offline
- greekgoddess
- Novi MyCity građanin
- Pridružio: 28 Maj 2009
- Poruke: 17
|
Evo loga:
ComboFix 09-07-09.08 - Barbika 10.07.2009 18:01.3.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2047.1514 [GMT 2:00]
Running from: c:\documents and settings\Barbika\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\11378594
c:\documents and settings\All Users\Application Data\11378594\11378594.exe
c:\documents and settings\All Users\Application Data\11378594\11378594.glu
c:\documents and settings\Barbika\Application Data\wiaserva.log
c:\documents and settings\Barbika\Barbika.exe
c:\documents and settings\Barbika\oashdihasidhasuidhiasdhiashdiuasdhasd
c:\program files\AskSearch\bin\DefaultSearch.dll
c:\windows\system32\drivers\ws2_32sik.sys
c:\windows\system32\uactmp.db
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_NICSK32
-------\Legacy_SECURENTM
-------\Service_nicsk32
-------\Service_securentm
((((((((((((((((((((((((( Files Created from 2009-06-10 to 2009-07-10 )))))))))))))))))))))))))))))))
.
2009-07-10 15:51 . 2009-07-10 15:51 253688 ----a-w- c:\windows\system32\cssdll32.dll
2009-07-10 15:51 . 2009-07-10 15:51 -------- d-----w- c:\program files\AskSearch
2009-07-10 15:51 . 2009-07-10 15:51 -------- d-----w- c:\program files\AskBarDis
2009-07-10 15:50 . 2009-07-10 16:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Comodo
2009-07-10 15:50 . 2009-07-10 15:50 82080 ----a-w- c:\windows\system32\drivers\inspect.sys
2009-07-10 15:50 . 2009-07-10 15:50 24096 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2009-07-10 15:50 . 2009-07-10 15:50 168208 ----a-w- c:\windows\system32\guard32.dll
2009-07-10 15:50 . 2009-07-10 15:50 132640 ----a-w- c:\windows\system32\drivers\cmdguard.sys
2009-07-10 15:50 . 2009-07-10 15:51 -------- d-----w- c:\program files\COMODO
2009-07-08 18:04 . 2009-07-08 18:04 -------- d-----w- c:\documents and settings\All Users\Application Data\91388586
2009-07-05 19:19 . 2009-07-05 19:19 -------- d-----w- c:\documents and settings\Download programs\Carlston za Ognjenku - Charleston & Vendetta - Tears for Sale (2008-)
2009-07-04 17:36 . 2009-07-04 17:36 -------- d-----w- c:\program files\Maxis
2009-07-03 23:05 . 2009-07-09 11:39 -------- d-----w- c:\documents and settings\Barbika\Application Data\Chameleon Tom Toolbar
2009-07-03 23:05 . 2009-07-03 23:05 -------- d-----w- c:\program files\Chameleon Tom Toolbar
2009-07-03 23:05 . 2009-07-03 23:05 -------- d-----w- c:\program files\ChameleonTom for IE
2009-07-03 23:05 . 2009-07-03 23:05 -------- d-----w- c:\documents and settings\Barbika\AppData
2009-07-01 12:34 . 2009-07-01 12:34 -------- d-----w- c:\program files\MagicISO
2009-07-01 10:45 . 2009-07-01 10:45 -------- d-----w- c:\documents and settings\Download programs\Iron Maiden Flight 666
2009-06-30 19:38 . 2009-06-30 20:29 -------- d-----w- c:\documents and settings\Download programs\MS Office 2007 Portable (6-in-1)
2009-06-30 17:58 . 2009-06-30 17:58 1967104 ----a-w- c:\documents and settings\Barbika\Application Data\Mozilla\Firefox\Profiles\ytx9lkcj.default\extensions\{e776fbbe-9f00-456f-9278-478f134d35c0}\plugins\npChameleonTomToolbar.dll
2009-06-30 17:04 . 2009-06-30 17:04 -------- d-----w- c:\documents and settings\Barbika\Local Settings\Application Data\PCHealth
2009-06-25 19:29 . 2009-06-25 19:29 -------- d-s---w- c:\documents and settings\Barbika\UserData
2009-06-25 19:23 . 2009-06-25 19:23 -------- d-----w- c:\program files\ESET
2009-06-25 11:44 . 2009-06-25 11:44 -------- d-----w- c:\documents and settings\Barbika\Local Settings\Application Data\Gearbox Software
2009-06-25 11:41 . 2009-06-25 18:48 -------- d-----w- c:\documents and settings\Download programs\Bond 007
2009-06-24 10:54 . 2009-06-25 10:37 1153948437 ----a-w- c:\documents and settings\Download programs\Bond 007.zip
2009-06-24 10:35 . 2009-06-24 12:14 -------- d-----w- c:\documents and settings\Download programs\The Hangover.2009.Cam-AlienFilms
2009-06-23 21:35 . 2009-06-23 21:35 -------- d-----w- c:\documents and settings\Barbika\Application Data\SpinTop Games
2009-06-23 21:35 . 2009-06-23 21:35 -------- d-----w- c:\windows\Amazing Adventures 2 - Around the World
2009-06-23 21:35 . 2009-06-23 21:35 -------- d-----w- c:\program files\Amazing Adventures 2 - Around the World
2009-06-23 21:17 . 2009-06-23 21:17 -------- d-----w- c:\documents and settings\Download programs\Bigfish Games - Amazing Adventures 2 - Around the World + Adnan_Boy 2008 + Pre(zabranjeno)ed
2009-06-23 21:14 . 2009-06-23 21:14 -------- d-----w- c:\windows\Adventures of Robinson Crusoe
2009-06-23 21:14 . 2009-06-23 21:14 -------- d-----w- c:\program files\Adventures of Robinson Crusoe
2009-06-23 20:38 . 2009-06-23 20:38 -------- d-----w- c:\windows\Lovely Kitchen
2009-06-23 20:00 . 2009-06-23 20:01 -------- d-----w- c:\documents and settings\Download programs\ReflexiveArcade
2009-06-23 19:17 . 2009-06-23 19:17 -------- d-----w- c:\documents and settings\Download programs\The-Haunted-Mansion-(2003)-Eng-WS-Xvid-BuRnT
2009-06-22 14:35 . 2009-06-22 14:35 -------- d-----w- c:\windows\Dream Day Wedding - Married in Manhattan
2009-06-21 22:07 . 2009-06-21 22:07 -------- d-----w- c:\documents and settings\Download programs\Bigfish Games - Dream Day Wedding 2 Married in Manhattan + Adnan_Boy 2008 + Pre(zabranjeno)ed
2009-06-21 18:48 . 2009-06-27 20:03 -------- d-----w- c:\documents and settings\Download programs\[PC] Max Payne 2 The Fall of Max Payne [RIP] [dopeman]
2009-06-17 22:41 . 2009-06-17 22:41 -------- d-----w- c:\documents and settings\Download programs\The Crow I-IV - CANiBUS
2009-06-17 22:31 . 2009-06-17 22:31 -------- d-----w- c:\documents and settings\Download programs\The Crow City Of Angels -Empire (Kingdom-KvCD by Empire)
2009-06-16 22:43 . 2009-06-16 22:43 -------- d-----w- c:\documents and settings\Download programs\The Crow 3 Salvation [eng] Dvd-rip Slim Shagy [AC3]
2009-06-16 22:42 . 2009-06-17 18:15 -------- d-----w- c:\documents and settings\Download programs\The Crow II - City Of Angels
2009-06-13 23:57 . 2009-06-13 23:57 -------- d-----w- c:\documents and settings\Barbika\Application Data\Aveyond 3
2009-06-13 23:57 . 2009-06-13 23:57 -------- d-----w- c:\program files\pfe
2009-06-13 23:57 . 2009-06-13 23:57 -------- d-----w- c:\program files\Aveyond - Lord of Twilight
2009-06-13 23:32 . 2009-06-13 23:44 -------- d-----w- c:\documents and settings\Download programs\Aveyond - Lord of Twilight
2009-06-12 14:04 . 2009-06-12 14:04 -------- d-----w- c:\documents and settings\Download programs\The Complete Collection of Disney and Pixar Classic Movies some extra Movies
2009-06-11 21:45 . 2009-06-13 14:31 -------- d-----w- c:\documents and settings\Download programs\BigFish Games - Echo Secret of the Lost Cavern - Adventure - Wendy99
2009-06-11 17:57 . 2009-06-11 17:57 -------- d-----w- c:\program files\GSP
2009-06-11 17:54 . 2009-06-11 17:54 -------- d-----w- c:\windows\Lost Secrets Bermuda Triangle
2009-06-11 17:54 . 2009-06-11 17:54 -------- d-----w- c:\program files\Lost Secrets Bermuda Triangle
2009-06-11 17:30 . 2009-06-11 17:35 -------- d-----w- c:\documents and settings\Download programs\Bigfish Games - Lost Secrets Bermuda Triangle + Adnan_Boy 2008 + Pre(zabranjeno)ed
2009-06-10 23:25 . 2009-06-10 23:33 -------- d-----w- c:\documents and settings\Download programs\Return.To.Mysterious.Island-RELOADED
2009-06-10 23:23 . 2009-06-10 23:32 -------- d-----w- c:\documents and settings\Download programs\Bigfish Games- Nancy Drew Ghost Dogs of Moon Lake (zabranjeno) + Direct Link + Adnan_Boy 2008
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-10 15:30 . 2008-12-02 22:39 -------- d-----w- c:\documents and settings\Barbika\Application Data\uTorrent
2009-07-10 04:33 . 2008-10-20 20:02 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-07-09 20:38 . 2008-11-19 20:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-07-08 10:45 . 2009-03-26 15:33 -------- d-----w- c:\program files\The Nightshift Code
2009-07-08 10:45 . 2009-03-26 15:41 -------- d-----w- c:\program files\Mystery Case Files Huntsville
2009-07-08 10:45 . 2009-03-26 15:43 -------- d-----w- c:\program files\Mahjong Fortuna 2 Deluxe
2009-07-08 10:43 . 2009-03-24 15:55 -------- d-----w- c:\program files\Hawaiian Explorer Pearl Harbor
2009-07-08 10:32 . 2009-02-23 17:15 -------- d-----w- c:\program files\GameHouse
2009-07-08 10:30 . 2009-02-24 16:46 -------- d-----w- c:\program files\Jigsaw Puzzle Platinum Edition
2009-07-01 14:48 . 2008-10-11 20:05 69840 ----a-w- c:\documents and settings\Barbika\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-01 14:03 . 2008-12-14 20:01 -------- d-----w- c:\program files\vanBasco's Karaoke Player
2009-07-01 14:03 . 2009-05-22 20:40 -------- d-----w- c:\program files\Ahead
2009-07-01 14:00 . 2009-05-20 14:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-07-01 13:34 . 2008-10-31 18:25 -------- d-----w- c:\program files\Common Files\AVSMedia
2009-07-01 13:34 . 2008-10-31 18:25 -------- d-----w- c:\program files\AVS4YOU
2009-06-15 12:17 . 2008-10-26 21:43 -------- d-----w- c:\documents and settings\All Users\Application Data\BigFishGamesCache
2009-06-13 17:50 . 2009-05-03 15:08 -------- d-----w- c:\program files\Games
2009-06-13 17:45 . 2009-06-09 10:23 -------- d-----w- c:\documents and settings\Barbika\Application Data\ForgottenRiddles2
2009-06-11 17:57 . 2008-10-07 20:06 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-08 20:09 . 2009-06-08 20:09 -------- d-----w- c:\program files\Forgotten Riddles - The Moonlight Sonatas
2009-06-04 17:58 . 2008-11-15 18:21 -------- d-----w- c:\documents and settings\Barbika\Application Data\Artogon
2009-06-04 17:51 . 2009-06-04 17:50 4728658 ----a-w- c:\documents and settings\All Users\Application Data\BigFishGamesCache\GameManager\GameDB\F5006T1L1\setup_gF5006T1L1_d540901819_l1_s1.exe
2009-06-02 07:26 . 2009-06-02 07:18 78116523 ----a-w- c:\documents and settings\Download programs\Plan It Green.zip
2009-06-01 18:00 . 2009-06-01 18:00 -------- d-----w- c:\documents and settings\Barbika\Application Data\Canneverbe_Limited
2009-06-01 18:00 . 2009-06-01 17:59 -------- d-----w- c:\program files\CDBurnerXP
2009-06-01 14:51 . 2009-06-01 08:04 -------- d-----w- c:\program files\Pahelika - Secret Legends
2009-06-01 10:46 . 2009-05-20 00:12 -------- d-----w- c:\program files\Dream Chronicles - The Chosen Child
2009-06-01 09:52 . 2009-06-01 09:52 -------- d-----w- c:\program files\Treasure Seekers - The Enchanted Canvases
2009-06-01 09:36 . 2008-10-27 17:08 -------- d-----w- c:\program files\bfgclient
2009-06-01 08:18 . 2009-06-01 08:18 -------- d-----w- c:\documents and settings\Barbika\Application Data\IronCode
2009-05-31 19:32 . 2009-05-31 19:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-05-31 19:01 . 2009-05-27 23:49 -------- d-----w- c:\program files\12345
2009-05-28 11:22 . 2009-05-28 11:22 -------- d-----w- c:\documents and settings\Dragana\Application Data\Malwarebytes
2009-05-28 00:20 . 2009-05-28 00:20 -------- d-----w- c:\documents and settings\Barbika\Application Data\Malwarebytes
2009-05-28 00:08 . 2009-03-26 15:40 -------- d-----w- c:\program files\Mystery of Shark Island
2009-05-27 23:49 . 2009-05-27 23:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-27 17:04 . 2009-05-27 14:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-05-27 16:36 . 2009-03-26 15:29 -------- d-----w- c:\program files\Hide And Secret
2009-05-26 16:14 . 2008-10-08 11:18 69840 ----a-w- c:\documents and settings\Dragana\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-26 11:20 . 2009-05-31 19:32 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-26 11:19 . 2009-05-31 19:32 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-05-25 14:57 . 2009-04-22 14:55 261 --s-a-w- c:\windows\system32\2698396479.dat
2009-05-22 21:41 . 2009-05-22 21:41 -------- d-----w- c:\documents and settings\All Users\Application Data\DivoGames
2009-05-22 20:40 . 2009-05-22 20:40 -------- d-----w- c:\program files\Common Files\Ahead
2009-05-20 00:13 . 2008-10-22 18:58 -------- d-----w- c:\documents and settings\Barbika\Application Data\PlayFirst
2009-05-18 20:11 . 2009-05-18 20:11 0 ----a-w- c:\windows\nsreg.dat
2009-05-18 19:06 . 2009-05-18 19:06 -------- d-----w- c:\documents and settings\Dragana\Application Data\Yahoo!
2009-05-15 23:27 . 2009-05-15 23:19 -------- d-----w- c:\documents and settings\All Users\Application Data\VirtualFarm
2009-05-14 23:16 . 2009-05-14 22:25 144124179 ----a-w- c:\documents and settings\Download programs\Fairy Godmother Tycoon.zip
2009-05-14 22:21 . 2009-05-14 22:21 -------- d-----w- c:\documents and settings\Barbika\Application Data\ShinyTales
2009-05-14 22:17 . 2009-05-14 22:17 -------- d-----w- c:\program files\Wonderburg
2009-05-13 11:50 . 2009-02-06 10:43 -------- d-----w- c:\documents and settings\Dragana\Application Data\uTorrent
2009-05-12 14:55 . 2009-05-12 14:55 -------- d-----w- c:\documents and settings\Barbika\Application Data\Enchanted Katya
2009-05-07 15:44 . 2002-08-29 03:41 344064 ----a-w- c:\windows\system32\localspl.dll
2009-05-03 16:03 . 2009-05-03 15:49 21840 ----atw- c:\windows\system32\SIntfNT.dll
2009-05-03 16:03 . 2009-05-03 15:49 17212 ----atw- c:\windows\system32\SIntf32.dll
2009-05-03 16:03 . 2009-05-03 15:49 12067 ----atw- c:\windows\system32\SIntf16.dll
2009-04-29 04:52 . 2002-08-29 03:41 659456 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:52 . 2008-10-11 16:00 81920 ------w- c:\windows\system32\ieencode.dll
2009-04-17 09:58 . 2002-08-29 02:14 1846656 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 15:11 . 2002-08-29 03:41 584192 ----a-w- c:\windows\system32\rpcrt4.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-08-06 13:20 279944 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2008-03-11 13520896]
"NvMediaCenter"="c:\windows\System32\NvMcTray.dll" [2008-03-11 86016]
"WireLessMouse"="c:\program files\Multimedia Mouse Driver\StartAutorun.exe" [2005-11-30 94208]
"WireLessKeyboard"="c:\program files\Office Keyboard Driver\StartAutorun.exe" [2005-11-30 94208]
"PMCRemote"="c:\program files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe" [2005-11-07 73728]
"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2003-11-10 406016]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-03 36352]
"LogonStudio"="c:\program files\WinCustomize\LogonStudio\logonstudio.exe" [2002-09-03 987187]
"PMCS"="c:\program files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe" [2005-11-08 65536]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-02-06 2021400]
"COMODO SafeSurf"="c:\program files\COMODO\SafeSurf\cssurf.exe" [2009-07-10 278264]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2009-07-10 1794320]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-09-27 16844800]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2007-08-03 1826816]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-03-11 1626112]
c:\documents and settings\Dragana\Start Menu\Programs\Startup\
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2008-10-11 3450608]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2007-9-19 282624]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\windows\system32\logonuiX.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\cssdll32.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"=
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [10.7.2009 17:50 132640]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [10.7.2009 17:50 24096]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [6.2.2009 14:23 106208]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [6.2.2009 14:24 93336]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [6.2.2009 14:23 727720]
R3 3xHybrid;Pinnacle PCTV 110i service;c:\windows\system32\drivers\3xHybrid.sys [11.10.2008 18:12 827008]
R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\l151x86.sys [7.10.2008 22:08 36864]
S2 ws2_32sik;ws2_32sik;\??\c:\windows\system32\drivers\ws2_32sik.sys --> c:\windows\system32\drivers\ws2_32sik.sys [?]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [31.5.2009 21:32 40160]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - CMDAGENT
*NewlyCreated* - CMDGUARD
*NewlyCreated* - CMDHLP
*NewlyCreated* - INSPECT
.
Contents of the 'Scheduled Tasks' folder
2009-07-10 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-19 23:29]
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-11378594 - c:\documents and settings\All Users\Application Data\11378594\11378594.exe
HKLM-Run-91388586 - c:\documents and settings\All Users\Application Data\91388586\91388586.exe
HKLM-Run-Regedit32 - c:\windows\system32\regedit.exe
.
------- Supplementary Scan -------
.
uStart Page = [Link mogu videti samo ulogovani korisnici]
mStart Page = [Link mogu videti samo ulogovani korisnici]
uInternet Connection Wizard,ShellNext = [Link mogu videti samo ulogovani korisnici]
uSearchURL,(Default) = [Link mogu videti samo ulogovani korisnici]*http://www.yahoo.com
IE: &Google Search - c:\program files\Google\googletoolbar.dll/cmsearch.html
IE: Backward &Links - c:\program files\Google\googletoolbar.dll/cmbacklinks.html
IE: Cac&hed Snapshot of Page - c:\program files\Google\googletoolbar.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Si&milar Pages - c:\program files\Google\googletoolbar.dll/cmsimilar.html
IE: Translate into English - c:\program files\Google\googletoolbar.dll/cmtrans.html
DPF: DirectAnimation Java Classes - [Link mogu videti samo ulogovani korisnici]\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - [Link mogu videti samo ulogovani korisnici]\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Barbika\Application Data\Mozilla\Firefox\Profiles\ytx9lkcj.default\
FF - prefs.js: browser.search.defaulturl - [Link mogu videti samo ulogovani korisnici]
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - [Link mogu videti samo ulogovani korisnici]
FF - prefs.js: keyword.URL - [Link mogu videti samo ulogovani korisnici]
FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\documents and settings\Barbika\Application Data\Mozilla\Firefox\Profiles\ytx9lkcj.default\extensions\{e776fbbe-9f00-456f-9278-478f134d35c0}\plugins\npChameleonTomToolbar.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2009-07-10 18:08
Windows 5.1.2600 Service Pack 2 NTFS
detected NTDLL code modification:
ZwClose, ZwOpenFile
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:e2,63,26,f1,3f,c8,ff,68,35,3a,f2,60,68,
c9,8b,a7,2e,e8,e1,00,eb,16,2b,de,35,9b,5e,9c,25,5f,43,76,e2,63,26,f1,3f,c8,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,25,f9,41,df,9d,
f3,7c,8b,46,47,15,b0,92,4b,c7,ef,fe,2b,5a,9a,cd,b0,bc,f9,6a,9c,d6,61,af,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:ff,7c,85,e0,43,d4,0e,fe,db,75,b0,c5,6f,
b5,b6,d3,7a,45,05,fd,91,e8,6f,31,b7,91,03,e2,9d,e6,80,b8,ff,7c,85,e0,43,d4,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:6b,65,49,6a,7e,99,74,f7,87,3f,8b,c6,36,
10,91,19,6b,65,49,6a,7e,99,74,f7,85,9e,57,b9,db,e9,36,54,86,8c,21,01,be,91,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:cd,44,cd,b9,a6,33,6c,cd,9c,d5,35,d3,52,
bb,f9,06,e9,02,6c,fa,fb,1d,47,57,f2,c0,11,1b,e3,5e,82,0e,f5,1d,4d,73,a8,13,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:df,20,58,62,78,6b,cf,c8,ea,7e,27,19,89,
80,c7,56,50,93,e5,ab,ec,6a,4e,ab,ef,5e,3e,0b,e5,e2,01,44,df,20,58,62,78,6b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,bd,d3,a9,07,7d,
5f,55,79,97,20,4e,9a,c7,f1,35,ee,31,ec,5e,90,86,fc,78,ad,fb,a7,78,e6,12,2f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:aa,52,c6,00,84,3c,26,64,55,b3,1f,68,bd,
cf,9e,fb,aa,52,c6,00,84,3c,26,64,37,fe,b8,22,4f,ae,74,22,01,3a,48,fc,e8,04,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:51,fa,6e,91,28,9e,14,cc,37,2d,61,7d,96,
8f,3c,24,b2,46,9a,e2,1b,fe,1b,94,18,15,cd,2b,b6,1b,47,1f,f6,0f,4e,58,98,5b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:3d,ce,ea,26,2d,45,aa,78,3d,59,90,ed,26,
72,7f,f2,37,a4,aa,c3,a6,15,56,0a,d4,90,b4,14,a8,a1,36,4b,3d,ce,ea,26,2d,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,56,16,18,5f,77,
a4,92,4d,f8,31,0f,a9,5f,a0,ec,fb,df,3c,a9,ef,8c,14,6b,51,2a,b7,cc,b5,b9,7f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,4d,bf,43,76,98,
c5,44,a1,05,73,21,dd,54,d8,4a,c5,c3,2a,8d,b9,36,e0,96,1f,6c,43,2d,1e,aa,22,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'lsass.exe'(988-)
c:\windows\system32\guard32.dll
- - - - - - - > 'explorer.exe'(1468-)
c:\windows\system32\guard32.dll
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_eng.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\COMODO\COMODO Internet Security\cmdagent.exe
c:\program files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\rundll32.exe
c:\program files\Office Keyboard Driver\PS2USBKbdDrv.exe
c:\program files\Multimedia Mouse Driver\MouseDrv.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\Pinnacle\Shared Files\Programs\PclePvr\VideoControl.exe
.
**************************************************************************
.
Completion time: 2009-07-10 18:11 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-10 16:11
ComboFix2.txt 2009-05-31 19:05
Pre-Run: 8.856.694.784 bytes free
Post-Run: 9.018.888.192 bytes free
351 --- E O F --- 2009-06-11 00:12
|
Kada preuzimanje programa bude završeno:
), a zatim 
