MyCity » Ambulanta -> Arhiva Ambulante » Worm.Zhelatin

Worm.Zhelatin

Napisano na dan: 13.11.2007

Worm.Zhelatin
Sledeća strana Pagination

Idi na vrh

Poslao: 13 Nov 2007 12:11
Idi na vrh
offline
  • Pridružio: 13 Nov 2007
  • Poruke: 4

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 12:59:00, on 13.8.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Raxco\PerfectDisk\PDSched.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\vsnpstd3.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Documents and Settings\Administrator\Desktop\New Folder\tt3.exe

R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: DAPBHO Class - {0096CC0A-623C-4829-AD9C-19AF0DC9D8FE} - C:\Program Files\DAP\DAPIEBar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Program Files\DAP\DAPIEBar.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [dmnjp.exe] C:\WINDOWS\system32\dmnjp.exe
O4 - HKLM\..\Run: [dmvsk.exe] C:\WINDOWS\system32\dmvsk.exe
O4 - HKLM\..\Run: [dmcpb.exe] C:\WINDOWS\system32\dmcpb.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [noskrnl] C:\WINDOWS\noskrnl.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: ICQ 4.0 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{5C1383C7-E6A6-4C29-AD3C-52AFD21E9FFB}: NameServer = 85.255.116.101,85.255.112.153
O17 - HKLM\System\CCS\Services\Tcpip\..\{C409A054-E8C2-4EF8-A784-9762372A54C6}: NameServer = 85.255.116.101,85.255.112.153
O17 - HKLM\System\CCS\Services\Tcpip\..\{DE5BAB9E-C8C4-4A27-9F91-227DFCB808CE}: NameServer = 85.255.116.101,85.255.112.153
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.101 85.255.112.153
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.101 85.255.112.153
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.101 85.255.112.153
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashserv.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: Prime95 Service - Unknown owner - C:\Program Files\Prime95\prime95.exe
O23 - Service: Windows Management Service - Unknown owner - C:\WINDOWS\system32\dmpot.exe

--
End of file - 5654 byte



procitao sam sve teme i probao da sam ocistim, al nesto je izgleda ostalo Smile, nista bez pravih doktora Smile



Poslao: 13 Nov 2007 15:15
Idi na vrh
offline
  • DEMIAN  Male
  • Legendarni građanin
  • IT Manager
  • Pridružio: 25 Mar 2005
  • Poruke: 3706
  • Gde živiš: The darkest place on earth..

Pozdrav,

Za početak uključi prikaz skrivenih fajlova, potraži i upload-uj nam sledeće fajlove sa tvog kompa.

C:\WINDOWS\system32\dmnjp.exe
C:\WINDOWS\system32\dmvsk.exe
C:\WINDOWS\system32\dmcpb.exe
C:\WINDOWS\system32\dmpot.exe

Za upload koristi ovaj link:
[Link mogu videti samo ulogovani korisnici]
-----------------------

Kada to završiš, preuzmi Panda Anti-Rootkit. Njime ćeš da preskeniraš računar. Ako se nisi do sada sretao sa ovim softverom pročitaj kratak opis i uputstvo ovde.

U suštini prosto je, raspakuješ ga iz arhive, dopuniš definicije, označiš opciju In-dept scan (tražiće restart) i skeniraš sistem. Šta nađe, označiš i ideš na remove.
Sačuvaj Advanced report programa (export CSV fajl opcija) i prikači ga uz sledeću poruku. Naravno, postavi i novi HijackThis log (da bi videli promene) pa nastavljamo..



Poslao: 13 Nov 2007 16:32
Idi na vrh
offline
  • Pridružio: 13 Nov 2007
  • Poruke: 4

Prvo, hvala na brzom odgovoru, svaka čast, moram da vas pohvalim pošto će ovo još neko čitati.

AntiRootkit nije ništa našao.
Uključen mi je prikaz skrivenih fajlova i u win i u total commander-u, ali onih exe fajlova nema, pretražio sam ceo disk, a hijack ih vidi. Evo i log:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 17:06:22, on 13.8.2007
Platform: Windows XP SP3, v.3205 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Raxco\PerfectDisk\PDSched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\vsnpstd3.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\Administrator\Desktop\New Folder\tt4.exe

R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: DAPBHO Class - {0096CC0A-623C-4829-AD9C-19AF0DC9D8FE} - C:\Program Files\DAP\DAPIEBar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Program Files\DAP\DAPIEBar.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [dmnjp.exe] C:\WINDOWS\system32\dmnjp.exe
O4 - HKLM\..\Run: [dmvsk.exe] C:\WINDOWS\system32\dmvsk.exe
O4 - HKLM\..\Run: [dmcpb.exe] C:\WINDOWS\system32\dmcpb.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [noskrnl] C:\WINDOWS\noskrnl.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: ICQ 4.0 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{5C1383C7-E6A6-4C29-AD3C-52AFD21E9FFB}: NameServer = 85.255.116.101,85.255.112.153
O17 - HKLM\System\CCS\Services\Tcpip\..\{C409A054-E8C2-4EF8-A784-9762372A54C6}: NameServer = 85.255.116.101,85.255.112.153
O17 - HKLM\System\CCS\Services\Tcpip\..\{DE5BAB9E-C8C4-4A27-9F91-227DFCB808CE}: NameServer = 85.255.116.101,85.255.112.153
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.101 85.255.112.153
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashserv.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: Prime95 Service - Unknown owner - C:\Program Files\Prime95\prime95.exe
O23 - Service: Windows Management Service - Unknown owner - C:\WINDOWS\system32\dmpot.exe

--
End of file - 5985 bytes

Dopuna: 13 Nov 2007 16:32

Samo da dodam:

Glavni problem je što ne dozvoljava pristup kontrol panelu, ni preko run-control a ni preko start menija, i display properties ne otvara, poruka je "Restrictions...bla bla, contact system admin".

Computer Management radi.

Poslao: 13 Nov 2007 16:37
Idi na vrh
offline
  • DEMIAN  Male
  • Legendarni građanin
  • IT Manager
  • Pridružio: 25 Mar 2005
  • Poruke: 3706
  • Gde živiš: The darkest place on earth..

Karlos_K ::
AntiRootkit nije ništa našao.
Uključen mi je prikaz skrivenih fajlova i u win i u total commander-u, ali onih exe fajlova nema, pretražio sam ceo disk, a hijack ih vidi.
Rootkit može da sakrije fajlove. Ništa čudno, sem toga da ga Panda ne detektuje. A i čistio si već komp tako da je u opticaju i da su zaista obrisani. Takođe, čudno mi je da HJT ne prikaže/očita bar servis (023 linija) kao file missing ako fajla zaista i nema. Iz tih razloga moraću da te zamolim za još jednu proveru da ne bi dalje nagađali.
-----------------

Uradi sledeće:
Preuzmi fajl gmer.zip sa ovog linka i sačuvaj na Desktop-u.
Raspakuj ga u neki folder.

Dupli klik na gmer.exe za početak: Izaberi Rootkit Tab na vrhu.
Klikni na Scan.
Kada je skeniranje završeno, klik na Copy dugme ispod - ovo će sačuvati to u Clipboard.
Iskoristi opciju Paste u Notepad-u da bi to prebacio u tekst. Snimi taj tekst iz Notepada kao file1.txt.
Ponovi ovo isto sa Autostart Tab-om. Snimi taj tekst iz Notepada kao file2.txt.

Iskopiraj nam ovde sadrzaj ta dva fajla koja smo malopre snimili.

Poslao: 13 Nov 2007 21:59
Idi na vrh
offline
  • Pridružio: 13 Nov 2007
  • Poruke: 4

Kad pokrenem gmer, i stisnem scan, nestane sa ekrana, ali ostane da radi i pojede 100% cpu. Probao sam par restarta ali isto. Gmer radi normalno na drugom kompu. Najbolje da uradim ono što sam pokušao da izbegnem, backup fajlova, low level format i reinstalacija. Sad

Dopuna: 13 Nov 2007 21:59

E pa red je i da ja zavrsim ovu temu Smile

Primenio sam najsigurniji nacin borbe protiv virusa i ostalih gamadi.

Backup vaznih podataka (sve obavezno skeniram na drugom kompu).

I reinstalacija. Smile (ovog puta pravim image - Acronis je super)

I jos jednom da pohvalim sve moderatore na mycity - odlicni ste

Sve najbolje

Poslao: 13 Nov 2007 22:29
Idi na vrh
offline
  • DEMIAN  Male
  • Legendarni građanin
  • IT Manager
  • Pridružio: 25 Mar 2005
  • Poruke: 3706
  • Gde živiš: The darkest place on earth..

Žao mi je što to nismo uspeli da završimo bez reinstalacije. Rešenje je postojalo ali očito da je vreme bio bitniji faktor kod tebe. Zbunio si onim prvim logovima malo, nije mi jasno šta je očišćeno bilo a šta ne, kojim alatima iz ambulante si skenirao sistem.. No nebitno sada.. kada si rešio problem. Smile

Pozz

MyCity » Ambulanta -> Arhiva Ambulante » Worm.Zhelatin

Ko je trenutno na forumu
 

Ukupno su 1041 korisnika na forumu :: 136 registrovanih, 15 sakrivenih i 890 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 19602 - dana 30 Mar 2026 00:11

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 04bokibole, A.R.Chafee.Jr., ajugovic74, akrep, aleksandar11332, aleksandar1888, anbeast, Andrija357, Apok, aramis s, Armadillo, Arsenije, Asteker, Atomski čoban, awathorn, babaroga, bambulic, Batko.VD.65, Beanara, Ben Roj, bestguarder, BojanB93, bpvl, C-Gun, CHARLIE JA., Cicumile, Clouseau, crnogorac, cuvarkuca, cyprus, Dalibor Šafar, dejan1972, DejanSt, Deki Duga Devetka, deLacy, Desmond, Dimitrise93, djordjemiklusev, Dogma21, DonRumataEstorski, Dr.Strangelove, draganl, Dukelander, dule10savic, Flanker-G, gajca1977, galerija, Gogi do, Goxy1, Igritelj, ikan, istina, jaeger, Jan, JK, JOntra, jovaaan00, Karla, KimiMR, KizJ, Kobrim, Kukuc, laurusri, MadMike, maiden6657, Malahit, marsi, mat, mercedesamg, Miler88, MiljanXD, milos1231, miodrag, mitja2512, Mićko, mocnijogurt, moldway, mrm, nebidrag, nebojsag, nekdo, Neutral-M, NiKoLa27, nixos, novator, Pale2025, Pantaaa, Papadubi, Pekman, Petar888, Pilence, Pilipenda, ping15, Polifon, Prašinar, promajauglavi, Prometeus, Pururin, radionica1, raptorsi, raso76, rodoljub, ruma, Sale0501, saputnik plavetnila, Sass Drake, Semberija, Semprini, Sevatar, Siti2, Skakac7, ssekir75, starlights, Stevan Visoki, stokssone, SympathyForTheDevil, t.e.m.p.l.a.r., Teodor60, TheDictator, tmanda323, tooljan, Tribal, tuf, ujke, vaci, Vanderx, Velizar, vidra1, Vlada78, vladaa012, Wrangler, x011, Zeljo980, Zoran1959, 1107, 79693