problem s postom

2

problem s postom

offline
  • Pridružio: 18 Sep 2008
  • Poruke: 32

ComboFix 08-11-30.02 - Aki 2008-12-01 21:13:50.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.519 [GMT 1:00]
Running from: c:\documents and settings\Aki\Desktop\ComboFix.exe
* Resident AV is active

.

((((((((((((((((((((((((( Files Created from 2008-11-01 to 2008-12-01 )))))))))))))))))))))))))))))))
.

2063-09-19 06:50 . 2063-09-19 06:50 5,501 --a------ c:\windows\system32\rtclmg32.dll
2008-12-01 21:06 . 2008-12-01 21:06 <DIR> d-------- c:\windows\LastGood.Tmp
2008-11-29 23:38 . 2008-12-01 21:09 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\~0
2008-11-29 23:34 . 2008-11-29 23:34 493,568 --a------ c:\windows\aki.scr
2008-11-29 23:33 . 2008-11-29 23:34 <DIR> d-------- c:\documents and settings\Aki\Application Data\VSSaver
2008-11-29 23:32 . 2008-11-29 23:32 <DIR> d-------- C:\dvd2avi
2008-11-29 23:32 . 2008-11-29 23:32 <DIR> d-------- c:\documents and settings\Aki\Application Data\DVD2AVI Ripper Professional
2008-11-29 23:25 . 2008-11-29 23:25 <DIR> d-------- C:\videodvdmaker
2008-11-29 23:25 . 2008-11-29 23:25 <DIR> d-------- c:\documents and settings\Aki\Application Data\Video DVD Maker FREE
2008-11-28 15:19 . 2008-11-28 15:19 <DIR> d-------- c:\program files\ESET
2008-11-28 15:19 . 2008-11-28 15:19 <DIR> d-------- c:\documents and settings\All Users\Application Data\ESET
2008-11-28 11:54 . 2008-12-01 19:22 <DIR> d-------- c:\program files\DAEMON Tools Toolbar
2008-11-28 11:53 . 2008-11-28 11:54 <DIR> d-------- c:\program files\DAEMON Tools Lite
2008-11-28 11:50 . 2008-11-28 11:50 <DIR> d-------- c:\documents and settings\Aki\Application Data\DAEMON Tools
2008-11-26 16:44 . 2008-11-26 16:44 <DIR> d-------- C:\digitalvideoconverter
2008-11-26 11:52 . 2008-11-26 11:54 <DIR> d-------- c:\program files\Movie DVD Maker
2008-11-26 11:51 . 2008-11-24 06:09 <DIR> d-------- c:\program files\Movie.DVD.Maker.v2.6.1123.g3n
2008-11-23 00:12 . 2008-11-23 00:12 410,976 --a------ c:\windows\system32\deploytk.dll
2008-11-22 21:07 . 2008-11-22 21:14 <DIR> d-------- C:\My Disc.VCD
2008-11-21 10:52 . 2008-11-21 10:52 137,344 --a------ c:\windows\system32\drivers\hwpsgt.sys
2008-11-21 10:52 . 2008-11-21 10:52 9,472 --a------ c:\windows\system32\drivers\lemsgt.sys
2008-11-20 21:08 . 2008-11-28 15:29 <DIR> d-------- c:\program files\PremierOpinion
2008-11-20 19:12 . 2008-11-24 16:19 <DIR> d-------- c:\program files\Crawler
2008-11-19 22:46 . 2008-11-19 22:46 <DIR> d-------- c:\documents and settings\Aki\Application Data\Games
2008-11-19 20:14 . 2008-11-19 20:45 <DIR> d-------- c:\program files\FlashGet
2008-11-19 10:53 . 2008-11-19 10:53 <DIR> d-------- c:\program files\Raw Modders Union
2008-11-18 17:40 . 2008-11-19 20:56 <DIR> d-------- c:\program files\Crypt load
2008-11-18 12:32 . 2008-11-28 13:26 <DIR> d-------- c:\program files\Kaspersky Lab
2008-11-18 11:49 . 2008-11-18 11:49 <DIR> d-------- c:\program files\FormatFactory
2008-11-17 21:04 . 2008-11-17 21:04 2,306,113 --a------ c:\windows\system32\GPhotos.scr
2008-11-16 16:51 . 2008-11-16 16:52 <DIR> d-------- c:\program files\Any Video Converter
2008-11-16 16:51 . 2008-11-16 16:57 <DIR> d-------- c:\documents and settings\Aki\Application Data\Any Video Converter
2008-11-13 00:45 . 2008-11-13 00:45 <DIR> d-------- c:\program files\MSXML 4.0
2008-11-11 21:25 . 2008-11-11 21:25 <DIR> d-------- c:\program files\DVD Photo Slideshow Professional
2008-11-05 11:16 . 2008-11-05 11:16 <DIR> d-------- c:\program files\Common Files\Blizzard Entertainment
2008-11-03 11:35 . 2008-11-03 11:35 <DIR> d-------- c:\documents and settings\Aki\Application Data\EleFun Games

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-01 19:22 --------- d-----w c:\program files\TuneUp Utilities 2006
2008-11-29 22:11 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-11-28 10:50 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-11-22 23:12 --------- d-----w c:\program files\Java
2008-11-20 20:25 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-19 19:17 --------- d-----w c:\program files\Google
2008-11-19 13:30 --------- d-----w c:\program files\Common Files\Adobe
2008-11-18 14:47 --------- d-----w c:\program files\Flash Slideshow Maker Professional
2008-11-18 11:32 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-11-16 10:28 --------- d-----w c:\program files\WinAVI Video Converter
2008-10-27 20:07 --------- d-----w c:\program files\Readon Technology
2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 18:39 --------- d-----w c:\program files\AnvSoft Flash to Video Converter Professional
2008-10-23 18:38 --------- d-----w c:\program files\Common Files\AVSMedia
2008-10-23 18:38 --------- d-----w c:\program files\AVS4YOU
2008-10-23 18:18 --------- d-----w c:\documents and settings\All Users\Application Data\AVS4YOU
2008-10-23 18:18 --------- d-----w c:\documents and settings\Aki\Application Data\AVS4YOU
2008-10-23 17:59 --------- d-----w c:\program files\Anvsoft
2008-10-23 17:52 --------- d-----w c:\program files\Xvid
2008-10-22 21:05 --------- d-----w c:\documents and settings\Aki\Application Data\Skype
2008-10-21 22:36 --------- d-----w c:\program files\Magic Swf2Avi 2008
2008-10-21 22:36 --------- d-----w c:\program files\Flash SWF to GIF AVI Converter
2008-10-21 22:11 --------- d-----w c:\documents and settings\All Users\Application Data\Anvsoft
2008-10-19 09:03 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2008-10-19 08:52 --------- d-----w c:\program files\Messenger Plus! Live
2008-10-17 13:51 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-17 10:22 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2008-10-16 18:25 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2008-10-16 18:25 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2008-10-16 09:13 --------- d-----w c:\documents and settings\All Users\Application Data\n7-89-o9-3r-4t-r9
2008-10-16 09:13 --------- d-----w c:\documents and settings\Aki\Application Data\GameHouse
2008-10-14 20:49 --------- d-----w c:\documents and settings\All Users\Application Data\Avg8
2008-10-13 22:31 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo! Companion
2008-10-13 22:24 --------- d-----w c:\program files\CCleaner
2008-10-13 22:23 --------- d-----w c:\program files\Yahoo!
2008-10-09 07:31 --------- d-----w c:\program files\Di recnik
2008-10-05 15:33 --------- d-----w c:\program files\Common Files\Java
2008-05-07 08:38 32 ----a-r c:\documents and settings\All Users\hash.dat
2004-11-18 12:15 1,950,208 ----a-w c:\program files\PPVIEWER.MSI
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-17 490952]
"Google Update"="c:\documents and settings\Aki\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-11-30 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 868352]
"VirtualDrive"="c:\program files\FarStone\VirtualDrive\VDTask.exe" [2003-09-26 98304]
"Di dictionary"="c:\program files\Di recnik\Di.exe" [2006-09-29 518144]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-08-30 185896]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-23 136600]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-06-10 1447168]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 c:\windows\system32\bthprops.cpl]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2008-06-18 1183744]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
--a------ 2005-10-03 23:18 118784 c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2005-10-28 15:25 94208 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-04 02:07 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Di dictionary]
--a------ 2006-09-29 14:23 518144 c:\program files\Di recnik\Di.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 17:24 1694208 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 10:34 5724184 c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 09:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2007-12-05 08:11 8523776 c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2007-12-05 08:11 81920 c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
--a------ 2007-02-05 16:35 25370152 c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
--a------ 2005-10-03 23:18 975941 c:\program files\Acronis\TrueImage\TrueImageMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2007-12-05 08:11 1626112 c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WLSetupSvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"TUWinStylerThemeSvc"=3 (0x3)
"NVSvc"=2 (0x2)
"nSvcLog"=2 (0x2)
"nSvcIp"=2 (0x2)
"ForcewareWebInterface"=2 (0x2)
"AcrSch2Svc"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"d:\\IGRICE\\War Craft\\War3.exe"=
"d:\\IGRICE\\War Craft\\Warcraft III.exe"=
"c:\\Program Files\\FarStone\\VirtualDrive\\MGR.exe"=
"c:\\Documents and Settings\\Aki\\Application Data\\PowerChallenge\\PowerSoccer\\PowerSoccer.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"d:\\IGRICE\\Tap a Jam\\Counter-Strike Source\\hl2.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

R1 epfwtdir;epfwtdir;c:\windows\system32\DRIVERS\epfwtdir.sys [2008-06-10 34312]
R3 FVDSCSI;FVDSCSI;c:\windows\system32\DRIVERS\fvdscsi.sys [2008-07-18 60008]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\E:\NTGLM7X.sys []
S4 usnjsvc;Messenger Sharing Folders USN Journal Reader service;"c:\program files\Windows Live\Messenger\usnsvc.exe" [2007-10-18 98328]
.
Contents of the 'Scheduled Tasks' folder

2008-11-28 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2006\SystemOptimizer.exe [2005-09-21 21:35]

2008-12-01 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\documents and settings\Aki\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-11-30 10:34]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\Aki\Application Data\Mozilla\Firefox\Profiles\xt6ar964.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
FF -: plugin - c:\documents and settings\Aki\Local Settings\Application Data\Google\Update\1.2.131.27\npGoogleOneClick6.dll
FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - c:\program files\Google\Picasa3\npPicasa3.dll
FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll
FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npjp2.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npdeploytk.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npigl.dll
FF -: plugin - c:\program files\Yahoo!\Common\npyaxmpb.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2008-12-01 21:16:12
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(900)
c:\windows\system32\relog_ap.dll
c:\windows\system32\imon.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\rundll32.exe
c:\program files\IVT Corporation\BlueSoleil\BTNtService.exe
c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wdfmgr.exe
.
**************************************************************************
.
Completion time: 2008-12-01 21:18:07 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-01 20:18:04
ComboFix2.txt 2008-12-01 17:06:44

Pre-Run: 6,207,221,760 bytes free
Post-Run: 6,170,836,992 bytes free

217 --- E O F --- 2008-11-23 09:14:16

offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

E jesam izlapeo...

Umesto da ti dam postupak za deinstalaciju ComboFixa, ja ti dao postupak za download... Izvini...

Klikni START a zatim RUN
U liniju za unos teksta ukucaj Combofix /u i klikni OK





Sačekaj da se proces deinstalacije završi

Gornja procedura će:
Obrisati sledeće:
ComboFix i njegove file-ove i foldere
VundoFix Backups folder, ako postoji
C:\Deckard folder, ako postoji
C:\OtMoveIt folder, ako postoji

Resetovati podešavanja sata na kompjuteru
Sakriti ekstenzije file-ova, ako je potrebno
Sakriti sistemske/skrivene file-ove/foldere, ako je potrebno
Resetovati System Restore

Ko je trenutno na forumu
 

Ukupno su 633 korisnika na forumu :: 13 registrovanih, 3 sakrivenih i 617 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: amstel, Bane san, bato, cikadeda, Despot1, djo97, djordje92sm, ivan979, Maestro, mikki jons, Miskohd, vasa.93, yamato