MyCity » Ambulanta -> Arhiva Ambulante » Šta dalje??

Šta dalje??

Napisano na dan: 12.3.2007
4

Šta dalje??
Pagination Prethodna strana
Sledeća strana Pagination

Idi na vrh

Poslao: 14 Mar 2007 16:16
Idi na vrh
offline
  • maha  Male
  • Super građanin
  • Pridružio: 06 Dec 2006
  • Poruke: 1152

Ne koristim IE već Mozill-u Firefox.



Poslao: 14 Mar 2007 16:27
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Ponovi postupak sa KillBox-om, ali pre klika na dugme za brisanje odaberi dole u opcijama "Delete on Reboot".
Fajl ce biti obrisan pri sledecem podizanju Windowsa.

Notepad nije opcija vec program koji ide uz svaki Windows.

Nakon sto budes restartovao racunar da bi onaj fajl bio obrisan, napravi ponovo GMER log.



Poslao: 14 Mar 2007 18:24
Idi na vrh
offline
  • maha  Male
  • Super građanin
  • Pridružio: 06 Dec 2006
  • Poruke: 1152

Uradio sam KillBox a evo i GMER log-a.

GMER 1.0.12.12086 - [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2007-03-14 18:26:49
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.12 ----

SSDT a347bus.sys ZwClose
SSDT a347bus.sys ZwCreateKey
SSDT a347bus.sys ZwCreatePagingFile
SSDT a347bus.sys ZwEnumerateKey
SSDT a347bus.sys ZwEnumerateValueKey
SSDT a347bus.sys ZwOpenFile
SSDT a347bus.sys ZwOpenKey
SSDT a347bus.sys ZwQueryKey
SSDT a347bus.sys ZwQueryValueKey
SSDT a347bus.sys ZwSetSystemPowerState
SSDT \??\C:\PROGRA~1\Agnitum\OUTPOS~1\kernel\FILTNT.SYS ZwWriteVirtualMemory

---- User code sections - GMER 1.0.12 ----

.text C:\WINDOWS\explorer.exe[1484] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 51981D1D C:\PROGRA~1\DVDIDL~1\DVDShell.dll
.text C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe[2340] KERNEL32.dll!CreateProcessW 7C802332 5 Bytes JMP 51981D1D C:\PROGRA~1\DVDIDL~1\DVDShell.dll

---- Devices - GMER 1.0.12 ----

Device \FileSystem\Ntfs \Ntfs IRP_MJ_READ 8256A810
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE 824FACD0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE_NAMED_PIPE 824FACD0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLOSE 824FACD0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_READ 824FACD0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_WRITE 824FACD0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_INFORMATION 824FACD0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_INFORMATION 824FACD0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_EA 824FACD0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_EA 824FACD0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FLUSH_BUFFERS 824FACD0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_VOLUME_INFORMATION 824FACD0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_VOLUME_INFORMATION 824FACD0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DIRECTORY_CONTROL 824FACD0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FILE_SYSTEM_CONTROL 824FACD0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CONTROL 824FACD0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_INTERNAL_DEVICE_CONTROL 824FACD0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SHUTDOWN 824FACD0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_LOCK_CONTROL 824FACD0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLEANUP 824FACD0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE_MAILSLOT 824FACD0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_SECURITY 824FACD0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_SECURITY 824FACD0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_POWER 824FACD0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SYSTEM_CONTROL 824FACD0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CHANGE 824FACD0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_QUOTA 824FACD0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_QUOTA 824FACD0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_PNP 824FACD0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_READ 81FC6E98
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE 824FACD0
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE_NAMED_PIPE 824FACD0
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLOSE 824FACD0
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_READ 824FACD0
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_WRITE 824FACD0
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_INFORMATION 824FACD0
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_INFORMATION 824FACD0
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_EA 824FACD0
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_EA 824FACD0
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FLUSH_BUFFERS 824FACD0
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_VOLUME_INFORMATION 824FACD0
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_VOLUME_INFORMATION 824FACD0
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DIRECTORY_CONTROL 824FACD0
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FILE_SYSTEM_CONTROL 824FACD0
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CONTROL 824FACD0
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_INTERNAL_DEVICE_CONTROL 824FACD0
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SHUTDOWN 824FACD0
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_LOCK_CONTROL 824FACD0
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLEANUP 824FACD0
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE_MAILSLOT 824FACD0
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_SECURITY 824FACD0
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_SECURITY 824FACD0
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_POWER 824FACD0
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SYSTEM_CONTROL 824FACD0
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CHANGE 824FACD0
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_QUOTA 824FACD0
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_QUOTA 824FACD0
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_PNP 824FACD0
Device \Driver\nvata \Device\00000076 IRP_MJ_CREATE 82163F00
Device \Driver\nvata \Device\00000076 IRP_MJ_CREATE_NAMED_PIPE 82163F00
Device \Driver\nvata \Device\00000076 IRP_MJ_CLOSE 82163F00
Device \Driver\nvata \Device\00000076 IRP_MJ_READ 82163F00
Device \Driver\nvata \Device\00000076 IRP_MJ_WRITE 82163F00
Device \Driver\nvata \Device\00000076 IRP_MJ_QUERY_INFORMATION 82163F00
Device \Driver\nvata \Device\00000076 IRP_MJ_SET_INFORMATION 82163F00
Device \Driver\nvata \Device\00000076 IRP_MJ_QUERY_EA 82163F00
Device \Driver\nvata \Device\00000076 IRP_MJ_SET_EA 82163F00
Device \Driver\nvata \Device\00000076 IRP_MJ_FLUSH_BUFFERS 82163F00
Device \Driver\nvata \Device\00000076 IRP_MJ_QUERY_VOLUME_INFORMATION 82163F00
Device \Driver\nvata \Device\00000076 IRP_MJ_SET_VOLUME_INFORMATION 82163F00
Device \Driver\nvata \Device\00000076 IRP_MJ_DIRECTORY_CONTROL 82163F00
Device \Driver\nvata \Device\00000076 IRP_MJ_FILE_SYSTEM_CONTROL 82163F00
Device \Driver\nvata \Device\00000076 IRP_MJ_DEVICE_CONTROL 82163F00
Device \Driver\nvata \Device\00000076 IRP_MJ_INTERNAL_DEVICE_CONTROL 82163F00
Device \Driver\nvata \Device\00000076 IRP_MJ_SHUTDOWN 82163F00
Device \Driver\nvata \Device\00000076 IRP_MJ_LOCK_CONTROL 82163F00
Device \Driver\nvata \Device\00000076 IRP_MJ_CLEANUP 82163F00
Device \Driver\nvata \Device\00000076 IRP_MJ_CREATE_MAILSLOT 82163F00
Device \Driver\nvata \Device\00000076 IRP_MJ_QUERY_SECURITY 82163F00
Device \Driver\nvata \Device\00000076 IRP_MJ_SET_SECURITY 82163F00
Device \Driver\nvata \Device\00000076 IRP_MJ_POWER 82163F00
Device \Driver\nvata \Device\00000076 IRP_MJ_SYSTEM_CONTROL 82163F00
Device \Driver\nvata \Device\00000076 IRP_MJ_DEVICE_CHANGE 82163F00
Device \Driver\nvata \Device\00000076 IRP_MJ_QUERY_QUOTA 82163F00
Device \Driver\nvata \Device\00000076 IRP_MJ_SET_QUOTA 82163F00
Device \Driver\nvata \Device\00000076 IRP_MJ_PNP 82163F00
Device \Driver\nvata \Device\00000078 IRP_MJ_CREATE 82163F00
Device \Driver\nvata \Device\00000078 IRP_MJ_CREATE_NAMED_PIPE 82163F00
Device \Driver\nvata \Device\00000078 IRP_MJ_CLOSE 82163F00
Device \Driver\nvata \Device\00000078 IRP_MJ_READ 82163F00
Device \Driver\nvata \Device\00000078 IRP_MJ_WRITE 82163F00
Device \Driver\nvata \Device\00000078 IRP_MJ_QUERY_INFORMATION 82163F00
Device \Driver\nvata \Device\00000078 IRP_MJ_SET_INFORMATION 82163F00
Device \Driver\nvata \Device\00000078 IRP_MJ_QUERY_EA 82163F00
Device \Driver\nvata \Device\00000078 IRP_MJ_SET_EA 82163F00
Device \Driver\nvata \Device\00000078 IRP_MJ_FLUSH_BUFFERS 82163F00
Device \Driver\nvata \Device\00000078 IRP_MJ_QUERY_VOLUME_INFORMATION 82163F00
Device \Driver\nvata \Device\00000078 IRP_MJ_SET_VOLUME_INFORMATION 82163F00
Device \Driver\nvata \Device\00000078 IRP_MJ_DIRECTORY_CONTROL 82163F00
Device \Driver\nvata \Device\00000078 IRP_MJ_FILE_SYSTEM_CONTROL 82163F00
Device \Driver\nvata \Device\00000078 IRP_MJ_DEVICE_CONTROL 82163F00
Device \Driver\nvata \Device\00000078 IRP_MJ_INTERNAL_DEVICE_CONTROL 82163F00
Device \Driver\nvata \Device\00000078 IRP_MJ_SHUTDOWN 82163F00
Device \Driver\nvata \Device\00000078 IRP_MJ_LOCK_CONTROL 82163F00
Device \Driver\nvata \Device\00000078 IRP_MJ_CLEANUP 82163F00
Device \Driver\nvata \Device\00000078 IRP_MJ_CREATE_MAILSLOT 82163F00
Device \Driver\nvata \Device\00000078 IRP_MJ_QUERY_SECURITY 82163F00
Device \Driver\nvata \Device\00000078 IRP_MJ_SET_SECURITY 82163F00
Device \Driver\nvata \Device\00000078 IRP_MJ_POWER 82163F00
Device \Driver\nvata \Device\00000078 IRP_MJ_SYSTEM_CONTROL 82163F00
Device \Driver\nvata \Device\00000078 IRP_MJ_DEVICE_CHANGE 82163F00
Device \Driver\nvata \Device\00000078 IRP_MJ_QUERY_QUOTA 82163F00
Device \Driver\nvata \Device\00000078 IRP_MJ_SET_QUOTA 82163F00
Device \Driver\nvata \Device\00000078 IRP_MJ_PNP 82163F00
Device \FileSystem\Srv \Device\LanmanServer IRP_MJ_READ 82214F10
Device \Driver\nvata \Device\NvAta0 IRP_MJ_CREATE 82163F00
Device \Driver\nvata \Device\NvAta0 IRP_MJ_CREATE_NAMED_PIPE 82163F00
Device \Driver\nvata \Device\NvAta0 IRP_MJ_CLOSE 82163F00
Device \Driver\nvata \Device\NvAta0 IRP_MJ_READ 82163F00
Device \Driver\nvata \Device\NvAta0 IRP_MJ_WRITE 82163F00
Device \Driver\nvata \Device\NvAta0 IRP_MJ_QUERY_INFORMATION 82163F00
Device \Driver\nvata \Device\NvAta0 IRP_MJ_SET_INFORMATION 82163F00
Device \Driver\nvata \Device\NvAta0 IRP_MJ_QUERY_EA 82163F00
Device \Driver\nvata \Device\NvAta0 IRP_MJ_SET_EA 82163F00
Device \Driver\nvata \Device\NvAta0 IRP_MJ_FLUSH_BUFFERS 82163F00
Device \Driver\nvata \Device\NvAta0 IRP_MJ_QUERY_VOLUME_INFORMATION 82163F00
Device \Driver\nvata \Device\NvAta0 IRP_MJ_SET_VOLUME_INFORMATION 82163F00
Device \Driver\nvata \Device\NvAta0 IRP_MJ_DIRECTORY_CONTROL 82163F00
Device \Driver\nvata \Device\NvAta0 IRP_MJ_FILE_SYSTEM_CONTROL 82163F00
Device \Driver\nvata \Device\NvAta0 IRP_MJ_DEVICE_CONTROL 82163F00
Device \Driver\nvata \Device\NvAta0 IRP_MJ_INTERNAL_DEVICE_CONTROL 82163F00
Device \Driver\nvata \Device\NvAta0 IRP_MJ_SHUTDOWN 82163F00
Device \Driver\nvata \Device\NvAta0 IRP_MJ_LOCK_CONTROL 82163F00
Device \Driver\nvata \Device\NvAta0 IRP_MJ_CLEANUP 82163F00
Device \Driver\nvata \Device\NvAta0 IRP_MJ_CREATE_MAILSLOT 82163F00
Device \Driver\nvata \Device\NvAta0 IRP_MJ_QUERY_SECURITY 82163F00
Device \Driver\nvata \Device\NvAta0 IRP_MJ_SET_SECURITY 82163F00
Device \Driver\nvata \Device\NvAta0 IRP_MJ_POWER 82163F00
Device \Driver\nvata \Device\NvAta0 IRP_MJ_SYSTEM_CONTROL 82163F00
Device \Driver\nvata \Device\NvAta0 IRP_MJ_DEVICE_CHANGE 82163F00
Device \Driver\nvata \Device\NvAta0 IRP_MJ_QUERY_QUOTA 82163F00
Device \Driver\nvata \Device\NvAta0 IRP_MJ_SET_QUOTA 82163F00
Device \Driver\nvata \Device\NvAta0 IRP_MJ_PNP 82163F00
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_READ 81FF2570
Device \Driver\nvata \Device\NvAta1 IRP_MJ_CREATE 82163F00
Device \Driver\nvata \Device\NvAta1 IRP_MJ_CREATE_NAMED_PIPE 82163F00
Device \Driver\nvata \Device\NvAta1 IRP_MJ_CLOSE 82163F00
Device \Driver\nvata \Device\NvAta1 IRP_MJ_READ 82163F00
Device \Driver\nvata \Device\NvAta1 IRP_MJ_WRITE 82163F00
Device \Driver\nvata \Device\NvAta1 IRP_MJ_QUERY_INFORMATION 82163F00
Device \Driver\nvata \Device\NvAta1 IRP_MJ_SET_INFORMATION 82163F00
Device \Driver\nvata \Device\NvAta1 IRP_MJ_QUERY_EA 82163F00
Device \Driver\nvata \Device\NvAta1 IRP_MJ_SET_EA 82163F00
Device \Driver\nvata \Device\NvAta1 IRP_MJ_FLUSH_BUFFERS 82163F00
Device \Driver\nvata \Device\NvAta1 IRP_MJ_QUERY_VOLUME_INFORMATION 82163F00
Device \Driver\nvata \Device\NvAta1 IRP_MJ_SET_VOLUME_INFORMATION 82163F00
Device \Driver\nvata \Device\NvAta1 IRP_MJ_DIRECTORY_CONTROL 82163F00
Device \Driver\nvata \Device\NvAta1 IRP_MJ_FILE_SYSTEM_CONTROL 82163F00
Device \Driver\nvata \Device\NvAta1 IRP_MJ_DEVICE_CONTROL 82163F00
Device \Driver\nvata \Device\NvAta1 IRP_MJ_INTERNAL_DEVICE_CONTROL 82163F00
Device \Driver\nvata \Device\NvAta1 IRP_MJ_SHUTDOWN 82163F00
Device \Driver\nvata \Device\NvAta1 IRP_MJ_LOCK_CONTROL 82163F00
Device \Driver\nvata \Device\NvAta1 IRP_MJ_CLEANUP 82163F00
Device \Driver\nvata \Device\NvAta1 IRP_MJ_CREATE_MAILSLOT 82163F00
Device \Driver\nvata \Device\NvAta1 IRP_MJ_QUERY_SECURITY 82163F00
Device \Driver\nvata \Device\NvAta1 IRP_MJ_SET_SECURITY 82163F00
Device \Driver\nvata \Device\NvAta1 IRP_MJ_POWER 82163F00
Device \Driver\nvata \Device\NvAta1 IRP_MJ_SYSTEM_CONTROL 82163F00
Device \Driver\nvata \Device\NvAta1 IRP_MJ_DEVICE_CHANGE 82163F00
Device \Driver\nvata \Device\NvAta1 IRP_MJ_QUERY_QUOTA 82163F00
Device \Driver\nvata \Device\NvAta1 IRP_MJ_SET_QUOTA 82163F00
Device \Driver\nvata \Device\NvAta1 IRP_MJ_PNP 82163F00
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_READ 81FF2570
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_READ 820125E0
Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_READ 8202B3F8
Device \FileSystem\cdudf_xp \Device\CdUdf_XP IRP_MJ_READ 8201C860
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port1Path0Target0Lun0 IRP_MJ_CREATE 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port1Path0Target0Lun0 IRP_MJ_CREATE_NAMED_PIPE 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port1Path0Target0Lun0 IRP_MJ_CLOSE 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port1Path0Target0Lun0 IRP_MJ_READ 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port1Path0Target0Lun0 IRP_MJ_WRITE 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port1Path0Target0Lun0 IRP_MJ_QUERY_INFORMATION 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port1Path0Target0Lun0 IRP_MJ_SET_INFORMATION 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port1Path0Target0Lun0 IRP_MJ_QUERY_EA 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port1Path0Target0Lun0 IRP_MJ_SET_EA 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port1Path0Target0Lun0 IRP_MJ_FLUSH_BUFFERS 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port1Path0Target0Lun0 IRP_MJ_QUERY_VOLUME_INFORMATION 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port1Path0Target0Lun0 IRP_MJ_SET_VOLUME_INFORMATION 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port1Path0Target0Lun0 IRP_MJ_DIRECTORY_CONTROL 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port1Path0Target0Lun0 IRP_MJ_FILE_SYSTEM_CONTROL 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port1Path0Target0Lun0 IRP_MJ_DEVICE_CONTROL 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port1Path0Target0Lun0 IRP_MJ_INTERNAL_DEVICE_CONTROL 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port1Path0Target0Lun0 IRP_MJ_SHUTDOWN 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port1Path0Target0Lun0 IRP_MJ_LOCK_CONTROL 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port1Path0Target0Lun0 IRP_MJ_CLEANUP 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port1Path0Target0Lun0 IRP_MJ_CREATE_MAILSLOT 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port1Path0Target0Lun0 IRP_MJ_QUERY_SECURITY 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port1Path0Target0Lun0 IRP_MJ_SET_SECURITY 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port1Path0Target0Lun0 IRP_MJ_POWER 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port1Path0Target0Lun0 IRP_MJ_SYSTEM_CONTROL 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port1Path0Target0Lun0 IRP_MJ_DEVICE_CHANGE 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port1Path0Target0Lun0 IRP_MJ_QUERY_QUOTA 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port1Path0Target0Lun0 IRP_MJ_SET_QUOTA 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port1Path0Target0Lun0 IRP_MJ_PNP 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_CREATE 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_CREATE_NAMED_PIPE 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_CLOSE 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_READ 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_WRITE 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_QUERY_INFORMATION 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SET_INFORMATION 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_QUERY_EA 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SET_EA 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_FLUSH_BUFFERS 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_QUERY_VOLUME_INFORMATION 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SET_VOLUME_INFORMATION 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_DIRECTORY_CONTROL 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_FILE_SYSTEM_CONTROL 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_DEVICE_CONTROL 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_INTERNAL_DEVICE_CONTROL 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SHUTDOWN 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_LOCK_CONTROL 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_CLEANUP 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_CREATE_MAILSLOT 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_QUERY_SECURITY 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SET_SECURITY 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_POWER 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SYSTEM_CONTROL 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_DEVICE_CHANGE 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_QUERY_QUOTA 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SET_QUOTA 820517F0
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_PNP 820517F0
Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer IRP_MJ_READ 823FB860
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer IRP_MJ_READ 823FB860
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer IRP_MJ_READ 823FB860
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer IRP_MJ_READ 823FB860
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer IRP_MJ_READ 823FB860
Device \FileSystem\Cdfs \Cdfs IRP_MJ_READ 825690E8

---- Registry - GMER 1.0.12 ----

Reg \Registry\USER\S-1-5-21-1454471165-1303643608-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BBFD6703-43D3-A048-240B-D282EBDC7469}@fahbeidhekmg 0x66 0x61 0x62 0x6A ...

---- Files - GMER 1.0.12 ----

ADS C:\Documents and Settings\-\My Documents\My eBooks\Korisni sajtovi za u:Roxio EMC Stream
ADS C:\Documents and Settings\-\My Documents\My eBooks\Korisni sajtovi za u:Roxio EMC Stream
ADS C:\Documents and Settings\-\My Documents\My eBooks\Korisni sajtovi za u:Roxio EMC Stream
ADS C:\Documents and Settings\-\My Documents\My eBooks\Korisni sajtovi za u:Roxio EMC Stream
ADS C:\Documents and Settings\-\My Documents\My eBooks\:Roxio EMC Stream
ADS C:\Documents and Settings\-\My Documents\My eBooks\:Roxio EMC Stream
ADS C:\Documents and Settings\-\My Documents\My eBooks\:Roxio EMC Stream
ADS C:\Documents and Settings\-\My Documents\My eBooks\:Roxio EMC Stream
ADS C:\Documents and Settings\-\My Documents\My eBooks\:Roxio EMC Stream
ADS D:\Programs\Tutoriali\Mre:Roxio EMC Stream
ADS D:\Programs\Tutoriali\Za:Roxio EMC Stream

---- EOF - GMER 1.0.12 ----

Poslao: 14 Mar 2007 18:47
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Ovo izgleda vec mnogo bolje.

Daj novi HJT log, pa da popravimo i DNS server, da te vise ne preusmerava.
Izgleda da smo se otarasili rootkita koji nam je branio da popravimo DNS.

Poslao: 14 Mar 2007 20:26
Idi na vrh
offline
  • maha  Male
  • Super građanin
  • Pridružio: 06 Dec 2006
  • Poruke: 1152

Malo kasnim ali imam problema sa konekcijom. Dešava se ponekad.
Evo novog HJT-a.

Logfile of HijackThis v1.99.1
Scan saved at 20:28:00, on 14.3.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CDBurnerXP\NMSAccess.exe
C:\Program Files\Eset\nod32krn.exe
C:\PROGRA~1\Agnitum\OUTPOS~1\outpost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\LClock\LClock.exe
C:\Program Files\VisualTooltip\VisualToolTip.exe
C:\Program Files\Styler\Styler.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Super Utilities\SuperUtil.exe
D:\Super Utilities\SuperUtil.exe
C:\Program Files\Ectosoft\Smart Wallpaper Lite\smartwallpaper.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe
C:\DOCUME~1\-\LOCALS~1\Temp\{5F167E6F-1BA5-488A-B7F6-789D67D67770}\Blaero Start Orb.exe
C:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Programs from MyCity for Viruses\Hijack This\airmj.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = [Link mogu videti samo ulogovani korisnici]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdmcks.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKLM\..\Run: [Vista Sidebar] C:\Program Files\Vista Sidebar\sidebar.exe
O4 - HKLM\..\Run: [VisualTooltip] C:\Program Files\VisualTooltip\VisualToolTip.exe
O4 - HKLM\..\Run: [Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
O4 - HKLM\..\Run: [Styler] C:\Program Files\Styler\Styler.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [xdbtyawi] c:\windows\system32\xdbtyawi.exe xdbtyawi
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Super Utilities] D:\Super Utilities\SuperUtil.exe /min
O4 - HKCU\..\Run: [smartwallpaper] C:\Program Files\Ectosoft\Smart Wallpaper Lite\smartwallpaper.exe
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - Startup: Stardock ObjectDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe
O4 - Startup: Y'z ToolBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe
O8 - Extra context menu item: Download all with Free Download Manager - [Link mogu videti samo ulogovani korisnici]\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - [Link mogu videti samo ulogovani korisnici]\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download with Free Download Manager - [Link mogu videti samo ulogovani korisnici]\Program Files\Free Download Manager\dllink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{77930581-C0D7-454A-8055-4FBF5FB69BB1}: NameServer = 194.106.162.3
O20 - AppInit_DLLs: C:\PROGRA~1\Agnitum\OUTPOS~1\wl_hook.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccess.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\PROGRA~1\Agnitum\OUTPOS~1\outpost.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxLiveShare.exe
O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
O23 - Service: RoxUpnpRenderer (RoxUPnPRenderer) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCom\RoxUpnpRenderer.exe
O23 - Service: RoxUpnpServer - Sonic Solutions - C:\Program Files\Roxio\Easy Media Creator 8\Digital Home\RoxUpnpServer.exe
O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

Poslao: 14 Mar 2007 20:49
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Podesavanja DNS servera su se sredila sama od sebe.

Skeniraj HJT-om i stikliraj polje ispred sledece linije:
O4 - HKLM\..\Run: [xdbtyawi] c:\windows\system32\xdbtyawi.exe xdbtyawi

Klikni na Fix Checked.

Zamolio bih te da sutra, ili za koji dan postavis jos jedan svez HJT log, da proverimo da se infekcija nije vratila kojim slucajem.
Eventualno, ukoliko se "curice" vrate, postavi log bez cekanja.
Sve mi nesto smrdi da neki program koji imas instaliran ubacuje ovu infekciju. Moguce je da se infekcija ponovi nakon ponovnog startovanja tog programa.

Moj savet je da izbegavas nadalje skidanje svega sto ima veze sa wallpaperima i screensaverima, osim ukoliko ne dobijes bas jaku preporuku nekog prijatelja da je sajt sa koga skidas siguran (cist).

Poslao: 15 Mar 2007 09:27
Idi na vrh
offline
  • maha  Male
  • Super građanin
  • Pridružio: 06 Dec 2006
  • Poruke: 1152

Goooooood Morning Virusokiller-i.
Prijatno iznenadjenje posle startovanja komp-a. Vidljivo je brži.Postaviću sada novi HJT log a još neki posle izvesnog vremena (korišćenja kompa).Nego jedno pitanje. Da li postoje neki tutorijali (postavljene sam sve skinuo i mogu reći da su prava stvar) ili uputstva za čitanje skenova iz programa koje sam skidao po vašim instrukcijama (sve ih čuvam) ? Jednostavno rečeno kako da naučim da u sken-u pronadjem gde je zaraženi fajl ?
Evo i svežeg HJT-a.
Logfile of HijackThis v1.99.1
Scan saved at 9:30:21, on 15.3.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CDBurnerXP\NMSAccess.exe
C:\Program Files\Eset\nod32krn.exe
C:\PROGRA~1\Agnitum\OUTPOS~1\outpost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\LClock\LClock.exe
C:\Program Files\VisualTooltip\VisualToolTip.exe
C:\Program Files\Styler\Styler.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Super Utilities\SuperUtil.exe
D:\Super Utilities\SuperUtil.exe
C:\Program Files\Ectosoft\Smart Wallpaper Lite\smartwallpaper.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\DOCUME~1\-\LOCALS~1\Temp\{B1A2530F-32D8-4F36-8123-52D947C6E47E}\Blaero Start Orb.exe
C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe
C:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Programs from MyCity for Viruses\Hijack This\airmj.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = [Link mogu videti samo ulogovani korisnici]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdmcks.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKLM\..\Run: [Vista Sidebar] C:\Program Files\Vista Sidebar\sidebar.exe
O4 - HKLM\..\Run: [VisualTooltip] C:\Program Files\VisualTooltip\VisualToolTip.exe
O4 - HKLM\..\Run: [Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
O4 - HKLM\..\Run: [Styler] C:\Program Files\Styler\Styler.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Super Utilities] D:\Super Utilities\SuperUtil.exe /min
O4 - HKCU\..\Run: [smartwallpaper] C:\Program Files\Ectosoft\Smart Wallpaper Lite\smartwallpaper.exe
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - Startup: Stardock ObjectDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe
O4 - Startup: Y'z ToolBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe
O8 - Extra context menu item: Download all with Free Download Manager - [Link mogu videti samo ulogovani korisnici]\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - [Link mogu videti samo ulogovani korisnici]\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download with Free Download Manager - [Link mogu videti samo ulogovani korisnici]\Program Files\Free Download Manager\dllink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{77930581-C0D7-454A-8055-4FBF5FB69BB1}: NameServer = 82.208.208.10 213.246.55.5
O20 - AppInit_DLLs: C:\PROGRA~1\Agnitum\OUTPOS~1\wl_hook.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccess.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\PROGRA~1\Agnitum\OUTPOS~1\outpost.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxLiveShare.exe
O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
O23 - Service: RoxUpnpRenderer (RoxUPnPRenderer) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCom\RoxUpnpRenderer.exe
O23 - Service: RoxUpnpServer - Sonic Solutions - C:\Program Files\Roxio\Easy Media Creator 8\Digital Home\RoxUpnpServer.exe
O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

Poslao: 15 Mar 2007 12:35
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Pozdrav

Vidim da imas dva Internet naloga.
Kada se prikljucis preko onog kojeg si juce koristio onda je DNS u redu.
Kada se prikljucis preko ovog sa kojim si napravio zadnji log, tu ima problema.

Skeniraj ponovo HJT-om i stikliraj polje ispred sledece linije:
O17 - HKLM\System\CCS\Services\Tcpip\..\{77930581-C0D7-454A-8055-4FBF5FB69BB1}: NameServer = 82.208.208.10 213.246.55.5

Klikni Fix Checked

Nakon restarta napravi novi log. Ukoliko se opet pojavi brojka 213.246.55.5 onda imamo problem.

Poslao: 15 Mar 2007 14:28
Idi na vrh
offline
  • maha  Male
  • Super građanin
  • Pridružio: 06 Dec 2006
  • Poruke: 1152

Juče sam koristio mrežu balkan(ci) a danas ITS koji obično i koristim (ponekad panline).
Skenirao sam HJT-om i opet se pojavio isti problem. Evo log-a.
Logfile of HijackThis v1.99.1
Scan saved at 14:27:41, on 15.3.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CDBurnerXP\NMSAccess.exe
C:\Program Files\Eset\nod32krn.exe
C:\PROGRA~1\Agnitum\OUTPOS~1\outpost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\LClock\LClock.exe
C:\Program Files\VisualTooltip\VisualToolTip.exe
C:\Program Files\Styler\Styler.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Super Utilities\SuperUtil.exe
D:\Super Utilities\SuperUtil.exe
C:\Program Files\Ectosoft\Smart Wallpaper Lite\smartwallpaper.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe
C:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe
C:\DOCUME~1\-\LOCALS~1\Temp\{30A4B4A2-4EF4-4C21-97F5-5D84261DFB58}\Blaero Start Orb.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Programs from MyCity for Viruses\Hijack This\airmj.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = [Link mogu videti samo ulogovani korisnici]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdmcks.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKLM\..\Run: [Vista Sidebar] C:\Program Files\Vista Sidebar\sidebar.exe
O4 - HKLM\..\Run: [VisualTooltip] C:\Program Files\VisualTooltip\VisualToolTip.exe
O4 - HKLM\..\Run: [Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
O4 - HKLM\..\Run: [Styler] C:\Program Files\Styler\Styler.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Super Utilities] D:\Super Utilities\SuperUtil.exe /min
O4 - HKCU\..\Run: [smartwallpaper] C:\Program Files\Ectosoft\Smart Wallpaper Lite\smartwallpaper.exe
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - Startup: Stardock ObjectDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe
O4 - Startup: Y'z ToolBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe
O8 - Extra context menu item: Download all with Free Download Manager - [Link mogu videti samo ulogovani korisnici]\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - [Link mogu videti samo ulogovani korisnici]\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download with Free Download Manager - [Link mogu videti samo ulogovani korisnici]\Program Files\Free Download Manager\dllink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{77930581-C0D7-454A-8055-4FBF5FB69BB1}: NameServer = 82.208.208.10 213.246.55.5
O20 - AppInit_DLLs: C:\PROGRA~1\Agnitum\OUTPOS~1\wl_hook.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccess.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\PROGRA~1\Agnitum\OUTPOS~1\outpost.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxLiveShare.exe
O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
O23 - Service: RoxUpnpRenderer (RoxUPnPRenderer) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCom\RoxUpnpRenderer.exe
O23 - Service: RoxUpnpServer - Sonic Solutions - C:\Program Files\Roxio\Easy Media Creator 8\Digital Home\RoxUpnpServer.exe
O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

Poslao: 15 Mar 2007 15:19
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Pusti ponovo FixWareout da odradi svoje. On je namenjen ovakvim stvarima. Pogledaj da li ce on uspeti da sredi ovo.

MyCity » Ambulanta -> Arhiva Ambulante » Šta dalje??

Ko je trenutno na forumu
 

Ukupno su 1622 korisnika na forumu :: 89 registrovanih, 7 sakrivenih i 1526 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 5623 - dana 13 Dec 2025 19:56

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 357magnum, 4thFlavian, acov34, Aleksa-, Alexa77, Andrija357, Baždaranac, bokisha253, Borx, bozo13, bukefal, cifra, CioRio, cyprus, darkojovxp, Dexlex, Dimitrise93, Dogma21, DonRumataEstorski, drimer, dukajov, dusan.l, Dzuki, Gogi_avio, goran.vvv, Hardenberg, Hitri, HogarStrashni, HrcAk47, ILGromovnik, Inner-Cell, istina, jarovitt, Joint Chief, Kajzer Soze, Kapetan Hadok, Lep1na, Litostroton, Macalone, Marko Marković, mgolub, Milos1389, Mirage 2000N, Moldovan, Naj-Turs, nemkea71, nevjerna beba, Nobunaga, Nomica, nuki1234, opt1, Paklenica, powSrb, procesor, proka89, R_038, radoznao, raf87, RajkoB, raptorsi, Resad76, rodoljub, sap, saputnik plavetnila, sasa87, sasovsky, Sirius, sspp, stegonosa, stokssone, SympathyForTheDevil, tajvankanasta, tomo2, tritonus, v82, Vanderx, vathra, vatrogasac, VBoss, virked, vlad4, Vojkan Petrovic, vukovi, wizzardone, wolf431, ZlatniRez, zlaya011, zmajognjeniivan, Žoržo