MyCity » Ambulanta -> Arhiva Ambulante » brzina konekcije

brzina konekcije

Napisano na dan: 11.4.2008
1

brzina konekcije
Sledeća strana Pagination

Idi na vrh

Poslao: 11 Apr 2008 19:45
Idi na vrh
offline
  • Pridružio: 30 Jan 2008
  • Poruke: 113

Pre par dana sam promenio AV,i od tada mi je racunar izgubio na konekciji.
Tacnije,nekada moram cekati i do dva minuta da bih otvorio internet.

Logfile of HijackThis v1.99.1
Scan saved at 19:32:44, on 11.04.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Servis (Mare)\Clock (tclock2)\tclock2.exe
C:\DOKUME~1\As\LOKALE~1\Temp\{B4B7DA37-2DD5-4453-8FAC-A0B666002C3E}\VistaPerfectionStartButton.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Dokumente und Einstellungen\As\Desktop\HT\HT.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
F2 - REG:system.ini: Shell=
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: CDNSCacheObj Object - {376892AE-1825-4E5F-9F85-23F9640051CC} - C:\WINDOWS\Trntfiltr.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [AzMixerSel] C:\Programme\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Programme\Brother\Brmfl05a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Programme\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: TClock2.lnk = C:\Programme\Servis (Mare)\Clock (tclock2)\tclock2.exe
O4 - Startup: VistaPerfectionStartButton.lnk = C:\VTPFiles\VistaPerfectionStartButton.exe
O4 - Global Startup: Adobe Acrobat - Schnellstart.lnk = ?
O4 - Global Startup: Status Monitor.lnk = C:\Programme\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - [Link mogu videti samo ulogovani korisnici]\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - [Link mogu videti samo ulogovani korisnici]\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - [Link mogu videti samo ulogovani korisnici]\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - [Link mogu videti samo ulogovani korisnici]\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: In Adobe PDF konvertieren - [Link mogu videti samo ulogovani korisnici]\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - [Link mogu videti samo ulogovani korisnici]\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - [Link mogu videti samo ulogovani korisnici]\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - [Link mogu videti samo ulogovani korisnici]\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: [TABS] Tabbed Browsing
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - [Link mogu videti samo ulogovani korisnici]
O16 - DPF: {D1548A26-B8F6-4E86-AE74-E7062CCC2E2A} (igLoader Content on Demand) - [Link mogu videti samo ulogovani korisnici]
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - [Link mogu videti samo ulogovani korisnici]
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIXŽ - C:\Programme\MAGIX\Common\Database\bin\fbserver.exe



Poslao: 11 Apr 2008 19:50
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8652
  • Gde živiš: Novi Beograd

Skini ComboFix sa jedne od sledecih adresa na Desktop:
[Link mogu videti samo ulogovani korisnici]

Startuj ga i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu. Kada zavrsi pojavice se log (C:\ComboFix.txt) koji ces nam ovde iskopirati.



Poslao: 11 Apr 2008 20:00
Idi na vrh
offline
  • Pridružio: 30 Jan 2008
  • Poruke: 113

ComboFix 08-04-11.1 - As 2008-04-11 19:53:39.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.49.1031.18.190 [GMT 2:00]
ausgeführt von:: C:\Dokumente und Einstellungen\As\Desktop\ComboFix.exe
* Neuer Wiederherstellungspunkt wurde erstellt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Dokumente und Einstellungen\As\Lokale Einstellungen\Temporary Internet Files\mxfilerelatedcache.mxc2
C:\WINDOWS\system\system.ini

.
((((((((((((((((((((((( Dateien erstellt von 2008-03-11 bis 2008-04-11 ))))))))))))))))))))))))))))))
.

2008-04-04 22:10 . 2008-04-11 19:26 <DIR> d-------- C:\Programme\DC++
2008-04-04 22:08 . 2008-04-04 22:08 <DIR> d-------- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\AdobeUM
2008-03-30 10:45 . 2008-04-06 17:55 116 --a------ C:\WINDOWS\NeroDigital.ini
2008-03-30 09:34 . 2008-03-30 09:34 <DIR> d-------- C:\Dokumente und Einstellungen\As\Anwendungsdaten\CyberLink
2008-03-30 00:23 . 2008-03-30 00:23 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Adobe Systems
2008-03-30 00:22 . 2008-03-30 00:22 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Adobe Systems Shared
2008-03-30 00:11 . 2008-03-30 00:11 <DIR> d-------- C:\Dokumente und Einstellungen\As\Anwendungsdaten\AdobeUM
2008-03-29 23:48 . 2008-03-29 23:48 <DIR> d-------- C:\Dokumente und Einstellungen\As\Anwendungsdaten\Pegasys Inc
2008-03-29 23:47 . 2008-03-29 23:47 <DIR> d-------- C:\Programme\Pegasys Inc
2008-03-29 23:47 . 2008-03-29 23:47 <DIR> d-------- C:\Programme\CyberLink
2008-03-29 23:47 . 2008-03-29 23:47 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CyberLink
2008-03-29 23:45 . 2008-03-30 19:36 <DIR> d-------- C:\Programme\Nero
2008-03-29 23:45 . 2008-03-29 23:45 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Ahead
2008-03-29 23:44 . 2008-03-29 23:44 <DIR> d-------- C:\Programme\DVD Shrink DE
2008-03-29 23:44 . 2008-03-29 23:44 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DVD Shrink
2008-03-29 23:43 . 2008-03-29 23:43 <DIR> d-------- C:\Programme\Audiograbber
2008-03-29 23:29 . 2008-03-30 02:33 <DIR> d-------- C:\Programme\Winamp
2008-03-29 23:29 . 2008-03-29 23:30 <DIR> d-------- C:\Dokumente und Einstellungen\As\Anwendungsdaten\Winamp
2008-03-29 23:15 . 2008-03-30 02:32 <DIR> d-------- C:\Programme\Elantech
2008-03-29 23:15 . 2006-03-17 17:03 27,904 -ra------ C:\WINDOWS\system32\drivers\Ktp.sys
2008-03-29 22:45 . 2008-03-29 22:45 <DIR> d-------- C:\Programme\Gemeinsame Dateien\xing shared
2008-03-29 22:30 . 2008-03-29 22:30 <DIR> d-------- C:\Programme\Avira
2008-03-29 22:30 . 2008-03-29 22:30 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
2008-03-29 21:52 . 2008-04-03 22:54 <DIR> d-------- C:\Programme\XoftSpySE
2008-03-29 21:51 . 2008-03-29 21:51 <DIR> d-------- C:\Programme\TuneUp Utilities 2007
2008-03-29 21:51 . 2008-03-29 21:51 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2008-03-29 21:51 . 2008-03-29 21:51 <DIR> d-------- C:\Dokumente und Einstellungen\As\Anwendungsdaten\TuneUp Software
2008-03-29 21:51 . 2008-03-29 21:51 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
2008-03-29 21:51 . 2007-03-28 20:42 29,704 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-03-26 21:55 . 2008-03-26 21:55 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ESET
2008-03-26 19:32 . 2008-03-26 20:54 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Symantec Shared
2008-03-19 21:04 . 2008-03-19 21:04 244 --ah----- C:\sqmnoopt07.sqm
2008-03-19 21:04 . 2008-03-19 21:04 232 --ah----- C:\sqmdata07.sqm
2008-03-19 11:25 . 2008-03-19 11:25 244 --ah----- C:\sqmnoopt06.sqm
2008-03-19 11:25 . 2008-03-19 11:25 232 --ah----- C:\sqmdata06.sqm
2008-03-19 09:09 . 2008-03-19 09:09 244 --ah----- C:\sqmnoopt05.sqm
2008-03-19 09:09 . 2008-03-19 09:09 232 --ah----- C:\sqmdata05.sqm
2008-03-17 22:36 . 2008-03-17 22:36 244 --ah----- C:\sqmnoopt04.sqm
2008-03-17 22:36 . 2008-03-17 22:36 232 --ah----- C:\sqmdata04.sqm
2008-03-17 22:32 . 2008-03-17 22:32 244 --ah----- C:\sqmnoopt03.sqm
2008-03-17 22:32 . 2008-03-17 22:32 232 --ah----- C:\sqmdata03.sqm
2008-03-15 20:49 . 2008-03-30 19:23 58 --a------ C:\WINDOWS\cdplayer.ini
2008-03-15 00:28 . 2008-03-15 00:28 <DIR> d-------- C:\Dokumente und Einstellungen\As\New Folder
2008-03-15 00:05 . 2007-06-30 16:04 17,976,688 --a------ C:\Programme\Install_Messenger.exe
2008-03-14 22:49 . 2008-03-14 22:49 <DIR> d-------- C:\Programme\CDBurnerXP Pro 3
2008-03-14 22:38 . 2008-03-14 22:38 5,632 --ahs---- C:\WINDOWS\Thumbs.db
2008-03-14 22:07 . 2008-03-30 00:27 <DIR> d-------- C:\Dokumente und Einstellungen\As\Anwendungsdaten\Ahead
2008-03-14 20:51 . 2008-03-30 02:32 <DIR> d-------- C:\Programme\LimeWire
2008-03-14 12:29 . 2008-03-14 12:29 <DIR> d-------- C:\Programme\Brother
2008-03-14 12:29 . 2004-12-03 02:26 188,416 --------- C:\WINDOWS\system32\PDRVINST.DLL
2008-03-14 12:29 . 2002-10-31 02:09 81,920 --------- C:\WINDOWS\system32\BrWebIns.dll
2008-03-14 12:29 . 2003-07-03 02:08 65,536 --------- C:\WINDOWS\system32\BRWEBUP.EXE
2008-03-14 12:29 . 2001-11-15 02:00 6,224 --------- C:\WINDOWS\CVRPAGE.bmp
2008-03-14 12:24 . 2008-03-14 12:35 <DIR> d-------- C:\Programme\SetupDCP115C
2008-03-11 12:43 . 2008-03-11 12:43 <DIR> d--h----- C:\WINDOWS\PIF

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-11 15:59 --------- d-----w C:\Dokumente und Einstellungen\As\Anwendungsdaten\LimeWire
2008-03-29 22:21 --------- d-----w C:\Programme\Gemeinsame Dateien\Adobe
2008-03-29 21:47 --------- d--h--w C:\Programme\InstallShield Installation Information
2008-03-29 20:45 --------- d-----w C:\Programme\Gemeinsame Dateien\Real
2008-03-14 10:29 --------- d-----w C:\Programme\Gemeinsame Dateien\InstallShield
2008-03-12 09:51 34,520 ----a-w C:\Dokumente und Einstellungen\As\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2008-03-09 10:04 54,052 ----a-w C:\Programme\subtitler-2_4.zip
2008-03-09 09:22 1,663,746 ----a-w C:\Programme\VirtualDubMod_1_5_10_2_All_inclusive.zip
2008-03-05 23:29 --------- d-----w C:\Programme\URUSoft
2008-03-05 23:28 1,087,682 ----a-w C:\Programme\subtitleworkshop251.zip
2008-03-01 08:19 --------- d-----w C:\Programme\Gabest
2008-02-25 11:35 --------- d-----w C:\Dokumente und Einstellungen\As\Anwendungsdaten\BearShare
2008-02-25 10:16 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-02-25 09:22 --------- d-----w C:\Programme\Common Files
2008-02-24 22:06 70,144 ----a-w C:\WINDOWS\system32\dllcache\notepad.exe
2008-02-24 22:06 70,144 ----a-w C:\WINDOWS\NOTEPAD.EXE
2008-02-24 21:49 --------- d-----w C:\Programme\microsoft frontpage
2008-02-21 15:34 --------- d-----w C:\Programme\MAGIX
2008-02-21 14:53 --------- d-----w C:\Programme\Gemeinsame Dateien\MAGIX
2008-02-21 13:39 --------- d-----w C:\Programme\Gemeinsame Dateien\Hypnotizer
2008-02-18 10:47 --------- d-----w C:\Programme\Windows Media Connect 2
2008-01-26 14:50 81,920 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2008-01-24 22:57 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-01-24 22:57 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-01-14 21:11 16 ---ha-w C:\Programme\Gemeinsame Dateien\mxfilerelatedcache.mxc2
2007-08-22 18:24 16 ---ha-w C:\Programme\mxfilerelatedcache.mxc2
2007-06-26 14:10 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
2007-06-26 14:10 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\index.dat
2007-06-26 14:10 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Verlauf\History.IE5\index.dat
2007-06-26 14:10 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Verlauf\History.IE5\MSHist012007062620070627\index.dat
.

------- Sigcheck -------

2006-12-13 12:35 578560 3751d7cf0e0a113d84414992146bce6a C:\WINDOWS\system32\user32.dll

2006-12-13 12:39 818688 92995334f993e6e49c25c6d02ec04401 C:\WINDOWS\system32\wininet.dll

2006-12-13 12:39 360576 bd8686216e34e22c4ed45a2320b2bea1 C:\WINDOWS\system32\drivers\tcpip.sys

2006-12-13 12:48 2059136 bdff8ffa77ee7df9758ef8c1e0da8eff C:\WINDOWS\system32\ntkrnlpa.exe
2006-12-13 12:48 2059136 bdff8ffa77ee7df9758ef8c1e0da8eff C:\WINDOWS\system32\VITrans\ntkrnlpa.exe

2006-12-13 12:35 2181632 7189a2391adc1f65c9ae87b0abe0f945 C:\WINDOWS\system32\ntoskrnl.exe
2006-12-13 12:35 2181632 7189a2391adc1f65c9ae87b0abe0f945 C:\WINDOWS\system32\VITrans\ntoskrnl.exe

2004-08-04 01:57 1425920 d1af72fc219fa4e43319bd4e3c821771 C:\WINDOWS\explorer.exe
2004-08-04 01:57 1035264 22fe1be02eadde1632e478e4125639e0 C:\WINDOWS\system32\VITrans\explorer.exe
.
(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{376892AE-1825-4E5F-9F85-23F9640051CC}]
2007-11-07 16:38 130048 --a------ C:\WINDOWS\Trntfiltr.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:57 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AzMixerSel"="C:\Programme\Realtek\InstallShield\AzMixerSel.exe" [2006-04-15 13:35 53248]
"ATICCC"="C:\Programme\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41 45056]
"SynTPEnh"="C:\Programme\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 13:07 761946]
"SetDefPrt"="C:\Programme\Brother\Brmfl05a\BrStDvPt.exe" [2005-01-26 19:02 49152]
"ControlCenter2.0"="C:\Programme\Brother\ControlCenter2\brctrcen.exe" [2005-05-17 18:42 933888]
"avgnt"="C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-03-29 22:32 249896]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]

C:\Dokumente und Einstellungen\As\Startmen\Programme\Autostart\
TClock2.lnk - C:\Programme\Servis (Mare)\Clock (tclock2)\tclock2.exe [2007-06-26 22:20:20 90624]
VistaPerfectionStartButton.lnk - C:\VTPFiles\VistaPerfectionStartButton.exe [2007-06-28 15:23:54 393216]

C:\Dokumente und Einstellungen\All Users\Startmen\Programme\Autostart\
Adobe Acrobat - Schnellstart.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000002}\SC_Acrobat.exe [2008-03-30 00:22:00 25214]
Status Monitor.lnk - C:\Programme\Brother\Brmfcmon\BrMfcWnd.exe [2008-03-14 12:29:23 802816]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"WMPNSCFG"=C:\Programme\Windows Media Player\WMPNSCFG.exe
"SpybotSD TeaTimer"=C:\Programme\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SkyTel"=SkyTel.EXE
"SunJavaUpdateSched"="C:\Programme\Java\jre1.6.0_01\bin\jusched.exe"
"TkBellExe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
"VisualTooltip"=C:\Programme\VisualTooltip\VisualToolTip.exe
"RemoteControl"=C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
"KTPWare"=C:\Programme\Elantech\ktp.exe
"Acrobat Assistant 7.0"="C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programme\\LimeWire\\LimeWire.exe"=
"C:\\Programme\\DC++\\DCPlusPlus.exe"=
"C:\\Programme\\BearShare Applications\\BearShare\\BearShare.exe"=
"C:\\Programme\\MSN Messenger\\msnmsgr.exe"=
"C:\\Programme\\MSN Messenger\\livecall.exe"=

R2 UxTuneUp;TuneUp Designerweiterung;C:\WINDOWS\System32\svchost.exe [2004-08-04 01:58]
R3 Ktp;Elantech Touchpad;C:\WINDOWS\system32\DRIVERS\Ktp.sys [2006-03-17 17:03]
S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys [2004-10-15 12:50]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;C:\Programme\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 15:18]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

*Newly Created Service* - CATCHME
.
Inhalt des "geplante Tasks" Ordners
"2008-03-29 19:52:04 C:\WINDOWS\Tasks\1-Klick-Wartung.job"
- C:\Programme\TuneUp Utilities 2007\SystemOptimizer.exe
"2008-03-29 19:52:53 C:\WINDOWS\Tasks\XoftSpySE.job"
- C:\Programme\XoftSpySE\XoftSpy.exe
.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2008-04-11 19:55:21
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
Zeit der Fertigstellung: 2008-04-11 19:55:53
ComboFix-quarantined-files.txt 2008-04-11 17:55:33
10 Verzeichnis(se), 37,089,161,216 Bytes frei
13 Verzeichnis(se), 37,079,859,200 Bytes frei

Poslao: 11 Apr 2008 20:18
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8652
  • Gde živiš: Novi Beograd

Jel ovo laptop?

Poslao: 11 Apr 2008 20:27
Idi na vrh
offline
  • Pridružio: 30 Jan 2008
  • Poruke: 113

Da,ovo je laptop

Poslao: 11 Apr 2008 23:06
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8652
  • Gde živiš: Novi Beograd

Otvoriti Notepad i iskopirati sledeci tekst:

File::
C:\WINDOWS\Trntfiltr.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{376892AE-1825-4E5F-9F85-23F9640051CC}]


Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

Poslao: 12 Apr 2008 22:24
Idi na vrh
offline
  • Pridružio: 30 Jan 2008
  • Poruke: 113

ComboFix 08-04-11.1 - As 2008-04-12 22:19:03.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.49.1031.18.118 [GMT 2:00]
ausgeführt von:: C:\Dokumente und Einstellungen\As\Desktop\ComboFix.exe
Command switches used :: C:\Dokumente und Einstellungen\As\Desktop\CFScript.txt
* Neuer Wiederherstellungspunkt wurde erstellt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\Trntfiltr.dll
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\Trntfiltr.dll

.
((((((((((((((((((((((( Dateien erstellt von 2008-03-12 bis 2008-04-12 ))))))))))))))))))))))))))))))
.

2008-04-11 21:11 . 2008-04-11 21:11 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Nullsoft
2008-04-04 22:10 . 2008-04-12 07:42 <DIR> d-------- C:\Programme\DC++
2008-04-04 22:08 . 2008-04-04 22:08 <DIR> d-------- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\AdobeUM
2008-03-30 10:45 . 2008-04-11 21:23 116 --a------ C:\WINDOWS\NeroDigital.ini
2008-03-30 09:34 . 2008-03-30 09:34 <DIR> d-------- C:\Dokumente und Einstellungen\As\Anwendungsdaten\CyberLink
2008-03-30 00:23 . 2008-03-30 00:23 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Adobe Systems
2008-03-30 00:22 . 2008-03-30 00:22 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Adobe Systems Shared
2008-03-30 00:11 . 2008-03-30 00:11 <DIR> d-------- C:\Dokumente und Einstellungen\As\Anwendungsdaten\AdobeUM
2008-03-29 23:48 . 2008-03-29 23:48 <DIR> d-------- C:\Dokumente und Einstellungen\As\Anwendungsdaten\Pegasys Inc
2008-03-29 23:47 . 2008-03-29 23:47 <DIR> d-------- C:\Programme\Pegasys Inc
2008-03-29 23:47 . 2008-03-29 23:47 <DIR> d-------- C:\Programme\CyberLink
2008-03-29 23:47 . 2008-03-29 23:47 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CyberLink
2008-03-29 23:45 . 2008-03-30 19:36 <DIR> d-------- C:\Programme\Nero
2008-03-29 23:45 . 2008-03-29 23:45 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Ahead
2008-03-29 23:44 . 2008-03-29 23:44 <DIR> d-------- C:\Programme\DVD Shrink DE
2008-03-29 23:44 . 2008-03-29 23:44 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DVD Shrink
2008-03-29 23:43 . 2008-03-29 23:43 <DIR> d-------- C:\Programme\Audiograbber
2008-03-29 23:29 . 2008-03-30 02:33 <DIR> d-------- C:\Programme\Winamp
2008-03-29 23:29 . 2008-03-29 23:30 <DIR> d-------- C:\Dokumente und Einstellungen\As\Anwendungsdaten\Winamp
2008-03-29 23:15 . 2008-03-30 02:32 <DIR> d-------- C:\Programme\Elantech
2008-03-29 23:15 . 2006-03-17 17:03 27,904 -ra------ C:\WINDOWS\system32\drivers\Ktp.sys
2008-03-29 22:45 . 2008-03-29 22:45 <DIR> d-------- C:\Programme\Gemeinsame Dateien\xing shared
2008-03-29 22:30 . 2008-03-29 22:30 <DIR> d-------- C:\Programme\Avira
2008-03-29 22:30 . 2008-03-29 22:30 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
2008-03-29 21:52 . 2008-04-03 22:54 <DIR> d-------- C:\Programme\XoftSpySE
2008-03-29 21:51 . 2008-03-29 21:51 <DIR> d-------- C:\Programme\TuneUp Utilities 2007
2008-03-29 21:51 . 2008-03-29 21:51 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2008-03-29 21:51 . 2008-03-29 21:51 <DIR> d-------- C:\Dokumente und Einstellungen\As\Anwendungsdaten\TuneUp Software
2008-03-29 21:51 . 2008-03-29 21:51 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
2008-03-29 21:51 . 2007-03-28 20:42 29,704 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-03-26 21:55 . 2008-03-26 21:55 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ESET
2008-03-26 19:32 . 2008-03-26 20:54 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Symantec Shared
2008-03-19 21:04 . 2008-03-19 21:04 244 --ah----- C:\sqmnoopt07.sqm
2008-03-19 21:04 . 2008-03-19 21:04 232 --ah----- C:\sqmdata07.sqm
2008-03-19 11:25 . 2008-03-19 11:25 244 --ah----- C:\sqmnoopt06.sqm
2008-03-19 11:25 . 2008-03-19 11:25 232 --ah----- C:\sqmdata06.sqm
2008-03-19 09:09 . 2008-03-19 09:09 244 --ah----- C:\sqmnoopt05.sqm
2008-03-19 09:09 . 2008-03-19 09:09 232 --ah----- C:\sqmdata05.sqm
2008-03-17 22:36 . 2008-03-17 22:36 244 --ah----- C:\sqmnoopt04.sqm
2008-03-17 22:36 . 2008-03-17 22:36 232 --ah----- C:\sqmdata04.sqm
2008-03-17 22:32 . 2008-03-17 22:32 244 --ah----- C:\sqmnoopt03.sqm
2008-03-17 22:32 . 2008-03-17 22:32 232 --ah----- C:\sqmdata03.sqm
2008-03-15 20:49 . 2008-03-30 19:23 58 --a------ C:\WINDOWS\cdplayer.ini
2008-03-15 00:28 . 2008-03-15 00:28 <DIR> d-------- C:\Dokumente und Einstellungen\As\New Folder
2008-03-15 00:05 . 2007-06-30 16:04 17,976,688 --a------ C:\Programme\Install_Messenger.exe
2008-03-14 22:49 . 2008-03-14 22:49 <DIR> d-------- C:\Programme\CDBurnerXP Pro 3
2008-03-14 22:38 . 2008-03-14 22:38 5,632 --ahs---- C:\WINDOWS\Thumbs.db
2008-03-14 22:07 . 2008-03-30 00:27 <DIR> d-------- C:\Dokumente und Einstellungen\As\Anwendungsdaten\Ahead
2008-03-14 20:51 . 2008-03-30 02:32 <DIR> d-------- C:\Programme\LimeWire
2008-03-14 12:29 . 2008-03-14 12:29 <DIR> d-------- C:\Programme\Brother
2008-03-14 12:29 . 2004-12-03 02:26 188,416 --------- C:\WINDOWS\system32\PDRVINST.DLL
2008-03-14 12:29 . 2002-10-31 02:09 81,920 --------- C:\WINDOWS\system32\BrWebIns.dll
2008-03-14 12:29 . 2003-07-03 02:08 65,536 --------- C:\WINDOWS\system32\BRWEBUP.EXE
2008-03-14 12:29 . 2001-11-15 02:00 6,224 --------- C:\WINDOWS\CVRPAGE.bmp
2008-03-14 12:24 . 2008-03-14 12:35 <DIR> d-------- C:\Programme\SetupDCP115C

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-12 05:40 --------- d-----w C:\Dokumente und Einstellungen\As\Anwendungsdaten\LimeWire
2008-03-29 22:21 --------- d-----w C:\Programme\Gemeinsame Dateien\Adobe
2008-03-29 21:47 --------- d--h--w C:\Programme\InstallShield Installation Information
2008-03-29 20:45 --------- d-----w C:\Programme\Gemeinsame Dateien\Real
2008-03-14 10:29 --------- d-----w C:\Programme\Gemeinsame Dateien\InstallShield
2008-03-12 09:51 34,520 ----a-w C:\Dokumente und Einstellungen\As\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2008-03-09 10:04 54,052 ----a-w C:\Programme\subtitler-2_4.zip
2008-03-09 09:22 1,663,746 ----a-w C:\Programme\VirtualDubMod_1_5_10_2_All_inclusive.zip
2008-03-05 23:29 --------- d-----w C:\Programme\URUSoft
2008-03-05 23:28 1,087,682 ----a-w C:\Programme\subtitleworkshop251.zip
2008-03-01 08:19 --------- d-----w C:\Programme\Gabest
2008-02-25 11:35 --------- d-----w C:\Dokumente und Einstellungen\As\Anwendungsdaten\BearShare
2008-02-25 10:16 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-02-25 09:22 --------- d-----w C:\Programme\Common Files
2008-02-24 22:06 70,144 ----a-w C:\WINDOWS\system32\dllcache\notepad.exe
2008-02-24 22:06 70,144 ----a-w C:\WINDOWS\NOTEPAD.EXE
2008-02-24 21:49 --------- d-----w C:\Programme\microsoft frontpage
2008-02-21 15:34 --------- d-----w C:\Programme\MAGIX
2008-02-21 14:53 --------- d-----w C:\Programme\Gemeinsame Dateien\MAGIX
2008-02-21 13:39 --------- d-----w C:\Programme\Gemeinsame Dateien\Hypnotizer
2008-02-18 10:47 --------- d-----w C:\Programme\Windows Media Connect 2
2008-01-26 14:50 81,920 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2008-01-24 22:57 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-01-24 22:57 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-01-14 21:11 16 ---ha-w C:\Programme\Gemeinsame Dateien\mxfilerelatedcache.mxc2
2007-08-22 18:24 16 ---ha-w C:\Programme\mxfilerelatedcache.mxc2
2007-06-26 14:10 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
2007-06-26 14:10 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\index.dat
2007-06-26 14:10 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Verlauf\History.IE5\index.dat
2007-06-26 14:10 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Verlauf\History.IE5\MSHist012007062620070627\index.dat
.

------- Sigcheck -------

2006-12-13 12:35 578560 3751d7cf0e0a113d84414992146bce6a C:\WINDOWS\system32\user32.dll

2006-12-13 12:39 818688 92995334f993e6e49c25c6d02ec04401 C:\WINDOWS\system32\wininet.dll

2006-12-13 12:39 360576 bd8686216e34e22c4ed45a2320b2bea1 C:\WINDOWS\system32\drivers\tcpip.sys

2006-12-13 12:48 2059136 bdff8ffa77ee7df9758ef8c1e0da8eff C:\WINDOWS\system32\ntkrnlpa.exe
2006-12-13 12:48 2059136 bdff8ffa77ee7df9758ef8c1e0da8eff C:\WINDOWS\system32\VITrans\ntkrnlpa.exe

2006-12-13 12:35 2181632 7189a2391adc1f65c9ae87b0abe0f945 C:\WINDOWS\system32\ntoskrnl.exe
2006-12-13 12:35 2181632 7189a2391adc1f65c9ae87b0abe0f945 C:\WINDOWS\system32\VITrans\ntoskrnl.exe

2004-08-04 01:57 1425920 d1af72fc219fa4e43319bd4e3c821771 C:\WINDOWS\explorer.exe
2004-08-04 01:57 1035264 22fe1be02eadde1632e478e4125639e0 C:\WINDOWS\system32\VITrans\explorer.exe
.
((((((((((((((((((((((((((((( [Link mogu videti samo ulogovani korisnici],34 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-11 17:53:48 71,492 ----a-w C:\WINDOWS\system32\perfc007.dat
+ 2008-04-12 20:19:10 71,492 ----a-w C:\WINDOWS\system32\perfc007.dat
- 2008-04-11 17:53:48 59,380 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-04-12 20:19:10 59,380 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-04-11 17:53:48 406,614 ----a-w C:\WINDOWS\system32\perfh007.dat
+ 2008-04-12 20:19:10 406,614 ----a-w C:\WINDOWS\system32\perfh007.dat
- 2008-04-11 17:53:48 393,272 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-04-12 20:19:11 393,272 ----a-w C:\WINDOWS\system32\perfh009.dat
.
(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:57 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AzMixerSel"="C:\Programme\Realtek\InstallShield\AzMixerSel.exe" [2006-04-15 13:35 53248]
"ATICCC"="C:\Programme\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41 45056]
"SynTPEnh"="C:\Programme\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 13:07 761946]
"SetDefPrt"="C:\Programme\Brother\Brmfl05a\BrStDvPt.exe" [2005-01-26 19:02 49152]
"ControlCenter2.0"="C:\Programme\Brother\ControlCenter2\brctrcen.exe" [2005-05-17 18:42 933888]
"avgnt"="C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-03-29 22:32 249896]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]

C:\Dokumente und Einstellungen\As\Startmen\Programme\Autostart\
TClock2.lnk - C:\Programme\Servis (Mare)\Clock (tclock2)\tclock2.exe [2007-06-26 22:20:20 90624]
VistaPerfectionStartButton.lnk - C:\VTPFiles\VistaPerfectionStartButton.exe [2007-06-28 15:23:54 393216]

C:\Dokumente und Einstellungen\All Users\Startmen\Programme\Autostart\
Adobe Acrobat - Schnellstart.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000002}\SC_Acrobat.exe [2008-03-30 00:22:00 25214]
Status Monitor.lnk - C:\Programme\Brother\Brmfcmon\BrMfcWnd.exe [2008-03-14 12:29:23 802816]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"WMPNSCFG"=C:\Programme\Windows Media Player\WMPNSCFG.exe
"SpybotSD TeaTimer"=C:\Programme\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SkyTel"=SkyTel.EXE
"SunJavaUpdateSched"="C:\Programme\Java\jre1.6.0_01\bin\jusched.exe"
"TkBellExe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
"VisualTooltip"=C:\Programme\VisualTooltip\VisualToolTip.exe
"RemoteControl"=C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
"KTPWare"=C:\Programme\Elantech\ktp.exe
"Acrobat Assistant 7.0"="C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programme\\LimeWire\\LimeWire.exe"=
"C:\\Programme\\DC++\\DCPlusPlus.exe"=
"C:\\Programme\\BearShare Applications\\BearShare\\BearShare.exe"=
"C:\\Programme\\MSN Messenger\\msnmsgr.exe"=
"C:\\Programme\\MSN Messenger\\livecall.exe"=

R2 UxTuneUp;TuneUp Designerweiterung;C:\WINDOWS\System32\svchost.exe [2004-08-04 01:58]
R3 Ktp;Elantech Touchpad;C:\WINDOWS\system32\DRIVERS\Ktp.sys [2006-03-17 17:03]
S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys [2004-10-15 12:50]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;C:\Programme\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 15:18]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Inhalt des "geplante Tasks" Ordners
"2008-03-29 19:52:04 C:\WINDOWS\Tasks\1-Klick-Wartung.job"
- C:\Programme\TuneUp Utilities 2007\SystemOptimizer.exe
"2008-03-29 19:52:53 C:\WINDOWS\Tasks\XoftSpySE.job"
- C:\Programme\XoftSpySE\XoftSpy.exe
.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2008-04-12 22:20:32
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
Zeit der Fertigstellung: 2008-04-12 22:21:03
ComboFix-quarantined-files.txt 2008-04-12 20:20:44
10 Verzeichnis(se), 37,311,090,688 Bytes frei
13 Verzeichnis(se), 37,298,479,104 Bytes frei

Poslao: 12 Apr 2008 22:46
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8652
  • Gde živiš: Novi Beograd

Skeniraj ponovo sa HJT-om i postavi mi log.

Poslao: 13 Apr 2008 18:35
Idi na vrh
offline
  • Pridružio: 30 Jan 2008
  • Poruke: 113

Logfile of HijackThis v1.99.1
Scan saved at 18:31:33, on 13.04.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Servis (Mare)\Clock (tclock2)\tclock2.exe
C:\DOKUME~1\As\LOKALE~1\Temp\{A8E9AEDE-5021-46FE-9431-3A83619802AF}\VistaPerfectionStartButton.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\internet explorer\iexplore.exe
C:\Dokumente und Einstellungen\As\Desktop\HT\HT.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [AzMixerSel] C:\Programme\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Programme\Brother\Brmfl05a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Programme\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: TClock2.lnk = C:\Programme\Servis (Mare)\Clock (tclock2)\tclock2.exe
O4 - Startup: VistaPerfectionStartButton.lnk = C:\VTPFiles\VistaPerfectionStartButton.exe
O4 - Global Startup: Adobe Acrobat - Schnellstart.lnk = ?
O4 - Global Startup: Status Monitor.lnk = C:\Programme\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - [Link mogu videti samo ulogovani korisnici]\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - [Link mogu videti samo ulogovani korisnici]\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - [Link mogu videti samo ulogovani korisnici]\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - [Link mogu videti samo ulogovani korisnici]\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: In Adobe PDF konvertieren - [Link mogu videti samo ulogovani korisnici]\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - [Link mogu videti samo ulogovani korisnici]\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - [Link mogu videti samo ulogovani korisnici]\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - [Link mogu videti samo ulogovani korisnici]\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: [TABS] Tabbed Browsing
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - [Link mogu videti samo ulogovani korisnici]
O16 - DPF: {D1548A26-B8F6-4E86-AE74-E7062CCC2E2A} (igLoader Content on Demand) - [Link mogu videti samo ulogovani korisnici]
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - [Link mogu videti samo ulogovani korisnici]
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - [Link mogu videti samo ulogovani korisnici]
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIXŽ - C:\Programme\MAGIX\Common\Database\bin\fbserver.exe

Iskreno se izvinjavam sto ne odgovaram u adekvatnom vremenu,ali malo sam u skripcu sa vremenom,pa sam rastrzan na par strana

Poslao: 13 Apr 2008 18:39
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8652
  • Gde živiš: Novi Beograd

I ja sam u skripcu pa ces malo sacekati dalja uputstva. Neutral

MyCity » Ambulanta -> Arhiva Ambulante » brzina konekcije

Ko je trenutno na forumu
 

Ukupno su 1413 korisnika na forumu :: 324 registrovanih, 20 sakrivenih i 1069 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 15694 - dana 01 Feb 2026 12:23

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: -Max-, 04bokibole, 100jan, 357magnum, 9191vs, Agape, akaherz994, aleksamaki, Aleksandar Šljivar, Aleksandar1991, AleksandarV, aleph_one, ambra, Apok, Aristotle2002, ArmFPGA, Arsenije, AS, Asparagus, Aster Blistok, Automaticar, Avalon015, BAKI89, Banovo Brdo, Battlehammer, BB, Betta, BlackGeorge1804, bobo85, Bobrock1, Bodin86, bog sunca, bojan1234, Bojke549, Bombona, Boris90, Boroš, BORUTUS, Borx, BOXRR, brkan1, Bubimir, bufanje, Butcher, Bvp, ccoogg123, celeron, Chainsaw, CikaKURE, CLIPPER, cole77, Crazzer, cuvarkuca, cvrle312, cyprus, Czrweni, dane007, dankisha, darkkran, Darth Malak, dd11ll, dejan1972, Dekanovic, Dimitrije Paunovic, Dimitrise93, Dinarid, Diplomac, djole01, DjomlaHomer, djordjemiklusev, Djota1, djukapfc, DJUNTA, Djuza, Doc, Dogma21, DovlaODR, dozorni, draganca, drimer, Duk011, dukajov, Dukelander, dusansdjordjevic, Dzigy, Džekson, Electron, ElvisP, entriun, exluppis, Fliper, Fructo, Fulcrum-A, gajca1977, galerija, Gall, GeoM, Gheljda, ginjica, Giro77, Glavni Oružni, GrammaticalAnalysis, Grochow, hajduk1911, Holy Saber, hooraay, HrcAk47, hyla, Ivan Germanovic, ivan1973, ivanhoe31, j-22orao, jarovitt, Jaxupa, Jaz, Jecmendo, jimi_agf, Joint Chief, Jomini, Jozo74, jugoslav.70, Kajzer Soze, Kapetan Hadok, karevski, Kazablankasrb, kibihrchak, Kichma, kikisp, kirucar, Klonfer83, Knovakov, Koridor, korin911, kovacicbozo, kovalski, kozhedub, krasta, krkalon, Krusarac, Kružić, Kubovac, Kukuvaja, kunktator, kybonacci, lacko, ladro, laurusri, Lazur_01, Lelemood, Leonov, leptirleptir, Lester Freamon, Levi, ljuba.b, LostInSpaceandTime, Lubenica303, LUDI, luka35, M1los, Magistar78, Makarid, Malahit, Mane88, MareMarkic, MarijaC84, Markisa, MarkoDzimi, marsi, marsovac 2, MaschinenPistole, Mcdado, medaTT, mercedesamg, mikelija, Miki 84, Miki281, mikki jons, mikrimaus, milan47, milanpb, mile33, Miler88, milijarder, Milo97, milutin134, mir juzni, Mitch22, mixkax, Miškić, Moldovan, moldway, Mrav Obrad, mrgud2025, mrkanidja, mrmjtvc, mux, Mzee, Naj-Turs, nebidrag, nebkv, nelezele, nick79, niki-mini_maki, Nmr, nobutado, Nomica, Novakomp, novator, Obrenovic, Ognjen D., opt1, ozzy, paja69, pein, Pekman, Petrusci, Phaeton, Piani Jazzer, picknick, PMsnow, Podljub, Polifon, Poof, Prašinar, Primus17, Prometeus, Pururin, rachmoff, radoznao, Radula, raster12, razumihin, redstar72, Resnica, RileHerc, Rocky I, Rothmans, royst33, ruma, sabros, Salence74, Samo gledam, samo_citam, samocitam, SamoGledam, samojednoimeznam, saputnik plavetnila, Seeker, Semberija, shaja1, Shajlok, shlauf, Silence, simazr, Sir Budimir, skok, Snorks, Sonic, sova72, spektorsky, Sr.Stat., Srki98, ss10, ssekir75, sspp, stalja, Steeeefan, stefanmpurtic, Stefanzi, stegonosa, Stoorb, Str2022, Su 57, superwhy, synergia, T55, tachinni, Tajpan, tajvankanasta, tamno.nebo, Tandrčak, Tas011, taz1cl, teheran, The_new_Statesman, TheDictator, tomo2, Tomo988, Tribal, trinitrotoluen, trpche, ulogovan, v0idmp3, vathra, Vatreni Zmaj, VBoss, Velizar Laro, vensla, vjetar, vlada13874, Vlada76, voja64, VPV, vrlenija, yiyi, yorov, Zandar, zbazin, Zdenko, Zdilar, Zeka_Peka, ZetaMan, zgoljo, zixmix, Zjmc, Zmaj Tolak, zmajognjeniivan, zokizemun, zoran-ruma, Zrcalo, zubri, Zukov, zule2, 79693