MyCity » Ambulanta -> Arhiva Ambulante » Nije mi jasno

Nije mi jasno

Napisano na dan: 13.2.2008
2

Nije mi jasno
Pagination Prethodna strana

Idi na vrh

Poslao: 15 Feb 2008 01:10
Idi na vrh
offline
  • Pridružio: 16 Nov 2007
  • Poruke: 16

ComboFix 08-02-13.2 - pepsaja 2008-02-15 0:58:47.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.110 [GMT 1:00]
Running from: C:\Documents and Settings\pepsaja\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\pepsaja\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\WINDOWS\system32\Win32.exe
.

((((((((((((((((((((((((( Files Created from 2008-01-15 to 2008-02-15 )))))))))))))))))))))))))))))))
.

2008-02-13 22:35 . 2008-02-13 22:35 <DIR> d-------- C:\WINDOWS\system32\xircom
2008-02-13 22:35 . 2008-02-13 22:35 <DIR> d-------- C:\WINDOWS\system32\restore
2008-02-13 22:35 . 2008-02-13 22:37 <DIR> d--hs---- C:\WINDOWS\system32\dllcache
2008-02-13 22:35 . 2008-02-13 22:35 <DIR> d-------- C:\WINDOWS\srchasst
2008-02-13 22:35 . 2008-02-13 22:35 <DIR> d-------- C:\Program Files\microsoft frontpage
2008-02-13 17:42 . 2008-02-13 17:42 1,894 --a------ C:\WINDOWS\system32\tmp.reg
2008-02-13 17:34 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-02-13 17:34 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-02-13 17:34 . 2008-02-08 23:55 85,504 --a------ C:\WINDOWS\system32\VACFix.exe
2008-02-13 17:34 . 2008-02-08 10:37 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-02-13 17:34 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-02-13 17:34 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-02-13 17:34 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-02-06 20:42 . 2005-11-06 00:03 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-02-06 20:42 . 2005-11-06 00:03 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-02-06 20:42 . 2005-11-06 00:03 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2008-02-05 20:19 . 2008-02-05 20:19 0 --a------ C:\LOG2AC.tmp
2008-02-05 20:18 . 2008-02-05 20:20 <DIR> d-------- C:\Documents and Settings\pepsaja\Application Data\U3
2008-01-25 20:42 . 2008-01-25 20:42 <DIR> d-------- C:\wally
2008-01-25 12:57 . 2008-01-25 13:08 0 --a------ C:\WINDOWS\system32\BWFAX
2008-01-25 12:54 . 2008-01-25 12:52 27,648 --a------ C:\WINDOWS\system32\bwprnmon.dll
2008-01-25 12:54 . 2008-01-25 12:54 3,347 --a------ C:\WINDOWS\BWRESTOR.REG
2008-01-25 12:54 . 2008-01-25 12:54 3,045 --a------ C:\WINDOWS\BWCHANGE.REG
2008-01-25 12:54 . 2008-01-25 12:54 0 --a------ C:\WINDOWS\system32\bwprnmon.bak
2008-01-25 12:52 . 2008-01-25 12:52 197,024 --a------ C:\WINDOWS\system\UNIDRV.DLL
2008-01-25 12:52 . 2008-01-25 12:52 37,408 --a------ C:\WINDOWS\system\BITWARED.DRV
2008-01-17 13:22 . 2005-11-06 00:03 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-01-15 11:47 . 2008-01-15 11:47 <DIR> d-------- C:\Program Files\Microsoft

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-14 21:58 --------- d-----w C:\Program Files\sXe Injected
2008-01-12 19:36 --------- d-----w C:\Program Files\LRC Editor 4
2008-01-06 18:38 --------- d-----w C:\Program Files\Common Files\ACD Systems
2007-12-29 14:35 --------- d-----w C:\Documents and Settings\pepsaja\Application Data\uTorrent
2007-11-28 19:58 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2007-11-15 00:53 16,768 ----a-w C:\WINDOWS\system32\tcpip_patcher.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46 1460560]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-11-11 12:47 7311360]
"nwiz"="nwiz.exe" [2005-11-11 12:47 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-11-11 12:47 86016]
"C-Media Mixer"="C:\Program Files\PCI Audio Applications\Mixer.exe" [2000-09-13 11:03 1085440]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-11-14 15:05 1410304]
"bwprnmon.exe"="C:\BITWARE\NT\bwprnmon.exe" [2008-01-25 12:52 54272]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nlsf"="cmd.exe" [2004-08-03 23:56 388608 C:\WINDOWS\system32\cmd.exe]
"nlhr"="C:\WINDOWS\System32\AdvPack.Dll" [2004-08-03 23:56 99840]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-03 21:59 44544]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-11-11 19:32:41 847872]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoInstrumentation"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoInstrumentation"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

R0 ALiAGP;ALi AGP Bus Filter Driver;C:\WINDOWS\system32\DRIVERS\ALiAGP.sys [2000-08-09 13:08]
R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2007-11-14 15:06]
R3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-05-04 18:50]
S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-03-02 19:25]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2008-02-15 01:01:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ntvdm.exe
.
**************************************************************************
.
Completion time: 2008-02-15 1:02:41 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-15 00:02:30
ComboFix2.txt 2008-02-13 21:37:15


Ja ne znam sta radimo i dokle smo stigli, ali hvala ti u svakom slucaju!
Vise nemam onih aktivacija prozora!



Poslao: 15 Feb 2008 18:10
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8657
  • Gde živiš: Novi Beograd

Spybot S&D's Teatimer


Pokrenite Spybot S&D
Kliknite Mode stavku u meniju
Odaberite Advance Mode
Na traci levo kliknite na Tools
Kliknite na Resident
Destiklirajte Resident Tea-Timer
Zatvorite Spybot S&D
Restartujte kompjuter.
Nemojte zaboraviti da ponovo ukljucite ove opcije kada zavrsimo ciscenje.

Otvoriti Notepad i iskopirati sledeci tekst:


Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}]



Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

Kada zavrsis sa skeniranjem i ciscenjem i ukljucis Spybot S&D's Teatimer dozvoli mu da izvrsi promene u Registry.



Poslao: 15 Feb 2008 18:56
Idi na vrh
offline
  • Pridružio: 16 Nov 2007
  • Poruke: 16

ComboFix 08-02-13.2 - pepsaja 2008-02-15 18:43:12.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.80 [GMT 1:00]
Running from: C:\Documents and Settings\pepsaja\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\pepsaja\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-01-15 to 2008-02-15 )))))))))))))))))))))))))))))))
.

2008-02-13 22:35 . 2008-02-13 22:35 <DIR> d-------- C:\WINDOWS\system32\xircom
2008-02-13 22:35 . 2008-02-13 22:35 <DIR> d-------- C:\WINDOWS\system32\restore
2008-02-13 22:35 . 2008-02-13 22:37 <DIR> d--hs---- C:\WINDOWS\system32\dllcache
2008-02-13 22:35 . 2008-02-13 22:35 <DIR> d-------- C:\WINDOWS\srchasst
2008-02-13 22:35 . 2008-02-13 22:35 <DIR> d-------- C:\Program Files\microsoft frontpage
2008-02-13 17:42 . 2008-02-13 17:42 1,894 --a------ C:\WINDOWS\system32\tmp.reg
2008-02-13 17:34 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-02-13 17:34 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-02-13 17:34 . 2008-02-08 23:55 85,504 --a------ C:\WINDOWS\system32\VACFix.exe
2008-02-13 17:34 . 2008-02-08 10:37 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-02-13 17:34 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-02-13 17:34 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-02-13 17:34 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-02-06 20:42 . 2005-11-06 00:03 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-02-06 20:42 . 2005-11-06 00:03 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-02-06 20:42 . 2005-11-06 00:03 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2008-02-05 20:19 . 2008-02-05 20:19 0 --a------ C:\LOG2AC.tmp
2008-02-05 20:18 . 2008-02-05 20:20 <DIR> d-------- C:\Documents and Settings\pepsaja\Application Data\U3
2008-01-25 20:42 . 2008-01-25 20:42 <DIR> d-------- C:\wally
2008-01-25 12:57 . 2008-01-25 13:08 0 --a------ C:\WINDOWS\system32\BWFAX
2008-01-25 12:54 . 2008-01-25 12:52 27,648 --a------ C:\WINDOWS\system32\bwprnmon.dll
2008-01-25 12:54 . 2008-01-25 12:54 3,347 --a------ C:\WINDOWS\BWRESTOR.REG
2008-01-25 12:54 . 2008-01-25 12:54 3,045 --a------ C:\WINDOWS\BWCHANGE.REG
2008-01-25 12:54 . 2008-01-25 12:54 0 --a------ C:\WINDOWS\system32\bwprnmon.bak
2008-01-25 12:52 . 2008-01-25 12:52 197,024 --a------ C:\WINDOWS\system\UNIDRV.DLL
2008-01-25 12:52 . 2008-01-25 12:52 37,408 --a------ C:\WINDOWS\system\BITWARED.DRV
2008-01-17 13:22 . 2005-11-06 00:03 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-01-15 11:47 . 2008-01-15 11:47 <DIR> d-------- C:\Program Files\Microsoft

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-15 15:57 --------- d-----w C:\Program Files\sXe Injected
2008-01-12 19:36 --------- d-----w C:\Program Files\LRC Editor 4
2008-01-06 18:38 --------- d-----w C:\Program Files\Common Files\ACD Systems
2007-12-29 14:35 --------- d-----w C:\Documents and Settings\pepsaja\Application Data\uTorrent
2007-11-28 19:58 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2007-11-15 00:53 16,768 ----a-w C:\WINDOWS\system32\tcpip_patcher.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-11-11 12:47 7311360]
"nwiz"="nwiz.exe" [2005-11-11 12:47 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-11-11 12:47 86016]
"C-Media Mixer"="C:\Program Files\PCI Audio Applications\Mixer.exe" [2000-09-13 11:03 1085440]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-11-14 15:05 1410304]
"bwprnmon.exe"="C:\BITWARE\NT\bwprnmon.exe" [2008-01-25 12:52 54272]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nlsf"="cmd.exe" [2004-08-03 23:56 388608 C:\WINDOWS\system32\cmd.exe]
"nlhr"="C:\WINDOWS\System32\AdvPack.Dll" [2004-08-03 23:56 99840]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-03 21:59 44544]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-11-11 19:32:41 847872]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoInstrumentation"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoInstrumentation"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

R0 ALiAGP;ALi AGP Bus Filter Driver;C:\WINDOWS\system32\DRIVERS\ALiAGP.sys [2000-08-09 13:08]
R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2007-11-14 15:06]
R3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-05-04 18:50]
S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-03-02 19:25]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2008-02-15 18:44:24
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-15 18:45:00
ComboFix-quarantined-files.txt 2008-02-15 17:44:50
ComboFix2.txt 2008-02-15 00:02:41
ComboFix3.txt 2008-02-13 21:37:15

Poslao: 15 Feb 2008 19:40
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8657
  • Gde živiš: Novi Beograd

Poslao: 15 Feb 2008 21:09
Idi na vrh
offline
  • Pridružio: 16 Nov 2007
  • Poruke: 16

Uradjeno!
Hvala vam puno!!!

MyCity » Ambulanta -> Arhiva Ambulante » Nije mi jasno

Ko je trenutno na forumu
 

Ukupno su 3066 korisnika na forumu :: 81 registrovanih, 10 sakrivenih i 2975 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 20624 - dana 04 Apr 2026 04:18

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 33 bren, 357magnum, aleksjevt, AleksSE, alternator, Apok, Asteker, bbrasnjo3, Betta, Bgd123, boromir, boskelazo, Botovac, bufanje, bukefal, bunker, burevesnik, BWG, carinko, cebam, Chainsaw, darcaud, Deki Duga Devetka, dexteroza, DezurniOperativni, dj.ape, Djokkinen, djonsule, dolinalima, dusanobr, Dzigy, Elvin, EVIDENTICAR, GeoM, Glavonja049, goran.vvv, Goxy1, GrammaticalAnalysis, grunff2, Hans Gajger, jeen yuhs, JOntra, kaput21, kozhedub, kuntakinte, Lazarus2, Marko Marković, mikoyan21, Milometer, Milos1987, Misirac, Motocar, Nepopravljivi, Njubara, novator, nuke92, pablojepao, peradetlić, pfc74, ping15, PITT, PO1974, raptorsi, SD izvidjac, Semberija, septembar, skvara, slowhand, smuk, Tvrtko I, vathra, vladimir070, vuk77, x9, YugoSlav, Zastava, zokizemun, Zoran Rapajić, zoran77, zoranjev, Zvone