Problem!!!

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Uloguj se preko Facebooka da bi skinuo fajl:

Napisano: 18 Apr 2011 22:23

USBNoRisk 2.7 (28 December 2010) by bobby

Started at 25.3.2011 19:44:39

Searching for connected USB Mass storage...
----------------------------------------
========================================

Searching for other storage...
----------------------------------------
D: {1b13654d-458c-11de-a247-806d6172696f}
E: {1b13654e-458c-11de-a247-806d6172696f}
C: {1b13654f-458c-11de-a247-806d6172696f}
========================================


Scanning fixed storage...
----------------------------------------

No blocked files found on C:
No autorun.inf files found on C:
No mountpoint found for C:
No mountpoint found for 1b13654f-458c-11de-a247-806d6172696f
No Desktop.ini files found on C:
----------------------------------------

No blocked files found on D:
No autorun.inf files found on D:
No mountpoint found for D:
No mountpoint found for 1b13654d-458c-11de-a247-806d6172696f
No Desktop.ini files found on D:
----------------------------------------

No blocked files found on E:
No autorun.inf files found on E:
No mountpoint found for E:
No mountpoint found for 1b13654e-458c-11de-a247-806d6172696f
No Desktop.ini files found on E:
----------------------------------------

========================================
Initial scan finished!
========================================


New device connected at 25.3.2011 19:45:01

Scanning for connected USB mass storage...
----------------------------------------
G: {67824d00-5457-11df-a7a1-00064f300101}
Added G:
========================================

Scanning USB mass storage for files...
----------------------------------------
Blocked file found: G:\autorun.inf.blocked
----------------------------------------
Content of G:\autorun.inf.blocked
----------------------------------------
[autorun]
USEAUTOPLAY=1
shellexcute=siljo/kramponja.exe
Shellbretoje=
icon=siljo/kramponja.exe
action=open folderto view files usingWindowsExplorer
----------------------------------------

Files referenced from G:\autorun.inf.blocked
----------------------------------------
None
----------------------------------------

----------------------------------------
No autorun.inf files found on G:
Sanitized mountpoint for 67824d00-5457-11df-a7a1-00064f300101
----------------------------------------

No Desktop.ini files found on G:
----------------------------------------

No mimics found on drive G:
----------------------------------------

No .lnk/.pif/.com/.scr files found on drive G:
========================================

========================================
Removed G:
========================================


New device connected at 25.3.2011 19:45:43

Scanning for connected USB mass storage...
----------------------------------------
G: {b1a4a6d1-23dc-11e0-a90d-00064f300101}
Added G:
========================================

Scanning USB mass storage for files...
----------------------------------------
Blocked file found: G:\autorun.inf.blocked
----------------------------------------
Content of G:\autorun.inf.blocked
----------------------------------------
[autorun]
USEAUTOPLAY=1
shellexcute=sminkom/krijebol.exe
Shellgori
shell\\explore\\command=sminkom/krijebol.exe
shell\open\\command=sminkom/krijebol.exe
icon=sminkom/krijebol.exe
open=sminkom/krijebol.exe
action=open folder to view files using Windows Explorer
----------------------------------------

Files referenced from G:\autorun.inf.blocked
----------------------------------------
None
----------------------------------------

----------------------------------------
No autorun.inf files found on G:
Sanitized mountpoint for b1a4a6d1-23dc-11e0-a90d-00064f300101
----------------------------------------

No Desktop.ini files found on G:
----------------------------------------

No mimics found on drive G:
----------------------------------------

No .lnk/.pif/.com/.scr files found on drive G:
========================================

========================================
Removed G:
========================================


New device connected at 25.3.2011 19:45:53

Scanning for connected USB mass storage...
----------------------------------------
G: {b1a4a6d1-23dc-11e0-a90d-00064f300101}
Added G:
========================================

Scanning USB mass storage for files...
----------------------------------------
Blocked file found: G:\autorun.inf.blocked
----------------------------------------
Content of G:\autorun.inf.blocked
----------------------------------------
[autorun]
USEAUTOPLAY=1
shellexcute=sminkom/krijebol.exe
Shellgori
shell\\explore\\command=sminkom/krijebol.exe
shell\open\\command=sminkom/krijebol.exe
icon=sminkom/krijebol.exe
open=sminkom/krijebol.exe
action=open folder to view files using Windows Explorer
----------------------------------------

Files referenced from G:\autorun.inf.blocked
----------------------------------------
None
----------------------------------------

----------------------------------------
No autorun.inf files found on G:
Sanitized mountpoint for b1a4a6d1-23dc-11e0-a90d-00064f300101
----------------------------------------

No Desktop.ini files found on G:
----------------------------------------

No mimics found on drive G:
----------------------------------------

No .lnk/.pif/.com/.scr files found on drive G:
========================================

========================================
Removed G:
========================================


New device connected at 25.3.2011 19:46:17

Scanning for connected USB mass storage...
----------------------------------------

========================================
New drive connected, but USBNoRisk can't find it
========================================



New device connected at 25.3.2011 19:46:21

Scanning for connected USB mass storage...
----------------------------------------
H: {c35ba4fa-493a-11de-a595-001558a6d62b}
Added H:
========================================

Scanning USB mass storage for files...
----------------------------------------
Blocked file found: H:\autorun.inf.blocked
----------------------------------------
Content of H:\autorun.inf.blocked
----------------------------------------
[autorun]
open=albkpq3.exe
shell\open\command=albkpq3.exe
----------------------------------------

Files referenced from H:\autorun.inf.blocked
----------------------------------------
H:\albkpq3.exe -r-hs 174592
----------------------------------------

----------------------------------------
No autorun.inf files found on H:
Sanitized mountpoint for c35ba4fa-493a-11de-a595-001558a6d62b
----------------------------------------

No Desktop.ini files found on H:
----------------------------------------

No mimics found on drive H:
----------------------------------------

No .lnk/.pif/.com/.scr files found on drive H:
========================================

========================================
Removed H:
========================================

Processing script
----------------------------------------
1b13654d-458c-11de-a247-806d6172696f
Drive letter for GUID: D:
SectionStart = 4
SectionEnd = 7
----------------------------------------
Deleting blocked files:
----------------------------------------
None
f_delete: D:\albkpq3.exe > File does not exist!
----------------------------------------

1b13654e-458c-11de-a247-806d6172696f
Drive letter for GUID: E:
SectionStart = 8
SectionEnd = 11
----------------------------------------
Deleting blocked files:
----------------------------------------
None
f_delete: E:\albkpq3.exe > File does not exist!
----------------------------------------

1b13654f-458c-11de-a247-806d6172696f
Drive letter for GUID: C:
SectionStart = 0
SectionEnd = 3
----------------------------------------
Deleting blocked files:
----------------------------------------
None
f_delete: C:\albkpq3.exe > File does not exist!
----------------------------------------

Dopuna: 18 Apr 2011 22:23

.
DDS (Ver_11-03-05.01) - NTFSx86
Run by jovana at 19:50:47,78 on pet 25.03.2011
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_20
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.446.156 [GMT 1:00]
.
AV: ESET NOD32 Antivirus 3.0 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
============== Running Processes ===============
.
D:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
D:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
D:\WINDOWS\system32\spoolsv.exe
svchost.exe
D:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\WINDOWS\system32\svchost.exe -k imgsvc
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\VTTimer.exe
D:\WINDOWS\system32\S3trayp.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
D:\Program Files\Conexant\Adsl\dslstat.exe
D:\Program Files\Conexant\Adsl\dslagent.exe
D:\Program Files\Common Files\Java\Java Update\jusched.exe
D:\WINDOWS\FixCamera.exe
D:\WINDOWS\vsnpstd3.exe
D:\WINDOWS\tsnpstd3.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Windows Live\Messenger\msnmsgr.exe
D:\Program Files\Windows Live\Contacts\wlcomm.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Mozilla Firefox\plugin-container.exe
D:\Documents and Settings\jovana\My Documents\dds.scr
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://mn.iamwired.net/
uSearch Page = hxxp://search.live.com
mDefault_Search_URL = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13925&gct=&gc=1&q=
uInternet Connection Wizard,ShellNext = hxxp://www.ask.com/?o=13928&l=dis
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13925&gct=&gc=1&q=%s
mSearchAssistant = hxxp://search.live.com/sphome.aspx
uURLSearchHooks: DefaultSearchHook Class: {c94e154b-1459-4a47-966b-4b843befc7db} - d:\program files\asksearch\bin\DefaultSearch.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - d:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Windows Live pomagac za prijavljivanje: {9030d464-4c02-4abf-8ecc-5164760863c6} - d:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - d:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - d:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [ctfmon.exe] d:\windows\system32\ctfmon.exe
uRun: [Skype] "d:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [msnmsgr] "d:\program files\windows live\messenger\msnmsgr.exe" /background
mRun: [VTTimer] VTTimer.exe
mRun: [S3Trayp] S3trayp.exe
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [Adobe Reader Speed Launcher] "d:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [NeroFilterCheck] d:\windows\system32\NeroCheck.exe
mRun: [egui] "d:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
mRun: [ISUSPM Startup] "d:\program files\common files\installshield\updateservice\isuspm.exe" -startup
mRun: [ISUSScheduler] "d:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [DSLSTATEXE] d:\program files\conexant\adsl\dslstat.exe icon
mRun: [DSLAGENTEXE] d:\program files\conexant\adsl\dslagent.exe
mRun: [SunJavaUpdateSched] "d:\program files\common files\java\java update\jusched.exe"
mRun: [FixCamera] d:\windows\FixCamera.exe
mRun: [snpstd3] d:\windows\vsnpstd3.exe
mRun: [tsnpstd3] d:\windows\tsnpstd3.exe
StartupFolder: d:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - d:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
IE: E&xport to Microsoft Excel - d:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - d:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - d:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} -
.
================= FIREFOX ===================
.
FF - ProfilePath - d:\docume~1\jovana\applic~1\mozilla\firefox\profiles\7dfta64z.default\
FF - prefs.js: browser.search.defaulturl - hxxp://mn.iamwired.net/websearch.php?src=tops&search=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://mn.iamwired.net/
FF - prefs.js: keyword.URL - hxxp://mn.iamwired.net/websearch.php?src=tops&search=
FF - plugin: d:\documents and settings\jovana\application data\facebook\npfbplugin_1_0_3.dll
FF - plugin: d:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - d:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - d:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - d:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Quick Starter: jqs@sun.com - d:\program files\java\jre6\lib\deploy\jqs\ff
.
============= SERVICES / DRIVERS ===============
.
R1 epfwtdir;epfwtdir;d:\windows\system32\drivers\epfwtdir.sys [2007-12-21 33800]
R2 ekrn;Eset Service;d:\program files\eset\eset nod32 antivirus\ekrn.exe [2007-12-21 468224]
R3 S3GIGP;S3GIGP;d:\windows\system32\drivers\S3gIGPm.sys [2009-5-20 808448]
S3 qcusbser;Modem Interface USB Device for Legacy Serial Communication;d:\windows\system32\drivers\qcusbser.sys [2010-11-3 103552]
.
=============== Created Last 30 ================
.
2011-03-20 17:02:56 -------- d-----w- D:\USBNoRisk
2011-03-17 10:04:51 388 ----a-w- D:\avexport.bat
2011-03-16 08:38:49 26624 ----a-w- d:\windows\system32\dll.dll
.
==================== Find3M ====================
.
2011-02-16 09:19:45 2516 --sha-w- d:\windows\system32\KGyGaAvL.sys
.
============= FINISH: 19:51:25,42 ===============

Dopuna: 18 Apr 2011 22:27

mycity.rs/must-login.png

mycity.rs/must-login.png

mycity.rs/must-login.png

mycity.rs/must-login.png

Dopuna: 18 Apr 2011 22:31

Mnogo hvala za dosadasnju pomoc..Ja se izvinjavam sto odgovaram sa zakasnjenjem ali sam bila u nekom poslu pa nikako nisam stizala..KOnekcija adsl modema (preko usb-a) i kompjutera i dalje ne funkcionise bas najbolje na ovom kompjuteru dok na drugom radi besprekorno pa me zanima da li je to uzrokovano virusom ili je rec o necemu drugom
Jos jednom hvala na trudu za resavanje mog problema ))

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Pozdrav,




Prikaži sve skrivene datoteke na računaru prateći ovo uputstvo:
http://www.mycity.rs/Uputstva/Kako-videti-skrivene-fajlove.html




Neophodno je da obrišeš dve datoteke koje se nalaze na sledećoj lokaciji:

Citat:D:\avexport.bat
d:\windows\system32\dll.dll




Ubaci USB memorijske uređaje na računar i obriši sve datoteke i direktorijume koji su ti nepoznati kao što su:

albkpq3.exe
kramponja.exe
krijebol.exe
siljo
sminkom



Nakon što obaviš ove radnje, napiši kakvo je stanje računara.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

stanje racunara je nazalost gotovo nepromenjeno
sistem se i dalje dize jako sporo, sve je usporeno, npr. kad ukljucim muziku u winampu cak i pesme seckaju
adsl modem se jedva konektuje, neko vreme radi i iskljuci se, odnosno racunar kao da ga ne prepoznaje
ima li pomoci?

• 1Ovo se svidja korisniku: Springfield
  
  Registruj se da bi pohvalio/la poruku!

Pozdrav,

Na računaru nemaš aktivnog malware-a, stoga predlažem da otvoriš temu u Windows potforumu za dalje akcije.

Preporučujem ti da instaliraš najnoviju verziju antivirusa kojeg poseduješ

Preporučujem ti da koristiš program MCShield za zaštitu USB memorijskih uređaja.

Program možeš preuzeti sa ovog linka. Nakon instalacije priključiš USB memorijske uređaje, koji će biti skenirani. Na kraju skeniranja ćeš dobiti izveštaj da je uređaj čist ili obaveštenje o uklonjenom malware-u.



AMF tim

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

hvala mnogo, svakako cu poslusati savete..