Virus problem/pomoc

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Uloguj se preko Facebooka da bi skinuo fajl:

Evo ovako,

pre nekoliko dana, KAspersky Antivirus 2009 je detektovao virus. U pitanju je Backdoor.Win32.Bredolab.bmk. JA se ne razumem preterano u sve ovo pa mi treba pomoc. Kada sam stavio Desinfect Virus u KAV-u racunar se restartovao. Ukoliko se ne restartuje, ni jedan .exe fajl ne moze da se pokrene. Instalirao sam i Search& Destroy i nista ne detektuje, U attach-u je i log od HijackThis-a. KOristim IKOM cable 4MB i to je to otprilike. Problem nije toliko veliki ali mi se cini da je konekcija malko sporija kao i da ponekad se aplikacije teze podizu, ne znam mozda je i to subjektivan osecaj,

Unapred hvala i Srecna Nova godina



DDS (Ver_09-12-01.01) - NTFSx86
Run by VvvV at 22:33:14.70 on Fri 01/01/2010
Internet Explorer: 6.0.2900.3244 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2555 [GMT 1:00]

AV: Kaspersky Anti-Virus *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\VDOTool\TBPanel.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\SafeSignCertReg.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Nero\Nero8\InCD\NBHGui.exe
C:\Program Files\Nero\Nero8\InCD\InCD.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
F:\NEW FIREFOX DLOAD\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: ContributeBHO Class: {074c1dc5-9320-4a9a-947d-c042949c6216} - c:\program files\adobe\/Adobe Contribute CS3/contributeieplugin.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky anti-virus 2009\ievkbd.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - c:\program files\adobe\/Adobe Contribute CS3/contributeieplugin.dll
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\nero\lib\NMBgMonitor.exe"
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [Alcmtr] ALCMTR.EXE
mRun: [JMB36X IDE Setup] c:\windows\raidtool\xInsIDE.exe
mRun: [36X Raid Configurer] c:\windows\system32\xRaidSetup.exe boot
mRun: [Gainward] c:\program files\vdotool\TBPanel.exe /A
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [CertificateRegistration] SafeSignCertReg.exe
mRun: [AVP] "c:\program files\kaspersky lab\kaspersky anti-virus 2009\avp.exe"
mRun: [WinampAgent] "c:\program files\winamp\winampa.exe"
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [LanguageShortcut] "c:\program files\cyberlink\powerdvd\language\Language.exe"
mRun: [NeroFilterCheck] c:\program files\common files\nero\lib\NeroCheck.exe
mRun: [SecurDisc] c:\program files\nero\nero8\incd\NBHGui.exe
mRun: [InCD] c:\program files\nero\nero8\incd\InCD.exe
mRun: [NBKeyScan] "c:\program files\nero\nero8\nero backitup\NBKeyScan.exe"
mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 8.0\acrobat\Acrotray.exe"
mRun: [<NO NAME>]
mRun: [Adobe_ID0EYTHM] c:\progra~1\common~1\adobe\adobev~1\server\bin\VERSIO~2.EXE
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [QuickTime Task] "c:\program files\quicktime alternative\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\documents and settings\vvvv\start menu\programs\startup\siszyd32.exe
IE: Append to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - {85E0B171-04FA-11D1-B7DA-00A0C90348D6} - c:\program files\kaspersky lab\kaspersky anti-virus 2009\SCIEPlgn.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
Trusted Zone: raiffeisenbank.rs\rol
DPF: {5ED7F9D0-90D3-4001-A768-7E95C1768821} - hxxps://rol.raiffeisenbank.rs/RetailDLL/FSINT8.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: klogon - c:\windows\system32\klogon.dll
AppInit_DLLs: c:\progra~1\kasper~1\kasper~1\mzvkbd3.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\vvvv\applic~1\mozilla\firefox\profiles\asv3f51v.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en&source=iglk
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=
FF - plugin: c:\program files\quicktime alternative\plugins\npqtplugin.dll
FF - plugin: c:\program files\quicktime alternative\plugins\npqtplugin2.dll
FF - plugin: c:\program files\quicktime alternative\plugins\npqtplugin3.dll
FF - plugin: c:\program files\quicktime alternative\plugins\npqtplugin4.dll
FF - plugin: c:\program files\quicktime alternative\plugins\npqtplugin5.dll
FF - plugin: c:\program files\quicktime alternative\plugins\npqtplugin6.dll
FF - plugin: c:\program files\quicktime alternative\plugins\npqtplugin7.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 kl1;Kl1;c:\windows\system32\drivers\kl1.sys [2008-7-21 121872]
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-1-29 33808]
R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2009-9-13 227344]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\atl01_xp.sys [2009-9-13 38656]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2009-5-13 31760]
R3 TodosAgmII;Driver for Todos Argosmini II USB;c:\windows\system32\drivers\AgmIIusb.sys [2009-9-13 22016]
S2 ASKUpgrade;ASKUpgrade;c:\program files\askbardis\bar\bin\ASKUpgrade.exe [2009-9-13 234888]
S2 AVP;Kaspersky Anti-Virus;c:\program files\kaspersky lab\kaspersky anti-virus 2009\avp.exe [2009-8-27 208616]

=============== Created Last 30 ================

2010-01-01 17:17:04 0 d-----w- c:\program files\Spybot - Search & Destroy
2010-01-01 17:17:04 0 d-----w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2010-01-01 17:12:25 0 d-----w- c:\program files\Trend Micro
2009-12-26 16:59:51 0 d-----w- c:\program files\Activision
2009-12-25 12:23:13 0 d-----w- c:\program files\iPod
2009-12-25 12:23:11 0 d-----w- c:\program files\iTunes
2009-12-22 20:49:06 15987 ---h--w- C:\treeinfo.wc
2009-12-18 15:33:52 0 d-----w- c:\program files\EarthView
2009-12-18 15:33:52 0 d-----w- c:\docume~1\vvvv\applic~1\DeskSoft
2009-12-15 08:36:38 704512 ----a-w- c:\windows\system32\drivers\ugtqee.sys
2009-12-15 08:36:13 16 ----a-w- c:\docume~1\vvvv\applic~1\fvgqad.dat
2009-12-15 08:36:02 8 ----a-w- c:\docume~1\vvvv\applic~1\avdrn.dat
2009-12-09 21:52:25 0 d-----w- c:\docume~1\alluse~1\applic~1\Codemasters
2009-12-09 17:02:06 839680 ----a-w- c:\windows\system32\mkl_vml_p4.dll
2009-12-09 17:02:06 532480 ----a-w- c:\windows\system32\mkl_vml_p3.dll
2009-12-09 17:02:06 512000 ----a-w- c:\windows\system32\mkl_vml_def.dll
2009-12-09 17:02:06 3485696 ----a-w- c:\windows\system32\mkl_p4.dll
2009-12-09 17:02:06 2793472 ----a-w- c:\windows\system32\mkl_p3.dll
2009-12-09 17:02:06 2125824 ----a-w- c:\windows\system32\mkl_lapack64.dll
2009-12-09 17:02:05 872448 ----a-w- c:\windows\system32\rapture3d_oal.dll
2009-12-09 17:02:05 2441216 ----a-w- c:\windows\system32\mkl_def.dll
2009-12-09 17:02:05 2174976 ----a-w- c:\windows\system32\mkl_lapack32.dll
2009-12-09 17:02:05 184320 ----a-w- c:\windows\system32\libguide40.dll
2009-12-09 17:02:05 0 d-----w- c:\program files\BRS
2009-12-09 16:56:50 0 d-----w- c:\windows\system32\xlive
2009-12-09 16:56:50 0 d-----w- c:\program files\Microsoft Games for Windows - LIVE
2009-12-09 16:55:57 809560 ----a-r- c:\windows\system32\tmp411C.tmp
2009-12-09 16:55:57 809560 ----a-r- c:\windows\system32\tmp411B.tmp
2009-12-09 16:55:57 445016 ----a-w- c:\windows\system32\wrap_oal.dll
2009-12-09 16:55:57 109144 ----a-w- c:\windows\system32\OpenAL32.dll
2009-12-09 16:55:57 0 d-----w- c:\program files\OpenAL
2009-12-09 16:48:42 0 d-----w- c:\program files\Codemasters
2009-12-03 20:38:14 2 ----a-w- c:\windows\Twain001.Mtx
2009-12-03 20:38:14 156 ----a-w- c:\windows\Twunk001.MTX
2009-12-03 20:38:14 0 ----a-w- c:\windows\Twunk002.MTX
2009-12-03 20:34:08 0 d-----w- c:\program files\Vstplugins
2009-12-03 20:33:58 0 d-----w- c:\program files\Sony
2009-12-03 20:26:51 0 d-----w- c:\windows\system32\XPSViewer
2009-12-03 20:26:17 14048 ------w- c:\windows\system32\spmsg2.dll

==================== Find3M ====================

2010-01-01 16:48:34 9981472 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-01-01 16:48:34 84300 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-01-01 16:48:34 7680 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-01-01 16:48:34 704544 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-11-06 09:59:54 15406728 ----a-w- c:\windows\system32\xlive.dll
2009-11-06 09:59:54 13642888 ----a-w- c:\windows\system32\xlivefnt.dll
2009-11-02 17:05:36 167064 ----a-w- c:\windows\system32\xliveinstall.dll
2009-11-02 17:05:34 71832 ----a-w- c:\windows\system32\xliveinstallhost.exe
2009-10-11 03:17:27 411368 ----a-w- c:\windows\system32\deploytk.dll
2006-06-23 22:48:54 32768 ----a-r- c:\windows\inf\UpdateUSB.exe

============= FINISH: 22:33:32.54 ===============







mycity.rs/must-login.png

mycity.rs/must-login.png

mycity.rs/must-login.png

mycity.rs/must-login.png

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Pozdrav...




Preuzmi The Avenger na Desktop.
Raspakuj arhivu u neki folder

Dvoklikom pokreni avenger.exe

Iskopiraj tekst koji se nalazi unutar Kod polja u (beli) prozor programa:


Files to delete:
C:\WINDOWS\system32\drivers\ugtqee.sys
c:\documents and settings\vvvv\start menu\programs\startup\siszyd32.exe
c:\docume~1\vvvv\applic~1\fvgqad.dat
c:\docume~1\vvvv\applic~1\avdrn.dat

Drivers to delete:
ugtqee



Klikni Execute, a zatim Yes u sledeća dva prozora koji će se otvoriti

Kompjuter će se restartovati (u određenim slučajevima: dva puta) i započeti će proces čišćenja/skeniranja

Kada proces bude završen, logfile C:\avenger.txt će se otvoriti u Notepad-u
Iskopiraj sadržaj dobijenog loga u temu na forumu.





Upload-uj file C:\avenger\backup.zip

preko ovog linka: http://www.mycity.rs/ambulanta-upload.php

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Napisano: 02 Jan 2010 0:14

Evo ovako. Mislim da je to to sada.

Pozdrav i veliko hvala!

Vlada

Logfile of The Avenger Version 2.0, (c) by Swandog46
swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\WINDOWS\system32\drivers\ugtqee.sys" deleted successfully.
File "c:\documents and settings\vvvv\start menu\programs\startup\siszyd32.exe" deleted successfully.
File "c:\docume~1\vvvv\applic~1\fvgqad.dat" deleted successfully.
File "c:\docume~1\vvvv\applic~1\avdrn.dat" deleted successfully.
Driver "ugtqee" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Dopuna: 02 Jan 2010 0:15

Inace, uploadovao sam beckup.zip na mycity.rs/ambulanta-upload.php


POzdrav

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Ako je sve u redu, ostaje samo da isključiš i zatim ponovo uključiš System Restore:

http://www.mycity.rs/Uputstva/Kako-iskljuciti-uklj.....Vista.html


Korišćene programe i avenger folder sa C: diska možeš obrisati.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Hvala jos jednom