Možda tražite i:
mbam i sas nasli viruse dali su to stvarno virusi?
virus,virusi ili....
MSN virusi

MyCity » Ambulanta -> Arhiva Ambulante » Pomoc virusi

Pomoc virusi

Napisano na dan: 19.1.2009

Pomoc virusi

Sledeća strana

Pagination

Odgovori

gagi_lape Poslao: 19 Jan 2009 19:06 Idi na vrh
offline gagi_lape Novi MyCity građanin Pridružio: 19 Jan 2009 Poruke: 5	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Komp mi je skroz usporen pa evo da neko pogleda: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:58:57, on 19.1.2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.20772) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Java\jre1.5.0_12\bin\jusched.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\USB Disk Win98 Driver\Res.EXE C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Rainlendar\Rainlendar.exe C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Java\jre1.5.0_12\bin\jucheck.exe C:\Documents and Settings\Gago\Desktop\New Folder (2)\TR3.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici] R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [Link mogu videti samo ulogovani korisnici] R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [Link mogu videti samo ulogovani korisnici] R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici] R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici] F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\byXRlKcY.dll O2 - BHO: (no name) - {782B90F9-A468-4815-88F3-1114DB17D77E} - C:\WINDOWS\system32\cbXqnlJd.dll O2 - BHO: C:\WINDOWS\system32\rakmdlkd83indfgnbu.dll - {D5BF4552-94F1-42BD-F434-3604812C807D} - C:\WINDOWS\system32\rakmdlkd83indfgnbu.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_12\bin\jusched.exe" O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98 Driver\Res.EXE O4 - HKLM\..\Run: [lrijh8s73jhbfgfd] C:\DOCUME~1\Gago\LOCALS~1\Temp\winloggn.exe O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [lrijh8s73jhbfgfd] C:\DOCUME~1\Gago\LOCALS~1\Temp\winloggn.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user') O4 - Startup: Rainlendar.lnk = C:\Program Files\Rainlendar\Rainlendar.exe O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_12\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_12\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O20 - AppInit_DLLs: ????????P O20 - Winlogon Notify: byXRlKcY - C:\WINDOWS\ O22 - SharedTaskScheduler: erajhsf8743kjrngjnf - {D5BF4552-94F1-42BD-F434-3604812C807D} - C:\WINDOWS\system32\rakmdlkd83indfgnbu.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe -- End of file - 6873 bytes

Profil

diarno Poslao: 19 Jan 2009 19:14 Idi na vrh
offline diarno Anti Malware Fighter Rank 2 Pridružio: 15 Jun 2007 Poruke: 5572	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! POzdrav... Uradi sledece : * Pokreni ESET Smart Security/ESET NOD32 na sledeci nacin : Start>All Programs>ESET>ESET Smart Security ili pak ESET NOD32 Antivirus(ukoliko koristis samo Antivirus resenje). * Kada ti se otvori glavni prozor programa, klikni na Setup opciju sa leve strane prozora; * Izaberi Antivirus and antispyware opciju i klikni na Temporarily disable Antivirus and antispyware protection. * Na sledece pitanje klikni Yes. Napomena: Ne zaboravi da ukljuciš ovu opciju po završetku cišcenja. Skini ComboFix sa jedne od sledecih adresa na Desktop: [Link mogu videti samo ulogovani korisnici] [Link mogu videti samo ulogovani korisnici] [Link mogu videti samo ulogovani korisnici] Startuj ga i ne diraj prozor programa dok skenira. Sledi uputstva na ekranu. Kada zavrsi pojavice se log (C:\ComboFix.txt) koji ces nam ovde iskopirati.

Profil

gagi_lape Poslao: 19 Jan 2009 20:15 Idi na vrh
offline gagi_lape Novi MyCity građanin Pridružio: 19 Jan 2009 Poruke: 5	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Evo i to: ComboFix 09-01-19.01 - Gago 2009-01-19 19:55:45.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.511.89 [GMT 1:00] Running from: c:\documents and settings\Gago\Desktop\ComboFix.exe AV: ESET NOD32 Antivirus 3.0 On-access scanning disabled (Updated) * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\AntiSpyKit 5.3 c:\program files\AntiSpyKit 5.3\DbgHelp.Dll c:\program files\AntiSpyKit 5.3\ignored.lst c:\program files\AntiSpyKit 5.3\Logs\scan_log_04082008-215407.html c:\program files\AntiSpyKit 5.3\Logs\scan_log_04082008-215741.html c:\program files\AntiSpyKit 5.3\Logs\scan_log_04082008-223152.html c:\program files\AntiSpyKit 5.3\Logs\scan_log_04082008-224658.html c:\program files\AntiSpyKit 5.3\monitorConfig.xml c:\program files\AntiSpyKit 5.3\usageStats.xml c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013 c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini c:\windows\system32\bdvjlnbh.dll c:\windows\system32\byXRlKcY.dll c:\windows\system32\cbXqnlJd.dll c:\windows\system32\cutlcoju.dll c:\windows\system32\dJlnqXbc.ini c:\windows\system32\dJlnqXbc.ini2 c:\windows\system32\frxghejy.dll c:\windows\system32\gugmymxi.dll c:\windows\system32\huvaexno.dll c:\windows\system32\mcrh.tmp c:\windows\system32\mpggudux.dll c:\windows\system32\nqucjbgj.dll c:\windows\system32\rakmdlkd83indfgnbu.dll c:\windows\Tasks\gswkfwgc.job . ((((((((((((((((((((((((( Files Created from 2008-12-19 to 2009-01-19 ))))))))))))))))))))))))))))))) . 2009-01-19 18:52 . 2009-01-19 18:53 1,407,643 --ahs---- c:\windows\system32\jgbjcuqn.ini 2009-01-19 08:43 . 2009-01-19 08:43 120 --ahs---- c:\windows\system32\ixmymgug.ini 2009-01-18 08:42 . 2009-01-18 08:42 1,407,285 --ahs---- c:\windows\system32\hbnljvdb.ini 2009-01-17 08:35 . 2009-01-17 08:35 1,407,263 --ahs---- c:\windows\system32\xuduggpm.ini 2009-01-16 07:34 . 2009-01-16 07:34 1,379,489 --ahs---- c:\windows\system32\yjehgxrf.ini 2009-01-14 22:18 . 2009-01-14 22:19 1,369,733 --ahs---- c:\windows\system32\onxeavuh.ini 2009-01-14 19:12 . 2009-01-14 19:12 1,369,733 --ahs---- c:\windows\system32\jtqfcwex.ini 2009-01-13 19:10 . 2009-01-13 19:11 1,353,077 --ahs---- c:\windows\system32\ujocltuc.ini 2009-01-09 15:27 . 2009-01-09 15:27 1,025 --a------ c:\windows\sysconnect.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-12 08:04 17,857,536 -c--a-w c:\program files\eav_nt32_enu.msi 2008-02-21 11:13 16,384 -csha-w c:\windows\system32\config\systemprofile\Cookies\index.dat 2008-02-21 11:13 32,768 -csha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat 2008-02-21 11:13 32,768 -csha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008022120080222\index.dat 2008-02-21 11:13 32,768 -csha-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat . ------- Sigcheck ------- 2007-05-30 03:31 823296 b8f4db39ca7353752f245379d285c80e c:\windows\ie7updates\KB947864-IE7\wininet.dll 2008-03-01 14:03 818176 b8edb26c7ffeff20a0f0c07831609a63 c:\windows\system32\wininet.dll 2008-03-01 14:03 818176 b8edb26c7ffeff20a0f0c07831609a63 c:\windows\system32\dllcache\wininet.dll 2007-06-13 12:26 975360 31ec9657d9c76143f6e61fc19851445f c:\windows\explorer.exe 2007-05-30 03:28 1033216 42d32722b805d7df42d30487a0bcbd78 c:\windows\$NtUninstallKB938828$\explorer.exe 2007-06-13 12:26 975360 31ec9657d9c76143f6e61fc19851445f c:\windows\system32\dllcache\explorer.exe 2007-07-30 18:19 68440 84d9a61860272d6177d46c86b8431557 c:\windows\system32\wuauclt.exe 2007-07-30 18:19 68440 84d9a61860272d6177d46c86b8431557 c:\windows\system32\dllcache\wuauclt.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2007-05-28 95800] "msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-12 68856] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2007-05-29 1694208] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648] "SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_12\bin\jusched.exe" [2007-05-02 75520] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-12-21 1443072] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-07-09 36352] "USB Storage Toolbox"="c:\program files\USB Disk Win98 Driver\Res.EXE" [2005-09-14 65536] "SoundMan"="SOUNDMAN.EXE" [2002-11-19 c:\windows\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "ShowDeskFix"="shell32" [X] "RunNarrator"="Narrator.exe" [2007-05-30 c:\windows\system32\narrator.exe] c:\documents and settings\Gago\Start Menu\Programs\Startup\ Rainlendar.lnk - c:\program files\Rainlendar\Rainlendar.exe [2006-01-21 118784] RocketDock.lnk - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-18 630784] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Pinnacle\\Pinnacle PCTV\\TeleText\\WebServer.exe"= R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2007-12-21 33800] R3 pctvvbi;PCTVVBI;c:\windows\system32\drivers\pctvvbi.sys [2008-10-23 6369] R3 SKYNET;TechniSat DVB-PC TV Star PCI;c:\windows\system32\drivers\SkyNET.sys [2008-10-23 462212] R4 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2007-12-21 468224] S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service;c:\program files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328] . - - - - ORPHANS REMOVED - - - - BHO-{782B90F9-A468-4815-88F3-1114DB17D77E} - c:\windows\system32\cbXqnlJd.dll MSConfigStartUp-ATICCC - c:\program files\ATI Technologies\ATI.ACE\cli.exe MSConfigStartUp-MsnMsgr - c:\program files\MSN Messenger\MsnMsgr.Exe MSConfigStartUp-QuickTime Task - c:\program files\QuickTime\qttask.exe MSConfigStartUp-WinSpywareProtect - c:\documents and settings\All Users\Application Data\Adsl Software Ltd\WinSpywareProtect\Winspywareprotect.exe . ------- Supplementary Scan ------- . uInternet Connection Wizard,ShellNext = iexplore IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Gago\Application Data\Mozilla\Firefox\Profiles\9cnd88vg.default\ FF - prefs.js: browser.startup.homepage - [Link mogu videti samo ulogovani korisnici] FF - plugin: c:\program files\Java\jre1.5.0_12\bin\NPJava11.dll FF - plugin: c:\program files\Java\jre1.5.0_12\bin\NPJava12.dll FF - plugin: c:\program files\Java\jre1.5.0_12\bin\NPJava13.dll FF - plugin: c:\program files\Java\jre1.5.0_12\bin\NPJava14.dll FF - plugin: c:\program files\Java\jre1.5.0_12\bin\NPJava32.dll FF - plugin: c:\program files\Java\jre1.5.0_12\bin\NPJPI150_12.dll FF - plugin: c:\program files\Java\jre1.5.0_12\bin\NPOJI610.dll FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll . ************************************************************************ catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici] Rootkit scan 2009-01-19 20:01:36 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(936) c:\windows\system32\Ati2evxx.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\ati2evxx.exe c:\windows\system32\ati2evxx.exe c:\windows\system32\LEXBCES.EXE c:\windows\system32\LEXPPS.EXE c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE . ************************************************************************ . Completion time: 2009-01-19 20:05:16 - machine was rebooted ComboFix-quarantined-files.txt 2009-01-19 19:05:00 Pre-Run: 2.533.654.528 bytes free Post-Run: 2,528,522,240 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 166 --- E O F --- 2008-07-07 23:29:30

Profil

diarno Poslao: 19 Jan 2009 21:13 Idi na vrh
offline diarno Anti Malware Fighter Rank 2 Pridružio: 15 Jun 2007 Poruke: 5572	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Otvoriti Notepad i iskopirati sledeci tekst: `File:: c:\windows\system32\jgbjcuqn.ini c:\windows\system32\ixmymgug.ini c:\windows\system32\hbnljvdb.ini c:\windows\system32\xuduggpm.ini c:\windows\system32\yjehgxrf.ini c:\windows\system32\onxeavuh.ini c:\windows\system32\jtqfcwex.ini c:\windows\system32\ujocltuc.ini c:\windows\sysconnect.exe` Snimiti na Desktop fajl iz Notepada kao "CFScript" Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici. Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

Profil

gagi_lape Poslao: 19 Jan 2009 22:01 Idi na vrh
offline gagi_lape Novi MyCity građanin Pridružio: 19 Jan 2009 Poruke: 5	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! ComboFix 09-01-19.01 - Gago 2009-01-19 21:48:50.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.511.87 [GMT 1:00] Running from: c:\documents and settings\Gago\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Gago\Desktop\CFScript.txt AV: ESET NOD32 Antivirus 3.0 On-access scanning disabled (Updated) * Created a new restore point FILE :: c:\windows\sysconnect.exe c:\windows\system32\hbnljvdb.ini c:\windows\system32\ixmymgug.ini c:\windows\system32\jgbjcuqn.ini c:\windows\system32\jtqfcwex.ini c:\windows\system32\onxeavuh.ini c:\windows\system32\ujocltuc.ini c:\windows\system32\xuduggpm.ini c:\windows\system32\yjehgxrf.ini . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\sysconnect.exe c:\windows\system32\hbnljvdb.ini c:\windows\system32\ixmymgug.ini c:\windows\system32\jgbjcuqn.ini c:\windows\system32\jtqfcwex.ini c:\windows\system32\onxeavuh.ini c:\windows\system32\ujocltuc.ini c:\windows\system32\xuduggpm.ini c:\windows\system32\yjehgxrf.ini . ((((((((((((((((((((((((( Files Created from 2008-12-19 to 2009-01-19 ))))))))))))))))))))))))))))))) . No new files created in this timespan . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-12 08:04 17,857,536 -c--a-w c:\program files\eav_nt32_enu.msi 2008-02-21 11:13 16,384 -csha-w c:\windows\system32\config\systemprofile\Cookies\index.dat 2008-02-21 11:13 32,768 -csha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat 2008-02-21 11:13 32,768 -csha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008022120080222\index.dat 2008-02-21 11:13 32,768 -csha-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat . ------- Sigcheck ------- 2007-05-30 03:31 823296 b8f4db39ca7353752f245379d285c80e c:\windows\ie7updates\KB947864-IE7\wininet.dll 2008-03-01 14:03 818176 b8edb26c7ffeff20a0f0c07831609a63 c:\windows\system32\wininet.dll 2008-03-01 14:03 818176 b8edb26c7ffeff20a0f0c07831609a63 c:\windows\system32\dllcache\wininet.dll 2007-06-13 12:26 975360 31ec9657d9c76143f6e61fc19851445f c:\windows\explorer.exe 2007-05-30 03:28 1033216 42d32722b805d7df42d30487a0bcbd78 c:\windows\$NtUninstallKB938828$\explorer.exe 2007-06-13 12:26 975360 31ec9657d9c76143f6e61fc19851445f c:\windows\system32\dllcache\explorer.exe 2007-07-30 18:19 68440 84d9a61860272d6177d46c86b8431557 c:\windows\system32\wuauclt.exe 2007-07-30 18:19 68440 84d9a61860272d6177d46c86b8431557 c:\windows\system32\dllcache\wuauclt.exe . ((((((((((((((((((((((((((((( [Link mogu videti samo ulogovani korisnici] ))))))))))))))))))))))))))))))))))))))))) . + 2005-10-20 19:02:28 163,328 ----a-w c:\windows\ERDNT\Hiv-backup\ERDNT.EXE - 2009-01-19 17:55:47 41,040 ----a-w c:\windows\system32\perfc009.dat + 2009-01-19 19:05:42 41,040 ----a-w c:\windows\system32\perfc009.dat - 2009-01-19 17:55:47 314,838 ----a-w c:\windows\system32\perfh009.dat + 2009-01-19 19:05:42 314,838 ----a-w c:\windows\system32\perfh009.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2007-05-28 95800] "msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-12 68856] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2007-05-29 1694208] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648] "SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_12\bin\jusched.exe" [2007-05-02 75520] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-12-21 1443072] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-07-09 36352] "USB Storage Toolbox"="c:\program files\USB Disk Win98 Driver\Res.EXE" [2005-09-14 65536] "SoundMan"="SOUNDMAN.EXE" [2002-11-19 c:\windows\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "ShowDeskFix"="shell32" [X] "RunNarrator"="Narrator.exe" [2007-05-30 c:\windows\system32\narrator.exe] c:\documents and settings\Gago\Start Menu\Programs\Startup\ Rainlendar.lnk - c:\program files\Rainlendar\Rainlendar.exe [2006-01-21 118784] RocketDock.lnk - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-18 630784] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Pinnacle\\Pinnacle PCTV\\TeleText\\WebServer.exe"= R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2007-12-21 33800] R3 pctvvbi;PCTVVBI;c:\windows\system32\drivers\pctvvbi.sys [2008-10-23 6369] R3 SKYNET;TechniSat DVB-PC TV Star PCI;c:\windows\system32\drivers\SkyNET.sys [2008-10-23 462212] R4 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2007-12-21 468224] S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service;c:\program files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328] . . ------- Supplementary Scan ------- . uInternet Connection Wizard,ShellNext = iexplore IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Gago\Application Data\Mozilla\Firefox\Profiles\9cnd88vg.default\ FF - prefs.js: browser.startup.homepage - [Link mogu videti samo ulogovani korisnici] FF - plugin: c:\program files\Java\jre1.5.0_12\bin\NPJava11.dll FF - plugin: c:\program files\Java\jre1.5.0_12\bin\NPJava12.dll FF - plugin: c:\program files\Java\jre1.5.0_12\bin\NPJava13.dll FF - plugin: c:\program files\Java\jre1.5.0_12\bin\NPJava14.dll FF - plugin: c:\program files\Java\jre1.5.0_12\bin\NPJava32.dll FF - plugin: c:\program files\Java\jre1.5.0_12\bin\NPJPI150_12.dll FF - plugin: c:\program files\Java\jre1.5.0_12\bin\NPOJI610.dll FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll . ************************************************************************ catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici] Rootkit scan 2009-01-19 21:50:22 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(936) c:\windows\system32\Ati2evxx.dll . Completion time: 2009-01-19 21:52:49 ComboFix-quarantined-files.txt 2009-01-19 20:52:18 ComboFix2.txt 2009-01-19 19:05:17 Pre-Run: 2.473.992.192 bytes free Post-Run: 2,452,369,408 bytes free 139 --- E O F --- 2008-07-07 23:29:30

Profil

diarno Poslao: 19 Jan 2009 22:07 Idi na vrh
offline diarno Anti Malware Fighter Rank 2 Pridružio: 15 Jun 2007 Poruke: 5572	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Kakvo je sada stanje?

Profil

gagi_lape Poslao: 19 Jan 2009 22:13 Idi na vrh
offline gagi_lape Novi MyCity građanin Pridružio: 19 Jan 2009 Poruke: 5	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! pa sad izgleda malo bolje, i dalje je malo sporiji nego inace. je li log fajl cist?

Profil

diarno Poslao: 19 Jan 2009 22:21 Idi na vrh
offline diarno Anti Malware Fighter Rank 2 Pridružio: 15 Jun 2007 Poruke: 5572	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Log je cist... Ovde vise nema malicioznih fajlova... Mozes probati neki od ovih saveta : [Link mogu videti samo ulogovani korisnici] Uradi jos i ovo : Klikni START a zatim RUN U liniju za unos teksta ukucaj Combofix /u i klikni OK Sačekaj da se proces deinstalacije završi Gornja procedura će: Obrisati sledeće: ComboFix i njegove file-ove i foldere VundoFix Backups folder, ako postoji C:\Deckard folder, ako postoji C:\OtMoveIt folder, ako postoji Resetovati podešavanja sata na kompjuteru Sakriti ekstenzije file-ova, ako je potrebno Sakriti sistemske/skrivene file-ove/foldere, ako je potrebno Resetovati System Restore PozZz

Profil

gagi_lape Poslao: 19 Jan 2009 22:26 Idi na vrh
offline gagi_lape Novi MyCity građanin Pridružio: 19 Jan 2009 Poruke: 5	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! ok hvala ti na vremenu

Profil

MyCity » Ambulanta -> Arhiva Ambulante » Pomoc virusi

Ko je trenutno na forumu

Ukupno su 6508 korisnika na forumu :: 56 registrovanih, 5 sakrivenih i 6447 gosta :: [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 20624 - dana 04 Apr 2026 04:18

Korisnici koji su trenutno na forumu:: Korisnici trenutno na forumu: -[CoA]-, -III-, 357magnum, ajo baba, ALEKSICMILE, Asparagus, Avalon015, bokicacar, BORUTUS, bukefal, bunker, CLIPPER, comi_pfc, damirZR, deki1001, desmeki, Djota1, Dorcolac, dusanobr, gobrad, goxin, Grebostrek, Jeremiah, Kajzer Soze, kibihrchak, kolle.the.kid, Leonov, Levi, MagicniHerpes, mačković, Mi lao shu, MIg, milenko crazy north, Milos1987, mir juzni, mnn2, MrG, nazgul75, novator, Paklenica, Petarvu, Polemarchoi, proka89, Remarqe, singa, slucajniprolaznik.ba, stagezin, tajvankanasta, Tamna_strana_Meseca, trajkoni018, VJ, Vlad000, vladaa012, vzd1389, ZetaMan, zlaya011

Svaki korisnik ovog sajta je odgovoran za sadržaj svoje poruke koju objavi na sajtu. Sajt se odriče svake odgovornosti za sadržaj tih poruka.
Postavljanjem vaše poruke ili vašeg autorskog dela na ovaj sajt, saglasni ste da ovaj sajt postaje distributer vašeg dela, i odričete se mogućnosti njegovog povlačenja ili brisanja, bez saglasnosti uprave sajta.
Distribucija sadržaja sa ovog sajta je dozvoljena samo u nekomercijalne svrhe, uz obaveznu napomenu da je sadržaj preuzet sa ovog sajta, i uz obavezno navođenje adrese MyCity sajta. Za sve ostale vidove distribucije obavezni ste da prethodno zatražite odobrenje od vlasnika MyCity sajta.
MyCity pokrenuo, administrira i razvija Predrag Damnjanović, a o uređenju sajta se brine MyCity Tim.
Ukoliko želite da nas kontaktirate kliknite ovde.
Naši sajtovi:
Vesti, Vojni forum, Zaštita od virusa, TekstPesme.rs

This content is licensed under a Creative Commons License.
Based on phpBB 2, translated by Simke, designed by