Problem sa 2 virusa. pomoc

1

Problem sa 2 virusa. pomoc

offline
  • Pridružio: 18 Jul 2008
  • Poruke: 115
  • Gde živiš: Majur

Log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:21:12 PM, on 2/28/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\SetPoints.exe
C:\Program Files\Gigabyte\Gigabyte WP01GS Wireless PCI Adapter SoftAP\Installer\WINXP\RaUI.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Achilles-Script 5.0 Black\Mirc.exe
C:\WINDOWS\system32\mspaint.exe
C:\WINDOWS\system32\svchost.exe
C:\Mihailo`\Programi WinXp\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = search.bearshare.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = search.bearshare.com/intl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Microsoft Update] SetPoints.exe
O4 - HKLM\..\RunServices: [Microsoft Update] SetPoints.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: GN-WP01GS Utility.lnk = C:\Program Files\Gigabyte\Gigabyte WP01GS Wireless PCI Adapter SoftAP\Installer\WINXP\RaUI.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{4BE5F4F9-5C64-42B2-9692-AAE6652B8F71}: NameServer = 10.5.0.100,10.5.0.200
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--
End of file - 4844 bytes

---------------------------------------------------------------------------

Slika:


Objasnjenje:
kad ubacim flesh odma javlja za ovaj autorun.inf svaki sekund iskace, a ovaj a.bat kad podigne sistem javi jednom. flesh formatiram ono opet odma javlja da ima znaci da je na hdd-u i vraca ga ne moze nista da ga obrise od programcica tj. obrise ga i opet se vrati odma znaci strasno.
Hvala

offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8617
  • Gde živiš: Novi Beograd

Zdravo,

* Pokreni ESET Smart Security/ESET NOD32 na sledeci nacin :
Start>All Programs>ESET>ESET Smart Security ili pak ESET NOD32 Antivirus(ukoliko koristis samo Antivirus resenje).

* Kada ti se otvori glavni prozor programa, klikni na Setup opciju sa leve strane prozora;
* Izaberi Antivirus and antispyware opciju i klikni na Temporarily disable Antivirus and antispyware protection.
* Na sledece pitanje klikni Yes.

Napomena: Ne zaboravi da ukljuciš ovu opciju po završetku cišcenja.

------------------

Skini ComboFix sa jedne od sledecih adresa na Desktop:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.forospyware.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

Startuj ga i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu. Kada zavrsi pojavice se log (C:\ComboFix.txt) koji ces nam ovde iskopirati.

offline
  • Pridružio: 18 Jul 2008
  • Poruke: 115
  • Gde živiš: Majur

ComboFix 09-02-27.02 - Aleksandar 2009-02-28 18:40:28.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.735.377 [GMT 1:00]
Running from: c:\documents and settings\Aleksandar\Desktop\ComboFix.exe
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated)
AV: Spyware Doctor with AntiVirus *On-access scanning enabled* (Updated)
FW: ESET Personal firewall *enabled*
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013
c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini
c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013\windowsupdate.com
c:\windows\system32\_000006_.tmp.dll

.
((((((((((((((((((((((((( Files Created from 2009-01-28 to 2009-02-28 )))))))))))))))))))))))))))))))
.

2009-02-23 19:00 . 2009-02-23 19:01 <DIR> d-------- c:\program files\Hewlett-Packard
2009-02-15 22:09 . 2001-11-01 16:24 731,355,136 --a------ C:\YoungDebutants.vob
2009-02-07 20:36 . 2009-02-07 20:36 <DIR> d-------- c:\windows\Sun
2009-02-07 00:10 . 2009-02-07 00:10 <DIR> d-------- c:\documents and settings\Aleksandar\Application Data\Nokia
2009-02-05 21:25 . 2009-02-05 21:25 <DIR> d----c--- c:\documents and settings\All Users\Application Data\{51019853-129C-4EDE-9030-D5FD7BBD9AD0}
2009-02-05 20:34 . 2009-02-28 18:40 <DIR> d-------- c:\program files\Achilles-Script 5.0 Black
2009-02-03 00:56 . 2009-02-03 00:56 <DIR> d-------- c:\program files\Java
2009-02-03 00:56 . 2009-02-03 00:56 410,984 --a------ c:\windows\system32\deploytk.dll
2009-02-03 00:56 . 2009-02-03 00:56 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-02-01 19:27 . 2009-02-01 19:27 1,077,336 -r--s---- c:\windows\system32\MSCOMCTL.OCX
2009-02-01 19:27 . 2009-02-01 19:27 140,488 -r------- c:\windows\system32\COMDLG32.OCX
2009-01-31 21:51 . 2009-01-31 21:51 <DIR> d-------- c:\program files\AVG
2009-01-29 20:17 . 2009-01-29 20:17 <DIR> d-------- c:\program files\Uniblue
2009-01-29 20:17 . 2009-01-29 20:17 <DIR> d-------- c:\documents and settings\Aleksandar\Application Data\Uniblue
2009-01-29 20:03 . 2009-01-29 20:04 <DIR> d-------- c:\program files\Common Files\PC Tools
2009-01-29 20:03 . 2008-07-28 12:29 160,792 --a------ c:\windows\system32\drivers\pctfw2.sys
2009-01-29 20:03 . 2008-08-25 12:36 81,288 --a------ c:\windows\system32\drivers\iksyssec.sys
2009-01-29 20:03 . 2008-08-25 12:36 66,952 --a------ c:\windows\system32\drivers\iksysflt.sys
2009-01-29 20:03 . 2008-08-25 12:36 40,840 --a------ c:\windows\system32\drivers\ikfilesec.sys
2009-01-29 20:03 . 2008-06-02 16:19 29,576 --a------ c:\windows\system32\drivers\kcom.sys
2009-01-29 18:09 . 2004-05-26 15:08 7,296 -r------- c:\windows\system32\drivers\EIO.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-24 21:49 --------- d-----w c:\program files\Professional §©®ÎÞt v.4 Black
2009-02-19 20:12 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-02-19 17:20 --------- d-----w c:\program files\Spyware Doctor
2009-02-15 12:42 --------- d-----w c:\program files\FlashGet
2009-02-05 20:05 --------- d-----w c:\program files\Counter-Strike
2009-02-01 18:05 2,079 ----a-w c:\windows\system32\M1achardks.dll
2009-01-24 22:22 4,100 ----a-w c:\windows\system32\hdvirffo.dll
2009-01-24 18:21 20,747 ----a-w c:\windows\system32\drivers\AegisP.sys
2009-01-24 18:20 --------- d-----w c:\program files\Gigabyte
2009-01-22 21:21 --------- d-----w c:\program files\D-Tools
2009-01-21 17:18 --------- d-----w c:\documents and settings\Aleksandar\Application Data\Ahead
2009-01-21 17:11 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-21 17:11 --------- d-----w c:\documents and settings\All Users\Application Data\Ahead
2009-01-21 17:09 --------- d-----w c:\program files\Common Files\Ahead
2009-01-21 17:07 --------- d-----w c:\program files\Nero
2009-01-21 17:07 --------- d-----w c:\documents and settings\All Users\Application Data\Nero
2009-01-20 21:35 --------- d-----w c:\program files\Valve
2009-01-20 17:21 --------- d-----w c:\program files\PC Tools Internet Security
2009-01-20 17:21 --------- d-----w c:\documents and settings\All Users\Application Data\PC Tools
2009-01-19 23:58 --------- d-----w c:\program files\EASEUS
2009-01-19 17:16 --------- d-----w c:\program files\Windows Live
2009-01-18 20:32 --------- d-----w c:\documents and settings\Aleksandar\Application Data\PCToolsSpamMonitorPlus
2009-01-18 20:32 --------- d-----w c:\documents and settings\Aleksandar\Application Data\PCToolsFirewallPlus
2009-01-17 17:26 729,088 ----a-w c:\windows\iun6002.exe
2009-01-15 23:14 --------- d-----w c:\program files\MSN Messenger
2009-01-15 23:14 --------- d-----w c:\program files\Messenger Plus! Live
2009-01-14 15:37 --------- d-----w c:\program files\Common Files\Windows Live
2009-01-14 15:30 --------- d-----w c:\documents and settings\Aleksandar\Application Data\PC Tools
2009-01-14 03:37 --------- d-----w c:\program files\Your Uninstaller 2008
2009-01-14 03:32 --------- d-----w c:\documents and settings\Aleksandar\Application Data\URSoft
2009-01-12 22:19 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-01-12 03:27 --------- d-----w c:\documents and settings\Aleksandar\Application Data\TeamViewer
2009-01-12 01:56 --------- d-----w c:\program files\Common Files\NSV
2009-01-10 21:37 --------- d-----w c:\program files\ATI Technologies
2009-01-10 14:22 --------- d-----w c:\program files\Lavalys
2008-12-28 13:37 --------- d-----w c:\documents and settings\Aleksandar\Application Data\ESET
2008-12-28 13:36 --------- d-----w c:\program files\ESET
2008-12-28 13:36 --------- d-----w c:\documents and settings\All Users\Application Data\ESET
2008-12-28 13:36 --------- d-----w c:\documents and settings\Aleksandar\Application Data\Winamp
2008-12-28 13:32 --------- d-----w c:\program files\Winamp
2008-04-14 04:42 263,168 --sh--r c:\windows\system32\SetPoints.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2007-12-21 1443072]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-03 136600]
"Microsoft Update"="SetPoints.exe" [2008-04-14 c:\windows\system32\SetPoints.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"Microsoft Update"="SetPoints.exe" [2008-04-14 c:\windows\system32\SetPoints.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-14 c:\windows\system32\narrator.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
GN-WP01GS Utility.lnk - c:\program files\Gigabyte\Gigabyte WP01GS Wireless PCI Adapter SoftAP\Installer\WINXP\RaUI.exe [2009-01-24 720896]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.3iv2"= 3ivxVfWCodec.dll
"VIDC.VP31"= vp31vfw.dll
"msacm.l3fhg"= mp3fhg.acm
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISTray

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-06-27 19:03 152872 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
--a------ 2004-08-22 17:05 81920 c:\program files\D-Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget]
--a------ 2007-09-25 10:29 2007088 c:\program files\FlashGet\flashget.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2008-04-14 05:42 1695232 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 12:54 5674352 c:\program files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2002-11-19 14:01 46592 c:\windows\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTPreset]
--a------ 2004-02-24 20:17 45056 c:\windows\system32\VTPreset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\Professional §©®ÎÞt v.4 Black\\mirc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\FlashGet\\FlashGet.exe"=

R1 pctfw2;pctfw2;c:\windows\system32\drivers\pctfw2.sys [2009-01-29 160792]
R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2007-12-21 468224]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-01-29 356920]
S3 Asushwio;Asushwio;c:\windows\system32\drivers\ASUSHWIO.SYS [2002-01-01 5824]
.
- - - - ORPHANS REMOVED - - - -

Notify-AtiExtEvent - (no file)


.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.bearshare.com/intl/
IE: &Download All with FlashGet - c:\program files\FlashGet\jc_all.htm
IE: &Download with FlashGet - c:\program files\FlashGet\jc_link.htm
LSP: c:\program files\Common Files\PC Tools\LSP\PCTLsp.dll
TCP: {4BE5F4F9-5C64-42B2-9692-AAE6652B8F71} = 10.5.0.100,10.5.0.200
FF - ProfilePath - c:\documents and settings\Aleksandar\Application Data\Mozilla\Firefox\Profiles\bxxmtu1l.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.com
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2009-02-28 18:42:12
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(652)
c:\program files\Common Files\PC Tools\LSP\PCTLsp.dll
.
Completion time: 2009-02-28 18:44:09
ComboFix-quarantined-files.txt 2009-02-28 17:43:57

Pre-Run: 969,269,248 bytes free
Post-Run: 1,002,315,776 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

174 --- E O F --- 2009-01-19 02:04:50

offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8617
  • Gde živiš: Novi Beograd

- Preuzmi USBNoRisk na Desktop i pokreni ga duplim klikom na ikonicu programa.
- Sacekaj koji sekund dok program izvrsi inicijalno skeniranje.
- Ubacuj sve USB memorijske uredjaje redom u USB slot i svaki zadrzi u slotu po 10 sekundi.
- Ukoliko imas vise uredjaja za proveru, onda na parcetu papira zapisi kojim redom su ubacivani jer ce nam kasnije trebati taj podatak
- Kada zavrsis sa svim uredjajima, klikni desno dugme misa na sred prozora programa i odaberi opciju Save log. To ce automatski otvoriti log u Notepadu. Iskopiraj nam taj log iz Notepada na forum.

Objasnjenje: U USB memorijske uredjaje spadaju svi oni uredjaji koji po prikljucivanju na kompjuter dobijaju svoju oznaku particije. Tu spadaju USB flash drajvovi, eksterni hard-diskovi, memorijske kartice, MP3 i MP4 plejeri, neki mobilni telefoni, neki GPS (navigacioni) uredjaji itd.

offline
  • Pridružio: 18 Jul 2008
  • Poruke: 115
  • Gde živiš: Majur

USBNoRisk 1.5 by bobby

Started at 2/28/2009 7:35:56 PM

Scanning for connected USB Mass storage...
----------------------------------------
========================================

Scanning for other storage...
----------------------------------------
C: {6c9e7d84-d450-11dd-841e-806d6172696f}
========================================


Scanning fixed storage for autorun.inf files...
----------------------------------------
Autorun.inf on C: - None
----------------------------------------

Sanitizing Shell Menu...
----------------------------------------
No key found for C:
No key found for 6c9e7d84-d450-11dd-841e-806d6172696f
========================================



New device connected at 2/28/2009 7:36:46 PM

Scanning for connected USB mass storage...
----------------------------------------
H: {a91d4628-d453-11dd-8d59-0010dc71772e}
Added H:
========================================

Scanning USB mass storage for files...
----------------------------------------
----------------------------------------
Autorun.inf on H: - None
----------------------------------------

Sanitizing Shell Menu...
----------------------------------------
No key found for a91d4628-d453-11dd-8d59-0010dc71772e
========================================

----------------------------------------

Desktop.ini on H: - None
----------------------------------------

========================================

========================================
Removed H:
========================================

offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8617
  • Gde živiš: Novi Beograd

Uploaduj mi:

c:\windows\system32\M1achardks.dll
c:\windows\system32\hdvirffo.dll

preko:

http://www.mycity.rs/ambulanta-upload.php

offline
  • Pridružio: 18 Jul 2008
  • Poruke: 115
  • Gde živiš: Majur

Uploadovao.

offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8617
  • Gde živiš: Novi Beograd

Iskljuci Nod.

Otvoriti Notepad i iskopirati sledeci tekst:

File::
c:\windows\system32\SetPoints.exe

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Microsoft Update"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"Microsoft Update"=-


Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

offline
  • Pridružio: 18 Jul 2008
  • Poruke: 115
  • Gde živiš: Majur

ComboFix 09-02-27.02 - Aleksandar 2009-02-28 21:22:47.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.735.327 [GMT 1:00]
Running from: c:\documents and settings\Aleksandar\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Aleksandar\Desktop\CFScript.txt
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated)
AV: Spyware Doctor with AntiVirus *On-access scanning enabled* (Updated)
FW: ESET Personal firewall *enabled*
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-01-28 to 2009-02-28 )))))))))))))))))))))))))))))))
.

2009-02-28 19:33 . 2009-02-28 19:37 <DIR> d-------- C:\USBNoRisk
2009-02-23 19:00 . 2009-02-23 19:01 <DIR> d-------- c:\program files\Hewlett-Packard
2009-02-15 22:09 . 2001-11-01 16:24 731,355,136 --a------ C:\YoungDebutants.vob
2009-02-07 20:36 . 2009-02-07 20:36 <DIR> d-------- c:\windows\Sun
2009-02-07 00:10 . 2009-02-07 00:10 <DIR> d-------- c:\documents and settings\Aleksandar\Application Data\Nokia
2009-02-05 21:25 . 2009-02-05 21:25 <DIR> d----c--- c:\documents and settings\All Users\Application Data\{51019853-129C-4EDE-9030-D5FD7BBD9AD0}
2009-02-05 20:34 . 2009-02-28 21:23 <DIR> d-------- c:\program files\Achilles-Script 5.0 Black
2009-02-03 00:56 . 2009-02-03 00:56 <DIR> d-------- c:\program files\Java
2009-02-03 00:56 . 2009-02-03 00:56 410,984 --a------ c:\windows\system32\deploytk.dll
2009-02-03 00:56 . 2009-02-03 00:56 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-02-01 19:27 . 2009-02-01 19:27 1,077,336 -r--s---- c:\windows\system32\MSCOMCTL.OCX
2009-02-01 19:27 . 2009-02-01 19:27 140,488 -r------- c:\windows\system32\COMDLG32.OCX
2009-01-31 21:51 . 2009-01-31 21:51 <DIR> d-------- c:\program files\AVG
2009-01-29 20:17 . 2009-01-29 20:17 <DIR> d-------- c:\program files\Uniblue
2009-01-29 20:17 . 2009-01-29 20:17 <DIR> d-------- c:\documents and settings\Aleksandar\Application Data\Uniblue
2009-01-29 20:03 . 2009-01-29 20:04 <DIR> d-------- c:\program files\Common Files\PC Tools
2009-01-29 20:03 . 2008-07-28 12:29 160,792 --a------ c:\windows\system32\drivers\pctfw2.sys
2009-01-29 20:03 . 2008-08-25 12:36 81,288 --a------ c:\windows\system32\drivers\iksyssec.sys
2009-01-29 20:03 . 2008-08-25 12:36 66,952 --a------ c:\windows\system32\drivers\iksysflt.sys
2009-01-29 20:03 . 2008-08-25 12:36 40,840 --a------ c:\windows\system32\drivers\ikfilesec.sys
2009-01-29 20:03 . 2008-06-02 16:19 29,576 --a------ c:\windows\system32\drivers\kcom.sys
2009-01-29 18:09 . 2004-05-26 15:08 7,296 -r------- c:\windows\system32\drivers\EIO.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-24 21:49 --------- d-----w c:\program files\Professional §©®ÎÞt v.4 Black
2009-02-19 20:12 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-02-19 17:20 --------- d-----w c:\program files\Spyware Doctor
2009-02-15 12:42 --------- d-----w c:\program files\FlashGet
2009-02-05 20:05 --------- d-----w c:\program files\Counter-Strike
2009-02-01 18:05 2,079 ----a-w c:\windows\system32\M1achardks.dll
2009-01-24 22:22 4,100 ----a-w c:\windows\system32\hdvirffo.dll
2009-01-24 18:21 20,747 ----a-w c:\windows\system32\drivers\AegisP.sys
2009-01-24 18:20 --------- d-----w c:\program files\Gigabyte
2009-01-22 21:21 --------- d-----w c:\program files\D-Tools
2009-01-21 17:18 --------- d-----w c:\documents and settings\Aleksandar\Application Data\Ahead
2009-01-21 17:11 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-21 17:11 --------- d-----w c:\documents and settings\All Users\Application Data\Ahead
2009-01-21 17:09 --------- d-----w c:\program files\Common Files\Ahead
2009-01-21 17:07 --------- d-----w c:\program files\Nero
2009-01-21 17:07 --------- d-----w c:\documents and settings\All Users\Application Data\Nero
2009-01-20 21:35 --------- d-----w c:\program files\Valve
2009-01-20 17:21 --------- d-----w c:\program files\PC Tools Internet Security
2009-01-20 17:21 --------- d-----w c:\documents and settings\All Users\Application Data\PC Tools
2009-01-19 23:58 --------- d-----w c:\program files\EASEUS
2009-01-19 17:16 --------- d-----w c:\program files\Windows Live
2009-01-18 20:32 --------- d-----w c:\documents and settings\Aleksandar\Application Data\PCToolsSpamMonitorPlus
2009-01-18 20:32 --------- d-----w c:\documents and settings\Aleksandar\Application Data\PCToolsFirewallPlus
2009-01-17 17:26 729,088 ----a-w c:\windows\iun6002.exe
2009-01-15 23:14 --------- d-----w c:\program files\MSN Messenger
2009-01-15 23:14 --------- d-----w c:\program files\Messenger Plus! Live
2009-01-14 15:37 --------- d-----w c:\program files\Common Files\Windows Live
2009-01-14 15:30 --------- d-----w c:\documents and settings\Aleksandar\Application Data\PC Tools
2009-01-14 03:37 --------- d-----w c:\program files\Your Uninstaller 2008
2009-01-14 03:32 --------- d-----w c:\documents and settings\Aleksandar\Application Data\URSoft
2009-01-12 22:19 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-01-12 03:27 --------- d-----w c:\documents and settings\Aleksandar\Application Data\TeamViewer
2009-01-12 01:56 --------- d-----w c:\program files\Common Files\NSV
2009-01-10 21:37 --------- d-----w c:\program files\ATI Technologies
2009-01-10 14:22 --------- d-----w c:\program files\Lavalys
2008-12-28 13:37 --------- d-----w c:\documents and settings\Aleksandar\Application Data\ESET
2008-12-28 13:36 --------- d-----w c:\program files\ESET
2008-12-28 13:36 --------- d-----w c:\documents and settings\All Users\Application Data\ESET
2008-12-28 13:36 --------- d-----w c:\documents and settings\Aleksandar\Application Data\Winamp
2008-12-28 13:32 --------- d-----w c:\program files\Winamp
2008-04-14 04:42 263,168 --sh--r c:\windows\system32\SetPoints.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2007-12-21 1443072]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-03 136600]
"Microsoft Update"="SetPoints.exe" [2008-04-14 c:\windows\system32\SetPoints.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"Microsoft Update"="SetPoints.exe" [2008-04-14 c:\windows\system32\SetPoints.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-14 c:\windows\system32\narrator.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
GN-WP01GS Utility.lnk - c:\program files\Gigabyte\Gigabyte WP01GS Wireless PCI Adapter SoftAP\Installer\WINXP\RaUI.exe [2009-01-24 720896]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.3iv2"= 3ivxVfWCodec.dll
"VIDC.VP31"= vp31vfw.dll
"msacm.l3fhg"= mp3fhg.acm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-06-27 19:03 152872 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
--a------ 2004-08-22 17:05 81920 c:\program files\D-Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget]
--a------ 2007-09-25 10:29 2007088 c:\program files\FlashGet\flashget.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2008-04-14 05:42 1695232 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 12:54 5674352 c:\program files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2002-11-19 14:01 46592 c:\windows\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTPreset]
--a------ 2004-02-24 20:17 45056 c:\windows\system32\VTPreset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\Professional §©®ÎÞt v.4 Black\\mirc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\FlashGet\\FlashGet.exe"=

R1 pctfw2;pctfw2;c:\windows\system32\drivers\pctfw2.sys [2009-01-29 160792]
R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2007-12-21 468224]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-01-29 356920]
S3 Asushwio;Asushwio;c:\windows\system32\drivers\ASUSHWIO.SYS [2002-01-01 5824]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.bearshare.com/intl/
IE: &Download All with FlashGet - c:\program files\FlashGet\jc_all.htm
IE: &Download with FlashGet - c:\program files\FlashGet\jc_link.htm
LSP: c:\program files\Common Files\PC Tools\LSP\PCTLsp.dll
TCP: {4BE5F4F9-5C64-42B2-9692-AAE6652B8F71} = 10.5.0.100,10.5.0.200
FF - ProfilePath - c:\documents and settings\Aleksandar\Application Data\Mozilla\Firefox\Profiles\bxxmtu1l.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.com
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2009-02-28 21:24:50
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(652)
c:\program files\Common Files\PC Tools\LSP\PCTLsp.dll
.
Completion time: 2009-02-28 21:26:57
ComboFix-quarantined-files.txt 2009-02-28 20:26:50
ComboFix2.txt 2009-02-28 17:44:11

Pre-Run: 1,046,786,048 bytes free
Post-Run: 1,040,629,760 bytes free

160 --- E O F --- 2009-01-19 02:04:50

offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8617
  • Gde živiš: Novi Beograd

Jesi siguran da si sve dobro odradio?

Posto se nista nije dogodilo.

Ko je trenutno na forumu
 

Ukupno su 923 korisnika na forumu :: 18 registrovanih, 5 sakrivenih i 900 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: _Rade, cikadeda, Dimitrije Paunovic, Djordje29, DPera, dragoljub11987, ILGromovnik, Karla, Kriglord, Krvava Devetka, MilosKop, opt1, powSrb, raykan, slonic_tonic, sovanova95, styg, zlaya011