Poslao: 08 Dec 2009 00:52
|
offline
- Pridružio: 14 Avg 2006
- Poruke: 108
|
Potrebna mi je pomoc oko ovih virusa koji su se odjednom pojavili i ne mogu da ih ocistim. Zabrljala mi je grafika nakon restarta racunara, a firefox ne moze vise uopste da se startuje. Hvala unapred!
Evo i loga:
DDS (Ver_09-12-01.01) - NTFSx86
Run by Milena at 0:18:17.20 on Tue 12/08/2009
Internet Explorer: 6.0.2900.5512
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.137 [GMT 1:00]
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
============== Running Processes ===============
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\USB TV\EM28XX\BDARemote.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\AVG\AVG9\avgui.exe
C:\Documents and Settings\Milena\Desktop\dds.scr
============== Pseudo HJT Report ===============
uStart Page = hxxp://google.mini20.com/
uInternet Connection Wizard,ShellNext = iexplore
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
uURLSearchHooks: H - No File
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
uRun: [ATI Launchpad] "c:\program files\ati multimedia\main\launchpd.exe"
uRun: [ATI DeviceDetect] c:\program files\ati multimedia\main\ATIDtct.EXE
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun
uRun: [av_md] c:\windows\temp\~TM26D.tmp
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
mRun: [NVMixerTray] "c:\program files\nvidia corporation\nvmixer\NVMixerTray.exe"
mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin
mRun: [WinampAgent] "c:\program files\winamp\winampa.exe"
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [UnlockerAssistant] "c:\program files\unlocker\UnlockerAssistant.exe"
mRun: [sysgif32] c:\windows\temp\~TM26C.tmp
mRun: [Regedit32] c:\windows\system32\regedit.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\bdarem~1.lnk - c:\program files\usb tv\em28xx\BDARemote.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {44226DFF-747E-4edc-B30C-78752E50CD0C} - {44226DFF-747E-4edc-B30C-78752E50CD0C} - c:\program files\ati multimedia\tv\EXPLBAR.DLL
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab
DPF: {76326493-E84F-4D4B-939C-1E07B50037F2} - hxxps://online.bancaintesabeograd.com/RetailDLL/SGCMSCCD.DLL
DPF: {A7C346A3-B076-46B3-97F0-D00F6B479451} - hxxps://online.bancaintesabeograd.com/RetailDLL/FSINT.dll
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: avgrsstarter - avgrsstx.dll
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\milena\applic~1\mozilla\firefox\profiles\50yn6ieh.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
============= SERVICES / DRIVERS ===============
R0 SI3112r;Silicon Image SiI 3112 SATARaid Controller;c:\windows\system32\drivers\SI3112r.sys [2004-1-1 97408]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-10-31 333192]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-10-31 28424]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-10-31 360584]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2009-10-31 906520]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2009-10-31 285392]
R3 RkHit;RkHit;\??\c:\windows\system32\drivers\rkhit.sys --> c:\windows\system32\drivers\RKHit.sys [?]
R3 TTDec;ATI WDM Teletext Decoder;c:\windows\system32\drivers\atinttxx.sys [2009-10-31 13824]
=============== Created Last 30 ================
2009-12-07 23:09:44 148768 -c--a-w- c:\windows\system32\dllcache\atapi.sys
2009-12-07 22:44:45 42 ----a-w- c:\windows\system32\scud.udf
2009-12-07 22:44:17 0 d-----w- c:\program files\Spyware Cease
2009-12-07 21:35:56 116 ----a-w- c:\windows\system32\fjhdyfhsn.bat
2009-12-07 21:35:35 4 ----a-w- c:\docume~1\milena\applic~1\avdrn.dat
2009-11-27 22:30:24 0 d-----w- c:\program files\Unlocker
2009-11-27 22:25:52 0 d-----w- c:\docume~1\milena\applic~1\Simply Super Software
2009-11-27 22:25:52 0 d-----w- c:\docume~1\alluse~1\applic~1\Simply Super Software
2009-11-27 20:51:01 0 d-s---w- C:\ComboFix
2009-11-27 17:34:15 0 d-sha-r- C:\cmdcons
2009-11-23 16:22:27 0 d-----w- C:\DeltaBanka
2009-11-21 19:37:28 0 d-----w- c:\program files\JoWooD
2009-11-21 04:32:19 0 d-----w- c:\program files\VideoLAN
2009-11-20 22:39:19 0 d-----w- c:\program files\eMule
2009-11-16 23:40:45 0 d-----w- c:\program files\FDRLab
2009-11-16 22:44:47 0 d-----w- c:\program files\Passware
2009-11-08 01:46:45 0 d-----w- c:\program files\YouTube Downloader
==================== Find3M ====================
2009-12-07 23:09:44 148768 ----a-w- c:\windows\system32\drivers\atapi.sys
2009-11-10 08:09:15 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-11-06 11:03:27 2828 --sha-w- c:\docume~1\alluse~1\applic~1\KGyGaAvL.sys
2009-11-05 17:54:06 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-11-04 13:21:45 8 --sh--r- c:\docume~1\alluse~1\applic~1\CA775620AE.sys
2009-10-31 19:22:17 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2009-10-31 19:22:09 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-10-31 10:00:29 21640 ----a-w- c:\windows\system32\emptyregdb.dat
============= FINISH: 0:18:45.56 ===============
mycity.rs/must-login.png
mycity.rs/must-login.png
mycity.rs/must-login.png
mycity.rs/must-login.png
|
|
|
|
|
Poslao: 08 Dec 2009 17:08
|
offline
- Pridružio: 14 Avg 2006
- Poruke: 108
|
ComboFix 09-12-07.07 - Milena 12/08/2009 8:54.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.245 [GMT 1:00]
Running from: c:\documents and settings\Milena\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\LocalService\oashdihasidhasuidhiasdhiashdiuasdhasd
c:\program files\Spyware Cease
c:\program files\Spyware Cease\md5.dll
c:\program files\Spyware Cease\mtools.dll
c:\program files\Spyware Cease\networkdll.dll
c:\program files\Spyware Cease\opfile.dll
c:\program files\Spyware Cease\QAreaDLL.dll
c:\program files\Spyware Cease\RkHitApi.dll
c:\program files\Spyware Cease\sctdll.dll
c:\program files\Spyware Cease\spkdll.dll
c:\program files\Spyware Cease\SpywareCease.exe
c:\program files\Spyware Cease\udefend.dll
c:\program files\Spyware Cease\ussafe.dll
c:\program files\Spyware Cease\zlib1.dll
Infected copy of c:\windows\system32\Drivers\atapi.sys was found and disinfected
Restored copy from - c:\windows\ERDNT\cache\atapi.sys
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_RKHIT
-------\Service_RkHit
((((((((((((((((((((((((( Files Created from 2009-11-08 to 2009-12-08 )))))))))))))))))))))))))))))))
.
2009-12-07 21:35 . 2009-12-07 21:35 116 ----a-w- c:\windows\system32\fjhdyfhsn.bat
2009-11-30 09:04 . 2009-09-21 14:59 3101560 ----a-w- c:\documents and settings\Milena\Application Data\Simply Super Software\Trojan Remover\shoC1D.exe
2009-11-30 09:04 . 2009-09-21 14:59 3101560 ----a-w- c:\documents and settings\Milena\Application Data\Simply Super Software\Trojan Remover\kcmC1E.exe
2009-11-30 09:04 . 2009-09-21 14:59 3101560 ----a-w- c:\documents and settings\Milena\Application Data\Simply Super Software\Trojan Remover\magC1C.exe
2009-11-27 22:30 . 2009-11-27 22:30 -------- d-----w- c:\program files\Unlocker
2009-11-27 22:27 . 2009-12-07 22:13 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-11-27 22:25 . 2009-11-27 22:25 -------- d-----w- c:\documents and settings\Milena\Application Data\Simply Super Software
2009-11-27 22:25 . 2009-11-27 22:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Simply Super Software
2009-11-26 17:05 . 2009-11-26 17:05 235520 ----a-w- c:\documents and settings\Milena\Application Data\GRETECH\GomPlayer\GrLauncherTempSetup.exe
2009-11-26 17:05 . 2007-03-22 10:46 126976 ----a-w- c:\documents and settings\Milena\Application Data\GRETECH\GomPlayer\GrLauncher.exe
2009-11-23 16:22 . 2009-11-23 16:22 -------- d-----w- C:\DeltaBanka
2009-11-22 22:32 . 2009-11-22 22:32 0 ----a-w- c:\windows\nsreg.dat
2009-11-22 22:32 . 2009-11-22 22:32 -------- d-----w- c:\documents and settings\Milena\Local Settings\Application Data\Mozilla
2009-11-21 19:37 . 2009-11-21 19:37 -------- d-----w- c:\program files\JoWooD
2009-11-21 04:36 . 2009-11-21 04:36 -------- d-----w- c:\documents and settings\Milena\Application Data\vlc
2009-11-21 04:32 . 2009-11-21 04:32 -------- d-----w- c:\program files\VideoLAN
2009-11-20 22:39 . 2009-11-20 22:48 -------- d-----w- c:\program files\eMule
2009-11-17 00:23 . 2009-11-17 00:23 -------- d-----w- c:\program files\QuickTime
2009-11-16 23:40 . 2009-11-16 23:40 -------- d-----w- c:\program files\FDRLab
2009-11-16 22:44 . 2009-11-16 22:44 -------- d-----w- c:\program files\Passware
2009-11-13 08:06 . 2009-11-13 08:06 3963648 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll
2009-11-13 08:06 . 2009-11-13 08:06 497944 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgchjwx.dll
2009-11-13 08:06 . 2009-11-10 08:09 4026136 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgui.exe
2009-11-13 08:06 . 2009-11-10 08:09 2016536 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtray.exe
2009-11-13 08:06 . 2009-11-10 08:09 1257240 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgfrw.exe
2009-11-10 08:08 . 2009-11-10 08:08 1657112 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-08 01:33 . 2009-10-31 19:36 -------- d-----w- c:\documents and settings\Milena\Application Data\Skype
2009-12-07 21:35 . 2009-12-07 21:35 16 ----a-w- c:\documents and settings\NetworkService\Application Data\fvgqad.dat
2009-12-07 21:35 . 2009-12-07 21:35 4 ----a-w- c:\documents and settings\Milena\Application Data\avdrn.dat
2009-12-07 20:39 . 2009-10-31 19:37 -------- d-----w- c:\documents and settings\Milena\Application Data\skypePM
2009-12-03 07:09 . 2009-11-04 21:22 -------- d-----w- c:\documents and settings\Milena\Application Data\ATI MMC
2009-11-22 21:10 . 2009-10-31 21:28 38808 ----a-w- c:\documents and settings\Milena\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-22 09:33 . 2009-11-04 13:21 -------- d-----w- c:\documents and settings\Milena\Application Data\Corel
2009-11-22 09:33 . 2009-11-01 01:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Corel
2009-11-22 09:29 . 2009-11-05 20:16 -------- d-----w- c:\program files\Autodesk
2009-11-22 09:28 . 2009-11-05 20:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Autodesk
2009-11-17 23:47 . 2009-11-04 21:20 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI MMC
2009-11-17 23:13 . 2009-11-05 16:26 -------- d-----w- c:\documents and settings\Milena\Application Data\BitTorrent
2009-11-10 08:09 . 2009-10-31 19:22 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-11-08 01:46 . 2009-11-08 01:46 -------- d-----w- c:\program files\YouTube Downloader
2009-11-06 11:03 . 2009-11-04 13:21 2828 --sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2009-11-06 11:03 . 2009-11-04 13:21 2828 --sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2009-11-05 18:24 . 2009-11-05 17:53 -------- d-----w- c:\documents and settings\Milena\Application Data\DAEMON Tools Lite
2009-11-05 17:54 . 2009-11-05 17:53 -------- d-----w- c:\program files\DAEMON Tools Lite
2009-11-05 17:54 . 2009-11-05 17:54 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-11-05 17:53 . 2009-11-05 17:53 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2009-11-05 16:26 . 2009-11-05 16:26 -------- d-----w- c:\program files\BitTorrent
2009-11-04 21:17 . 2009-10-31 20:59 -------- d-----w- c:\program files\ATI Technologies
2009-11-04 21:17 . 2009-10-31 20:36 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-11-04 21:16 . 2009-10-31 21:27 -------- d-----w- c:\documents and settings\Milena\Application Data\ATI
2009-11-04 21:11 . 2009-11-04 21:11 -------- d-----w- c:\program files\ATI Multimedia
2009-11-04 21:11 . 2009-11-04 21:11 -------- d-----w- c:\program files\Common Files\ATI
2009-11-04 21:08 . 2009-11-04 21:08 -------- d-----w- c:\program files\msaccrt
2009-11-04 18:23 . 2009-11-04 18:23 9158 ----a-r- c:\documents and settings\Milena\Application Data\Microsoft\Installer\{2EAB346D-6073-4FD7-AFC0-B035ABC82A67}\ARPPRODUCTICON.exe
2009-11-04 18:23 . 2009-11-04 18:23 -------- d-----w- c:\program files\Common Files\ATI Technologies
2009-11-04 18:23 . 2009-11-04 18:23 -------- d-----w- c:\program files\DIFX
2009-11-04 18:23 . 2009-11-04 18:23 -------- d-----w- c:\program files\USB TV
2009-11-04 18:22 . 2009-11-04 18:22 -------- d-----w- c:\documents and settings\Milena\Application Data\InstallShield
2009-11-04 17:27 . 2009-11-04 17:24 -------- d-----w- c:\documents and settings\Milena\Application Data\Winamp
2009-11-04 17:27 . 2009-11-04 17:24 -------- d-----w- c:\program files\Winamp
2009-11-04 13:21 . 2009-11-04 13:21 8 --sh--r- c:\documents and settings\All Users\Application Data\CA775620AE.sys
2009-11-04 13:21 . 2009-11-04 13:21 8 --sh--r- c:\documents and settings\All Users\Application Data\CA775620AE.sys
2009-11-04 01:07 . 2009-11-04 01:07 -------- d-----w- c:\documents and settings\Milena\Application Data\AdobeUM
2009-11-04 01:07 . 2009-11-01 00:31 -------- d-----w- c:\program files\Common Files\Adobe
2009-11-02 23:37 . 2009-11-02 23:37 -------- d-----w- c:\program files\Microsoft ActiveSync
2009-11-02 23:36 . 2009-11-02 23:36 -------- d-----w- c:\program files\Microsoft.NET
2009-11-02 23:21 . 2009-10-31 10:02 76487 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-11-02 18:01 . 2009-11-02 18:00 -------- d-----w- c:\documents and settings\All Users\Application Data\WinZip
2009-11-02 16:52 . 2009-11-02 16:52 -------- d-----w- c:\documents and settings\Milena\Application Data\GRETECH
2009-11-02 16:51 . 2009-11-02 16:51 -------- d-----w- c:\program files\GRETECH
2009-11-01 00:58 . 2009-11-01 00:58 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
2009-11-01 00:37 . 2009-11-01 00:37 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2009-10-31 21:27 . 2009-10-31 21:27 129 ----a-w- c:\documents and settings\Milena\Local Settings\Application Data\fusioncache.dat
2009-10-31 21:00 . 2009-10-31 20:34 -------- d-----w- c:\program files\Common Files\InstallShield
2009-10-31 20:36 . 2009-10-31 20:36 -------- d-----w- c:\program files\Common Files\NVIDIA Shared
2009-10-31 20:36 . 2009-10-31 20:36 -------- d-----w- c:\program files\NVIDIA Corporation
2009-10-31 19:37 . 2009-10-31 19:37 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-10-31 19:36 . 2009-10-31 19:36 -------- d-----w- c:\program files\Common Files\Skype
2009-10-31 19:36 . 2009-10-31 19:36 -------- d-----r- c:\program files\Skype
2009-10-31 19:36 . 2009-10-31 19:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-10-31 19:29 . 2009-10-31 19:29 -------- d-----w- c:\program files\Opera
2009-10-31 19:23 . 2009-10-31 19:22 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2009-10-31 19:22 . 2009-10-31 19:22 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2009-10-31 19:22 . 2009-10-31 19:22 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-10-31 19:22 . 2009-10-31 19:22 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-10-31 19:21 . 2009-10-31 19:21 -------- d-----w- c:\program files\AVG
2009-10-31 19:21 . 2009-10-31 19:21 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2009-10-31 10:03 . 2009-10-31 10:03 -------- d-----w- c:\program files\microsoft frontpage
2009-10-31 10:00 . 2009-10-31 10:00 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-10-16 11:12 . 2009-10-31 19:23 1119488 ----a-w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar\IEToolbar.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-10-16 11:12 1119488 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATI Launchpad"="c:\program files\ATI Multimedia\main\launchpd.exe" [2005-03-18 102400]
"ATI DeviceDetect"="c:\program files\ATI Multimedia\main\ATIDtct.EXE" [2005-03-18 53248]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2009-11-13 2020120]
"NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-06-03 131072]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-04-22 37888]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 339968]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-17 417792]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2009-10-26 15872]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
BDARemote.lnk - c:\program files\USB TV\EM28XX\BDARemote.exe [2009-11-4 81997]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-10-31 19:22 12464 ----a-w- c:\windows\system32\avgrsstx.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\monitor.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\manager.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\server.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
R0 SI3112r;Silicon Image SiI 3112 SATARaid Controller;c:\windows\system32\drivers\SI3112r.sys [1/1/2004 1:34 AM 97408]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [11/5/2009 6:54 PM 691696]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [10/31/2009 8:22 PM 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [10/31/2009 8:22 PM 360584]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [10/31/2009 8:21 PM 906520]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [10/31/2009 8:21 PM 285392]
R3 TTDec;ATI WDM Teletext Decoder;c:\windows\system32\drivers\atinttxx.sys [10/31/2009 11:43 AM 13824]
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.mini20.com/
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: {76326493-E84F-4D4B-939C-1E07B50037F2} - hxxps://online.bancaintesabeograd.com/RetailDLL/SGCMSCCD.DLL
DPF: {A7C346A3-B076-46B3-97F0-D00F6B479451} - hxxps://online.bancaintesabeograd.com/RetailDLL/FSINT.dll
FF - ProfilePath - c:\documents and settings\Milena\Application Data\Mozilla\Firefox\Profiles\50yn6ieh.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2009-12-08 17:06
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll nvatabus.sys spyt.sys >>UNKNOWN [0x82392938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf859af28
\Driver\ACPI -> ACPI.sys @ 0xf83e2cb8
\Driver\atapi -> atapi.sys @ 0xf839db40
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0598
ParseProcedure -> ntoskrnl.exe @ 0x8056c1d6
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0598
ParseProcedure -> ntoskrnl.exe @ 0x8056c1d6
NDIS: NVIDIA nForce Networking Controller -> SendCompleteHandler -> NDIS.sys @ 0xf827abb0
PacketIndicateHandler -> NDIS.sys @ 0xf8287a21
SendHandler -> NDIS.sys @ 0xf826587b
user & kernel MBR OK
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(688-)
c:\windows\system32\Ati2evxx.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\AVG\AVG9\avgrsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\windows\system32\wdfmgr.exe
c:\program files\AVG\AVG9\avgnsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\Ati2evxx.exe
.
**************************************************************************
.
Completion time: 2009-12-08 17:09 - machine was rebooted
ComboFix-quarantined-files.txt 2009-12-08 16:09
ComboFix2.txt 2009-11-27 17:41
Pre-Run: 11,592,884,224 bytes free
Post-Run: 11,509,211,136 bytes free
- - End Of File - - EFA37CD132673E55B248B16A1D0122A6
|
|
|
|
|
Poslao: 08 Dec 2009 23:58
|
offline
- Pridružio: 14 Avg 2006
- Poruke: 108
|
Evo i ovog loga:
ComboFix 09-12-07.07 - Milena 12/08/2009 23:50.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.239 [GMT 1:00]
Running from: c:\documents and settings\Milena\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Milena\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FILE ::
"c:\documents and settings\Milena\Application Data\avdrn.dat"
"c:\documents and settings\NetworkService\Application Data\fvgqad.dat"
"c:\windows\system32\fjhdyfhsn.bat"
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Milena\Application Data\avdrn.dat
c:\documents and settings\NetworkService\Application Data\fvgqad.dat
c:\windows\system32\fjhdyfhsn.bat
.
((((((((((((((((((((((((( Files Created from 2009-11-08 to 2009-12-08 )))))))))))))))))))))))))))))))
.
2009-11-30 09:04 . 2009-09-21 14:59 3101560 ----a-w- c:\documents and settings\Milena\Application Data\Simply Super Software\Trojan Remover\shoC1D.exe
2009-11-30 09:04 . 2009-09-21 14:59 3101560 ----a-w- c:\documents and settings\Milena\Application Data\Simply Super Software\Trojan Remover\kcmC1E.exe
2009-11-30 09:04 . 2009-09-21 14:59 3101560 ----a-w- c:\documents and settings\Milena\Application Data\Simply Super Software\Trojan Remover\magC1C.exe
2009-11-27 22:30 . 2009-11-27 22:30 -------- d-----w- c:\program files\Unlocker
2009-11-27 22:27 . 2009-12-07 22:13 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-11-27 22:25 . 2009-11-27 22:25 -------- d-----w- c:\documents and settings\Milena\Application Data\Simply Super Software
2009-11-27 22:25 . 2009-11-27 22:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Simply Super Software
2009-11-26 17:05 . 2009-11-26 17:05 235520 ----a-w- c:\documents and settings\Milena\Application Data\GRETECH\GomPlayer\GrLauncherTempSetup.exe
2009-11-26 17:05 . 2007-03-22 10:46 126976 ----a-w- c:\documents and settings\Milena\Application Data\GRETECH\GomPlayer\GrLauncher.exe
2009-11-23 16:22 . 2009-11-23 16:22 -------- d-----w- C:\DeltaBanka
2009-11-22 22:32 . 2009-11-22 22:32 0 ----a-w- c:\windows\nsreg.dat
2009-11-22 22:32 . 2009-11-22 22:32 -------- d-----w- c:\documents and settings\Milena\Local Settings\Application Data\Mozilla
2009-11-21 19:37 . 2009-11-21 19:37 -------- d-----w- c:\program files\JoWooD
2009-11-21 04:36 . 2009-11-21 04:36 -------- d-----w- c:\documents and settings\Milena\Application Data\vlc
2009-11-21 04:32 . 2009-11-21 04:32 -------- d-----w- c:\program files\VideoLAN
2009-11-20 22:39 . 2009-11-20 22:48 -------- d-----w- c:\program files\eMule
2009-11-17 00:23 . 2009-11-17 00:23 -------- d-----w- c:\program files\QuickTime
2009-11-16 23:40 . 2009-11-16 23:40 -------- d-----w- c:\program files\FDRLab
2009-11-16 22:44 . 2009-11-16 22:44 -------- d-----w- c:\program files\Passware
2009-11-13 08:06 . 2009-11-13 08:06 3963648 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll
2009-11-13 08:06 . 2009-11-13 08:06 497944 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgchjwx.dll
2009-11-13 08:06 . 2009-11-10 08:09 4026136 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgui.exe
2009-11-13 08:06 . 2009-11-10 08:09 2016536 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtray.exe
2009-11-13 08:06 . 2009-11-10 08:09 1257240 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgfrw.exe
2009-11-10 08:08 . 2009-11-10 08:08 1657112 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-31 21:51 . 2009-10-31 19:37 -------- d-----w- c:\documents and settings\Milena\Application Data\skypePM
2009-12-08 22:34 . 2009-10-31 19:36 -------- d-----w- c:\documents and settings\Milena\Application Data\Skype
2009-12-03 07:09 . 2009-11-04 21:22 -------- d-----w- c:\documents and settings\Milena\Application Data\ATI MMC
2009-11-22 21:10 . 2009-10-31 21:28 38808 ----a-w- c:\documents and settings\Milena\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-22 09:33 . 2009-11-04 13:21 -------- d-----w- c:\documents and settings\Milena\Application Data\Corel
2009-11-22 09:33 . 2009-11-01 01:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Corel
2009-11-22 09:29 . 2009-11-05 20:16 -------- d-----w- c:\program files\Autodesk
2009-11-22 09:28 . 2009-11-05 20:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Autodesk
2009-11-17 23:47 . 2009-11-04 21:20 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI MMC
2009-11-17 23:13 . 2009-11-05 16:26 -------- d-----w- c:\documents and settings\Milena\Application Data\BitTorrent
2009-11-10 08:09 . 2009-10-31 19:22 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-11-08 01:46 . 2009-11-08 01:46 -------- d-----w- c:\program files\YouTube Downloader
2009-11-06 11:03 . 2009-11-04 13:21 2828 --sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2009-11-06 11:03 . 2009-11-04 13:21 2828 --sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2009-11-05 18:24 . 2009-11-05 17:53 -------- d-----w- c:\documents and settings\Milena\Application Data\DAEMON Tools Lite
2009-11-05 17:54 . 2009-11-05 17:53 -------- d-----w- c:\program files\DAEMON Tools Lite
2009-11-05 17:54 . 2009-11-05 17:54 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-11-05 17:53 . 2009-11-05 17:53 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2009-11-05 16:26 . 2009-11-05 16:26 -------- d-----w- c:\program files\BitTorrent
2009-11-04 21:17 . 2009-10-31 20:59 -------- d-----w- c:\program files\ATI Technologies
2009-11-04 21:17 . 2009-10-31 20:36 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-11-04 21:16 . 2009-10-31 21:27 -------- d-----w- c:\documents and settings\Milena\Application Data\ATI
2009-11-04 21:11 . 2009-11-04 21:11 -------- d-----w- c:\program files\ATI Multimedia
2009-11-04 21:11 . 2009-11-04 21:11 -------- d-----w- c:\program files\Common Files\ATI
2009-11-04 21:08 . 2009-11-04 21:08 -------- d-----w- c:\program files\msaccrt
2009-11-04 18:23 . 2009-11-04 18:23 9158 ----a-r- c:\documents and settings\Milena\Application Data\Microsoft\Installer\{2EAB346D-6073-4FD7-AFC0-B035ABC82A67}\ARPPRODUCTICON.exe
2009-11-04 18:23 . 2009-11-04 18:23 -------- d-----w- c:\program files\Common Files\ATI Technologies
2009-11-04 18:23 . 2009-11-04 18:23 -------- d-----w- c:\program files\DIFX
2009-11-04 18:23 . 2009-11-04 18:23 -------- d-----w- c:\program files\USB TV
2009-11-04 18:22 . 2009-11-04 18:22 -------- d-----w- c:\documents and settings\Milena\Application Data\InstallShield
2009-11-04 17:27 . 2009-11-04 17:24 -------- d-----w- c:\documents and settings\Milena\Application Data\Winamp
2009-11-04 17:27 . 2009-11-04 17:24 -------- d-----w- c:\program files\Winamp
2009-11-04 13:21 . 2009-11-04 13:21 8 --sh--r- c:\documents and settings\All Users\Application Data\CA775620AE.sys
2009-11-04 13:21 . 2009-11-04 13:21 8 --sh--r- c:\documents and settings\All Users\Application Data\CA775620AE.sys
2009-11-04 01:07 . 2009-11-04 01:07 -------- d-----w- c:\documents and settings\Milena\Application Data\AdobeUM
2009-11-04 01:07 . 2009-11-01 00:31 -------- d-----w- c:\program files\Common Files\Adobe
2009-11-02 23:37 . 2009-11-02 23:37 -------- d-----w- c:\program files\Microsoft ActiveSync
2009-11-02 23:36 . 2009-11-02 23:36 -------- d-----w- c:\program files\Microsoft.NET
2009-11-02 23:21 . 2009-10-31 10:02 76487 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-11-02 18:01 . 2009-11-02 18:00 -------- d-----w- c:\documents and settings\All Users\Application Data\WinZip
2009-11-02 16:52 . 2009-11-02 16:52 -------- d-----w- c:\documents and settings\Milena\Application Data\GRETECH
2009-11-02 16:51 . 2009-11-02 16:51 -------- d-----w- c:\program files\GRETECH
2009-11-01 00:58 . 2009-11-01 00:58 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
2009-11-01 00:37 . 2009-11-01 00:37 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2009-10-31 21:27 . 2009-10-31 21:27 129 ----a-w- c:\documents and settings\Milena\Local Settings\Application Data\fusioncache.dat
2009-10-31 21:00 . 2009-10-31 20:34 -------- d-----w- c:\program files\Common Files\InstallShield
2009-10-31 20:36 . 2009-10-31 20:36 -------- d-----w- c:\program files\Common Files\NVIDIA Shared
2009-10-31 20:36 . 2009-10-31 20:36 -------- d-----w- c:\program files\NVIDIA Corporation
2009-10-31 19:37 . 2009-10-31 19:37 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-10-31 19:36 . 2009-10-31 19:36 -------- d-----w- c:\program files\Common Files\Skype
2009-10-31 19:36 . 2009-10-31 19:36 -------- d-----r- c:\program files\Skype
2009-10-31 19:36 . 2009-10-31 19:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-10-31 19:29 . 2009-10-31 19:29 -------- d-----w- c:\program files\Opera
2009-10-31 19:23 . 2009-10-31 19:22 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2009-10-31 19:22 . 2009-10-31 19:22 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2009-10-31 19:22 . 2009-10-31 19:22 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-10-31 19:22 . 2009-10-31 19:22 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-10-31 19:21 . 2009-10-31 19:21 -------- d-----w- c:\program files\AVG
2009-10-31 19:21 . 2009-10-31 19:21 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2009-10-31 10:03 . 2009-10-31 10:03 -------- d-----w- c:\program files\microsoft frontpage
2009-10-31 10:00 . 2009-10-31 10:00 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-10-16 11:12 . 2009-10-31 19:23 1119488 ----a-w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar\IEToolbar.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-10-16 11:12 1119488 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATI Launchpad"="c:\program files\ATI Multimedia\main\launchpd.exe" [2005-03-18 102400]
"ATI DeviceDetect"="c:\program files\ATI Multimedia\main\ATIDtct.EXE" [2005-03-18 53248]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\program files\Opera\program\plugins\NPSWF32_FlashUtil.exe" [2009-07-18 257440]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2009-11-13 2020120]
"NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-06-03 131072]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-04-22 37888]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 339968]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-17 417792]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2009-10-26 15872]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
BDARemote.lnk - c:\program files\USB TV\EM28XX\BDARemote.exe [2009-11-4 81997]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-10-31 19:22 12464 ----a-w- c:\windows\system32\avgrsstx.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\monitor.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\manager.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\server.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
R0 SI3112r;Silicon Image SiI 3112 SATARaid Controller;c:\windows\system32\drivers\SI3112r.sys [1/1/2004 1:34 AM 97408]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [10/31/2009 8:22 PM 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [10/31/2009 8:22 PM 360584]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [10/31/2009 8:21 PM 906520]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [10/31/2009 8:21 PM 285392]
R3 TTDec;ATI WDM Teletext Decoder;c:\windows\system32\drivers\atinttxx.sys [10/31/2009 11:43 AM 13824]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [11/5/2009 6:54 PM 691696]
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.mini20.com/
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: {76326493-E84F-4D4B-939C-1E07B50037F2} - hxxps://online.bancaintesabeograd.com/RetailDLL/SGCMSCCD.DLL
DPF: {A7C346A3-B076-46B3-97F0-D00F6B479451} - hxxps://online.bancaintesabeograd.com/RetailDLL/FSINT.dll
FF - ProfilePath - c:\documents and settings\Milena\Application Data\Mozilla\Firefox\Profiles\50yn6ieh.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2009-12-08 23:55
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(660)
c:\windows\system32\Ati2evxx.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
Completion time: 2009-12-08 23:58
ComboFix-quarantined-files.txt 2009-12-08 22:57
ComboFix2.txt 2009-12-08 16:09
ComboFix3.txt 2009-11-27 17:41
Pre-Run: 11,502,632,960 bytes free
Post-Run: 11,473,391,616 bytes free
- - End Of File - - 48DCEB38C05E6AEF1F895D28FB45F26D
|
|
|
|
|
Poslao: 09 Dec 2009 23:25
|
offline
- Pridružio: 14 Avg 2006
- Poruke: 108
|
Hvala puno, sad sve radi Ok, a AVG ne prijavljuje vise nista.
|
|
|
|