|
Poslao: 05 Jul 2012 18:07
|
offline
- njuskalo75
- Ugledni građanin
- Pridružio: 03 Feb 2011
- Poruke: 445
- Gde živiš: Landau and der Pfalz
|
Napisano: 05 Jul 2012 18:06
Danas sam skenirao računar ali ovo nemogu da uklonim
Dopuna: 05 Jul 2012 18:07
|
|
|
|
|
|
|
|
|
Poslao: 05 Jul 2012 20:37
|
offline
- njuskalo75
- Ugledni građanin
- Pridružio: 03 Feb 2011
- Poruke: 445
- Gde živiš: Landau and der Pfalz
|
Da otvorim drugu temu u ambulanti ili da ovde nastavim dalje 
|
|
|
|
|
|
|
|
|
Poslao: 05 Jul 2012 20:53
|
offline
- njuskalo75
- Ugledni građanin
- Pridružio: 03 Feb 2011
- Poruke: 445
- Gde živiš: Landau and der Pfalz
|
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by Administrator at 20:39:31 on 2012-07-05
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.378 [GMT 2:00]
.
AV: Avira Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\VMSnap3.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\program files\real\realplayer\update\realsched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Firebird\Firebird_2_5\bin\fbguard.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Firebird\Firebird_2_5\bin\fbserver.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\MCShield\MCShieldRTM.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.searchnu.com/406
uSearch Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://www.google.com/ie
uWindow Title = Internet Explorer, optimized for Bing and MSN
uDefault_Page_URL = about:blank
mDefault_Page_URL = about:blank
mStart Page = about:blank
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: FastestTubeBHO Class: {3e532ce8-c6d9-4a10-8ace-4348c96e8b6a} - c:\program files\fastesttube\2.0.0\WombatBHO.dll
BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No File
BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - No File
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
TB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File
TB: {742E70CF-7770-412D-86CB-230B322E807C} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [MCShield Monitor] c:\program files\mcshield\mcshieldrtm.exe
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [VMSnap3] c:\windows\VMSnap3.exe
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
mRun: [RTHDCPL] RTHDCPL.EXE
mRunOnce: [Malwarebytes Anti-Malware (cleanup)] rundll32.exe "c:\documents and settings\all users\application data\malwarebytes\malwarebytes' anti-malware\cleanup.dll",ProcessCleanupScript
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\admini~1\startm~1\programs\startup\yahoo!~1.lnk - c:\program files\yahoo!\widgets\YahooWidgets.exe
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5}
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1317104157750
TCP: Interfaces\{3318030E-D9FE-4743-86EB-1FC99D49B8CB} : NameServer = 194.247.192.33,194.247.192.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\administrator\application data\mozilla\firefox\profiles\5bzqvh71.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Search Results
FF - prefs.js: browser.startup.homepage - hxxp://www.searchnu.com/406
FF - prefs.js: keyword.URL - hxxp://dts.search-results.com/sr?src=ffb&appid=390&systemid=406&sr=0&q=
FF - plugin: c:\documents and settings\administrator\application data\mozilla\plugins\np-mswmp.dll
FF - plugin: c:\documents and settings\administrator\application data\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\administrator\application data\mozilla\plugins\npgtpo3dautoplugin.dll
FF - plugin: c:\documents and settings\administrator\local settings\application data\google\update\1.3.21.111\npGoogleUpdate3.dll
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\google\update\1.3.21.111\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.3.21.99\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\nprpplugin.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npyaxmpb.dll
FF - plugin: c:\program files\real\realplayer\netscape6\nprpplugin.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_3_300_262.dll
.
---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=111294
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - d84bfe66000000000000001d92472bc2
FF - user.js: extensions.BabylonToolbar_i.hardId - d84bfe66000000000000001d92472bc2
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15523
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1715:18:33
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
============= SERVICES / DRIVERS ===============
.
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [2012-5-13 36000]
R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\avira\antivir desktop\sched.exe [2012-5-13 86224]
R2 AntiVirService;Avira Realtime Protection;c:\program files\avira\antivir desktop\avguard.exe [2012-5-13 110032]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2012-5-13 83392]
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\firebird\firebird_2_5\bin\fbguard.exe [2012-3-7 98304]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [2012-1-7 12184]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-7-5 654408]
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\firebird\firebird_2_5\bin\fbserver.exe [2012-3-7 3735552]
R3 gMouPS2;PS2 Scroll Mouse Device;c:\windows\system32\drivers\gMouPS2.sys [2012-2-29 17408]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-7-5 22344]
R3 vvftav303;vvftav303;c:\windows\system32\drivers\vvftav303.sys [2011-8-28 480128]
R3 ZSMC0303;A4 TECH PC Camera H;c:\windows\system32\drivers\usbVM303.sys [2011-8-28 1472768]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-9-29 136176]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-20 250056]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2011-8-28 1691480]
S3 DrvAgent32;DrvAgent32;c:\windows\system32\drivers\DrvAgent32.sys [2012-1-8 23456]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-9-29 136176]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\mozilla maintenance service\maintenanceservice.exe [2012-5-4 113120]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [2012-7-5 27064]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys --> e:\NTGLM7X.sys [?]
.
=============== Created Last 30 ================
.
2012-07-05 18:38:29 54016 ----a-w- c:\windows\system32\drivers\kwedkkb.sys
2012-07-05 18:29:49 -------- d-----w- c:\program files\Defraggler
2012-07-05 18:16:09 -------- d-----w- c:\documents and settings\all users\application data\MCShield
2012-07-05 18:16:08 -------- d-----w- c:\program files\MCShield
2012-07-05 18:09:18 -------- d-----w- c:\documents and settings\administrator\local settings\application data\VS Revo Group
2012-07-05 18:09:06 27064 ----a-w- c:\windows\system32\drivers\revoflt.sys
2012-07-05 18:09:04 -------- d-----w- c:\program files\VS Revo Group
2012-07-05 17:45:56 3584 ----a-r- c:\documents and settings\administrator\application data\microsoft\installer\{121634b0-2f4b-11d3-ada3-00c04f52dd52}\Icon386ED4E3.exe
2012-07-05 17:45:56 -------- d-----w- c:\program files\Windows Installer Clean Up
2012-07-05 17:45:35 -------- d-----w- c:\program files\MSECACHE
2012-07-05 17:34:55 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-07-05 17:34:55 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-07-05 15:06:56 -------- d-----w- c:\program files\Hitman Pro 3.5
2012-07-04 12:22:50 -------- d-----w- c:\documents and settings\administrator\AppData
2012-07-04 12:22:49 -------- d-----w- c:\documents and settings\administrator\application data\searchquband
2012-07-02 13:18:40 554176 ----a-w- c:\program files\uninstall information\ib_uninst_430\uninstall.exe
2012-07-02 13:18:34 -------- d-----w- c:\documents and settings\administrator\application data\PerformerSoft
2012-07-02 13:18:33 554176 ----a-w- c:\program files\uninstall information\ib_uninst_396\uninstall.exe
2012-07-02 13:18:17 17464 ----a-w- c:\windows\system32\roboot.exe
2012-07-02 13:18:10 554176 ----a-w- c:\program files\uninstall information\ib_uninst_312\uninstall.exe
2012-07-02 13:18:10 -------- d-----w- c:\documents and settings\administrator\local settings\application data\Babylon
2012-07-02 13:18:08 -------- d-----w- c:\documents and settings\all users\application data\Babylon
2012-07-02 13:18:07 -------- d-----w- c:\documents and settings\administrator\application data\Babylon
2012-07-02 13:18:03 554176 ----a-w- c:\program files\uninstall information\ib_uninst_479\uninstall.exe
2012-07-02 13:17:38 554176 ----a-w- c:\program files\uninstall information\ib_uninst_0\uninstall.exe
2012-06-25 07:50:37 -------- d-----w- c:\program files\GRETECH
2012-06-15 20:19:16 521728 -c----w- c:\windows\system32\dllcache\jsdbgui.dll
2012-06-11 20:57:32 -------- d-----w- c:\program files\SpeedFan
2012-06-07 04:14:19 770384 ----a-w- c:\program files\mozilla firefox\msvcr100.dll
2012-06-07 04:14:19 421200 ----a-w- c:\program files\mozilla firefox\msvcp100.dll
.
==================== Find3M ====================
.
2012-07-05 16:19:39 23624 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2012-07-05 15:12:09 12872 ----a-w- c:\windows\system32\bootdelete.exe
2012-06-24 21:06:42 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-06-24 21:06:42 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-06-02 13:19:44 22040 ----a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 13:19:38 219160 ----a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 13:19:38 15384 ----a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 13:19:34 15384 ----a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 13:19:30 17944 ----a-w- c:\windows\system32\wuaueng.dll.mui
2012-05-31 19:09:41 499712 ----a-w- c:\windows\system32\msvcp71.dll
2012-05-31 19:09:41 348160 ----a-w- c:\windows\system32\msvcr71.dll
2012-05-31 15:24:14 6126736 ----a-w- c:\windows\system32\drivers\RtkHDAud.sys
2012-05-31 13:22:09 599040 ----a-w- c:\windows\system32\crypt32.dll
2012-05-25 16:06:00 1706640 ----a-w- c:\windows\RtlExUpd.dll
2012-05-24 08:48:10 21376 ----a-w- c:\windows\system32\RegistryDefragBootTime.exe
2012-05-16 15:08:26 916992 ----a-w- c:\windows\system32\wininet.dll
2012-05-15 13:20:33 1863168 ----a-w- c:\windows\system32\win32k.sys
2012-05-11 14:42:33 43520 ------w- c:\windows\system32\licmgr10.dll
2012-05-11 14:42:33 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-05-11 11:38:02 385024 ------w- c:\windows\system32\html.iec
2012-05-10 15:34:50 65640 ----a-w- c:\windows\system32\RtkCoInstIIXP.dll
2012-05-04 13:16:13 2148352 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-04 12:32:19 2026496 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-04 08:15:00 1493608 ----a-w- c:\windows\RtlUpd.exe
2012-05-02 13:46:36 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-04-24 22:32:27 83392 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-04-24 12:51:38 20065896 ----a-w- c:\windows\RTHDCPL.EXE
2012-04-16 19:18:01 36000 ----a-w- c:\windows\system32\drivers\avkmgr.sys
.
============= FINISH: 20:40:31.03 ===============
https://www.mycity.rs/must-login.png
https://www.mycity.rs/must-login.png
|
|
|
|
|
|
|
|
|
|
|
Poslao: 06 Jul 2012 09:17
|
offline
- ivance95
- AMF pripravnik
- Pridružio: 04 Jul 2011
- Poruke: 5424
|
 Zaražen si Virut-om, to je virus (fajl-infektor) koji modifikuje fajlove. Sledećom procedurom pokušaćemo da spasemo sistem, ali ništa nije sigurno. U suprotnom je neophodna reinstalacija sistema.
- Desni klik na My Computer - System Restore tab
- Klikni na Turn off System Restore on all drives
- Klikni na OK, a na pitanje koje dobiješ odgovori sa Yes
- Restartuj računar
Preuzmi Dr.Web CureIt (~50 MB).
Restartuj kompjuter u Safe Mode (uputstvo za Safe Mode)
Dvoklikom pokreni launch.exe, nakon čega će se pojaviti uvodni prozor - klikni Start
Pojaviće se obaveštenje o započinjanju uvodnog skeniranja - klikni OK
Sačekaj nekoliko minuta da Dr.Web CureIt izvrši Express Scan; ukoliko malware bude pronađen, klikom na taster Yes to All u prozoru koji se pojavi dozvoli programu da izvrši dezinfekciju
Klikni Options > Change settings F9; u prozoru koji će se otvoriti, dečekiraj opciju Heuristic Analysis a zatim klikni OK
U glavnom prozoru obeleži opciju Complete scan a zatim klikni  i Dr.Web CureIt će započeti skeniranje
Ukoliko malware bude pronađen, klikom na taster Yes to All u prozoru koji se pojavi dozvoli programu da izvrši dezinfekciju
Kada skeniranje bude završeno, klikni Select all taster (ukoliko je dostupan), a zatim klikni Cure i,
u meniju koji se otvori, klikni Move incurable:
Po završetku procesa, klikni File > Save report list i sačuvaj log na Desktopu
Iskopiraj sadržaj Dr.Web CureIt loga u temu na forumu.
Pokreni ponovo DDS, i postavi mi DDS.txt
|
|
|
|
|
|
|
|
|
|
