MyCity » Ambulanta -> Arhiva Ambulante » Problem!!Nije Hitno Ali Je Pozeljna Pomoc...

Problem!!Nije Hitno Ali Je Pozeljna Pomoc...

Napisano na dan: 6.2.2010

Problem!!Nije Hitno Ali Je Pozeljna Pomoc...
Sledeća strana Pagination

Idi na vrh

Poslao: 06 Feb 2010 12:04
Idi na vrh
offline
  • Pridružio: 12 Avg 2008
  • Poruke: 708
  • Gde živiš: Bogu iza tregera!

Ovako...
Kada upalim racunar iskoci mi ova slika:


A nakon toga...par minuti iskoci ovo...




Trazio sam po netu...ali nisam nasao nista korisno...
Pa reko da pitam profesionalce...pa se sjetio vas...Smile
[/img]

I Izvinjavam se sto su slike...sto imaju ovo bijelo...ali u zurbi sam radio...



Poslao: 06 Feb 2010 12:46
Idi na vrh
offline
  • Pridružio: 04 Jan 2009
  • Poruke: 2168

[Link mogu videti samo ulogovani korisnici]



Poslao: 06 Feb 2010 14:48
Idi na vrh
offline
  • Pridružio: 12 Avg 2008
  • Poruke: 708
  • Gde živiš: Bogu iza tregera!

Izvinjavam se zbog NEprofesionalnog odnosa prema AMF Timu...

Prije jedno 2 dana su odjednom poceli da iskacu prozori koje cete vidjeti u nastavku...
Tada nisam instalirao/brisao nikakve programe ili neke druge fajlove.
Koristim Avast5,updade-ujem ga redovno...
Prije par min sam uradio Full System Scan i nije bilo nikakvih infektovanih datoteka...


Koristim Windows XP SP2 32-bitni...

Evo Log fajla...


DDS (Ver_09-12-01.01) - NTFSx86 
Run by x-Death-x at 14:38:10,48 on sub 06.02.2010
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Professional  5.1.2600.2.1252.1.1033.18.1470.945 [GMT 1:00]

AV: avast! Antivirus *On-access scanning enabled* (Updated)   {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\PowerDVD\PDVDServ.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\x-Death-x\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.googlebreak.com/?CID=3&PID=STV
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: ShowBarObjMp3 Class: {cf59ae24-5796-44fc-9575-8d4f383c65f8} - c:\program files\youtubemp3downloader\MinBHOMp3.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: YouTube MP3 Downloader: {f27a9a1d-6f23-442d-88c0-5dc40fd13dcd} - c:\program files\youtubemp3downloader\YouTubeMP3.dll
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [MsnMsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [sysinfo] c:\windows\system32\rundll32.exe c:\docume~1\x-deat~1\locals~1\temp\88437616Wsy.dll,Sets
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [CorelDRAW Graphics Suite 11b] c:\program files\corel\corel graphics 12\languages\en\programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=021410 serial=DR12WCT-1689604-YCX lang=EN
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [RemoteControl] "c:\program files\powerdvd\PDVDServ.exe"
mRun: [LanguageShortcut] "c:\program files\powerdvd\language\Language.exe"
mRun: [avast5] c:\progra~1\alwils~1\avast5\avastUI.exe /nogui
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\x-deat~1\startm~1\programs\startup\stardo~1.lnk - c:\program files\stardock\objectdock\ObjectDock.exe
StartupFolder: c:\docume~1\x-deat~1\startm~1\programs\startup\warcra~1.lnk - c:\program files\warcraft iii\support\config.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\d-link~1.lnk - c:\program files\d-link airplus\AirPlus.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - c:\program files\common files\sourcetec\swf catcher\InternetExplorer.htm
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\x-deat~1\applic~1\mozilla\firefox\profiles\vk1wbsjs.default\
FF - prefs.js: browser.search.selectedEngine - [Link mogu videti samo ulogovani korisnici]
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ba/
FF - plugin: c:\documents and settings\x-death-x\application data\mozilla\firefox\profiles\vk1wbsjs.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [2010-1-2 155136]
R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [2010-1-2 5248]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2009-12-31 162640]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-12-31 19024]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-1-24 40384]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-1-24 40384]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-1-24 40384]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-6 34064]
S3 rootrepeal;rootrepeal;\??\c:\windows\system32\drivers\rootrepeal.sys --> c:\windows\system32\drivers\rootrepeal.sys [?]

=============== Created Last 30 ================

2010-02-06 10:51:01   2560   ----a-w-   c:\windows\_MSRSTRT.EXE
2010-02-06 10:42:36   0   d-----w-   c:\program files\RAR Password (zabranjeno)er
2010-02-05 23:41:34   0   d-----w-   c:\program files\JDownloader
2010-02-04 21:50:33   31616   -c--a-w-   c:\windows\system32\dllcache\usbccgp.sys
2010-02-04 21:50:33   31616   ----a-w-   c:\windows\system32\drivers\usbccgp.sys
2010-02-02 19:50:35   0   d-----w-   c:\program files\WinPcap
2010-02-02 19:50:25   0   d-----w-   c:\program files\YouTubeMP3Downloader
2010-02-02 14:38:36   0   d-----w-   c:\program files\Unlocker
2010-02-02 14:15:03   69   ----a-w-   c:\windows\NeroDigital.ini
2010-02-02 04:35:49   4767   ----a-w-   c:\windows\Irremote.ini
2010-02-02 04:20:03   0   d-----w-   c:\docume~1\alluse~1\applic~1\Nero
2010-02-01 19:17:57   0   d-----w-   c:\program files\VLC
2010-02-01 15:40:44   0   d-----w-   c:\windows\system32\XPSViewer
2010-02-01 15:39:49   89088   -c----w-   c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-02-01 15:39:49   597504   -c----w-   c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-02-01 15:39:49   575488   -c----w-   c:\windows\system32\dllcache\xpsshhdr.dll
2010-02-01 15:39:49   575488   ------w-   c:\windows\system32\xpsshhdr.dll
2010-02-01 15:39:49   1676288   -c----w-   c:\windows\system32\dllcache\xpssvcs.dll
2010-02-01 15:39:49   1676288   ------w-   c:\windows\system32\xpssvcs.dll
2010-02-01 15:39:49   117760   ------w-   c:\windows\system32\prntvpt.dll
2010-02-01 15:39:49   0   d-----w-   C:\9d6e42c39e220bdf0352dc5ebce6
2010-02-01 15:36:40   0   d-----w-   c:\program files\MSXML 6.0
2010-01-31 20:05:29   0   d-----w-   c:\docume~1\x-deat~1\applic~1\TeamViewer
2010-01-31 20:04:50   0   d-----w-   c:\program files\TeamViewer
2010-01-25 19:05:00   25600   -c--a-w-   c:\windows\system32\dllcache\usbser.sys
2010-01-25 19:05:00   25600   ----a-w-   c:\windows\system32\drivers\usbser.sys
2010-01-25 19:01:37   0   ---ha-w-   c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2010-01-25 19:01:34   0   ---ha-w-   c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2010-01-24 20:44:18   0   d-----w-   c:\program files\Stardock
2010-01-24 20:35:25   5760054   ----a-w-   c:\windows\AW_1600x1200.bmp
2010-01-24 20:33:20   3932214   ----a-w-   c:\windows\InvaderDark1280.bmp
2010-01-24 20:23:14   3932214   ----a-w-   c:\windows\AW_XenoMorph1280.bmp
2010-01-24 20:21:14   36864   ----a-w-   c:\windows\system32\wbsys.dll
2010-01-24 20:21:14   0   d-----w-   c:\program files\common files\Stardock
2010-01-24 20:21:14   0   d-----w-   c:\program files\AlienWare
2010-01-24 18:42:58   0   d-----w-   c:\docume~1\alluse~1\applic~1\Alwil Software
2010-01-23 21:53:13   0   d--h--r-   C:\AHCache
2010-01-22 07:56:20   0   d-----w-   c:\windows\system32\SoftwareDistribution
2010-01-20 19:27:54   8608   ----a-w-   c:\windows\system32\mpeg4ax.cat
2010-01-20 19:27:54   8587   ----a-w-   c:\windows\system32\msaudio.cat
2010-01-20 19:27:54   73728   ----a-w-   c:\windows\system32\TOverlay.ax
2010-01-20 19:27:54   700416   ----a-w-   c:\windows\system32\AxisToolBar.ocx
2010-01-20 19:27:54   53248   ----a-w-   c:\windows\system32\DSTimeStamp.ax
2010-01-20 19:27:54   438976   ----a-w-   c:\windows\system32\MSHFLXGD.OCX
2010-01-20 19:27:54   40960   ----a-w-   c:\windows\system32\wavdest.ax
2010-01-20 19:27:54   36864   ----a-w-   c:\windows\system32\Sof2FFTPrj.ocx
2010-01-20 19:27:54   28672   ----a-w-   c:\windows\system32\SpecBarPrj.ocx
2010-01-20 19:27:54   28672   ----a-w-   c:\windows\system32\PCWinSoftPBar.ocx
2010-01-20 19:27:54   188416   ----a-w-   c:\windows\system32\UScreenCapture.ax
2010-01-20 19:27:53   126976   ----a-w-   c:\windows\system32\ArielColorCtrl.ocx
2010-01-20 19:26:56   0   d-----w-   c:\program files\ScreenCapture
2010-01-08 20:39:28   0   d-----w-   c:\program files\Valve
2010-01-07 16:32:29   0   d-----w-   c:\documents and settings\x-death-x\Tracing
2010-01-07 16:25:59   0   d-----w-   c:\program files\Microsoft
2010-01-07 16:25:41   0   d-----w-   c:\program files\Windows Live SkyDrive
2010-01-07 16:14:50   0   d-----w-   c:\program files\common files\Windows Live

==================== Find3M  ====================

2010-01-02 20:38:59   411368   ----a-w-   c:\windows\system32\deploytk.dll
2009-12-31 11:12:48   21640   ----a-w-   c:\windows\system32\emptyregdb.dat
2009-12-29 21:29:58   258352   ----a-w-   c:\windows\system32\unicows.dll

============= FINISH: 14:38:25,14 ===============


A evo Attach.txt fajla
http://fotkica.com/uploads2N/123891_1161100265_Attach.txt

Sto se tice RootRepeal
http://fotkica.com/uploads2N/123891_1749741154_RootRepeal%20report%2002-06-10%20%2814-44-57%29.txt

Kada upalim racunar iskoci mi ovaj prozorcic:



A nakon toga...par minuti iskoci ovo...



(Nemora uvijek da bude tim redosljedom)

Trazio sam po netu...ali nisam nasao nista korisno...
Pa reko da pitam profesionalce...
I jos jednom se izvinjavam zbog prethodnog posta...nece se vise nikada ponoviti...obecavam...
Uz duzno postovanje prema AMF Timu,
x-Death-x

Poslao: 06 Feb 2010 19:06
Idi na vrh
offline
  • Pridružio: 04 Jan 2009
  • Poruke: 2168

Preuzmi sUBs-ov ComboFix sa sledeće adrese na Desktop:


Bleeping Computer
Klikni desnim tasterom na link i odaberi opciju Save Target As... (Save Link As..., Save Linked Content As... ili sličnu);
Kada se otvori dijalog za izbor lokacije na kojoj treba sačuvati file, odaberi Desktop i klikni Save.



Kada preuzimanje programa bude završeno:
deaktiviraj zaštitni softver (uputstvo);
zatvori pokrenute programe;
dvoklikom pokreni program ComboFix.
U toku rada, ComboFix će:proveriti postoji li novija verzija programa:
klikni Yes ako bude ponuđeno preuzimanje iste. prikazati DISCLAIMER OF WARRANTY ON SOFTWARE:
klikni Yes kako bi proces bio nastavljen.ako Recovery Console nije instalirana, ponuditi instalaciju:
obavezno prihvati klikom na Yes i isprati postupak.postaviti/dati određeni broj upita/obaveštenja:
prihvati klikom na Yes ili OK.po potrebi, restartovati Windows (više puta);
na kraju rada, otvoriti Notepad sa izveštajem o skeniranju.

Iskopiraj izveštaj koji je ComboFix napravio u temu na forumu:
klikni desnim tasterom miša u prozor Notepad-a i izaberi Select All;
klikni desnim tasterom miša na obeleženi tekst i izaberi Copy;
klikni desnim tasterom miša u polje za pisanje poruke i izaberi Paste.

Napomena:Izveštaj će biti sačuvan pod nazivom ComboFix.txt na sistemskoj particiji (tipična lokacija: C:\ComboFix.txt);
Ukoliko nakon slanja poruke primetiš da izveštaj nije kompletan, iskoristi opciju Prikači fajl za prilaganje file-a C:\ComboFix.txt uz poruku.

Poslao: 06 Feb 2010 19:52
Idi na vrh
offline
  • Pridružio: 12 Avg 2008
  • Poruke: 708
  • Gde živiš: Bogu iza tregera!

Evo i ComboFix Log-fajl

ComboFix 10-02-05.04 - x-Death-x 06.02.2010 19:46:07.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1470.846 [GMT 1:00]
Running from: c:\documents and settings\x-Death-x\Desktop\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((( Files Created from 2010-01-06 to 2010-02-06 )))))))))))))))))))))))))))))))
.

2010-02-06 14:35 . 2010-02-06 14:43 -------- d-----w- c:\program files\Garena
2010-02-06 14:18 . 2010-02-06 14:25 76295 ----a-w- c:\windows\War3Unin.dat
2010-02-06 14:18 . 2010-02-06 14:24 2829 ----a-w- c:\windows\War3Unin.pif
2010-02-06 14:18 . 2010-02-06 14:24 139264 ----a-w- c:\windows\War3Unin.exe
2010-02-06 14:17 . 2010-02-06 17:58 -------- d-----w- c:\program files\Warcraft III
2010-02-06 14:11 . 2010-02-06 14:11 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-02-06 10:51 . 2010-02-06 10:51 2560 ----a-w- c:\windows\_MSRSTRT.EXE
2010-02-05 23:41 . 2010-02-06 10:59 -------- d-----w- c:\program files\JDownloader
2010-02-04 21:50 . 2004-08-03 22:08 31616 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2010-02-04 21:50 . 2004-08-03 22:08 31616 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2010-02-04 16:43 . 2010-02-04 16:43 -------- d-----w- c:\documents and settings\Default User\Local Settings\Application Data\Adobe
2010-02-04 16:42 . 2010-02-04 16:42 -------- d-----w- c:\program files\Common Files\Adobe
2010-02-04 16:39 . 2009-11-20 11:08 38784 ----a-w- c:\documents and settings\x-Death-x\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-02-04 16:39 . 2009-11-20 11:08 38784 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-02-04 16:39 . 2010-02-04 16:39 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-02-04 16:35 . 2010-02-04 16:58 -------- d-----w- c:\documents and settings\x-Death-x\Local Settings\Application Data\Adobe
2010-02-04 16:35 . 2010-02-04 16:35 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-02-04 16:35 . 2010-02-05 18:28 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-02-04 16:35 . 2010-02-04 16:35 -------- d-----w- c:\program files\NOS
2010-02-04 16:35 . 2010-01-25 09:02 31936 ----a-w- c:\documents and settings\x-Death-x\Application Data\Mozilla\Firefox\Profiles\vk1wbsjs.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
2010-02-04 16:35 . 2010-01-25 09:02 29344 ----a-w- c:\documents and settings\x-Death-x\Application Data\Mozilla\Firefox\Profiles\vk1wbsjs.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
2010-02-02 19:50 . 2010-02-02 19:50 -------- d-----w- c:\program files\WinPcap
2010-02-02 19:50 . 2010-02-02 19:50 -------- d-----w- c:\program files\YouTubeMP3Downloader
2010-02-02 14:58 . 2010-02-02 14:58 78264 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-02-02 14:38 . 2010-02-02 14:38 -------- d-----w- c:\program files\Unlocker
2010-02-02 14:20 . 2010-02-02 14:20 -------- d-----w- c:\documents and settings\x-Death-x\Local Settings\Application Data\Nero
2010-02-02 04:33 . 2010-02-02 14:43 -------- d-----w- c:\program files\Windows Sidebar
2010-02-02 04:20 . 2010-02-02 14:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2010-02-01 19:20 . 2010-02-02 15:36 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\vlc
2010-02-01 19:17 . 2010-02-01 19:18 -------- d-----w- c:\program files\VLC
2010-02-01 15:40 . 2010-02-01 15:40 -------- d-----w- c:\windows\system32\XPSViewer
2010-02-01 15:40 . 2010-02-01 15:40 -------- d-----w- c:\program files\MSBuild
2010-02-01 15:40 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-02-01 15:39 . 2010-02-01 15:40 -------- d-----w- C:\9d6e42c39e220bdf0352dc5ebce6
2010-02-01 15:39 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-02-01 15:39 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-02-01 15:39 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2010-02-01 15:39 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2010-02-01 15:39 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2010-02-01 15:39 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2010-02-01 15:39 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-02-01 15:39 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-02-01 15:36 . 2010-02-01 15:36 -------- d-----w- c:\program files\MSXML 6.0
2010-01-31 20:05 . 2010-01-31 20:05 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\TeamViewer
2010-01-31 20:04 . 2010-01-31 20:04 -------- d-----w- c:\program files\TeamViewer
2010-01-28 00:37 . 2010-01-28 00:37 -------- d-----w- c:\documents and settings\Turisti\Application Data\skypePM
2010-01-27 21:48 . 2010-01-28 01:19 -------- d-----w- c:\documents and settings\Turisti\Application Data\Skype
2010-01-25 19:05 . 2004-08-03 22:08 25600 -c--a-w- c:\windows\system32\dllcache\usbser.sys
2010-01-25 19:05 . 2004-08-03 22:08 25600 ----a-w- c:\windows\system32\drivers\usbser.sys
2010-01-24 20:44 . 2010-01-24 20:44 -------- d-----w- c:\program files\Stardock
2010-01-24 20:23 . 2010-01-25 22:08 -------- d-----w- c:\documents and settings\x-Death-x\Local Settings\Application Data\Stardock
2010-01-24 20:21 . 2010-02-06 10:52 -------- d-----w- c:\program files\AlienWare
2010-01-24 20:21 . 2010-02-06 10:48 -------- d-----w- c:\program files\Common Files\Stardock
2010-01-24 20:21 . 2003-02-26 21:27 36864 ----a-w- c:\windows\system32\wbsys.dll
2010-01-24 18:42 . 2010-01-24 18:42 -------- d-----w- c:\program files\Alwil Software
2010-01-24 18:42 . 2010-01-24 18:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-01-23 22:02 . 2010-01-23 22:06 -------- d-----w- c:\documents and settings\x-Death-x\Local Settings\Application Data\Paint.NET
2010-01-23 21:58 . 2010-01-23 21:58 -------- d-----w- c:\program files\Reference Assemblies
2010-01-23 21:53 . 2010-01-23 21:53 -------- d-----r- C:\AHCache
2010-01-21 23:29 . 2010-01-21 23:29 -------- d-----w- c:\documents and settings\Turisti\Application Data\Corel
2010-01-21 10:49 . 2010-01-21 10:49 -------- d-----w- c:\documents and settings\Turisti\Local Settings\Application Data\Apple Computer
2010-01-21 10:40 . 2010-01-21 10:40 -------- d-----w- c:\documents and settings\Turisti
2010-01-20 19:26 . 2010-01-20 19:31 -------- d-----w- c:\program files\ScreenCapture
2010-01-20 19:26 . 2010-01-20 19:26 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\InstallShield
2010-01-12 18:33 . 2010-01-12 18:33 -------- d-----w- c:\documents and settings\x-Death-x\Local Settings\Application Data\Identities
2010-01-12 16:45 . 2010-01-26 19:22 -------- d-----w- c:\documents and settings\Maja\Application Data\skypePM
2010-01-08 20:39 . 2010-01-08 21:39 -------- d-----w- c:\program files\Valve
2010-01-07 23:31 . 2010-01-07 23:31 -------- d-----w- c:\windows\Sun

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-06 10:51 . 2009-12-31 15:18 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\uTorrent
2010-02-02 15:01 . 2010-01-04 00:00 -------- d-----w- c:\program files\AIMP2
2010-02-01 17:32 . 2009-12-31 11:42 19224 ----a-w- c:\documents and settings\x-Death-x\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-31 20:08 . 2009-12-31 17:50 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\Skype
2010-01-31 20:01 . 2009-12-31 17:51 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\skypePM
2010-01-27 21:47 . 2010-01-04 21:45 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-01-26 20:47 . 2010-01-04 21:37 -------- d-----w- c:\documents and settings\Maja\Application Data\Skype
2010-01-25 19:01 . 2010-01-25 19:01 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2010-01-25 19:01 . 2010-01-25 19:01 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2010-01-20 19:27 . 2009-12-31 12:00 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-19 13:13 . 2009-12-31 11:44 162640 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-01-19 11:57 . 2009-12-31 11:44 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-01-19 11:57 . 2009-12-31 11:43 152672 ----a-w- c:\windows\system32\aswBoot.exe
2010-01-19 11:46 . 2009-12-31 11:44 46544 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-01-19 11:43 . 2009-12-31 11:44 23248 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-01-19 11:43 . 2009-12-31 11:44 100304 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-01-19 11:43 . 2009-12-31 11:44 94672 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-01-19 11:42 . 2009-12-31 11:44 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-01-19 11:42 . 2009-12-31 11:44 28240 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-01-09 15:43 . 2009-12-31 18:07 -------- d-----w- c:\program files\Common Files\Apple
2010-01-07 16:25 . 2010-01-07 16:25 -------- d-----w- c:\program files\Microsoft
2010-01-07 16:25 . 2010-01-07 16:25 -------- d-----w- c:\program files\Windows Live
2010-01-07 16:25 . 2010-01-07 16:25 -------- d-----w- c:\program files\Windows Live SkyDrive
2010-01-07 16:14 . 2010-01-07 16:14 -------- d-----w- c:\program files\Common Files\Windows Live
2010-01-07 12:25 . 2009-12-31 15:50 -------- d-----w- c:\program files\Common Files\AVSMedia
2010-01-07 12:19 . 2010-01-07 12:16 -------- d-----w- c:\program files\PowerDVD
2010-01-07 12:19 . 2010-01-07 12:19 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\CyberLink
2010-01-07 12:18 . 2010-01-07 12:18 -------- d-----w- c:\documents and settings\All Users\Application Data\CyberLink
2010-01-07 12:17 . 2010-01-07 12:16 -------- d-----w- c:\program files\CyberLink
2010-01-07 12:02 . 2010-01-04 21:44 -------- d-----w- c:\program files\SourceTec
2010-01-07 12:02 . 2010-01-04 21:44 -------- d-----w- c:\program files\Common Files\SourceTec
2010-01-06 15:15 . 2010-01-04 10:26 -------- d-----w- c:\documents and settings\Maja\Application Data\Free Download Manager
2010-01-05 20:44 . 2010-01-05 20:44 -------- d-----w- c:\documents and settings\Maja\Application Data\Corel
2010-01-05 20:40 . 2009-12-31 12:06 -------- d-----w- c:\program files\Realtek
2010-01-05 16:52 . 2010-01-05 16:52 -------- d-----w- c:\program files\D-Link AirPlus
2010-01-05 16:13 . 2010-01-05 16:11 -------- d-----w- c:\program files\Driver Magician
2010-01-04 21:37 . 2010-01-04 21:37 -------- d-----w- c:\program files\Common Files\Skype
2010-01-04 21:37 . 2009-12-31 17:48 -------- d-----r- c:\program files\Skype
2010-01-04 21:31 . 2010-01-04 21:31 -------- d-----w- c:\program files\Inpaint
2010-01-03 23:03 . 2010-01-03 22:16 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-01-03 22:14 . 2010-01-03 22:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard
2010-01-02 20:38 . 2010-01-02 20:39 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-01-02 20:38 . 2010-01-02 20:38 -------- d-----w- c:\program files\Java
2010-01-02 20:38 . 2010-01-02 20:38 152576 ----a-w- c:\documents and settings\x-Death-x\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2010-01-02 20:36 . 2010-01-02 20:36 79488 ----a-w- c:\documents and settings\x-Death-x\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-01-02 19:24 . 2010-01-02 19:24 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\Leadertech
2010-01-02 19:12 . 2010-01-02 19:12 -------- d-----w- c:\program files\Deamon
2010-01-02 14:35 . 2009-12-31 18:08 -------- d-----w- c:\program files\QuickTime
2010-01-02 14:35 . 2009-12-31 18:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-01-01 14:31 . 2009-12-31 18:10 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\Apple Computer
2010-01-01 13:58 . 2010-01-01 13:58 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\AnvSoft
2010-01-01 11:56 . 2010-01-01 11:56 -------- d-----w- c:\documents and settings\All Users\Application Data\AVS4YOU
2010-01-01 11:52 . 2009-12-31 11:16 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-12-31 18:10 . 2009-12-31 18:09 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-12-31 18:08 . 2009-12-31 18:08 -------- d-----w- c:\program files\Apple Software Update
2009-12-31 18:07 . 2009-12-31 18:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-12-31 17:51 . 2009-12-31 17:51 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-12-31 17:48 . 2009-12-31 17:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-12-31 15:31 . 2009-12-31 15:31 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\Ambient Design
2009-12-31 15:19 . 2009-12-31 15:19 -------- d-----w- c:\program files\uTorrent
2009-12-31 14:03 . 2009-12-31 14:03 -------- d-----w- c:\program files\7-Zip
2009-12-31 14:01 . 2009-12-31 14:01 0 ----a-w- c:\windows\nsreg.dat
2009-12-31 13:59 . 2009-12-31 13:59 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\Corel
2009-12-31 12:36 . 2009-12-31 12:36 -------- d-----w- c:\program files\Common Files\Corel
2009-12-31 12:36 . 2009-12-31 12:00 -------- d-----w- c:\program files\Common Files\InstallShield
2009-12-31 12:36 . 2009-12-31 12:36 -------- d-----w- c:\program files\Corel
2009-12-31 12:27 . 2009-12-31 12:27 -------- d-----w- c:\program files\Microsoft ActiveSync
2009-12-31 11:57 . 2009-12-31 11:57 -------- d-----w- c:\program files\MSXML 4.0
2009-12-31 11:17 . 2009-12-31 11:17 -------- d-----w- c:\program files\microsoft frontpage
2009-12-31 11:12 . 2009-12-31 11:12 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-12-29 21:29 . 2009-12-31 19:44 258352 ----a-w- c:\windows\system32\unicows.dll
.

------- Sigcheck -------

[-] 2007-12-29 . 9F960FAC5166F8626B9CDE4DD9A0EB84 . 1580544 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cf59ae24-5796-44fc-9575-8d4f383c65f8}]
2010-01-29 14:44 221184 ----a-w- c:\program files\YouTubeMP3Downloader\MinBHOMp3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{f27a9a1d-6f23-442d-88c0-5dc40fd13dcd}"= "c:\program files\YouTubeMP3Downloader\YouTubeMP3.dll" [2010-01-29 704512]

[HKEY_CLASSES_ROOT\clsid\{f27a9a1d-6f23-442d-88c0-5dc40fd13dcd}]
[HKEY_CLASSES_ROOT\KBBar.KBBarBandMp3.1]
[HKEY_CLASSES_ROOT\TypeLib\{f20fd027-a5f3-451a-8db1-13298321f6a8}]
[HKEY_CLASSES_ROOT\KBBar.KBBarBandMp3]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2005-10-15 14864384]
"CorelDRAW Graphics Suite 11b"="c:\program files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe" [2003-11-25 729088]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-01-02 149280]
"RemoteControl"="c:\program files\PowerDVD\PDVDServ.exe" [2007-02-07 71216]
"LanguageShortcut"="c:\program files\PowerDVD\Language\Language.exe" [2007-02-07 54832]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-01-19 2743104]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

c:\documents and settings\x-Death-x\Start Menu\Programs\Startup\
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2010-1-24 3450608]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
D-Link AirPlus.lnk - c:\program files\D-Link AirPlus\AirPlus.exe [2010-1-5 262144]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\PowerDVD\\PowerDVD.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Program Files\\YouTubeMP3Downloader\\YouTubeMP3.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Garena\\Garena.exe"=

R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [2.1.2010 20:12 155136]
R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [2.1.2010 20:12 5248]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [31.12.2009 12:44 162640]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [31.12.2009 12:44 19024]
R3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\X-DEAT~1\LOCALS~1\Temp\ISD14F.tmp --> c:\docume~1\X-DEAT~1\LOCALS~1\Temp\ISD14F.tmp [?]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [6.2.2010 15:11 691696]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [6.11.2007 21:22 34064]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - GARENAPENGINE

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
.
------- Supplementary Scan -------
.
uStart Page = [Link mogu videti samo ulogovani korisnici]
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\x-Death-x\Application Data\Mozilla\Firefox\Profiles\vk1wbsjs.default\
FF - prefs.js: browser.search.selectedEngine - [Link mogu videti samo ulogovani korisnici]
FF - prefs.js: browser.startup.homepage - [Link mogu videti samo ulogovani korisnici]
FF - plugin: c:\documents and settings\x-Death-x\Application Data\Mozilla\Firefox\Profiles\vk1wbsjs.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2010-02-06 19:49
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, [Link mogu videti samo ulogovani korisnici]

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x897A3AE8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba8ecfc3
\Driver\ACPI -> ACPI.sys @ 0xba759cb8
\Driver\atapi -> 0x897a3ae8
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x8058236c
ParseProcedure -> ntkrnlpa.exe @ 0x8058146a
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x8058236c
ParseProcedure -> ntkrnlpa.exe @ 0x8058146a
NDIS: Realtek RTL8139/810x Family Fast Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0xba5e0ba0
PacketIndicateHandler -> NDIS.sys @ 0xba5edb21
SendHandler -> NDIS.sys @ 0xba5cb87b
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\X-DEAT~1\LOCALS~1\Temp\ISD14F.tmp"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\PowerDVD\000.fcl"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-527237240-329068152-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(716)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2604)
c:\windows\system32\msi.dll
.
Completion time: 2010-02-06 19:50:26
ComboFix-quarantined-files.txt 2010-02-06 18:50

Pre-Run: 51.167.334.400 bytes free
Post-Run: 51.789.438.976 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 0CE7CD7EB18E4AAC87A0D7228EF91E14

Poslao: 06 Feb 2010 21:54
Idi na vrh
offline
  • Pridružio: 04 Jan 2009
  • Poruke: 2168

Korak 1.

Preuzmi DeFogger sa ovog linka na Desktop .


Dvoklikom pokreni DeFogger;

Pojaviće se MsgBox na kome ćeš kliknuti na taster Disable;

Ponovo će se pojaviti MsgBox na kome ćeš kliknuti na Yes;
Sačekaj da se procesuiranje programa DeFogger izvrši pa nastavi prema sledećem uputstvu.

Napomena:Na kraju postupka ce biti potrebno ponovno pokretanje Windows-a.
Ovim postupkom će biti deaktivirani CD/DVD emulatori i omogućen neometan rad programa koje koristimo.



Korak 2.


Otvoriti Notepad i iskopirati sledeci tekst:

FileLook::
c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe

RegLock::
[HKEY_USERS\S-1-5-21-527237240-329068152-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]

Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

Poslao: 07 Feb 2010 15:43
Idi na vrh
offline
  • Pridružio: 12 Avg 2008
  • Poruke: 708
  • Gde živiš: Bogu iza tregera!

Evo ga...

ComboFix 10-02-05.04 - x-Death-x 07.02.2010 15:34:47.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1470.993 [GMT 1:00]
Running from: c:\documents and settings\x-Death-x\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\x-Death-x\Desktop\CFScript.txt
AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((( Files Created from 2010-01-07 to 2010-02-07 )))))))))))))))))))))))))))))))
.

2010-02-06 14:35 . 2010-02-06 22:43 -------- d-----w- c:\program files\Garena
2010-02-06 14:18 . 2010-02-06 19:32 98366 ----a-w- c:\windows\War3Unin.dat
2010-02-06 14:18 . 2010-02-06 14:24 2829 ----a-w- c:\windows\War3Unin.pif
2010-02-06 14:18 . 2010-02-06 14:24 139264 ----a-w- c:\windows\War3Unin.exe
2010-02-06 14:17 . 2010-02-06 22:35 -------- d-----w- c:\program files\Warcraft III
2010-02-06 14:11 . 2010-02-06 14:11 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-02-06 10:51 . 2010-02-06 10:51 2560 ----a-w- c:\windows\_MSRSTRT.EXE
2010-02-05 23:41 . 2010-02-06 10:59 -------- d-----w- c:\program files\JDownloader
2010-02-04 21:50 . 2004-08-03 22:08 31616 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2010-02-04 21:50 . 2004-08-03 22:08 31616 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2010-02-04 16:43 . 2010-02-04 16:43 -------- d-----w- c:\documents and settings\Default User\Local Settings\Application Data\Adobe
2010-02-04 16:42 . 2010-02-04 16:42 -------- d-----w- c:\program files\Common Files\Adobe
2010-02-04 16:39 . 2009-11-20 11:08 38784 ----a-w- c:\documents and settings\x-Death-x\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-02-04 16:39 . 2009-11-20 11:08 38784 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-02-04 16:39 . 2010-02-04 16:39 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-02-04 16:35 . 2010-02-04 16:58 -------- d-----w- c:\documents and settings\x-Death-x\Local Settings\Application Data\Adobe
2010-02-04 16:35 . 2010-02-04 16:35 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-02-04 16:35 . 2010-02-05 18:28 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-02-04 16:35 . 2010-02-04 16:35 -------- d-----w- c:\program files\NOS
2010-02-04 16:35 . 2010-01-25 09:02 31936 ----a-w- c:\documents and settings\x-Death-x\Application Data\Mozilla\Firefox\Profiles\vk1wbsjs.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
2010-02-04 16:35 . 2010-01-25 09:02 29344 ----a-w- c:\documents and settings\x-Death-x\Application Data\Mozilla\Firefox\Profiles\vk1wbsjs.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
2010-02-02 19:50 . 2010-02-02 19:50 -------- d-----w- c:\program files\WinPcap
2010-02-02 19:50 . 2010-02-02 19:50 -------- d-----w- c:\program files\YouTubeMP3Downloader
2010-02-02 14:58 . 2010-02-02 14:58 78264 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-02-02 14:38 . 2010-02-02 14:38 -------- d-----w- c:\program files\Unlocker
2010-02-02 14:20 . 2010-02-02 14:20 -------- d-----w- c:\documents and settings\x-Death-x\Local Settings\Application Data\Nero
2010-02-02 04:33 . 2010-02-02 14:43 -------- d-----w- c:\program files\Windows Sidebar
2010-02-02 04:20 . 2010-02-02 14:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2010-02-01 19:20 . 2010-02-02 15:36 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\vlc
2010-02-01 19:17 . 2010-02-01 19:18 -------- d-----w- c:\program files\VLC
2010-02-01 15:40 . 2010-02-01 15:40 -------- d-----w- c:\windows\system32\XPSViewer
2010-02-01 15:40 . 2010-02-01 15:40 -------- d-----w- c:\program files\MSBuild
2010-02-01 15:40 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-02-01 15:39 . 2010-02-01 15:40 -------- d-----w- C:\9d6e42c39e220bdf0352dc5ebce6
2010-02-01 15:39 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-02-01 15:39 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-02-01 15:39 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2010-02-01 15:39 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2010-02-01 15:39 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2010-02-01 15:39 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2010-02-01 15:39 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-02-01 15:39 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-02-01 15:36 . 2010-02-01 15:36 -------- d-----w- c:\program files\MSXML 6.0
2010-01-31 20:05 . 2010-01-31 20:05 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\TeamViewer
2010-01-31 20:04 . 2010-01-31 20:04 -------- d-----w- c:\program files\TeamViewer
2010-01-28 00:37 . 2010-01-28 00:37 -------- d-----w- c:\documents and settings\Turisti\Application Data\skypePM
2010-01-27 21:48 . 2010-01-28 01:19 -------- d-----w- c:\documents and settings\Turisti\Application Data\Skype
2010-01-25 19:05 . 2004-08-03 22:08 25600 -c--a-w- c:\windows\system32\dllcache\usbser.sys
2010-01-25 19:05 . 2004-08-03 22:08 25600 ----a-w- c:\windows\system32\drivers\usbser.sys
2010-01-24 20:44 . 2010-01-24 20:44 -------- d-----w- c:\program files\Stardock
2010-01-24 20:23 . 2010-01-25 22:08 -------- d-----w- c:\documents and settings\x-Death-x\Local Settings\Application Data\Stardock
2010-01-24 20:21 . 2010-02-06 10:52 -------- d-----w- c:\program files\AlienWare
2010-01-24 20:21 . 2010-02-06 10:48 -------- d-----w- c:\program files\Common Files\Stardock
2010-01-24 20:21 . 2003-02-26 21:27 36864 ----a-w- c:\windows\system32\wbsys.dll
2010-01-24 18:42 . 2010-01-24 18:42 -------- d-----w- c:\program files\Alwil Software
2010-01-24 18:42 . 2010-01-24 18:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-01-23 22:02 . 2010-01-23 22:06 -------- d-----w- c:\documents and settings\x-Death-x\Local Settings\Application Data\Paint.NET
2010-01-23 21:58 . 2010-01-23 21:58 -------- d-----w- c:\program files\Reference Assemblies
2010-01-23 21:53 . 2010-01-23 21:53 -------- d-----r- C:\AHCache
2010-01-21 23:29 . 2010-01-21 23:29 -------- d-----w- c:\documents and settings\Turisti\Application Data\Corel
2010-01-21 10:49 . 2010-01-21 10:49 -------- d-----w- c:\documents and settings\Turisti\Local Settings\Application Data\Apple Computer
2010-01-21 10:40 . 2010-01-21 10:40 -------- d-----w- c:\documents and settings\Turisti
2010-01-20 19:26 . 2010-01-20 19:31 -------- d-----w- c:\program files\ScreenCapture
2010-01-20 19:26 . 2010-01-20 19:26 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\InstallShield
2010-01-12 18:33 . 2010-01-12 18:33 -------- d-----w- c:\documents and settings\x-Death-x\Local Settings\Application Data\Identities
2010-01-12 16:45 . 2010-01-26 19:22 -------- d-----w- c:\documents and settings\Maja\Application Data\skypePM
2010-01-08 20:39 . 2010-01-08 21:39 -------- d-----w- c:\program files\Valve

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-06 10:51 . 2009-12-31 15:18 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\uTorrent
2010-02-02 15:01 . 2010-01-04 00:00 -------- d-----w- c:\program files\AIMP2
2010-02-01 17:32 . 2009-12-31 11:42 19224 ----a-w- c:\documents and settings\x-Death-x\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-31 20:08 . 2009-12-31 17:50 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\Skype
2010-01-31 20:01 . 2009-12-31 17:51 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\skypePM
2010-01-27 21:47 . 2010-01-04 21:45 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-01-26 20:47 . 2010-01-04 21:37 -------- d-----w- c:\documents and settings\Maja\Application Data\Skype
2010-01-25 19:01 . 2010-01-25 19:01 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2010-01-25 19:01 . 2010-01-25 19:01 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2010-01-20 19:27 . 2009-12-31 12:00 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-19 13:13 . 2009-12-31 11:44 162640 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-01-19 11:57 . 2009-12-31 11:44 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-01-19 11:57 . 2009-12-31 11:43 152672 ----a-w- c:\windows\system32\aswBoot.exe
2010-01-19 11:46 . 2009-12-31 11:44 46544 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-01-19 11:43 . 2009-12-31 11:44 23248 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-01-19 11:43 . 2009-12-31 11:44 100304 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-01-19 11:43 . 2009-12-31 11:44 94672 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-01-19 11:42 . 2009-12-31 11:44 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-01-19 11:42 . 2009-12-31 11:44 28240 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-01-09 15:43 . 2009-12-31 18:07 -------- d-----w- c:\program files\Common Files\Apple
2010-01-07 16:25 . 2010-01-07 16:25 -------- d-----w- c:\program files\Microsoft
2010-01-07 16:25 . 2010-01-07 16:25 -------- d-----w- c:\program files\Windows Live
2010-01-07 16:25 . 2010-01-07 16:25 -------- d-----w- c:\program files\Windows Live SkyDrive
2010-01-07 16:14 . 2010-01-07 16:14 -------- d-----w- c:\program files\Common Files\Windows Live
2010-01-07 12:25 . 2009-12-31 15:50 -------- d-----w- c:\program files\Common Files\AVSMedia
2010-01-07 12:19 . 2010-01-07 12:16 -------- d-----w- c:\program files\PowerDVD
2010-01-07 12:19 . 2010-01-07 12:19 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\CyberLink
2010-01-07 12:18 . 2010-01-07 12:18 -------- d-----w- c:\documents and settings\All Users\Application Data\CyberLink
2010-01-07 12:17 . 2010-01-07 12:16 -------- d-----w- c:\program files\CyberLink
2010-01-07 12:02 . 2010-01-04 21:44 -------- d-----w- c:\program files\SourceTec
2010-01-07 12:02 . 2010-01-04 21:44 -------- d-----w- c:\program files\Common Files\SourceTec
2010-01-06 15:15 . 2010-01-04 10:26 -------- d-----w- c:\documents and settings\Maja\Application Data\Free Download Manager
2010-01-05 20:44 . 2010-01-05 20:44 -------- d-----w- c:\documents and settings\Maja\Application Data\Corel
2010-01-05 20:40 . 2009-12-31 12:06 -------- d-----w- c:\program files\Realtek
2010-01-05 16:52 . 2010-01-05 16:52 -------- d-----w- c:\program files\D-Link AirPlus
2010-01-05 16:13 . 2010-01-05 16:11 -------- d-----w- c:\program files\Driver Magician
2010-01-04 21:37 . 2010-01-04 21:37 -------- d-----w- c:\program files\Common Files\Skype
2010-01-04 21:37 . 2009-12-31 17:48 -------- d-----r- c:\program files\Skype
2010-01-04 21:31 . 2010-01-04 21:31 -------- d-----w- c:\program files\Inpaint
2010-01-03 23:03 . 2010-01-03 22:16 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-01-03 22:14 . 2010-01-03 22:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard
2010-01-02 20:38 . 2010-01-02 20:39 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-01-02 20:38 . 2010-01-02 20:38 -------- d-----w- c:\program files\Java
2010-01-02 20:38 . 2010-01-02 20:38 152576 ----a-w- c:\documents and settings\x-Death-x\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2010-01-02 20:36 . 2010-01-02 20:36 79488 ----a-w- c:\documents and settings\x-Death-x\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-01-02 19:24 . 2010-01-02 19:24 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\Leadertech
2010-01-02 19:12 . 2010-01-02 19:12 -------- d-----w- c:\program files\Deamon
2010-01-02 14:35 . 2009-12-31 18:08 -------- d-----w- c:\program files\QuickTime
2010-01-02 14:35 . 2009-12-31 18:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-01-01 14:31 . 2009-12-31 18:10 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\Apple Computer
2010-01-01 13:58 . 2010-01-01 13:58 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\AnvSoft
2010-01-01 11:56 . 2010-01-01 11:56 -------- d-----w- c:\documents and settings\All Users\Application Data\AVS4YOU
2010-01-01 11:52 . 2009-12-31 11:16 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-12-31 18:10 . 2009-12-31 18:09 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-12-31 18:08 . 2009-12-31 18:08 -------- d-----w- c:\program files\Apple Software Update
2009-12-31 18:07 . 2009-12-31 18:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-12-31 17:51 . 2009-12-31 17:51 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-12-31 17:48 . 2009-12-31 17:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-12-31 15:31 . 2009-12-31 15:31 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\Ambient Design
2009-12-31 15:19 . 2009-12-31 15:19 -------- d-----w- c:\program files\uTorrent
2009-12-31 14:03 . 2009-12-31 14:03 -------- d-----w- c:\program files\7-Zip
2009-12-31 14:01 . 2009-12-31 14:01 0 ----a-w- c:\windows\nsreg.dat
2009-12-31 13:59 . 2009-12-31 13:59 -------- d-----w- c:\documents and settings\x-Death-x\Application Data\Corel
2009-12-31 12:36 . 2009-12-31 12:36 -------- d-----w- c:\program files\Common Files\Corel
2009-12-31 12:36 . 2009-12-31 12:00 -------- d-----w- c:\program files\Common Files\InstallShield
2009-12-31 12:36 . 2009-12-31 12:36 -------- d-----w- c:\program files\Corel
2009-12-31 12:27 . 2009-12-31 12:27 -------- d-----w- c:\program files\Microsoft ActiveSync
2009-12-31 11:57 . 2009-12-31 11:57 -------- d-----w- c:\program files\MSXML 4.0
2009-12-31 11:17 . 2009-12-31 11:17 -------- d-----w- c:\program files\microsoft frontpage
2009-12-31 11:12 . 2009-12-31 11:12 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-12-29 21:29 . 2009-12-31 19:44 258352 ----a-w- c:\windows\system32\unicows.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

--- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File size: 86016
Created time: 2010-02-04 16:35
Modified time: 2010-02-04 16:35
MD5: 8C27E380661ECBE327203F3B1456DD2C
SHA1: 56E3ABCA71E56065FB1E91BE7A070DDB8FE6F132


------- Sigcheck -------

[-] 2007-12-29 . 9F960FAC5166F8626B9CDE4DD9A0EB84 . 1580544 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( [Link mogu videti samo ulogovani korisnici] )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-02-07 14:28 . 2010-02-07 14:28 16384 c:\windows\Temp\Perflib_Perfdata_1fc.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cf59ae24-5796-44fc-9575-8d4f383c65f8}]
2010-01-29 14:44 221184 ----a-w- c:\program files\YouTubeMP3Downloader\MinBHOMp3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{f27a9a1d-6f23-442d-88c0-5dc40fd13dcd}"= "c:\program files\YouTubeMP3Downloader\YouTubeMP3.dll" [2010-01-29 704512]

[HKEY_CLASSES_ROOT\clsid\{f27a9a1d-6f23-442d-88c0-5dc40fd13dcd}]
[HKEY_CLASSES_ROOT\KBBar.KBBarBandMp3.1]
[HKEY_CLASSES_ROOT\TypeLib\{f20fd027-a5f3-451a-8db1-13298321f6a8}]
[HKEY_CLASSES_ROOT\KBBar.KBBarBandMp3]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2005-10-15 14864384]
"CorelDRAW Graphics Suite 11b"="c:\program files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe" [2003-11-25 729088]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-01-02 149280]
"RemoteControl"="c:\program files\PowerDVD\PDVDServ.exe" [2007-02-07 71216]
"LanguageShortcut"="c:\program files\PowerDVD\Language\Language.exe" [2007-02-07 54832]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-01-19 2743104]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

c:\documents and settings\x-Death-x\Start Menu\Programs\Startup\
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2010-1-24 3450608]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
D-Link AirPlus.lnk - c:\program files\D-Link AirPlus\AirPlus.exe [2010-1-5 262144]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\PowerDVD\\PowerDVD.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Garena\\Garena.exe"=
"c:\\Program Files\\YouTubeMP3Downloader\\YouTubeMP3.exe"=

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [31.12.2009 12:44 162640]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [31.12.2009 12:44 19024]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\X-DEAT~1\LOCALS~1\Temp\UZM361.tmp --> c:\docume~1\X-DEAT~1\LOCALS~1\Temp\UZM361.tmp [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [6.11.2007 21:22 34064]
S4 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [2.1.2010 20:12 155136]
S4 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [2.1.2010 20:12 5248]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [6.2.2010 15:11 691696]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - ISAPNP

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
.
------- Supplementary Scan -------
.
uStart Page = [Link mogu videti samo ulogovani korisnici]
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\x-Death-x\Application Data\Mozilla\Firefox\Profiles\vk1wbsjs.default\
FF - prefs.js: browser.search.selectedEngine - [Link mogu videti samo ulogovani korisnici]
FF - prefs.js: browser.startup.homepage - [Link mogu videti samo ulogovani korisnici]
FF - plugin: c:\documents and settings\x-Death-x\Application Data\Mozilla\Firefox\Profiles\vk1wbsjs.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2010-02-07 15:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\X-DEAT~1\LOCALS~1\Temp\UZM361.tmp"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\PowerDVD\000.fcl"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(700)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3328-)
c:\program files\Stardock\ObjectDock\DockShellHook.dll
.
Completion time: 2010-02-07 15:40:23
ComboFix-quarantined-files.txt 2010-02-07 14:40
ComboFix2.txt 2010-02-06 18:50

Pre-Run: 51.729.027.072 bytes free
Post-Run: 51.699.220.480 bytes free

- - End Of File - - 863F0CAE70693A84743474C18B32237F

Poslao: 07 Feb 2010 16:27
Idi na vrh
offline
  • Pridružio: 04 Jan 2009
  • Poruke: 2168

Ovo sad deluje ok.


Isprati još sledeća uputstva...

Korak 1.


Potrebno je deinstalirati ComboFix:
klikni start (ili ), a zatim RUN.

Na Visti koristiti Start Search polje ukoliko Run nije dostupan.

U liniju za unos teksta ukucaj (iskopiraj) sledeće:

ComboFix /Uninstall

Primeti da postoji razmak između "ComboFix" i "/Uninstall".



a zatim klikni OK (ili pritisni Enter).

Sačekaj da se proces deinstalacije završi.



Korak 2.


Ponovo dvoklikom pokreni DeFogger;

Pojaviće se MsgBox na kome ćeš kliknuti na taster Re-enable;

Ponovo će se pojaviti MsgBox na kome ćeš kliknuti na Yes;
Sačekaj da se procesuiranje programa DeFogger izvrši pa nastavi prema sledećem uputstvu.

Napomena:Na kraju postupka ce biti potrebno ponovno pokretanje Windows-a.
Ovim postupkom će ponovo biti aktivirani CD/DVD emulatori.

Poslao: 07 Feb 2010 17:23
Idi na vrh
offline
  • Pridružio: 12 Avg 2008
  • Poruke: 708
  • Gde živiš: Bogu iza tregera!

Hvala mnogo...Sada neko od modova neka stavi katanac ako hoce...da drugi nebi piskarali ovuda...

Imas moje postovanje...

MyCity » Ambulanta -> Arhiva Ambulante » Problem!!Nije Hitno Ali Je Pozeljna Pomoc...

Ko je trenutno na forumu
 

Ukupno su 1193 korisnika na forumu :: 77 registrovanih, 6 sakrivenih i 1110 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 15694 - dana 01 Feb 2026 12:23

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: A.R.Chafee.Jr., ALBION101, aleksamaki, Andrija357, Anunakiii, Betty25, blatruc82, Bojan198527, Bubimir, Cirkon, cuvarkuca, Dejan_vw, Djuza, DonRumataEstorski, Drugard72, dskrlec33, dusanobr, Flanker-G, FOX, Georgius, goxin, halkin gol, ikan, ivran064, jaka013, Jakonjveliki, Jan, Jaz, jeen yuhs, jodzula, Još malo pa deda, Kajzer Soze, Knovakov, Kolimator, kolle.the.kid, komsija1, Kriglord, Kubovac, kybonacci, Lazur_01, Lieutenant, madza, Malahit, mean_machine, mercedesamg, Mrav Obrad, nebkv, nekdo, niksa517, nobutado, opt1, Pantelejmon, pceklic, Pekman, Petar888, ping15, PlayerOne, PoolbegD02, Povratak1912, RajkoB, SamostalniReferent, sasa87, skok, skvara, sspp, Tvrtko I, ujke, VaRvArI 85, vathra, vazduh, Velibor Radoja, Volkhov-M, W123, Wepp, zixo, zziko, Đurđevdan