009-02-16 11:39 --------- d-----w c:\program files\ESET
.

------- Sigcheck -------

2009-04-06 22:22 182656 1df7f42665c94b825322fae71721130d c:\windows\system32\dllcache\ndis.sys
2009-04-06 22:22 182656 1df7f42665c94b825322fae71721130d c:\windows\system32\drivers\ndis.sys

2009-04-06 15:49 3195392 3be4584f9ac9b9094c634f9348a57fe2 c:\windows\Explorer.EXE
2007-06-13 12:23 3195392 3be4584f9ac9b9094c634f9348a57fe2 c:\windows\system32\dllcache\EXPLORER.EXE

2001-08-23 11:00 15360 32694ac77d5e914c1e41b770ad8c36b8 c:\windows\system32\CTFMON.EXE
2001-08-23 11:00 15360 32694ac77d5e914c1e41b770ad8c36b8 c:\windows\system32\dllcache\CTFMON.EXE

2005-06-11 02:17 57856 133a73d934146423b7a7da1720003e9f c:\windows\$hf_mig$\KB896423\SP2QFE\SPOOLSV.EXE
2001-08-23 11:00 75264 cce859e4ac703108ca655b2f1634310b c:\windows\$NtUninstallKB896423$\SPOOLSV.EXE
2005-06-11 01:53 75264 4fae26cdc82923a92c85f57fb7cfe177 c:\windows\system32\SPOOLSV.EXE
2005-06-11 01:53 57856 aaa6eaea2cdae6139e71ff603ebbe9dd c:\windows\system32\dllcache\SPOOLSV.EXE

2001-08-23 11:00 24576 a6469e376946ac97e397ad2543bf62f9 c:\windows\system32\USERINIT.EXE
2001-08-23 11:00 25088 24166e7ca7f86911e80972f881b8723d c:\windows\system32\dllcache\USERINIT.EXE
.
((((((((((((((((((((((((((((( SnapShot@2009-04-06_22.39.51.35 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-04-06 20:32:46 16,384 --sha-w c:\windows\system32\%USERPROFILE%\Local Settings\Temp\Cookies\index.dat
+ 2009-04-06 21:25:03 16,384 --sha-w c:\windows\system32\%USERPROFILE%\Local Settings\Temp\Cookies\index.dat
- 2009-04-06 20:32:46 16,384 --sha-w c:\windows\system32\%USERPROFILE%\Local Settings\Temp\History\History.IE5\index.dat
+ 2009-04-06 21:25:03 16,384 --sha-w c:\windows\system32\%USERPROFILE%\Local Settings\Temp\History\History.IE5\index.dat
- 2009-04-06 20:32:46 32,768 --sha-w c:\windows\system32\%USERPROFILE%\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat
+ 2009-04-06 21:25:03 32,768 --sha-w c:\windows\system32\%USERPROFILE%\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat
+ 2009-04-06 21:24:42 16,384 ----atw c:\windows\system32\config\systemprofile\Local Settings\Temp\Perflib_Perfdata_794.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-07-02 393216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-12 339968]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-06-26 185896]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"DAEMON Tools-1033"="c:\program files\D-Tools\daemon.exe" [2004-08-22 86016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 1443072]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
"vidc.CDVC"= cdvccodc.dll
"MSACM.pcdv"= pcdv.acm
"vidc.CDV5"= cdv5codc.dll
"vidc.CLLC"= cllccodc.dll
"vidc.CUVC"= cuvccodc.dll
"vidc.CDVH"= cdvhcodc.dll
"vidc.CMIC"= cmiccodc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\iexplore.exe]
"Debugger"=

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\InterVideo\\DVD7\\WinDVD.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"f:\\igrica2\\DC++\\DCPlusPlus.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Sony\\Vegas Pro 8.0\\VegSrv80.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=

R1 epfwtdir;epfwtdir; [x]
R2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2001-08-23 20992]
R3 k510bus;Sony Ericsson K510 Driver driver (WDM);c:\windows\system32\DRIVERS\k510bus.sys [2008-04-26 58288]
R3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;c:\windows\system32\DRIVERS\k510mdfl.sys [2008-04-26 8336]
R3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;c:\windows\system32\DRIVERS\k510mdm.sys [2008-04-26 94064]
R3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\k510mgmt.sys [2008-04-26 85408]
R3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\k510obex.sys [2008-04-26 83344]
R3 MSSQL$SONY_MEDIAMGR2;SQL Server (SONY_MEDIAMGR2); [x]
R3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\DRIVERS\s0016bus.sys [2008-05-16 89256]
R3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s0016mdfl.sys [2008-05-16 15016]
R3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s0016mdm.sys [2008-05-16 120744]
R3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s0016mgmt.sys [2008-05-16 114216]
R3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\DRIVERS\s0016nd5.sys [2008-05-16 25512]
R3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s0016obex.sys [2008-05-16 110632]
R3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\DRIVERS\s0016unic.sys [2008-05-16 115752]
S1 cdrblock;cdrblock;c:\windows\system32\DRIVERS\cdrblock.sys [2007-05-31 20864]
S1 cdrport;cdrport;c:\windows\system32\DRIVERS\cdrport.sys [2005-03-11 4608]
S2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-02-20 472320]


--- Other Services/Drivers In Memory ---

*Deregistered* - a2free
*Deregistered* - AFD
*Deregistered* - ALG
*Deregistered* - Ati HotKey Poller
*Deregistered* - ATI Smart
*Deregistered* - AudioSrv
*Deregistered* - audstub
*Deregistered* - Beep
*Deregistered* - Browser
*Deregistered* - Cdfs
*Deregistered* - cdrport
*Deregistered* - CryptSvc
*Deregistered* - d347bus
*Deregistered* - DcomLaunch
*Deregistered* - Dhcp
*Deregistered* - dmboot
*Deregistered* - dmio
*Deregistered* - dmload
*Deregistered* - dmserver
*Deregistered* - Dnscache
*Deregistered* - eamon
*Deregistered* - easdrv
*Deregistered* - EIO
*Deregistered* - ekrn
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - Fastfat
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - Fips
*Deregistered* - FltMgr
*Deregistered* - Ftdisk
*Deregistered* - Gpc
*Deregistered* - Hardlock
*Deregistered* - helpsvc
*Deregistered* - HTTP
*Deregistered* - ImapiService
*Deregistered* - IpNat
*Deregistered* - IPSec
*Deregistered* - JavaQuickStarterService
*Deregistered* - KSecDD
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LightScribeService
*Deregistered* - LmHosts
*Deregistered* - MDM
*Deregistered* - mnmdd
*Deregistered* - Mouclass
*Deregistered* - MountMgr
*Deregistered* - MRxDAV
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - Ndisuio
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Netman
*Deregistered* - Nla
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - PartMgr
*Deregistered* - ParVdm
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - PSched
*Deregistered* - RasAcd
*Deregistered* - Rasl2tp
*Deregistered* - RasMan
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - rdpdr
*Deregistered* - RemoteRegistry
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - SoundMAX Agent Service (default)
*Deregistered* - Spooler
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - Srv
*Deregistered* - SSDPSRV
*Deregistered* - swenum
*Deregistered* - TapiSrv
*Deregistered* - Tcpip
*Deregistered* - TermDD
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - tifsfilter
*Deregistered* - TrkWks
*Deregistered* - uagp35
*Deregistered* - Update
*Deregistered* - UserAccess7
*Deregistered* - VgaSave
*Deregistered* - VolSnap
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - wscsvc
*Deregistered* - WZCSVC
.
Contents of the 'Scheduled Tasks' folder

2009-04-03 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClick.exe []

2009-02-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uDefault_Search_URL =
uSearchURL,(Default) = hxxp://www.searchgateway.net/search-Google-Gateway.php?sa=Search+Here&client=pub-4642981363251965&forid=1&ie=ISO-8859-1&oe=ISO-8859-1&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A11&q=%s
IE: Crawler Search - tbr:iemenu
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\ctbr.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {6715D12F-213F-4C6E-ACE1-8A363F550B96} - hxxp://www.gamehouse.com/games/DoggieDash.cab
DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} - hxxp://www.gamehouse.com/games/gamehouse/ghplayer.cab
DPF: {74EF5274-F439-2168-B543-14745B625C72} - hxxp://www.gamehouse.com/games/WeddingDash2.cab
DPF: {935F9B04-0C7B-4454-A391-348C54AD7ADD} - hxxp://www.gamehouse.com/games/JBGamePlayer.cab
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://www.gamehouse.com/games/zylom/zylomplayer.cab
DPF: {D40F5876-A494-4124-8161-82625BB28C06} - hxxp://www.gamehouse.com/games/Chocolatier2.cab
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\krdyd8eg.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - component: c:\progra~1\Crawler\firefox\components\xcomm.dll
FF - component: c:\progra~1\Crawler\firefox\components\xshared.dll
FF - component: c:\progra~1\Crawler\firefox\components\xsupport.dll
FF - component: c:\progra~1\Crawler\firefox\components\xwsg.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-06 23:29:09
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwOpenFile

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1659004503-764733703-682003330-500\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:10,a8,30,d3,b8,33,00,8f,fc,ad,fd,0d,76,5a,ce,7c,4c,c5,d0,2d,c1,00,ab,
e2,32,1a,58,0b,6d,4b,57,a0,c0,af,28,a6,00,0c,5c,e7,9b,51,de,34,80,c4,5c,77,\
"??"=hex:07,49,a2,2d,fb,b0,e3,48,51,fa,5f,01,d8,8c,79,84
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(668-)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-04-06 23:31:39
ComboFix-quarantined-files.txt 2009-04-06 21:31:18
ComboFix2.txt 2009-04-06 21:10:52
ComboFix3.txt 2009-04-06 20:41:28
ComboFix4.txt 2009-04-05 21:22:47

Pre-Run: 29,520,777,216 bytes free
Post-Run: 29,512,638,464 bytes free

297 --- E O F --- 2009-01-13 21:10:23

Dopuna: 06 Apr 2009 23:34

a toku veceri ide log od noda ili sutra

Dopuna: 06 Apr 2009 23:57

Evo delimicnog loga (prekinuo sam 50%)
Scan Log
Version of virus signature database: 3990 (20090406)
Date: 06/04/2009 Time: 11:33:26 PM
Scanned disks, folders and files: C:\;F:\
C:\AUTOEXEC.BAT » MIME - is OK (internal scanning not performed)
C:\pagefile.sys - error opening [4]
C:\Documents and Settings\Administrator\NTUSER.DAT - error opening [4]
C:\Documents and Settings\Administrator\ntuser.dat.LOG - error opening [4]
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\krdyd8eg.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}\chrome.manifest » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Administrator\Local Settings\Application Data\Identities\{012CA8E8-D2EE-4A5F-8A24-6E65E8D6C935}\Microsoft\Outlook Express\Inbox.dbx » DBX - is OK (internal scanning not performed)
C:\Documents and Settings\Administrator\Local Settings\Application Data\Identities\{012CA8E8-D2EE-4A5F-8A24-6E65E8D6C935}\Microsoft\Outlook Express\Sent Items.dbx » DBX - is OK (internal scanning not performed)
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\CardSpace\CardSpace.db - error opening [4]
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\CardSpace\CardSpace.db.shadow - error opening [4]
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - error opening [4]
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - error opening [4]
C:\Documents and Settings\Administrator\My Documents\Odštampaj stranicu - Sta su to Torenti.mht » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Administrator\My Documents\Italija\Polovni automobil Fiat punto cena 650 ( po dogovoru ) 327530- auto oglasi - MojAuto - polovni automobili.mht » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Administrator\My Documents\My Videos\RealPlayer Downloads\preferans.mht » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Administrator\My Documents\sppski\Kaleidoskop - Marina Cvetaeva.mht » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Administrator\My Documents\sppski\Zak Prever.mht » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\LocalService\NTUSER.DAT - error opening [4]
C:\Documents and Settings\LocalService\ntuser.dat.LOG - error opening [4]
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - error opening [4]
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - error opening [4]
C:\Documents and Settings\NetworkService\NTUSER.DAT - error opening [4]
C:\Documents and Settings\NetworkService\ntuser.dat.LOG - error opening [4]
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - error opening [4]
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - error opening [4]
C:\Program Files\AGEIA Technologies\AGEIA_PhysX_Help.mht » MIME - is OK (internal scanning not performed)
C:\Program Files\Ahead\Nero\CDI\CDI_VCD.CFG » MIME - is OK (internal scanning not performed)
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe - Win32/Virut.NBM virus - error while cleaning
C:\Program Files\Common Files\LightScribe\LSSrvc.exe - Win32/Virut.NBM virus - error while cleaning
C:\Program Files\Common Files\LightScribe\Content\Getting Started.mht » MIME - is OK (internal scanning not performed)
C:\Program Files\Crawler\firefox\chrome.manifest » MIME - is OK (internal scanning not performed)
C:\Program Files\Java\jre6\lib\resources.jar » ZIP » com/sun/org/apache/xerces/internal/impl/msg/XIncludeMessages.properties » MIME - is OK (internal scanning not performed)
C:\Program Files\Java\jre6\lib\resources.jar » ZIP » com/sun/xml/internal/fastinfoset/resources/ResourceBundle.properties » MIME - is OK (internal scanning not performed)
C:\Program Files\Java\jre6\lib\resources.jar » ZIP » javax/xml/bind/Messages.properties » MIME - is OK (internal scanning not performed)
C:\Program Files\Java\jre6\lib\deploy\ffjcext.zip » ZIP » {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}/chrome.manifest » MIME - is OK (internal scanning not performed)
C:\Program Files\Java\jre6\lib\deploy\jqs\ff\chrome.manifest » MIME - is OK (internal scanning not performed)
C:\Program Files\Microsoft Office\OFFICE11\1033\VIDEO.MHT » MIME - is OK (internal scanning not performed)
C:\Program Files\Mozilla Firefox\chrome\browser.manifest » MIME - is OK (internal scanning not performed)
C:\Program Files\Mozilla Firefox\chrome\comm.manifest » MIME - is OK (internal scanning not performed)
C:\Program Files\Mozilla Firefox\chrome\pippki.manifest » MIME - is OK (internal scanning not performed)
C:\Program Files\Mozilla Firefox\chrome\reporter.manifest » MIME - is OK (internal scanning not performed)
C:\Program Files\Mozilla Firefox\chrome\toolkit.manifest » MIME - is OK (internal scanning not performed)
C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome.manifest » MIME - is OK (internal scanning not performed)
C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome.manifest » MIME - is OK (internal scanning not performed)
C:\Program Files\Nero\Nero Burning ROM\CDI\CDI_VCD.CFG » MIME - is OK (internal scanning not performed)
C:\Program Files\Real\RealPlayer\browserrecord\chrome.manifest » MIME - is OK (internal scanning not performed)
C:\Program Files\Sony\Vegas Pro 8.0\Sony Vegas Pro 8 -- ShuttlePRO v2.mht » MIME - is OK (internal scanning not performed)
C:\Program Files\Sony\Vegas Pro 8.0\Sony Vegas Pro 8 -- ShuttlePRO.mht » MIME - is OK (internal scanning not performed)
C:\Program Files\Sony\Vegas Pro 8.0\Sony Vegas Pro 8 -- ShuttleXpress.mht » MIME - is OK (internal scanning not performed)
C:\Program Files\Sony Setup\Sound Forge 7.0\main.cab » CAB » shuttlepromht » MIME - is OK (internal scanning not performed)
C:\Program Files\Sony Setup\Sound Forge 7.0\main.cab » CAB » shuttlepro2mht » MIME - is OK (internal scanning not performed)
C:\Program Files\Sony Setup\Sound Forge 7.0\main.cab » CAB » shuttlexpmht » MIME - is OK (internal scanning not performed)
C:\Program Files\Sony Setup\Vegas Pro 8.0\main.cab » CAB » Sony_Vegas_Pro_8_ShuttlePRO_v2.mht » MIME - is OK (internal scanning not performed)
C:\Program Files\Sony Setup\Vegas Pro 8.0\main.cab » CAB » Sony_Vegas_Pro_8_ShuttlePRO.mht » MIME - is OK (internal scanning not performed)
C:\Program Files\Sony Setup\Vegas Pro 8.0\main.cab » CAB » Sony_Vegas_Pro_8_ShuttleXpress.mht » MIME - is OK (internal scanning not performed)
Scan terminated by user!
Number of scanned objects: 163419
Number of threats found: 2
Number of cleaned objects: 0
Time of completion: 11:54:59 PM Total scanning time: 1293 sec (00:21:33)

Notes:
[4] Object cannot be opened. It may be in use by another application or operating system.
ponovo ima ono viruta

Ko je trenutno na forumu
 

Ukupno su 485 korisnika na forumu :: 9 registrovanih, 0 sakrivenih i 476 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: _Sale, hyla, ivan979, ladro, Mixelotti, pacika, Raptor1, stegonosa, V.P.