Neki dialeri i čuda

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Ah, ja to nisam dobro razumeo! Nisam znao da se gašenjem AMON-a gasi NOD. Ja ugasio AMON, skenirao komp NOD-om, uključio ga, onda sam skinuo ComboFix i skenirao... A NOD "ugasio" na Quit! Šta ćeš, kad sam neuk...

Evo log fajla nakon gašenja NOD-a (valjda je ovaj put ok):

ComboFix 09-01-19.05 - Ivan Pear 2009-01-20 23:20:56.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2047.1396 [GMT 1:00]
Running from: c:\documents and settings\Ivan Pear\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Ivan Pear\Desktop\CFScript.txt
AV: Eset NOD32 antivirus system 2.51 *On-access scanning disabled* (Updated)
FW: Outpost Firewall Pro *enabled*
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:\recycler\S-1-5-21-3117105925-7748888398-658117204-9010\winservices.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_VFILT


((((((((((((((((((((((((( Files Created from 2008-12-20 to 2009-01-20 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-20 22:26 --------- d-----w c:\documents and settings\Ivan Pear\Application Data\Skype
2009-01-20 17:23 --------- d-----w c:\documents and settings\Ivan Pear\Application Data\skypePM
2009-01-20 01:49 --------- d-----w c:\program files\CCleaner
2009-01-20 01:49 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-12-17 19:27 --------- d-----w c:\program files\QuickTime
2008-12-17 19:26 --------- d-----w c:\program files\Common Files\Apple
2008-12-17 19:26 --------- d-----w c:\program files\Apple Software Update
2008-12-17 19:26 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2008-12-17 19:26 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2008-12-17 19:12 --------- d-----w c:\documents and settings\Ivan Pear\Application Data\Apple Computer
2008-12-16 21:14 --------- d-----w c:\program files\Opera
2008-12-12 23:33 --------- d-----w c:\program files\MessengerDiscovery
2008-12-11 03:02 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2008-12-10 01:55 --------- d-----w c:\program files\Common Files\Skype
2008-12-04 16:29 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-11-27 13:59 --------- d-----w c:\program files\K-Lite Codec Pack
2008-11-25 03:08 --------- d-----w c:\documents and settings\Ivan Pear\Application Data\uTorrent
2008-11-11 22:00 410,976 ----a-w c:\windows\system32\deploytk.dll
2008-11-02 14:02 7,680 ----a-w c:\windows\system32\ff_vfw.dll
2008-10-28 22:35 684,032 ----a-w c:\windows\system32\divx.dll
2008-10-23 16:18 306,432 ----a-w c:\windows\system32\TuneUpDefragService.exe
2007-11-30 15:36 22,328 ----a-w c:\documents and settings\Ivan Pear\Application Data\PnkBstrK.sys
2006-06-23 22:48 32,768 ----a-r c:\windows\inf\UpdateUSB.exe
.

((((((((((((((((((((((((((((( snapshot@2009-01-20_18.37.12.89 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-01-20 17:35:06 215,106 ----a-w c:\windows\system32\inetsrv\MetaBase.bin
+ 2009-01-20 22:24:29 215,096 ----a-w c:\windows\system32\inetsrv\MetaBase.bin
+ 2009-01-20 22:24:25 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_4bc.dat
+ 2009-01-20 22:24:25 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_4f4.dat
+ 2009-01-20 22:25:59 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_c0c.dat
- 2009-01-20 17:35:03 1,500 ----a-w c:\windows\UI\BIOSCTL.DAT
+ 2009-01-20 22:24:26 1,500 ----a-w c:\windows\UI\BIOSCTL.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320]
"Messenger (Yahoo!)"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2008-11-05 4347120]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gainward"="c:\windows\TBPanel.exe" [2007-06-26 2173480]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-07-23 8466432]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-07-23 81920]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-04 1603152]
"BigDogPath323VMSnap"="c:\windows\VMSnap23.exe" [2006-09-19 212992]
"BigDogPath323Domino"="c:\windows\Domino.exe" [2006-06-28 49152]
"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2008-01-24 917504]
"Outpost Firewall"="c:\program files\Agnitum\Outpost Firewall\outpost.exe" [2006-10-20 94720]
"OutpostFeedBack"="c:\program files\Agnitum\Outpost Firewall\feedback.exe" [2006-10-30 335872]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 623992]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 570664]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-11 136600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"nwiz"="nwiz.exe" [2007-07-23 c:\windows\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2007-03-21 c:\windows\RTHDCPL.exe]
"CertificateRegistration"="SafeSignCertReg.exe" [2004-02-17 c:\windows\system32\SafeSignCertReg.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

c:\documents and settings\Ivan Pear\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"DAEMON Tools Pro Agent"="c:\program files\DAEMON Tools Pro\DTProAgent.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"CanonSolutionMenu"=c:\program files\Canon\SolutionMenu\CNSLMAIN.exe /logon
"DiskeeperSystray"="c:\program files\Executive Software\Diskeeper\DkIcon.exe"
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe"
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe"
"PWRISOVM.EXE"=c:\program files\PowerISO\PWRISOVM.EXE

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ6\\ICQ.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 SandBox;Outpost Firewall Sandbox Driver;c:\program files\Agnitum\Outpost Firewall\Kernel\SandBox.sys [2008-01-24 256296]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\atl01_xp.sys [2007-11-07 38656]
R3 TodosAgmII;Driver for Todos Argosmini II USB;c:\windows\system32\drivers\AgmIIusb.sys [2008-03-19 22016]
R3 usnjsvc;Messenger Sharing Folders USN Journal Reader service;c:\program files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
R3 vmfilter323;323 filter service, Normal;c:\windows\system32\drivers\vmfilter323.sys [2007-11-07 476672]
R3 ZSMC326;VIMICRO USB2.0 PC Camera(VC0323);c:\windows\system32\drivers\usbvm323.sys [2007-11-07 260096]
S3 ADBLOCK.DLL;Outpost Firewall PlugIn (ADBLOCK.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\adblock.dll [2008-01-24 33568]
S3 ARP.DLL;Outpost Firewall PlugIn (ARP.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\arp.dll [2008-01-24 17408]
S3 CONTENT.DLL;Outpost Firewall PlugIn (CONTENT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\content.dll [2008-01-24 4896]
S3 DNSCACHE.DLL;Outpost Firewall PlugIn (DNSCACHE.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\dnscache.dll [2008-01-24 14464]
S3 FTPFILT.DLL;Outpost Firewall PlugIn (FTPFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\ftpfilt.dll [2008-01-24 9248]
S3 HTMLFILT.DLL;Outpost Firewall PlugIn (HTMLFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\htmlfilt.dll [2008-01-24 11552]
S3 HTTPFILT.DLL;Outpost Firewall PlugIn (HTTPFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\httpfilt.dll [2008-01-24 13216]
S3 IMAPFILT.DLL;Outpost Firewall PlugIn (IMAPFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\imapfilt.dll [2008-01-24 7168]
S3 MAILFILT.DLL;Outpost Firewall PlugIn (MAILFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\mailfilt.dll [2008-01-24 14880]
S3 NNTPFILT.DLL;Outpost Firewall PlugIn (NNTPFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\nntpfilt.dll [2008-01-24 6752]
S3 POP3FILT.DLL;Outpost Firewall PlugIn (POP3FILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\pop3filt.dll [2008-01-24 10048]
S3 PROTECT.DLL;Outpost Firewall PlugIn (PROTECT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\protect.dll [2008-01-24 15200]
S3 SECRET.DLL;Outpost Firewall PlugIn (SECRET.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\secret.dll [2008-01-24 12928]
S3 UsbCmxp;Scientific Atlanta WebSTAR 2000 series Cable Modem;c:\windows\system32\drivers\sacmxp2.sys [2007-11-07 14336]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2009-01-09 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClick.exe [2007-12-21 14:17]

2009-01-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.medfax.org/
IE: + &Download Express: download this file - c:\program files\Download Express\Add_Url.htm
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: imon.dll
Name-Space Handler: ftp\HIEClickCatcher - {E131C96E-4DDB-11D4-84B8-008048B33DEA} - c:\progra~1\DOWNLO~1\mdpph.dll
Name-Space Handler: http\HIEClickCatcher - {E131C96E-4DDB-11D4-84B8-008048B33DEA} - c:\progra~1\DOWNLO~1\mdpph.dll
Name-Space Handler: https\HIEClickCatcher - {E131C96E-4DDB-11D4-84B8-008048B33DEA} - c:\progra~1\DOWNLO~1\mdpph.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-20 23:26:02
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1614895754-688789844-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:c8,69,20,b1,14,a8,81,6b,59,b4,a5,17,b8,ef,b7,42,7d,82,fa,ac,9b,1b,cf,
7b,d6,f6,f5,60,bd,e4,40,7f,da,d1,ca,71,02,b9,0b,cb,06,30,0b,26,4a,47,14,06,\
"??"=hex:c9,32,d9,29,9c,8e,85,25,e8,29,7b,36,24,6d,08,bf
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(884)
c:\windows\system32\imon.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\scardsvr.exe
c:\program files\Executive Software\Diskeeper\DkService.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\system32\rundll32.exe
c:\program files\ESET\nod32krn.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Yahoo!\Messenger\YahooMessenger.exe
c:\program files\MessengerDiscovery\MessengerDiscovery Live.exe
c:\windows\system32\IoctlSvc.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
.
**************************************************************************
.
Completion time: 2009-01-20 23:28:10 - machine was rebooted [Ivan Pear]
ComboFix-quarantined-files.txt 2009-01-20 22:28:08
ComboFix2.txt 2009-01-20 19:31:00
ComboFix3.txt 2009-01-20 17:37:55
C:\DeQuarantine.txt

Pre-Run: 19,672,309,760 bytes free
Post-Run: 19,655,909,376 bytes free

212

Dopuna: 20 Jan 2009 23:34

Aj kad sam već ovde, da vas pitam, šta je ova Recovery Consola? Da ja to instaliram ili mi nije potrebno?

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Nije potrebna konzola da se instalira.

Jel znas da je ovo adware: c:\program files\MessengerDiscovery

Nisam hteo da brisem, posto si svojevoljno instalirao.

Javljam se sutra za ostalo...

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Pa ja sam video taj program u nekoj temi o MSN-u ovde na forumu i bilo mi zanimljivo da mogu da imitiram druge, tj da napišem nešto a da ispadne kao da su oni to napisali... Ne znam više tačno u kom forumu je tema, ali bili su tako razni dodaci za MSN, pa i ovo.

Kako to da ga nije našao ni jedan program za čišćenje... Da ga uninstaliram i brišem?

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Mozes, a i ne moras. Kako hoces. Tvoj je kompjuter.

Mene interesuje ono sto ti nisi zeleo da imas, a mi smo, nadam se obrisali.

Kakvo je stanje?

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Ma obrisaću ja to ako je štetno, nije mi to neopodno. Samo pitam, šta mi je činiti...

Izgleda je sređeno. Za sada ne iskače ništa, ni messengeri, ni NOD ništa ne javlja. Hvala vam puno.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Nismo jos zavrsili:

- Preuzmi USBNoRisk na Desktop i pokreni ga duplim klikom na ikonicu programa.
- Sacekaj koji sekund dok program izvrsi inicijalno skeniranje.
- Ubacuj sve USB memorijske uredjaje redom u USB slot i svaki zadrzi u slotu po 10 sekundi.
- Ukoliko imas vise uredjaja za proveru, onda na parcetu papira zapisi kojim redom su ubacivani jer ce nam kasnije trebati taj podatak
- Kada zavrsis sa svim uredjajima, klikni desno dugme misa na sred prozora programa i odaberi opciju Save log. To ce automatski otvoriti log u Notepadu. Iskopiraj nam taj log iz Notepada na forum.

Objasnjenje: U USB memorijske uredjaje spadaju svi oni uredjaji koji po prikljucivanju na kompjuter dobijaju svoju oznaku particije. Tu spadaju USB flash drajvovi, eksterni hard-diskovi, memorijske kartice, MP3 i MP4 plejeri, neki mobilni telefoni, neki GPS (navigacioni) uredjaji itd.


----------------------------

Zipuj/raruj mi sledeci folder:

C:\QooBox\Quarantine\Registry_Backups

i posalji mi ga preko sledeceg linka:

http://www.mycity.rs/ambulanta-upload.php

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Ček sad, opet sam zbunjen. Imam priključeno preko USB-a sledeće: štampač, miš, Card Reader, e-Banking, webcam. Treba to da čupam napolje i onda da na 10 sekundi ubacim u svaki USB slot moj USB flash? Nemam eksternih HDD-ova, nemam ni MP3 player. Imam samo USB stik koji baš jako retko koristim... Jel treba taj USB flash/stik da bude formatiran, da li treba nešto na njemu da bude?

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Ne, ne vadis nista. Samo ubacis taj USB stick, i nista ne formatiras.

Samo ubacis i pustis program.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Aj sad da smaram, ali i dalje mi nije najjasnije. Znači skinem program (skinuo već), pokrenem ga, ostavim da uradi inicijalno skeniranje, onda ubacim USB stick i kada završi, šta već radi, onda desni klik na desktop i Save Log? Jesam dobro razumeo?

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Ukljucis program i kad se pojavi prozor programa gde ce pisati nesto, ti stavis USB stick u kompjuter i on sam ga prepozna i skenira i onda sacuvas log.

A, mozes i da prvo stavis USB stick u kompjuter i onda tek ukljucis program i kad se pojavi log, onda uradis desni klik i Save log.