Virusi:(

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

prozor Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:58:38 PM, on 4/5/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\AVENGINE.EXE
c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Roland\VSC32\vsc32cnf.exe
C:\Program Files\Roland\VSC32\vscvol.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\SystemErrorFixer\strpmon.exe
C:\WINDOWS\System32\carpserv.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\PavBckPT.exe
C:\PROGRA~1\DAP\DAP.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = [Link mogu videti samo ulogovani korisnici]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = [Link mogu videti samo ulogovani korisnici]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = CRA
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: GNX Rolex - {766F2044-BB5A-4456-965F-E4CFD884CD2C} - C:\WINDOWS\drnpfdxsxp.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\it\msntb.dll
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Program Files\DAP\DAPIEBar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: etlrlws - {6D0FE499-35D6-47C0-BE2E-5C90E34CDCD4} - C:\WINDOWS\etlrlws.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\it\msntb.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [vsc32cnf.exe] C:\Program Files\Roland\VSC32\vsc32cnf.exe
O4 - HKLM\..\Run: [vscvol.exe] C:\Program Files\Roland\VSC32\vscvol.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [Winddows Servicer] servicer.exe
O4 - HKLM\..\Run: [Micr0s0ftf DDEs C0ntr0l] TRed.pif
O4 - HKLM\..\Run: [MSDOS Security Service] msdos.pif
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [RavTimeXP] \Mstray.exe
O4 - HKLM\..\Run: [strpmon] "C:\Program Files\Common Files\SystemErrorFixer\strpmon.exe" dm=http://systemerrorfixer.com ad=http://systemerrorfixer.com sd=http://inspaid.systemerrorfixer.com
O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Common Files\SystemErrorFixer\strpmon.exe" dm=http://systemerrorfixer.com ad=http://systemerrorfixer.com sd=http://inspaid.systemerrorfixer.com
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Security\Panda Internet Security 2008\Inicio.exe"
O4 - HKLM\..\RunServices: [Winddows Servicer] servicer.exe
O4 - HKLM\..\RunServices: [Micr0s0ftf DDEs C0ntr0l] TRed.pif
O4 - HKLM\..\RunServices: [MSDOS Security Service] msdos.pif
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunServices: [MSDOS Security Service] msdos.pif (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunServices: [MSDOS Security Service] msdos.pif (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O21 - SSODL: AlrtSetup - {1e5dcb1a-5ee5-4501-a432-d2306e9e87ce} - C:\WINDOWS\Installer\{1e5dcb1a-5ee5-4501-a432-d2306e9e87ce}\AlrtSetup.dll (file missing)
O21 - SSODL: zip - {e1ad7492-ae7c-49d5-b2dd-330ef9259db0} - C:\WINDOWS\Installer\{e1ad7492-ae7c-49d5-b2dd-330ef9259db0}\zip.dll (file missing)
O21 - SSODL: altvxvm - {17B30508-F1B0-4651-8E7E-B1D3AD5691F0} - C:\WINDOWS\altvxvm.dll
O21 - SSODL: bokpkov - {AF8366DC-A7D3-4D04-8547-58A50E1C0C5E} - C:\WINDOWS\bokpkov.dll
O21 - SSODL: WinWin - {ab394182-e325-4861-91e6-8d7b296fd328} - C:\WINDOWS\Installer\{ab394182-e325-4861-91e6-8d7b296fd328}\WinWin.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe
O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Windows Process Moniter - Unknown owner - C:\WINDOWS\winmon.exe (file missing)
O24 - Desktop Component 0: Privacy Protection - [Link mogu videti samo ulogovani korisnici]\WINDOWS\privacy_danger\index.htm

--
End of file - 10987 bytes

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Racunar je zarazen sa vise infekcija.

Zasto nije instaliran Service Pack 2 za Windows XP?

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Evo installirao sam SP2 i evo novi log:

Logfile of HijackThis v1.99.1
Scan saved at 7:37:09 PM, on 4/6/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\msiexec.exe
C:\Documents and Settings\Slavuljica\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = CRA
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\RunOnce: [NoIE4StubProcessing] C:\WINDOWS\system32\reg.exe DELETE "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components" /v "NoIE4StubProcessing" /f
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O11 - Options group: [INTERNATIONAL] International*
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe


Inace sad komp radi kao bombona ali mi neradi MSN...

Dopuna: 08 Apr 2008 22:34

Jeste li zaboravili? Samo da vas podsjetim...

Dopuna: 08 Apr 2008 22:36

Nestale mi ikone sa desktopa...

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Izvini na kasnjenju.

Pa u drugom logu nije imalo sta da se vidi posto je sveze instaliran Windows.
Sto se tice ikonica, sta si instalirao pre nego sto su nestale ikonice?
Messenger ti najverovatnije ne radi jer nisi instalirao noviju verziju (protokol je menjan).

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Nisam instalirao windows sp2 iznova, nego sam samo skinuo SP2 i instralirao. Dali sam jos uvijek zarazen?

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Zanimljivo. Izgleda kao da je instalacija SP2 upisala nov/cist registry, sto je cudno.

Ajmo ovako:

Skini ComboFix sa jedne od sledecih adresa na Desktop:
[Link mogu videti samo ulogovani korisnici]
[Link mogu videti samo ulogovani korisnici]

Startuj ga i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu. Kada zavrsi pojavice se log (C:\ComboFix.txt) koji ces nam ovde iskopirati.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

ComboFix 08-04-08.10 - Slavuljica 2008-04-09 17:52:29.1 - FAT32x86
Running from: C:\Documents and Settings\Slavuljica\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrator\Desktop\Error Cleaner.url
C:\Documents and Settings\Administrator\Desktop\Privacy Protector.url
C:\Documents and Settings\Administrator\Desktop\Spyware&Malware Protection.url
C:\Documents and Settings\Administrator\Favorites\Error Cleaner.url
C:\Documents and Settings\Administrator\Favorites\Privacy Protector.url
C:\Documents and Settings\Administrator\Favorites\Spyware&Malware Protection.url
C:\Documents and Settings\Slavuljica\Favorites\Error Cleaner.url
C:\Documents and Settings\Slavuljica\Favorites\Privacy Protector.url
C:\Documents and Settings\Slavuljica\Favorites\Spyware&Malware Protection.url
C:\WINDOWS\privacy_danger
C:\WINDOWS\privacy_danger\images\capt.gif
C:\WINDOWS\privacy_danger\images\danger.jpg
C:\WINDOWS\privacy_danger\images\down.gif
C:\WINDOWS\privacy_danger\images\spacer.gif
C:\WINDOWS\privacy_danger\index.htm
C:\WINDOWS\rs.txt
c:\WINDOWS\system32\zcucgc.dat
c:\windows\system32\zcucgc.exe
C:\WINDOWS\system32\zcucgc_nav.dat
c:\WINDOWS\system32\zcucgc_navps.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_WINMON


((((((((((((((((((((((((( Files Created from 2008-03-09 to 2008-04-09 )))))))))))))))))))))))))))))))
.

2008-04-07 22:34 . 2008-04-07 22:34 <DIR> d-------- C:\Program Files\Real
2008-04-07 22:34 . 2008-04-07 22:34 <DIR> d-------- C:\Documents and Settings\Slavuljica\Contacts
2008-04-07 22:33 . 2008-04-07 22:33 <DIR> d-------- C:\Program Files\MSN Messenger
2008-04-07 20:01 . 2008-04-07 20:01 <DIR> d-------- C:\Documents and Settings\Slavuljica\Application Data\Yahoo!
2008-04-07 20:01 . 2008-04-07 20:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-04-07 19:44 . 2008-04-07 19:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-04-07 19:43 . 2008-04-07 19:43 <DIR> d-------- C:\Program Files\Yahoo!
2008-04-06 21:13 . 2008-04-06 21:13 <DIR> d-------- C:\WINDOWS\Sun
2008-04-06 21:13 . 2008-04-06 21:13 <DIR> d-------- C:\Program Files\Google
2008-04-06 21:11 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-04-06 21:10 . 2008-04-06 21:10 <DIR> d-------- C:\Program Files\Java
2008-04-06 21:05 . 2008-04-06 21:05 <DIR> d-------- C:\Program Files\Common Files\Java
2008-04-06 19:32 . 2008-04-06 19:32 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-04-06 18:14 . 2008-04-06 19:01 1,355 --a------ C:\WINDOWS\imsins.BAK
2008-04-06 18:01 . 2008-04-06 18:01 <DIR> d-------- C:\WINDOWS\provisioning
2008-04-06 17:53 . 2008-04-06 17:53 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-04-06 17:50 . 2004-08-04 00:56 1,392,671 --a------ C:\WINDOWS\system32\msvbvm60.dll
2008-04-06 17:49 . 2004-08-04 00:56 2,897,920 --------- C:\WINDOWS\system32\xpsp2res.dll
2008-04-06 17:46 . 2006-09-06 17:43 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-04-06 17:46 . 2004-07-17 11:40 19,528 --a------ C:\WINDOWS\002472_.tmp
2008-04-06 17:37 . 2008-04-06 17:37 <DIR> d-------- C:\WINDOWS\EHome
2008-04-05 14:47 . 2008-04-05 14:48 91,700 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-04-05 14:47 . 2008-04-05 14:48 85,860 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-04-05 14:46 . 2008-04-05 14:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-04-05 14:46 . 2008-04-09 18:13 483,872 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-04-05 14:46 . 2008-04-09 18:13 30,240 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-04-05 14:46 . 2008-04-09 18:13 7,556 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-04-05 14:46 . 2008-04-09 18:13 3,908 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-04-05 14:35 . 2008-04-05 14:35 <DIR> d-------- C:\kav
2008-04-05 13:56 . 2008-04-05 13:56 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-05 13:33 . 2008-04-05 13:33 <DIR> d-------- C:\ComboFix(2)
2008-04-04 00:10 . 2008-04-04 00:10 <DIR> d-------- C:\Program Files\MSN Apps
2008-04-02 17:50 . 2008-04-02 17:50 <DIR> d--hs---- C:\FOUND.120
2008-03-28 18:49 . 2008-03-28 18:49 319,488 --a------ C:\WINDOWS\system32\cqxdddqzi.exe
2008-03-28 13:22 . 2008-03-30 19:48 8,627 --a------ C:\WINDOWS\system32\PAV_FOG.OPC
2008-03-28 12:37 . 2008-03-28 12:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\sentinel
2008-03-28 12:32 . 2008-03-28 12:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Backup
2008-03-28 12:32 . 2003-10-22 17:23 446,464 --a------ C:\WINDOWS\system32\HHActiveX.dll
2008-03-27 22:07 . 2008-03-27 22:07 <DIR> d-------- C:\Program Files\Common Files\Panda Software
2008-03-25 19:44 . 2008-03-25 19:44 <DIR> d--hs---- C:\FOUND.119
2008-03-25 19:12 . 2008-04-09 16:50 2,572 --a------ C:\WINDOWS\system32\PerfStringBackup.TMP
2008-03-25 16:53 . 2008-03-26 22:14 4,550 ---h----- C:\PANDA.RPT
2008-03-25 15:29 . 1997-09-18 06:12 9,488 --a------ C:\WINDOWS\system32\sporder.dll
2008-03-25 13:08 . 2008-03-25 13:08 <DIR> d--hs---- C:\FOUND.118
2008-03-25 12:40 . 2008-03-25 12:40 <DIR> d--hs---- C:\FOUND.117
2008-03-25 12:23 . 2008-03-25 12:23 <DIR> d-------- C:\Program Files\CONEXANT
2008-03-25 12:22 . 2002-11-19 12:11 585,472 -ra------ C:\WINDOWS\system32\drivers\HSF_CNXT.sys
2008-03-20 18:04 . 2008-03-20 18:04 <DIR> d--hs---- C:\FOUND.116
2008-03-20 15:59 . 2008-03-20 15:59 <DIR> dr------- C:\Documents and Settings\All Users\Application Data\systemerrorfixer
2008-03-20 15:53 . 2008-03-20 15:53 <DIR> d-------- C:\Program Files\Common Files\SystemErrorFixer
2008-03-20 15:53 . 2008-03-20 15:53 <DIR> dr------- C:\Documents and Settings\All Users\Application Data\SalesMon
2008-03-20 10:41 . 2008-03-20 10:41 <DIR> d--hs---- C:\FOUND.115
2008-03-19 19:36 . 2008-03-19 19:36 <DIR> d-------- C:\Program Files\nobrand
2008-03-19 18:10 . 2008-03-19 18:10 <DIR> d---s---- C:\Documents and Settings\Slavuljica\UserData
2008-03-13 21:39 . 2008-03-13 21:39 <DIR> d-------- C:\SUPERS
2008-03-13 17:11 . 2008-03-13 17:11 <DIR> d-------- C:\SIMPSONS
2008-03-11 13:28 . 2008-03-11 13:28 <DIR> d--hs---- C:\FOUND.114

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-22 18:00 724,992 ----a-w C:\WINDOWS\iun6002.exe
2008-03-07 19:11 --------- d-----w C:\Program Files\Evviva la chitarra!
2008-02-27 18:51 --------- d-----w C:\Program Files\MP3 Player Utilities 4.09
2008-02-17 14:02 --------- d-----w C:\Documents and Settings\Slavuljica\Application Data\Ulead Systems
2008-02-17 14:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ulead Systems
2008-02-08 16:37 219,664 ----a-w C:\WINDOWS\system32\klogon.dll
2005-01-11 16:06 16,368 ----a-w C:\Documents and Settings\Slavuljica\Application Data\GDIPFONTCACHEV1.DAT
2004-10-01 13:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54 5674352]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-04-06 21:14 171448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2008-02-08 18:36 227856]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=

.
Contents of the 'Scheduled Tasks' folder
"2008-04-08 17:49:02 C:\WINDOWS\Tasks\Strip screensavers.job"
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2008-04-09 18:15:57
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
.
**************************************************************************
.
Completion time: 2008-04-09 18:20:14 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-09 16:19:50
Pre-Run: 2,141,749,248 bytes free
Post-Run: 2,021,933,056 bytes fre

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Uradi sledeće:
Preuzmi fajl gmer.zip sa ovog linka i sačuvaj na Desktop-u.
Raspakuj ga u neki folder.

Dupli klik na gmer.exe za početak: Izaberi Rootkit/Malware Tab na vrhu.
Klikni na Scan.
Kada je skeniranje završeno, klik na Copy dugme ispod - ovo će sačuvati to u Clipboard.
Iskoristi opciju Paste u Notepad-u da bi to prebacio u tekst. Snimi taj tekst iz Notepada kao file1.txt.
Ponovi ovo isto sa Autostart Tab-om. Snimi taj tekst iz Notepada kao file2.txt.

Prikaci ta dva fajla uz sledecu poruku.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Uloguj se preko Facebooka da bi skinuo fajl:

[Link mogu videti samo ulogovani korisnici]

[Link mogu videti samo ulogovani korisnici]

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Otvoriti Notepad i iskopirati sledeci tekst:

File::
C:\WINDOWS\system32\cqxdddqzi.exe

Folder::
C:\Documents and Settings\All Users\Application Data\systemerrorfixer
C:\Program Files\Common Files\SystemErrorFixer
C:\Documents and Settings\All Users\Application Data\SalesMon



Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.