|
Fajl uploadovan, putanju onog prvog ne mogu da nadjem... mozda je samo neki reg. entry...
ComboFix 08-10-18.03 - Dejan 2008-10-19 14:33:07.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.243 [GMT 2:00]
Running from: C:\Documents and Settings\Dejan\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\Cache
C:\WINDOWS\system32\msupdte.exe
.
((((((((((((((((((((((((( Files Created from 2008-09-19 to 2008-10-19 )))))))))))))))))))))))))))))))
.
2020-10-15 23:16 . 2020-10-15 23:16 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2020-10-15 15:39 . 2020-10-15 15:39 268 --ah----- C:\sqmdata02.sqm
2020-10-15 15:39 . 2020-10-15 15:39 244 --ah----- C:\sqmnoopt02.sqm
2008-10-17 17:17 . 2008-10-17 17:17 <DIR> d-------- C:\Program Files\Peninsula Group
2008-10-16 14:33 . 2008-10-19 10:32 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-10-16 14:33 . 2008-10-16 14:33 1,409 --a------ C:\WINDOWS\QTFont.for
2008-10-13 19:47 . 2008-10-13 19:48 409,088 --a------ C:\Informalletters.ppt
2008-10-13 14:27 . 2008-10-13 14:27 572,422 --a------ C:\LcInstallUSA_80708_dna.exe
2008-10-12 12:45 . 2020-10-12 13:08 <DIR> d-------- C:\Program Files\Your Uninstaller 2008
2008-10-12 12:45 . 2008-10-12 12:45 <DIR> d-------- C:\Documents and Settings\Dejan\Application Data\URSoft
2008-10-12 12:45 . 2020-10-16 13:44 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-10-10 07:50 . 2008-10-10 07:50 49 --a------ C:\WINDOWS\NeroDigital.ini
2008-10-04 15:19 . 2008-10-04 15:19 4,096 --a------ C:\WINDOWS\d3dx.dat
2008-10-04 14:03 . 2008-10-04 14:03 <DIR> d-------- C:\Documents and Settings\Dejan\Application Data\Ahead
2008-10-04 14:02 . 2004-03-29 12:10 1,794,048 --------- C:\WINDOWS\UNNMP.exe
2008-10-04 14:02 . 2004-04-01 11:09 50,779 --------- C:\WINDOWS\UNNMP.cfg
2008-10-04 13:59 . 2008-10-04 13:59 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-10-04 13:59 . 2008-10-04 14:02 <DIR> d-------- C:\Program Files\Ahead
2008-10-04 13:59 . 2001-07-06 15:41 569,344 -ra------ C:\WINDOWS\system32\imagr5.dll
2008-10-04 13:59 . 2001-07-06 13:44 544,768 -ra------ C:\WINDOWS\system32\imagx5.dll
2008-10-04 13:59 . 2001-07-06 19:24 283,920 -ra------ C:\WINDOWS\system32\ImagXpr5.dll
2008-10-04 13:59 . 2001-07-09 12:50 155,648 -ra------ C:\WINDOWS\system32\NeroCheck.exe
2008-10-04 13:59 . 2001-06-26 09:15 38,912 -ra------ C:\WINDOWS\system32\picn20.dll
2008-09-28 10:34 . 2020-10-12 13:09 <DIR> d-------- C:\Program Files\Hamachi
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-19 12:35 557,088 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-10-19 12:35 5,080 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-10-19 12:35 4,519,456 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-10-19 12:35 38,484 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-10-19 12:17 --------- d-----w C:\Documents and Settings\Dejan\Application Data\Hamachi
2008-10-19 12:16 --------- d-----w C:\Program Files\Warcraft III
2008-10-19 07:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-10-15 05:50 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-14 12:24 --------- d-----w C:\Documents and Settings\Dejan\Application Data\uTorrent
2008-10-12 16:50 --------- d-----w C:\Documents and Settings\Dejan\Application Data\Nettalk
2008-10-12 11:21 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2008-10-10 10:21 --------- d-----w C:\Program Files\Unlocker
2008-10-09 21:30 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-10-09 20:54 --------- d-----w C:\Program Files\Opera
2008-09-28 11:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-18 12:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-09-13 12:48 985,839 ----a-w C:\tp55.zip
2008-09-12 19:05 --------- d-----w C:\Program Files\AskPBar
2008-09-12 10:27 --------- d-----w C:\Program Files\Winamp
2008-09-12 10:26 --------- d-----w C:\Documents and Settings\Dejan\Application Data\Winamp
2008-09-04 16:27 --------- d-----w C:\Program Files\uTorrent
2008-09-03 13:32 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-09-01 20:31 --------- d-----w C:\Program Files\FLV to AVI MPEG WMV 3GP MP4 iPod Converter
2008-08-22 13:50 --------- d-----w C:\Program Files\Kali95
2008-08-22 13:43 --------- d-----w C:\Program Files\Wippien
2008-08-22 13:43 --------- d-----w C:\Documents and Settings\Dejan\Application Data\Wippien
2008-08-11 14:07 2,829 ----a-w C:\WINDOWS\War3Unin.pif
2008-08-11 14:07 139,264 ----a-w C:\WINDOWS\War3Unin.exe
2007-06-19 00:47 67,175,974 ----a-w C:\Program Files\PowerDVD 7.3 Ultra Delux.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 1667584]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-07-19 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-07-19 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-07-19 114688]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2008-04-25 201992]
"SigmatelSysTrayApp"="stsystra.exe" [2005-08-24 C:\WINDOWS\stsystra.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.X264"= x264vfw.dll
"VIDC.DVSD"= pdvcodec.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.2.407\\English\\setup.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 32784]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;C:\WINDOWS\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-03-25 24592]
S3 wip0204;Wippien Network Adapter 2.4;C:\WINDOWS\system32\DRIVERS\wip0204.sys [2008-05-21 23480]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{621FCD24-4498-4324-A81E-07D331376EDF}]
C:\Program Files\PixiePack Codec Pack\InstallerHelper.exe
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Dejan\Application Data\Mozilla\Firefox\Profiles\s5iij27s.default\
FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF -: plugin - C:\Program Files\Opera\program\plugins\nppl3260.dll
FF -: plugin - C:\Program Files\Opera\program\plugins\nprpjplug.dll
FF -: plugin - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2008-10-19 14:36:41
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\WLTRYSVC.EXE
C:\WINDOWS\system32\BCMWLTRY.EXE
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\snmp.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-10-19 14:40:20 - machine was rebooted [Dejan]
ComboFix-quarantined-files.txt 2008-10-19 12:40:13
Pre-Run: 16,180,420,608 bytes free
Post-Run: 16,105,275,392 bytes free
143
|