MyCity » Ambulanta -> Arhiva Ambulante » log file - vista

log file - vista

Napisano na dan: 8.12.2008
1

log file - vista
Sledeća strana Pagination

Idi na vrh

Poslao: 08 Dec 2008 18:02
Idi na vrh
offline
  • Pridružio: 16 Avg 2007
  • Poruke: 22

legalna vista, problemi nastaju posle update-a na service pack 1, windows je sam trazio update, ja odobrio.

od tada mu treba jedno 10 minuta da se digne ( stoji na ekranu please wait ) posle toga nastavi normalno... norton antivirus pronasao samo neki low risk cookie, koji sam obrisao.


ovo je log file :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:51:36, on 08/12/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Program Files\DigitalPersona\Bin\DpAgent.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Windows Defender\MSASCui.exe
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Winamp\winampa.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Dj\Desktop\New Folder\tr3.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = ie.redirect.hp.com/svs/rdr?TYPE=3&tp=ie.....;pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [DpAgent] C:\Program Files\DigitalPersona\Bin\dpagent.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [8F5.tmp] C:\Windows\temp\8F5.tmp
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{93F4F16B-E8F1-45F6-8A60-9A8359986C6D}: NameServer = 85.255.112.10;85.255.112.103
O17 - HKLM\System\CCS\Services\Tcpip\..\{A0D1F4C2-DEAF-45CD-B29A-A06B18910E2E}: NameServer = 85.255.112.10;85.255.112.103
O17 - HKLM\System\CCS\Services\Tcpip\..\{A9820405-E885-4B1D-8EE2-2BA8931F5AB0}: NameServer = 85.255.112.10;85.255.112.103
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHostW.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: Windows Tribute Service - Unknown owner - C:\Windows\system32\kdruk.exe

--
End of file - 10763 bytes

Poslao: 08 Dec 2008 20:15
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Pozdrav...



Privremeno isključi sav zaštitni softver a zatim isprati sledeće uputstvo.



Skini ComboFix sa jedne od sledecih adresa na Desktop:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.forospyware.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

Startuj ga i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu. Kada zavrsi pojavice se log (C:\ComboFix.txt) koji ces nam ovde iskopirati.

Poslao: 08 Dec 2008 21:17
Idi na vrh
offline
  • Pridružio: 16 Avg 2007
  • Poruke: 22

evo ga log :

ComboFix 08-12-07.01 - Dj 2008-12-08 20:57:50.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1250.381.1033.18.1790 [GMT 1:00]
Running from: c:\users\Dj\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
c:\program files\Mozilla Firefox\components\iamfamous.dll
C:\resycled
c:\resycled\boot.com
c:\windows\system32\hpgt2436.dll
c:\windows\system32\hpxp2436.dll
c:\windows\system32\KBL.LOG
D:\Autorun.inf
D:\resycled
d:\resycled\boot.com
E:\Autorun.inf
E:\resycled
e:\resycled\boot.com

.
((((((((((((((((((((((((( Files Created from 2008-11-08 to 2008-12-08 )))))))))))))))))))))))))))))))
.

2008-12-07 14:29 . 2008-12-07 14:29 <DIR> d----c--- c:\windows\System32\DRVSTORE
2008-12-07 14:29 . 2008-12-07 14:29 <DIR> d-------- c:\program files\DIFX
2008-12-07 14:28 . 2008-12-07 14:31 <DIR> d-------- C:\UniScan
2008-12-07 14:28 . 2007-01-17 01:19 438,272 --a------ c:\windows\System32\hp2436co.dll
2008-12-06 16:13 . 2008-12-06 16:13 0 --ah----- c:\windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-12-06 14:44 . 2008-12-06 14:44 <DIR> d-------- C:\PerfLogs
2008-12-03 18:42 . 2008-12-03 18:42 <DIR> d-------- c:\users\Dj\AppData\Roaming\AVS4YOU
2008-12-03 18:42 . 2008-12-03 18:42 <DIR> d-------- c:\users\All Users\AVS4YOU
2008-12-03 18:42 . 2008-12-03 18:42 <DIR> d-------- c:\programdata\AVS4YOU
2008-12-03 18:42 . 2008-12-03 18:42 <DIR> d-------- c:\program files\Common Files\AVSMedia
2008-12-03 18:42 . 2008-12-03 18:42 <DIR> d-------- c:\program files\AVS4YOU
2008-12-03 18:42 . 2007-02-27 18:36 1,700,352 --a------ c:\windows\System32\GdiPlus.dll
2008-12-03 18:42 . 2007-02-27 18:36 974,848 --a------ c:\windows\System32\mfc70.dll
2008-12-03 18:42 . 2007-02-27 18:36 487,424 --a------ c:\windows\System32\msvcp70.dll
2008-12-03 18:42 . 2007-02-27 18:36 344,064 --a------ c:\windows\System32\msvcr70.dll
2008-12-03 18:42 . 2007-02-27 18:36 24,576 --a------ c:\windows\System32\msxml3a.dll
2008-12-01 19:54 . 2008-12-03 21:03 <DIR> d-------- c:\users\All Users\FLEXnet
2008-12-01 19:54 . 2008-12-03 21:03 <DIR> d-------- c:\programdata\FLEXnet
2008-12-01 19:48 . 2008-12-01 19:48 <DIR> d-------- c:\program files\Adobe Media Player
2008-12-01 19:45 . 2008-12-01 19:45 <DIR> d-------- c:\program files\Common Files\Adobe AIR
2008-12-01 19:41 . 2008-12-01 19:41 <DIR> d-------- c:\program files\Common Files\Macrovision Shared
2008-12-01 19:38 . 2008-12-01 19:38 29,184 --a------ c:\windows\System32\drivers\ndisprot.sys
2008-11-26 19:57 . 2008-11-26 21:40 <DIR> d-------- c:\users\Dj\AppData\Roaming\Winamp
2008-11-26 19:57 . 2008-11-26 19:58 <DIR> d-------- c:\program files\Winamp
2008-11-26 19:57 . 2007-03-08 00:51 129,784 --------- c:\windows\System32\pxafs.dll
2008-11-26 09:36 . 2008-10-21 06:25 1,645,568 --a------ c:\windows\System32\connect.dll
2008-11-26 09:36 . 2008-08-28 04:40 712,704 --a------ c:\windows\System32\WindowsCodecs.dll
2008-11-26 09:36 . 2008-08-28 04:40 425,472 --a------ c:\windows\System32\PhotoMetadataHandler.dll
2008-11-26 09:36 . 2008-08-28 04:40 347,136 --a------ c:\windows\System32\WindowsCodecsExt.dll
2008-11-26 09:36 . 2008-10-22 04:57 241,152 --a------ c:\windows\System32\PortableDeviceApi.dll
2008-11-26 09:36 . 2008-01-19 08:36 160,768 --a------ c:\windows\System32\PortableDeviceTypes.dll
2008-11-26 09:36 . 2008-01-19 08:36 94,720 --a------ c:\windows\System32\PortableDeviceClassExtension.dll
2008-11-21 17:45 . 2008-10-16 22:13 1,809,944 --a------ c:\windows\System32\wuaueng.dll
2008-11-21 17:45 . 2008-10-16 21:56 1,524,736 --a------ c:\windows\System32\wucltux.dll
2008-11-21 17:45 . 2008-10-16 22:12 561,688 --a------ c:\windows\System32\wuapi.dll
2008-11-21 17:45 . 2008-10-16 14:08 162,064 --a------ c:\windows\System32\wuwebv.dll
2008-11-21 17:45 . 2008-10-16 21:55 83,456 --a------ c:\windows\System32\wudriver.dll
2008-11-21 17:45 . 2008-10-16 22:09 51,224 --a------ c:\windows\System32\wuauclt.exe
2008-11-21 17:45 . 2008-10-16 22:09 43,544 --a------ c:\windows\System32\wups2.dll
2008-11-21 17:45 . 2008-10-16 22:08 34,328 --a------ c:\windows\System32\wups.dll
2008-11-21 17:45 . 2008-10-16 13:56 31,232 --a------ c:\windows\System32\wuapp.exe
2008-11-16 17:46 . 2008-11-16 17:46 <DIR> d-------- c:\users\Dj\AppData\Roaming\Soldat
2008-11-16 17:46 . 2008-11-16 17:46 <DIR> d-------- C:\Soldat
2008-11-16 13:45 . 2008-11-16 13:45 <DIR> d-------- c:\users\Dj\AppData\Roaming\HP
2008-11-16 13:45 . 2008-11-21 17:23 <DIR> d-------- c:\users\Dj\AppData\Roaming\CyberLink
2008-11-16 13:45 . 2008-11-16 13:45 <DIR> d-------- c:\users\All Users\HP
2008-11-16 13:45 . 2008-11-16 13:45 <DIR> d-------- c:\programdata\HP
2008-11-12 10:48 . 2008-08-27 02:05 212,480 --a------ c:\windows\System32\drivers\mrxsmb10.sys
2008-11-12 10:46 . 2008-09-05 06:14 1,191,936 --a------ c:\windows\System32\msxml3.dll
2008-11-12 10:45 . 2008-09-10 04:40 1,334,272 --a------ c:\windows\System32\msxml6.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-08 19:55 --------- d-----w c:\users\Dj\AppData\Roaming\Skype
2008-12-08 18:30 --------- d-----w c:\programdata\Symantec
2008-12-08 17:12 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-12-08 17:00 --------- d-----w c:\users\Dj\AppData\Roaming\skypePM
2008-12-08 16:09 --------- d-----w c:\users\Dj\AppData\Roaming\LimeWire
2008-12-07 17:09 --------- d-----w c:\users\Dj\AppData\Roaming\Azureus
2008-12-07 15:47 27,050 ----a-w c:\users\Dj\AppData\Roaming\nvModes.dat
2008-12-06 13:56 174 --sha-w c:\program files\desktop.ini
2008-12-06 13:46 --------- d-----w c:\program files\Windows Sidebar
2008-12-06 13:46 --------- d-----w c:\program files\Windows Photo Gallery
2008-12-06 13:46 --------- d-----w c:\program files\Windows Mail
2008-12-06 13:46 --------- d-----w c:\program files\Windows Journal
2008-12-06 13:46 --------- d-----w c:\program files\Windows Defender
2008-12-06 13:46 --------- d-----w c:\program files\Windows Collaboration
2008-12-06 13:46 --------- d-----w c:\program files\Windows Calendar
2008-12-06 13:40 --------- d-----w c:\programdata\NVIDIA
2008-12-06 13:27 82,432 ----a-w c:\windows\System32\axaltocm.dll
2008-12-06 13:27 101,888 ----a-w c:\windows\System32\ifxcardm.dll
2008-12-01 18:49 --------- d-----w c:\program files\Common Files\Adobe
2008-11-12 18:49 --------- d-----w c:\program files\DivX
2008-11-12 18:46 --------- d-----w c:\program files\Common Files\PX Storage Engine
2008-11-09 15:33 270 ----a-w c:\users\Dj\AppData\Roaming\wklnhst.dat
2008-11-06 10:45 --------- d-----w c:\users\Dj\AppData\Roaming\Template
2008-11-01 17:35 --------- d-----w c:\program files\LimeWire
2008-10-26 09:14 --------- d-----w c:\programdata\KONAMI
2008-10-26 08:54 --------- d-----w c:\program files\KONAMI
2008-10-25 12:53 48 ---ha-w c:\users\All Users\ezsidmv.dat
2008-10-25 12:53 48 ---ha-w c:\programdata\ezsidmv.dat
2008-10-25 10:16 --------- d-----w c:\program files\Microsoft ActiveSync
2008-10-25 10:14 --------- d-----w c:\program files\Microsoft.NET
2008-10-24 15:11 --------- d-----w c:\programdata\Azureus
2008-10-24 15:10 --------- d-----w c:\program files\Vuze
2008-10-24 11:53 --------- d-----w c:\programdata\CyberLink
2008-10-20 15:56 269,312 ----a-w c:\windows\System32\es.dll
2008-10-19 20:35 --------- d-----w c:\users\Dj\AppData\Roaming\Media Player Classic
2008-10-19 20:34 --------- d-----w c:\program files\K-Lite Codec Pack
2008-10-19 13:29 --------- d-----w c:\users\Dj\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2008-10-19 09:05 61,440 ----a-w c:\windows\System32\winipsec.dll
2008-10-19 09:05 361,984 ----a-w c:\windows\System32\IPSECSVC.DLL
2008-10-19 09:05 28,672 ----a-w c:\windows\System32\FwRemoteSvr.dll
2008-10-19 09:05 272,896 ----a-w c:\windows\System32\polstore.dll
2008-10-19 09:04 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-10-19 09:04 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-10-19 09:04 4,240,384 ----a-w c:\windows\System32\GameUXLegacyGDFs.dll
2008-10-19 09:04 28,160 ----a-w c:\windows\System32\Apphlpdm.dll
2008-10-19 09:04 2,560 ----a-w c:\windows\AppPatch\AcRes.dll
2008-10-19 09:04 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-10-19 09:04 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-10-19 09:04 1,695,744 ----a-w c:\windows\System32\gameux.dll
2008-10-19 08:56 2,048 ----a-w c:\windows\System32\tzres.dll
2008-10-19 08:55 303,616 ----a-w c:\windows\System32\wmpeffects.dll
2008-10-19 08:54 2,032,640 ----a-w c:\windows\System32\win32k.sys
2008-10-19 08:50 29,184 ----a-w c:\windows\system32\drivers\BTHUSB.SYS
2008-10-19 08:50 220,160 ----a-w c:\windows\system32\drivers\bthport.sys
2008-10-19 08:50 19,456 ----a-w c:\windows\system32\drivers\bthenum.sys
2008-10-19 08:50 181,760 ----a-w c:\windows\System32\fsquirt.exe
2008-10-19 08:48 988,216 ----a-w c:\windows\System32\winload.exe
2008-10-19 08:48 927,288 ----a-w c:\windows\System32\winresume.exe
2008-10-19 08:48 615,992 ----a-w c:\windows\System32\ci.dll
2008-10-19 08:48 6,656 ----a-w c:\windows\System32\kbd106n.dll
2008-10-19 08:48 46,592 ----a-w c:\windows\System32\setbcdlocale.dll
2008-10-19 08:48 40,960 ----a-w c:\windows\System32\srclient.dll
2008-10-19 08:48 378,368 ----a-w c:\windows\System32\srcore.dll
2008-10-19 08:48 318,464 ----a-w c:\windows\System32\rstrui.exe
2008-10-19 08:48 19,000 ----a-w c:\windows\System32\kd1394.dll
2008-10-19 08:48 14,848 ----a-w c:\windows\System32\srdelayed.exe
2008-10-19 08:46 288,768 ----a-w c:\windows\system32\drivers\srv.sys
2008-10-19 08:45 295,936 ----a-w c:\windows\System32\gdi32.dll
2008-10-19 08:45 14,848 ----a-w c:\windows\System32\wshrm.dll
2008-10-19 08:45 113,664 ----a-w c:\windows\system32\drivers\rmcast.sys
2008-10-19 08:41 84,480 ----a-w c:\windows\System32\INETRES.dll
2008-10-19 08:41 738,304 ----a-w c:\windows\System32\inetcomm.dll
2008-10-19 08:41 1,314,816 ----a-w c:\windows\System32\quartz.dll
2008-10-19 08:40 3,601,464 ----a-w c:\windows\System32\ntkrnlpa.exe
2008-10-19 08:40 3,549,240 ----a-w c:\windows\System32\ntoskrnl.exe
2008-10-19 08:35 827,392 ----a-w c:\windows\System32\wininet.dll
2008-10-18 19:33 --------- d-----w c:\programdata\Skype
2008-10-18 19:33 --------- d-----w c:\program files\Skype
2008-10-18 19:33 --------- d-----w c:\program files\Common Files\Skype
2008-10-16 18:40 --------- d-----w c:\program files\MSXML 4.0
2008-10-15 19:20 --------- d-----w c:\users\Dj\AppData\Roaming\DivX
2008-10-15 19:20 --------- d-----w c:\programdata\Yahoo! Companion
2008-10-15 19:19 --------- d-----w c:\users\Dj\AppData\Roaming\Yahoo!
2008-10-15 19:19 --------- d-----w c:\program files\Yahoo!
2008-10-15 15:30 --------- d-----w c:\program files\Java
2008-10-11 09:24 --------- d-----w c:\users\Dj\AppData\Roaming\Symantec
2008-10-11 09:23 --------- d-----w c:\users\Dj\AppData\Roaming\DigitalPersona
2008-10-11 09:21 --------- d-----w c:\users\Dj\AppData\Roaming\Hewlett-Packard
2008-10-11 09:20 --------- d-----w c:\program files\Microsoft Works
2008-10-11 09:16 --------- d-----w c:\program files\MSN Messenger
2008-10-11 09:15 --------- d-----w c:\program files\HP
2008-10-11 09:14 0 --sha-r c:\windows\system32\drivers\103C_HP_cNB_Pavilion dv9700 Notebook PC_Y5335KV_0U_QCNF811543V_E459053-DH3_4A_I30CB_SQuanta_V79.29_F.51_T080226_WV3-0_L409_M3070_J250_7Intel_86FB_92.20_#071127_N10EC8168;80864229_(KL018EA#UUW)_XMOBILE_CN10_Z.MRK
2008-10-11 09:14 --------- d-----w c:\users\Dj\AppData\Roaming\Macrovision
2008-09-30 15:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll
2008-09-16 00:11 161,096 ----a-w c:\windows\System32\DivXCodecVersionChecker.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2007-01-17 634880]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-07-25 174616]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-10-01 181544]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-19 202032]
"OnScreenDisplay"="c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-09-04 554320]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-08-17 218408]
"DpAgent"="c:\program files\DigitalPersona\Bin\dpagent.exe" [2007-09-20 671744]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-08-25 51048]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-09-13 480560]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-09 311296]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-04 36352]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-09-19 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-09-19 8497696]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-09-19 81920]
"RtHDVCpl"="RtHDVCpl.exe" [2007-08-17 c:\windows\RtHDVCpl.exe]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [9/5/2007 9:09:54 PM 727592]
Microsoft Office OneNote 2003 Quick Launch.lnk - c:\program files\Microsoft Office\OFFICE11\ONENOTEM.EXE [8/6/2003 12:23:32 PM 51776]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codecp"= l3codecp.acm

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli DPPWDFLT

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{55F5EADE-378B-4F78-BA0A-E484B5B8B7BA}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{30BD20B5-9A18-4007-9475-0C090EBD1CA1}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{C784D43B-5F94-427C-BA37-5E59E18B3436}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{BD35F1F8-28F7-4473-8EFE-18DFA4F9EA2F}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{14C96575-8C21-4C18-A376-E5F4957B9DBF}"= c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{E749EE25-2313-4ABA-B1CF-1C56B114C4AE}c:\\program files\\vuze\\azureus.exe"= UDP:c:\program files\vuze\azureus.exe:Azureus
"UDP Query User{02E66595-0692-4D2E-B334-E9C54B230E73}c:\\program files\\vuze\\azureus.exe"= TCP:c:\program files\vuze\azureus.exe:Azureus
"TCP Query User{EC7D77D6-A52F-4032-9517-582B6FF9EEFB}c:\\program files\\vuze\\azureus.exe"= UDP:c:\program files\vuze\azureus.exe:Azureus
"UDP Query User{C7F5D75B-F3EB-4215-A24D-3C6A3AF62B27}c:\\program files\\vuze\\azureus.exe"= TCP:c:\program files\vuze\azureus.exe:Azureus
"{D0393AD8-9712-4C10-BA38-F56D54FB78A2}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{B6DE732B-5BD3-4939-9B97-D8C2CA102791}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"TCP Query User{7D917953-A040-44B9-A37E-B05CD4CFE702}c:\\soldat\\soldat.exe"= UDP:c:\soldat\soldat.exe:Soldat
"UDP Query User{85ACB49A-63C6-4209-A483-9A5C40A1844F}c:\\soldat\\soldat.exe"= TCP:c:\soldat\soldat.exe:Soldat
"TCP Query User{C3F0513A-BDD4-4D33-B499-6A3207D8CE0B}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{25DAF192-D5BC-4F9F-ACED-81A83B9BBFA8}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire
"{73917913-9BD9-44C8-B226-3A36C606C122}"= UDP:5353:Adobe CSI CS4
"{6924DB79-858B-45CE-9D71-6484F902ACC8}"= UDP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"{CCA6EF38-9384-4A50-A2A8-0FDDD882AE66}"= TCP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R1 IDSvix86;Symantec Intrusion Prevention Driver;\??\c:\progra~2\Symantec\DEFINI~1\SymcData\ipsdefs\20081204.001\IDSvix86.sys [12/8/2008 6:14:58 PM 270384]
R2 {22D78859-9CE9-4B77-BF18-AC83E81A9263};{22D78859-9CE9-4B77-BF18-AC83E81A9263};\??\c:\program files\HP\QuickPlay\000.fcl [3/23/2008 9:59:47 AM 39408]
R2 LiveUpdate Notice;LiveUpdate Notice;"c:\program files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [8/25/2007 5:07:00 AM 149864]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [12/8/2008 6:37:32 PM 99376]
R3 SYMNDISV;SYMNDISV;c:\windows\system32\Drivers\SYMNDISV.SYS [8/13/2007 8:50:00 PM 41008]
S3 COH_Mon;COH_Mon;\??\c:\windows\system32\Drivers\COH_Mon.sys [5/29/2007 8:55:00 PM 23888]
S3 Ndisprot;ArcNet NDIS Protocol Driver;\??\c:\windows\system32\drivers\Ndisprot.sys [12/1/2008 7:38:39 PM 29184]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder

2008-12-08 c:\windows\Tasks\Norton Internet Security - Run Full System Scan - Dj.job
- c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2007-08-27 01:19]

2008-12-08 c:\windows\Tasks\User_Feed_Synchronization-{197EB1D9-5A26-4BEB-8840-78D4663676F5}.job
- c:\windows\system32\msfeedssync.exe [2008-01-19 08:33]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-HP Health Check Scheduler - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.yahoo.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FireFox -: Profile - c:\users\Dj\AppData\Roaming\Mozilla\Firefox\Profiles\bihe4hb4.default\
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2008-12-08 21:07:25
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


c:\windows\TEMP\TMP00000038C327AFA270242B7E 524288 bytes

scan completed successfully
hidden files: 1

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(684)
c:\windows\system32\DPPWDFLT.dll

- - - - - - - > 'Explorer.exe'(2428-)
c:\program files\Common Files\Symantec Shared\auCOLPwd.dll
c:\program files\DigitalPersona\Bin\DpoFeedb.dll
c:\windows\system32\btmmhook.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
c:\windows\system32\BtwNamespaceExt.dll
c:\windows\system32\BtwNeLib.dll
c:\windows\system32\btwapi.dll
c:\windows\system32\btosif.dll
c:\windows\system32\btwpimif.dll
c:\windows\system32\btncopy.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\audiodg.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\DigitalPersona\Bin\DpHostW.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\program files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\Hewlett-Packard\Shared\hpqWmiEx.exe
c:\windows\System32\conime.exe
c:\windows\System32\rundll32.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Synaptics\SynTP\SynTPEnh.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\windows\System32\rundll32.exe
c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
c:\windows\System32\wbem\WMIADAP.exe
c:\program files\WIDCOMM\Bluetooth Software\BTStackServer.exe
c:\program files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
.
**************************************************************************
.
Completion time: 2008-12-08 21:12:13 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-08 20:11:47

Pre-Run: 179,354,476,544 bytes free
Post-Run: 180,826,517,504 bytes free

330 --- E O F --- 2008-12-06 13:29:38

Poslao: 08 Dec 2008 22:06
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Upakuj u zip (ili rar) kompletan folder: C:\qoobox\quarantine

i upload-uj ga preko ovog linka: http://www.mycity.rs/ambulanta-upload.php


Isto uradi i sa ovim file-om: c:\windows\System32\hp2436co.dll


Nakon toga postavi svež HijackThis logfile.

Poslao: 09 Dec 2008 00:26
Idi na vrh
offline
  • Pridružio: 16 Avg 2007
  • Poruke: 22

uploadovao sam ova 2 fajla.

novi log je ovo :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:22:28, on 09/12/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Program Files\DigitalPersona\Bin\DpAgent.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Winamp\winampa.exe
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Dj\Desktop\New Folder\tr3.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = ie.redirect.hp.com/svs/rdr?TYPE=3&tp=ie.....;pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [DpAgent] C:\Program Files\DigitalPersona\Bin\dpagent.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHostW.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 9653 bytes

Poslao: 09 Dec 2008 17:06
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Skini zip sa donjeg linka i raspakuj ga u C:\Windows\System32 folder:

https://www.mycity.rs/must-login.png

U pitanju su dva file-a koje je ComboFix greškom obrisao.


Kakvo je sada stanje?

Poslao: 09 Dec 2008 17:25
Idi na vrh
offline
  • Pridružio: 16 Avg 2007
  • Poruke: 22

sada sve funkcionise normalno, osim sto se pri svakom startu/shut downu windowsa, prikaze ekran sa tekstom installing updates, a na shut downu - configuring updates.

kao da jos uvek nije zavrsena instalacija service pack-a

pored toga, norton antivirus je nekoliko puta pokazivao da je pobio neke crve ( packed generic 200. i trojan dropper ) i virus w32silly fdc.

iskopirao sam 2 fajla sa linka u system32 folder.

sta dalje ?

Poslao: 09 Dec 2008 18:56
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Uradi ovo:
Klikni START a zatim RUN
U liniju za unos teksta ukucaj Combofix /u i klikni OK





Sačekaj da se proces deinstalacije završi
Gornja procedura će:
Obrisati sledeće:
ComboFix i njegove file-ove i foldere
VundoFix Backups folder, ako postoji
C:\Deckard folder, ako postoji
C:\OtMoveIt folder, ako postoji
Resetovati podešavanja sata na kompjuteru
Sakriti ekstenzije file-ova, ako je potrebno
Sakriti sistemske/skrivene file-ove/foldere, ako je potrebno
Resetovati System Restore



Vezano za instalaciju update-a... Najbolje je da pitanje o tome postaviš u forumu Windows.

Poslao: 10 Dec 2008 20:54
Idi na vrh
offline
  • Pridružio: 16 Avg 2007
  • Poruke: 22

hvala na pomoci !

jos jedno pitanje samo, ranije sam u c/windows/system32/hosts dopisao jedan red. to je posle intervencije combofix-a poremeceno pa moram da radim opet.

da li je to bezbedno ?

Poslao: 10 Dec 2008 22:08
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Jeste, bezbedno je (podrazumeva se da znaš šta radiš, naravno).

MyCity » Ambulanta -> Arhiva Ambulante » log file - vista

Ko je trenutno na forumu
 

Ukupno su 813 korisnika na forumu :: 7 registrovanih, 1 sakriven i 805 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: Bobrock1, Darko001, mrav pesadinac, naki011, robytz, Srle993, voja64