MyCity » Ambulanta -> Arhiva Ambulante » Neshto vuche konekciju

Neshto vuche konekciju

Napisano na dan: 28.3.2008
2

Neshto vuche konekciju
Pagination Prethodna strana
Sledeća strana Pagination

Idi na vrh

Poslao: 31 Mar 2008 10:50
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8652
  • Gde živiš: Novi Beograd

@hazmaju

Gledam,ali cu prvo morati bobbiju da se javim pa tebi.Takva su pravila skolice. Wink



Poslao: 31 Mar 2008 15:00
Idi na vrh
offline
  • Uroš Ilić
  • dr stom.
  • Pridružio: 08 Jul 2006
  • Poruke: 2182
  • Gde živiš: Beograd

OK naravno!



Poslao: 31 Mar 2008 21:00
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8652
  • Gde živiš: Novi Beograd

Spakuj sledece fajlove u jednu arhivu i uploaduj mi na proveru:

C:\WINDOWS\n.tmp
C:\WINDOWS\~de74bc.tmp


preko ovog linka:
[Link mogu videti samo ulogovani korisnici]

Poslao: 31 Mar 2008 21:11
Idi na vrh
offline
  • Uroš Ilić
  • dr stom.
  • Pridružio: 08 Jul 2006
  • Poruke: 2182
  • Gde živiš: Beograd

Rarovao i uploadovao.
Hvala na pomoci helen1!
Ako je od znachaja, u medjuvremenu sam promenio zashtitu u Eset Internet Security 3.0.654 , skenirao i nishta, kao ni sa predhodnim Symantec Endpint Protection 11 i Spyware Terminatorom.

Poslao: 31 Mar 2008 21:56
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8652
  • Gde živiš: Novi Beograd

Uploadovani fajlovi su legitimni.

Da li ima jos nekih problema u vezi sa konekcijom?Ili nekih drugih problema?

Poslao: 31 Mar 2008 22:07
Idi na vrh
offline
  • Uroš Ilić
  • dr stom.
  • Pridružio: 08 Jul 2006
  • Poruke: 2182
  • Gde živiš: Beograd

Pa nema, prestali su simtomi koje sam pominjao, ne posle sredjivanja one moje brljotine (m4rk0 hvala!), vec kada sam iz regedit na search, nashao sve zaostale stringove onog PartyPoker chuda.
Mozda je do toga?!
Hvala puno na pomoci, lepo je kad imash jednu ovakvu sigurnost, to je mnogo vishe nego shto ti daje sama antivirus zashtita!
Pozdrav i chujemo se, nadam se u nekoj vedrijoj temi Wink

Poslao: 31 Mar 2008 22:14
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8652
  • Gde živiš: Novi Beograd

Poslao: 31 Mar 2008 22:20
Idi na vrh
offline
  • Uroš Ilić
  • dr stom.
  • Pridružio: 08 Jul 2006
  • Poruke: 2182
  • Gde živiš: Beograd

E, sorry, opet ja poleteh! To sam sve uradio rucno, sat se sam vratio u normalu, fajlove i ostatke ComboFixa sam pobisao u Total Commanderu (VundoFix Backups nije postojao), sakrio skrivene fajlove i poznate ekstenzije.
Nadam se da nisam opet pogreshio? Ima li smisla da to sada uradim?

Poslao: 31 Mar 2008 22:28
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8652
  • Gde živiš: Novi Beograd

E,covece cudo si Wink .Nemam pojma sta se radi u tom slucaju,kad uradi korisnik rucno.Probaj kako sam ti rekao,zato sto treba resetovati System restore.Mada ne verujem da ces uspeti.Sto nisi prelistao prvo forum da vidis da uvek posle CF-a ide isto uputstvo za uninstal. Wink

Poslao: 02 Apr 2008 00:30
Idi na vrh
offline
  • Uroš Ilić
  • dr stom.
  • Pridružio: 08 Jul 2006
  • Poruke: 2182
  • Gde živiš: Beograd

Evo uradio sam, kaze da je deinstalirao, delovalo mi je OK. U svakom sluchaju System Restore mi je bio iskljuchen.
Bilo kako bilo, sada je OK, a u svakom sluchaju necu vishe biti tako brzoplet.
Pozdrav i hvala josh jednom.

Dopuna: 02 Apr 2008 0:13

Imam i dalje isti problem!
Opet se skida fajl u Temp folderu i vuche veliki deo konekcije. U Commanderu ga vidim kao BIT39.tmp i skriven je. Kada kliknem na njega u Commanderu, to ustvari nije temp fajl vec arhiva puna nekih fajlova sa chudnim ekstenzijama, medju kojima su neke .exe. Kada se skine u Temp folder, ponovo mi oslobodi konekciju i nema vishe aktivnosti.
Uploadovao bih ga na analizu ali je u raru tezak 17.9 Mb, a dozvoljeni upload je 10.
Molim pomagajte, ovo je bez sumnje neshto maliciozno?!!



Evo i HJT loga:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0:11:20, on 2.4.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608-)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\netdde.exe
C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
C:\WINDOWS\system32\clipsrv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\tlntsvr.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\LClock\LClock.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\RivaTuner v2.06\RivaTuner.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\ASUS USB ADSL Modem\ASUS USB ADSL Modem\dslmon.exe
C:\Documents and Settings\Fritz\Start Menu\Programs\Startup\PS2.bat
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\fritz.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [RivaTuner] "C:\Program Files\RivaTuner v2.06\RivaTuner.exe" /T
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.06\RivaTuner.exe" /S
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-18\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: PS2.bat
O4 - Global Startup: DSLMON.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - [Link mogu videti samo ulogovani korisnici]
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - [Link mogu videti samo ulogovani korisnici]
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - [Link mogu videti samo ulogovani korisnici]
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - [Link mogu videti samo ulogovani korisnici]
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - [Link mogu videti samo ulogovani korisnici]
O17 - HKLM\System\CCS\Services\Tcpip\..\{BC17F6B4-A672-448A-957E-48AF5C5851CA}: NameServer = 80.74.160.35 80.74.160.52
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodata Limited License Service - Autodata Limited - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 7423 bytes

Dopuna: 02 Apr 2008 0:30

Evo i ComboFix loga:

ComboFix 08-04-01.2 - Fritz 2008-04-02 0:26:06.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.1525 [GMT 2:00]
Running from: C:\Documents and Settings\Fritz\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-03-01 to 2008-04-01 )))))))))))))))))))))))))))))))
.

2008-03-31 17:16 . 2008-03-31 17:16 <DIR> d-------- C:\Documents and Settings\Fritz\Application Data\ESET
2008-03-31 17:15 . 2008-03-31 17:15 <DIR> d-------- C:\Program Files\ESET
2008-03-31 17:15 . 2008-03-31 17:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ESET
2008-03-26 23:08 . 1997-11-19 16:49 303,616 --a------ C:\WINDOWS\IsUninst.exe
2008-03-15 01:18 . 2008-03-15 01:18 38 --a------ C:\WINDOWS\avisplitter.INI
2008-03-14 18:55 . 2008-03-14 18:58 <DIR> d-------- C:\Documents and Settings\Fritz\Application Data\DisplayTune
2008-03-14 18:50 . 2004-08-04 02:56 1,392,671 --a------ C:\WINDOWS\msvbvm60.dll
2008-03-14 18:50 . 2002-01-05 05:40 487,424 --a------ C:\WINDOWS\msvcp70.dll
2008-03-14 18:50 . 2002-01-05 05:37 344,064 --a------ C:\WINDOWS\msvcr70.dll
2008-03-12 14:10 . 2008-03-12 14:10 633,344 --------- C:\WINDOWS\system32\gpprefcl.dll
2008-03-01 04:56 . 2008-03-01 04:56 71,176 --a------ C:\WINDOWS\system32\drivers\epfw.sys
2008-03-01 04:56 . 2008-03-01 04:56 54,280 --a------ C:\WINDOWS\system32\drivers\epfwtdi.sys
2008-03-01 04:56 . 2008-03-01 04:56 30,728 --a------ C:\WINDOWS\system32\drivers\epfwndis.sys
2008-03-01 04:53 . 2008-03-01 04:53 29,704 --a------ C:\WINDOWS\system32\drivers\easdrv.sys
2008-03-01 04:52 . 2008-03-01 04:52 39,944 --a------ C:\WINDOWS\system32\drivers\eamon.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-31 13:42 --------- d-----w C:\Documents and Settings\Fritz\Application Data\uTorrent
2008-03-30 13:52 --------- d-----w C:\Program Files\LClock
2008-03-19 21:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-03-14 16:58 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-10 21:55 --------- d-----w C:\Program Files\Java
2008-03-06 15:53 566,784 ----a-w C:\WINDOWS\~de74bc.tmp
2008-03-04 18:19 --------- d-----w C:\Documents and Settings\Fritz\Application Data\LimeWire
2008-02-22 23:12 --------- d-----w C:\Program Files\Opera
2008-02-15 09:01 --------- d-----w C:\Program Files\Common Files\Autodata Limited Shared
2008-02-03 13:32 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-02-02 13:28 --------- d-----w C:\Program Files\Sierra
2008-02-02 12:56 --------- d-----w C:\Program Files\DAEMON Tools
2008-02-02 12:52 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-01-04 22:05 74,752 ----a-w C:\WINDOWS\cadkasdeinst01e.exe
2008-01-02 18:15 78 --sh--w C:\Program Files\Desktop.ini
.

------- Sigcheck -------

2007-12-18 00:24 1226752 e0c482f440b81974649bb101c6c71d80 C:\WINDOWS\explorer.exe
2007-06-13 13:26 1033216 7712df0cdde3a5ac89843e61cd5b3658 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2007-12-18 00:24 1226752 e0c482f440b81974649bb101c6c71d80 C:\WINDOWS\system32\dllcache\explorer.exe
2007-06-13 12:23 1246208 a4d7137b5804532b75bd9dd8d7c17566 C:\WINDOWS\system32\VITrans\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 14:58 495616]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 13:24 167368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-10 17:28 16126464 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2007-04-04 19:22 1822720 C:\WINDOWS\SkyTel.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 14:00 110592 C:\WINDOWS\system32\bthprops.cpl]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2006-11-08 14:27 222208]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-10-19 21:16 286720]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 02:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"LClock"="C:\Program Files\LClock\LClock.exe" [2004-09-20 01:27 65536]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 02:41 81920]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-08-11 17:30 249856]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 17:30 81920]
"RivaTuner"="C:\Program Files\RivaTuner v2.06\RivaTuner.exe" [2007-10-30 20:05 2650112]
"RivaTunerStartupDaemon"="C:\Program Files\RivaTuner v2.06\RivaTuner.exe" [2007-10-30 20:05 2650112]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2008-03-01 04:54 1443072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 18:15 1634304]

C:\Documents and Settings\Fritz\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50 113664]
PS2.bat [2002-10-17 00:57:10 81920]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
DSLMON.lnk - C:\Program Files\ASUS USB ADSL Modem\ASUS USB ADSL Modem\dslmon.exe [2007-11-27 01:29:26 929889]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoStrCmpLogical"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsNetHood"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUSGamerOSD]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X74-X75]
--a------ 2002-10-14 22:09 57344 C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\rfagent]
--a------ 2006-08-26 10:34 365056 C:\Program Files\RFA Platinum\rfagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\EA Games\\Medal of Honor Pacific Assault(tm)\\mohpa.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 14:00]
R3 usnjsvc;Messenger Sharing Folders USN Journal Reader service;"C:\Program Files\MSN Messenger\usnsvc.exe" [2007-01-19 13:54]
S0 NVStrap;NVStrap;C:\WINDOWS\system32\drivers\NVStrap.sys [2007-10-30 20:05]
S3 asusgsb;ASUS Virtual Video Capture Device Driver;C:\WINDOWS\system32\drivers\asusgsb.sys [2007-07-12 11:03]
S3 ASUSVRC;ASUSTeK Virtual Capture Device;C:\WINDOWS\system32\DRIVERS\AsusVRC.sys [2007-01-29 18:12]
S3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;C:\WINDOWS\system32\DRIVERS\l151x86.sys [2007-07-03 13:06]
S3 n558;N558 Bluetooth USB Filter Driver;C:\WINDOWS\system32\Drivers\n558.sys [2007-08-15 08:27]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2007-12-30 13:55]
S3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys []

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contents of the 'Scheduled Tasks' folder
"2008-01-25 16:15:00 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2008-04-02 00:26:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\vsdatant]
"ImagePath"="a"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\RocketDock\RocketDock.dll
-> C:\WINDOWS\system32\nview.dll
-> C:\Program Files\LClock\LC.dll
.
Completion time: 2008-04-02 0:27:14
ComboFix-quarantined-files.txt 2008-04-01 22:27:06
Pre-Run: 11,939,721,216 bytes free
Post-Run: 11,927,162,880 bytes free

MyCity » Ambulanta -> Arhiva Ambulante » Neshto vuche konekciju

Ko je trenutno na forumu
 

Ukupno su 1056 korisnika na forumu :: 177 registrovanih, 24 sakrivenih i 855 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 15694 - dana 01 Feb 2026 12:23

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 9k38, A.R.Chafee.Jr., aleksandar1888, ALEKSICMILE, aleksjevt, alternator, Asparagus, Belisarius, blue, Bojan198527, bojankrstc, Bojcca, Bosnjo, Botovac, bpop, BraneS, branko7, Brankojle, brufen, bukefal, cakija, cikadeda, Cirkon, Colt D, DeerHunter, deki1001, desmeki, djoli, djonsule, djukapfc, Dogma21, Dorcolac, Dragacevac, draganl, dragoljub11987, DreadForce83, Duh16, Dzigy, EVIDENTICAR, EXIT78, Feller, FGR, flash12, Fog of War, fokac, Futurama, Georgius, grenadir, Grochow, Hans Gajger, havoc995, Iii, Ilija84, Ir, ivanhoe31, Jakonjveliki, jalos, Jan, Jeremiah, JK, Joint Chief, Jonbonjovi, Kajzer Soze, Kapetan993, Kapo64, kaput21, klepesina, Kole1975, kovacicbozo, kybonacci, ladro, Le Banner, Levi, Mackomen, maiden6657, mango, Marko Marković, marsovac 2, matrix_1, maxim_von_burdengate, MDrasko, medaTT, milanpb, mile.ilic75, miljannis, MiloradKomadic, Mirage 2000N, miroslav tamnavski, mm1811, Mr. Majevica, Naj-Turs, Ne doznajem se u oružje, nebkv, nevjerna beba, nikolapetkovic, orfanel, orjen, ozzy, Papadubi, Permaldar, Pero Petković, Perudin_92, Petar888, petrovicrs, PlayerOne, PoolbegD02, Povratak1912, precan, Prečanin30, prikolica, pristinski korpus, PuškeiPlavuše, Radogost, RajkoB, raptorsi, renvoi, Ripanjac, rodoljub, sale755, SamoGledam, sarma, Sass Drake, Seeker, Semberija, Semprini, sevenino, Sgmpk, Sharpshooter, siwoti, Smor, StankoVrankovic, Stefanzi, stegonosa, steksi, Stoilkovic, styg, t84dar, Tas011, TheDictator, tmanda323, tomigun, tomo-hr, tomo2, Tomo988, toni061, TRAVUNIJA, tuja, tvlada, Tvrtko I, UAV operator, vathra, Vatreni Zmaj, vazduh, vensla, virked, Vlada78, vladimir070, VNVK, vobo, VOŽD, vuk77, vzd1389, W123, Wehicle, wize, x011, xAlex2, XBMC, yiyi, Zastava, zil10, Zjmc, zombicar153, zoran-ruma, Zoran1959, Zvrk, Žrnov