MyCity » Ambulanta -> Arhiva Ambulante » problem sa kompom zarazenim flash karticom

problem sa kompom zarazenim flash karticom

Napisano na dan: 16.4.2008
3

problem sa kompom zarazenim flash karticom
Pagination Prethodna strana

Idi na vrh

Poslao: 29 Apr 2008 20:32
Idi na vrh
offline
  • Pridružio: 26 Jan 2006
  • Poruke: 233

log je:

ComboFix 08-04-20.2 - gogi 2008-04-29 20:27:25.9 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1251.1.1033.18.316 [GMT 2:00]
Running from: C:\Documents and Settings\gogi\Desktop\virusi\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\2DED3ED8.EXE

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_9BC11C18
-------\Service_9BC11C18


((((((((((((((((((((((((( Files Created from 2008-03-28 to 2008-04-29 )))))))))))))))))))))))))))))))
.

2008-04-28 21:10 . 2008-04-28 21:20 209,340,416 --a------ C:\kasp.iso
2008-04-21 15:53 . 2008-04-21 15:53 <DIR> d-------- C:\MISA
2008-04-21 07:53 . 2007-12-24 13:49 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll
2008-04-21 07:53 . 2007-07-10 17:10 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest
2008-04-16 13:30 . 2008-04-21 07:14 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
2008-04-16 10:15 . 2001-08-17 13:47 12,928 --a------ C:\WINDOWS\system32\drivers\Dot4Prt.sys
2008-04-16 10:15 . 2001-08-17 13:47 12,928 --a--c--- C:\WINDOWS\system32\dllcache\dot4prt.sys
2008-04-16 10:14 . 2004-08-03 22:58 207,360 --a------ C:\WINDOWS\system32\drivers\Dot4.sys
2008-04-16 10:14 . 2004-08-03 22:58 207,360 --a--c--- C:\WINDOWS\system32\dllcache\dot4.sys
2008-04-16 10:14 . 2001-08-17 13:47 23,808 --a------ C:\WINDOWS\system32\drivers\Dot4usb.sys
2008-04-16 10:14 . 2001-08-17 13:47 23,808 --a--c--- C:\WINDOWS\system32\dllcache\dot4usb.sys
2008-04-16 09:16 . 2008-04-16 09:16 <DIR> d-------- C:\WINDOWS\system32\EFFA9C20.DLL
2008-04-11 14:49 . 2008-04-11 14:49 4,226,353 --a------ C:\WINDOWS\REGBK01.ZIP
2008-04-01 13:10 . 2008-04-01 13:10 <DIR> d-------- C:\WINDOWS\PIF
2008-03-31 14:02 . 2008-03-31 14:02 <DIR> d-------- C:\Program Files\Stonisa

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-29 18:25 --------- d-----w C:\Documents and Settings\gogi\Application Data\SolidDocuments
2008-04-29 10:47 --------- d-----w C:\Program Files\FreeCap
2008-04-21 05:55 --------- d-----w C:\Program Files\ffdshow
2008-04-12 06:14 --------- d-----w C:\Program Files\Common Files\Real
2008-04-12 06:13 --------- d-----w C:\Program Files\Online TV Player 3
2008-04-01 04:58 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-31 12:17 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-03-31 08:54 --------- d-----w C:\Program Files\Evidencija Gradjana
2008-03-29 13:56 180,999 ----a-w C:\Program Files\firebird.log
2008-03-26 12:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-03-19 17:08 --------- d-----w C:\Program Files\Java
2008-03-11 17:04 4,224,123 ----a-w C:\WINDOWS\REGBK00.ZIP
2008-03-05 06:10 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-03-05 06:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-05 06:05 691,545 ----a-w C:\WINDOWS\unins000.exe
2008-02-29 06:09 --------- d-----w C:\Program Files\SolidDocuments
2008-02-29 06:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\SolidDocuments
.

((((((((((((((((((((((((((((( snapshot@2008-04-16_13.37.01.46 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-16 11:33:40 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-04-29 18:29:17 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2002-12-31 14:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PRONoMgr.exe"="C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-03-11 17:24 86016]
"SoundMan"="SOUNDMAN.EXE" [2003-07-23 18:19 56832 C:\WINDOWS\SOUNDMAN.EXE]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2002-12-31 14:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-10-10 20:51 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 12:21 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 17:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
--a------ 2006-03-03 04:39 6144 C:\Program Files\Unlocker\UnlockerAssistant.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\totalcmd\\TOTALCMD.EXE"=


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d25b4bc3-15ca-11dd-88da-000d6119bd1a}]
\Shell\Auto\command - G:\auto.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe

.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-29 20:29:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe
.
**************************************************************************
.
Completion time: 2008-04-29 20:31:04 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-29 18:30:53
ComboFix2.txt 2008-04-25 10:03:23
ComboFix3.txt 2008-04-25 05:08:35
ComboFix4.txt 2008-04-23 06:08:02
ComboFix5.txt 2008-04-22 05:26:10

Pre-Run: 105,629,941,760 bytes free
Post-Run: 105,623,392,256 bytes free

112

Poslao: 29 Apr 2008 21:28
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8617
  • Gde živiš: Novi Beograd

Preuzmi program Flash_Disinfector.

program se pokreće dvoklikom na Flash_Disinfector.exe
kada se pojavi poruka sa obaveštenjem, potrebno je priključiti inficirane USB flash drive-ove (pri tome držati pritisnut taster Shift kako bi se izbegao autoplay)
kliknuti na OK i sačekati da se proces završi
kada se pojavi poruka Done !!, kliknuti na OK.


Otvoriti Notepad i iskopirati sledeci tekst:


Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d25b4bc3-15ca-11dd-88da-000d6119bd1a}]



Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

Poslao: 30 Apr 2008 07:13
Idi na vrh
offline
  • Pridružio: 26 Jan 2006
  • Poruke: 233

log ComboFix-a izgleda ovako

ComboFix 08-04-20.2 - gogi 2008-04-30 7:10:54.10 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1251.1.1033.18.267 [GMT 2:00]
Running from: C:\Documents and Settings\gogi\Desktop\virusi\ComboFix.exe
Command switches used :: C:\Documents and Settings\gogi\Desktop\virusi\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-03-28 to 2008-04-30 )))))))))))))))))))))))))))))))
.

2008-04-28 21:10 . 2008-04-28 21:20 209,340,416 --a------ C:\kasp.iso
2008-04-21 15:53 . 2008-04-21 15:53 <DIR> d-------- C:\MISA
2008-04-21 07:53 . 2007-12-24 13:49 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll
2008-04-21 07:53 . 2007-07-10 17:10 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest
2008-04-16 13:30 . 2008-04-21 07:14 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
2008-04-16 10:15 . 2001-08-17 13:47 12,928 --a------ C:\WINDOWS\system32\drivers\Dot4Prt.sys
2008-04-16 10:15 . 2001-08-17 13:47 12,928 --a--c--- C:\WINDOWS\system32\dllcache\dot4prt.sys
2008-04-16 10:14 . 2004-08-03 22:58 207,360 --a------ C:\WINDOWS\system32\drivers\Dot4.sys
2008-04-16 10:14 . 2004-08-03 22:58 207,360 --a--c--- C:\WINDOWS\system32\dllcache\dot4.sys
2008-04-16 10:14 . 2001-08-17 13:47 23,808 --a------ C:\WINDOWS\system32\drivers\Dot4usb.sys
2008-04-16 10:14 . 2001-08-17 13:47 23,808 --a--c--- C:\WINDOWS\system32\dllcache\dot4usb.sys
2008-04-16 09:16 . 2008-04-16 09:16 <DIR> d-------- C:\WINDOWS\system32\EFFA9C20.DLL
2008-04-11 14:49 . 2008-04-11 14:49 4,226,353 --a------ C:\WINDOWS\REGBK01.ZIP
2008-04-01 13:10 . 2008-04-01 13:10 <DIR> d-------- C:\WINDOWS\PIF
2008-03-31 14:02 . 2008-03-31 14:02 <DIR> d-------- C:\Program Files\Stonisa
2008-03-11 19:04 . 2008-03-11 19:04 4,224,123 --a------ C:\WINDOWS\REGBK00.ZIP
2008-03-11 10:22 . 2008-03-11 10:22 <DIR> d-a------ C:\WINDOWS\zts2.exe
2008-03-11 10:22 . 2008-03-11 10:22 <DIR> d-a------ C:\WINDOWS\system32\vcmgcd32.dll
2008-03-11 10:22 . 2008-03-11 10:22 <DIR> d-a------ C:\WINDOWS\system32\iifgfgf.dll
2008-03-11 10:22 . 2008-03-11 10:22 <DIR> d-a------ C:\WINDOWS\rundll16.exe
2008-03-11 10:22 . 2008-03-11 10:22 <DIR> d-a------ C:\WINDOWS\rundl132.dll
2008-03-11 10:22 . 2008-03-11 10:22 <DIR> d-a------ C:\WINDOWS\logo1_.exe
2008-03-05 09:59 . 2002-12-31 14:00 146,432 --a------ C:\WINDOWS\R.COM
2008-03-05 09:59 . 2002-12-31 14:00 135,680 --a------ C:\WINDOWS\system32\T.COM
2008-03-05 09:59 . 2008-04-17 12:08 50 --a------ C:\WINDOWS\Lic.xxx
2008-03-05 08:08 . 2008-03-05 08:05 691,545 --a------ C:\WINDOWS\unins000.exe
2008-03-05 08:08 . 2008-03-05 08:08 2,542 --a------ C:\WINDOWS\unins000.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-29 18:36 --------- d-----w C:\Documents and Settings\gogi\Application Data\SolidDocuments
2008-04-29 10:47 --------- d-----w C:\Program Files\FreeCap
2008-04-21 05:55 --------- d-----w C:\Program Files\ffdshow
2008-04-12 06:14 --------- d-----w C:\Program Files\Common Files\Real
2008-04-12 06:13 --------- d-----w C:\Program Files\Online TV Player 3
2008-04-01 04:58 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-31 12:17 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-03-31 08:54 --------- d-----w C:\Program Files\Evidencija Gradjana
2008-03-29 13:56 180,999 ----a-w C:\Program Files\firebird.log
2008-03-26 12:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-03-19 17:08 --------- d-----w C:\Program Files\Java
2008-03-05 06:10 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-03-05 06:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-29 06:09 --------- d-----w C:\Program Files\SolidDocuments
2008-02-29 06:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\SolidDocuments
.

((((((((((((((((((((((((((((( snapshot@2008-04-16_13.37.01.46 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-16 11:33:40 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-04-30 05:02:45 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2002-12-31 14:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PRONoMgr.exe"="C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-03-11 17:24 86016]
"SoundMan"="SOUNDMAN.EXE" [2003-07-23 18:19 56832 C:\WINDOWS\SOUNDMAN.EXE]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2002-12-31 14:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-10-10 20:51 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 12:21 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 17:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
--a------ 2006-03-03 04:39 6144 C:\Program Files\Unlocker\UnlockerAssistant.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\totalcmd\\TOTALCMD.EXE"=


*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-30 07:11:58
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-30 7:12:38
ComboFix-quarantined-files.txt 2008-04-30 05:12:33
ComboFix2.txt 2008-04-29 18:31:05
ComboFix3.txt 2008-04-25 10:03:23
ComboFix4.txt 2008-04-25 05:08:35
ComboFix5.txt 2008-04-23 06:08:02

Pre-Run: 105,606,787,072 bytes free
Post-Run: 105,597,677,568 bytes free

107

Poslao: 02 Maj 2008 22:19
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8617
  • Gde živiš: Novi Beograd

Poslao: 03 Maj 2008 01:04
Idi na vrh
offline
  • Pridružio: 26 Jan 2006
  • Poruke: 233

izvini ja sam opet dosadan. da li mi mozes reci kojim virusima, trojancima, malware i spyware je bio zarazen moj racunar

Poslao: 03 Maj 2008 20:13
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8617
  • Gde živiš: Novi Beograd

To je sve zbog onog flasha. I trebalo bi da instaliras neki normalan AV. Tipa Avire, AVG... Inace ces se vrlo brzo ponovo zaraziti.

Pravo da ti kazem, ni ja ne znam sta si imao Wink . Provera se radi tako sto svaki fajl iz loga proveravam na googlu i specijalizovanim sajtovim. Proveri neki od onih fajlova iz skripte na googlu. I videces da google izlistava samo Mycity. A. to znaci da je 99% malware. Mr. Green

Poslao: 05 Maj 2008 15:39
Idi na vrh
offline
  • Pridružio: 26 Jan 2006
  • Poruke: 233

poenta je sto sam ja na pojedinim racunarima imao instaliran antivirus avg,ali on nije nista registrovao

MyCity » Ambulanta -> Arhiva Ambulante » problem sa kompom zarazenim flash karticom

Ko je trenutno na forumu
 

Ukupno su 858 korisnika na forumu :: 49 registrovanih, 6 sakrivenih i 803 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: Alibaba1981, anbeast, Andrija357, babaroga, bankulen, BORUTUS, dehhhhi, dekan.m, Dimitrise93, djboj, draganl, dragoljub11987, FileFinder, FOX, Georgius, goxin, HrcAk47, ILGromovnik, kikisp, Koridor, Kubovac, ladro, laki_bb, ljuba, Marko Marković, MB120mm, mercedesamg, Metanoja, milenko crazy north, MiroslavD, mnn2, Neutral-M, Oscar, pacika, sevenino, solic, Srle993, stankolich, StepskiVuk, Stoilkovic, TheBeastOfMG, theNedjeljko, vathra, Vlajman1957, voja64, vukovi, Zeks, zillbg, Zoca